Slashdot Mirror

You just need to search around a bit. Here's a few places I know of:

GemPlus
Athena
TX Systems

Note that $5-10 per card is about the best you're going to do in small quantities.

Smart Card Module for J2SE:

http://www.gemplus.com/smart/r_d/publications/pdf/ GG00jaas.pdf

Cheers,
Tyler

Developer - Mac OS X Security

Apple Federal Smart Card Package Manual

"To use FSCP, you need the following:

A Macintosh computer with Mac OS X v10.2.3 installed
A Department of Defense Common Access Card issued since 2001
An SCM Microsystems SCR331 USB High Speed EMV Reader

You can also use one of these smart card readers, but you must download and install driver software from the manufacturer's website:

Gemplus GemPC430 USB Smart Card Reader
OMNIKEY CardMan Desktop USB 2020
Schlumberger Sema Reflex USB v.2 Reader or Reflex USB Lite Reader

Smart Card Services (PC/SC) SDK

"The PC/SC Workgroup is a collaborative effort of leading international personal computer and smart card companies, united to integrate their technologies under common standards. Apple is a Core Member of the PC/SC Workgroup along with Bull Personal Transaction Systems, Gemplus, Hewlett-Packard, Infineon, Intel, Microsoft, Schlumberger, Sun Microsystems and Toshiba.

PC/SC is a standard that builds upon existing industry smart card standards - ISO7816 and EMV - and complements them by defining low-level device interfaces and device-independent application APIs as well as resource management, to allow multiple applications to share smart card devices attached to a system.

The Smart Card Services SDK enables developers to write PC/SC-compliant applications and drivers on MacOSX starting with MacOSX 10.0.2.

The Smart Card Services SDK is available from Apple's Open Source repository. Access requires agreeing to the Apple Public Source License."

Err... smartcards just store data, they don't have an embedded OS on them.

Really? The creators of:

• STARCOS
• JCOP
• MPCOS
• MFC
• MULTOS
• SOSSE
• Cryptoflex
• andWindows for Smart Card

might disagree.

I've actually used all but two of the above. There are many more, but I got tired of googling for links.

After doing a bit of research on the linked sites, one can see that this falls under the "well meaning and very useful in nitches" category. If you are building software that *can't die* because it will be used in critical points like aircraft control systems or medical equipment, you can probably afford people smart enough to implement this.

The "language" itself looks like a cross between boolean algebra, set theory and relational algebras (which came from set theory). Using a truely functional language would make this much easier to implement (as you point out, procedural languages tend to allow you to wack the state at any time).

So we have a methodology that requires people to understand functional programming and some pretty abstract math concepts to boot. I guess you could have a really well payed designer with those attributes, but most business programmers would be lost forever.

That being said, another comment mentioned Gemplus, a JVM entirely proven by using the B method (which uses the Z language). This is used for smartcards, where "undesired functionality" would mean compromized financials. If it is possible to write a proven JVM, perhaps I fall in the "not bright enough" category to see how.

A previous poster mentioned the MUSCLE project. It provides lots of open-source software for talking to smartcards, primarily for cryptographic applications.

MUSCLE works with JavaCards . With these it is relateively easy to write your own applets that run on the card and do whatever you want.

Lots of vendors supply JavaCard-compliant cards. For example, SchlumbergerSema, iButton, and Gemplus.

Right. They make some of the Geldkarte cards and if all you need is just any old electronic purse, they've got that functionality on many of their cards even on the GPK digital signature cards!

Looks like slashdot finally discovered electronic purse applications. What's next? :-)

I thought you would maybe like to check MUSCLE

It includes a very good PC/SC reader abstraction layer and other goodies like PAM modules, Perl wrappers,... Most of it runs on any Unix flavor (including Mac OS X).

It won't give you a "Plug&Play" solution but most of the stuff is Open Source, so feel free to hack...

For readers, you can have a look at the GemPlus's web store for USB & serial readers. The drivers are available on MUSCLE and as Debian packages.

Are you proposing to use a smartcard alone to authenticate a login? Make sure you understand the security properties of what you're trying to achieve.

A card is something you have, not hugely secure (easy to lend/steal, though easy lendability might be an advantage in some situations) unless combined with something you know (eg. passphrase) or something you are (insert the usual biometrics worries here.)

If you want to build such a system yourself, GemPlus cards are very popular, also check out the smart cards division of Schlumberger. You can get RS232-connected card readers (sorry, the make escapes me); I'm not in touch in this field, but I'd be surprised if there weren't USB-connected and keyboard-embedded readers too.

The capabilities range from simple memory storage cards (3KB to 16KB), which are a high tech equalivant of the magnetic stripe on "swipe cards" to high end crypto processors which are tamper resistant and/or tamper evident. These crypto cards can generate a private key that never leaves the card, and can securely performing digitial signind decryption using the private key. Such cards typically support DES, Triple DES, RSA 512-1024 bit and SHA-1. E.g. CryptoFlex from Schlumberger, Gemplus Public Key

Smart cards are already far more common in Europe, are used in satellite TV, Mondex (an electronic wallet scheme that never seems to get off the ground), and in a different form factor, the SIM cards of GSM mobile phones are smart cards. Because of Sat-TV, Pay-TV, and GSM phones there are hundreds of millions of smart cards in use today.

There is also Linux support via MUSCLE which supports the PC/SC API made popular under Windows, and most vendors support.

That's because VISA let alone any of its compliant card companies don't even make the cards, now if somebody from Gemplus phoned up trying to sell you SmardCards then I expect they would accommodate your pedantic questions. Otherwise you're just being an idiot, even though you obviously think you're a laugh a minute to yourself.

I hope VISA has marked your Credit record suitably as "pedantic, sarcastic techie guy, much like the fat (and lonely) comic collector in the Simpson's, this guy does not appear to have a life and therefore would not value a CC. Note: Also lacks any social skills when it comes to dealing with women"

gemplus.com, a leading smartcard manufacturer, has some good info on smartcard technology.

Smart card readers/writers cost only about $80 for a serial port version and $100 for a PCMCIA version. (Gemplus.com)

Why wouldn't it be possible to just copy all of the contents from one card to another, direct copy the magnetic strip too, and change the picture (if there is one) to assume someone else's identity? I don't know much about encryption or how the smart cards work other than the basics, but this seems to be logically possible whatever the encryption scheme, as long as the hardware itself didn't limit directly copying. So would this work, or do I just not know enough?