One of the key benefits of smart cards is the ability for some cards to support on board cryptography. For more information on cryptography please read "Applied Cryptography" by Bruce Schneier. Cryptographic smart cards open up a whole new realm in information security because it now allows a secure place for storage of keys and keyrings. By doing the actual cryptography on the card, the keys never have to leave their storage place. This gives the card holder a secure way of storing keys especially if the key pair was generated on the card. I will briefly describe what is necessary for using smart cards with cryptography. Cryptography comes in two flavors: symmetric and assymetric. Symmetric cryptography is when two parties share a secret key that no one else knows. They use this key to encrypt and decrypt messages. If that key were to get loose though, anyone could do the same. Assymmetric cryptography works in key pairs. There is a public and private key. The public key is anywhere and can be used by anyone to encrypt a message that the owner of that public key decrypts with their private key which is safely stored on the smart card. Since symmetric cryptography is generally thousands of times faster than assymetric, a combination of the two are used to achieve the best level of security at the right speed. Imagine the following schema. A user wants to encrypt a large file to send to another user in a secure fashion so they decide to use public key cryptography. Since symmetric cryptography is much faster, the user encrypts this large file using a symmetric cryptographic algorithm such as DES. Now the user has the symmetric key which is usually small and fixed-width. This key unlocks the encrypted file so this key must be encrypted using the receivers public key. By doing this, the reciever has the private key that decrypts the symmetric key that allows the receiver to then decrypt the file using the same symmetric algorithm. For more information on different types of cryptographic algorithms please visit http://www.homeport.org/~adam/crypto/table.html . This page will also show freeware and non free software libraries in different programming languages to perform various cryptographic functionality. Keys are part of a larger structure called a certificate. A certificate is not only a key but ties that key to an identity. This certificate or 'cert' may have a username, age, sex, etc tied into it somehow. How these certificates is stored on the card brings another issue. How does one interoperate with different types of certificates ? How does one authenticate one certificate with the username stored in a different location than another ? This problem is posed today with the many different standards that exist. Netscape, for example, uses PKCS-11 which is a library of functions to perform various security tasks such as smart cards. An overview of PKCS-11 is located here . Microsoft uses PC/SC and their Crypto API to integrate with Internet Explorer and their Windows products. The problem exists: the two do not work together. To try and solve this a consortium of companies including IBM, Sun, Netscape, and others have tried to standardize smart card communication with something called the Open Card Framework. This is a set of Java cross-platform API's for integrating smart card technology in an interoperable way. For now it seems to be the best but is it scalable for biometric support such as fingerprint scanners and face recognition ? Is it strong enough to eventually tie into physical security along with electronic security ? If we can answer yes to all of these then I think that we are on the right track. Unfortunately, the biggest problem I see with OpenCard is the bandwidth requirements. Smart cards and readers are very slow devices, with the Java Virtual Machine running, it is common to see up to 20% of your CPU cycles and memory being used on a relatively novice application. Once a standard paves it's way it is important to look at cryptographic smart cards for different applications. One application is smart card enabled secure web access. This ability exists today in raw form using the smart card to sign the document before it is sent. Smart card enabled secure web transaction today begins by opening a SSL or Secure Socket Layer to the host machines web server software. Once this encrypted pipe exists the web browser makes a hash or fixed width representation of the form. It then sign's or encrypts this hash using it's private key stored on the smart card. Since the form is hashed it will be fixed width and can be encrypted on the card quickly. The original form is then sent along with this encrypted hash, or signature to the web server. At the web server the form is received and sent through the same hash function. The signature is decrypted and the hashs are compared. If they are equal then the document has not been changed during it's travels to the web server. Another application would include secure email. Secure email would use an algorithm similar to the one described in the schema described above which describes the encryption of a large file. In this one would sign their mail using a hash function and their their private key. They would encrypt their mail and combined signature using a symmetric algorithm such as DES. They would then encrypt the symmetric key using the recipients public key and send the document to the recipient for encryption. Signing may or may not occur. It is useful when making sure the document is not intercepted during transmission and changed and then passed along to look like the original document. Another application is physical access. Physical access is the ability to open a door or gate. Most modern day physical security systems use a protocol called Wiegand to communicate with door locks and other security devices on the Wiegand strip. Wiegand is especially useful for it's ability to travel longer distances without interference. Imagine a parallel or RS232 serial line. Devices would have to be within 20 feet of one another to avoid loss of data. So it is especially important when designing a physical access door reader to interface it to the Wiegand specifications. For more information of Wiegand, please visit http://www.siaonline.org . These door readers can tie other factors into authentication including just the verification of a certificate on a smart card. They can also use biometrics. Biometrics are especially useful when not only do you want to tie authentication to something that the user has but also something that they are. Most people aren't prone to forget their eyes or hands when they come to work so biometrics give a very secure and reliable way of identifying a user. Biometrics also come in many flavors. Retinal and Iris scanning determine a person's proprietary features of their eye. Facial scanning is a way of photographing a persons face and determining distinct features such as shape, size, or cheek to nose ratio. Finger print scanning, the most effective for the least amount of money, looks at features of the fingerprint. Everyone is born with a distinct fingerprint that does not change during their lifetime. Many fingerprint scanners map out the finger's minutiae - interesting points in the print where the ridges branch out. Others measure distance. There are many types of algorithms. One fingerprint scanner is made by a company called American Biometrics sells for under $300. For more information please visit http://www.abio.com Biometrics tie into smart cards in many ways. They often compliment each other. For one, the users prints can be stored on the card which would keep authentication from leaving the reader, thus the fingerprint representation never travels across a data line. Second, smart cards provide the second token during authentication. If only biometrics were used, a scanned print would have to try and match itself to hundreds or thousands of stored prints in a database. With the smart card it only has to check one print, thus speeding up the authentication process.