Hong Kong Smart Identity Cards In 2003

griffinn writes: "The Hong Kong Government has announced its plan to replace the identity cards of all Hong Kong citizens with smart cards, starting 2003. I don't know anything about smart card technology, but I suppose some sort of asymmetric cryptographic scheme is employed to fortify any data stored in it, so smart ID cards should be immune from DeCSS fiascos. But is it possible for someone to just make an identical copy of my smart ID card, and 'become me'?"

For information that comes straight from the "HK Special Administrative Region Government," there's more information in here than I expected. Two paragraphs in particular caught my attention:

Besides, immigration officers would be able to update a temporary resident's conditions of stay readily. In anti-illegal immigration operations, law enforcement officers in the field can use a special reader to confirm instantly whether a person's permission to stay was valid without holding him up for further checks.

"More importantly, a smart card with biometric data stored on it will lay the foundation for the Immigration Department to introduce automated passenger clearance system in future which will bring benefits to the travelling public as more immigration counters can be opened without increase of manpower," Mrs Ip said.

Your papers, please?

Comments

Smart cards limit data access.

[zCyl]

A coworker of mine was doing smart card security research recently. A smart card is not simply a data storage device, but instead actually contains a small processor. This processor can be programmed to perform public key encryption and hashing, and thus, the smart card is able to limit data access. Rather than pass out the private key to the computer where the person is trying to to authenticate themself, the smartcard receives a secret which can be signed with the private key, passed back out to the authenticating computer, and there compared with the public key with that user. It can be done in a manner similar to PGP signing of email, without the card even possessing the instructions necessary to export the private key from the card.

The equipment that would be needed to get the private key off would be pretty expensive, since you would need to be able to break the card apart and read individual memory locations with some sort of electron scanning microscope or something. (Which is tougher than it sounds.) However, Hong Kong's use of biometric data makes that even more difficult, because you would then have to modify the person carrying the copied card so their biometric data matches what's stored on the card.

Essentially, copying a smartcard like this is astronomically difficult, and at the very least, m uch more difficult than xeroxing a paper card or making a duplicate of a plastic card with a hologram.