IBM Smart Card OS On A 1MB Smart Card

michaelpapet.com writes "IBM has ported/developed their Javacard smart card operating system for Sharp's 1MB smart card. Read Sharp's announcement here. Interesting features include: AES encryption; elliptical curve encryption; and 1MB of storage. Sharp's smart card package claims to be almost as small as a normal smart card package. In an industry that can considers 64K of memory a luxury, 1MB is staggering. Read Sharp's original 1MB smart card announcement here. Is this a 'Build it and they will come...' kind of solution? How small is an 'almost as small' smart card IC package?"

Comments

Storage space

[Anonymous Coward]

Interesting features include: AES encryption; elliptical curve encryption; and 1MB of storage.

Wow, 1MB of storage available on 1MB media, so that's like 0MB for the OS?

Also, why not start with a larger media? most digital cameras start at at least 16 MB. Something more than 1MB doesn't seem too unreasonable.

Re:Storage space

[AndroidCat]

Think of as a 1M hard drive. The card also has a dinky 8K RAM and 8K ROM. (Note that the press release for the card is a year old.)

Re:Storage space

[John Harrison]

I work for IBM with smart cards. My team directect Sharp the the JCOP (Java Card Open Platform) operating system over a year ago. The 1MB is rewritable storage. The OS is stored in ROM. It is a simplified version of Java (the JavaCard standard) that requires very little in the way of resources.

Functionality is added to the card by securely loading JavaCard applets to the 1MB of storage. More info on JCOP can be found here.

Re:Storage space

[John Harrison]

Lumpy, For one thing, the smart card itself has no concept of Windows or Linux. All it knows about are the APDUs that are coming and going. I don't know why there are no consumer apps. There certainly are in Europe. You can store your browser bookmarks on your bankcard and things like that. I am not sure what sort of "basic information" you want to store. Most vendors concentrate on healthcare, banking, and finance rather than the hobbist market. If you want a password manager ActivCard makes a very capable one. IBM had one in the past but I believe that it has been discontinued. Another reason there are no consumer apps is lack of standards. Until recently most smart cards were very proprietary. Software was written for a specific card platform, burned into the mask, and would not work with other cards. With the advent of JavaCard some of these problems are going away. However that brings us to a new problem of card management. Who owns your smartcard? You might think that you do, but unless you have the keys needed to load new applets, then from the smartcard's point of view you are not in charge. Because of security functionality you can't just sit down, write a Java applet to store your passwords, and load it to your Visa card. This is a good thing, because Visa wants to know that the applets on the card came from them and are legit. However it reduces the hobbyist market substantially, doesn't it?

Re:OS

[Melibeus]

As soon as I finish porting the kernel to java...

redudancy alert

[xsupergr0verx]

One "640k should be enough for anybody" joke in the title should be enough for everybody.

Titanium Card

[Anonymous Coward]

Check out the titanium card, I believe it has more than 1 meg of memory, and while we are on the topic of smart cards flip over to www.cardcoders.org

Picture of the card and tech specs

[AndroidCat]

Looks .. card-sized!

Security anybody?

[SpeedyGonz]

Sorry for this, i couldn't help it: *** TIN FOIL HAT MODE ON An IC card, capable of running a tiny java - based OS, used for, say, storing my Credit card details . . . sounds like clock frequencies on the high Khz to low Mhz order, am I right? What about somebody detecting it's electromagnetic activity (when used) using a device like that "Tempest project" one that detects the EM fields produced by CRTs. Does this thing use too small a voltage to be picked up by an antenna at short range? *** TIN FOIL HAT MODE OFF

Virtual Machine?

[Jimmy The Leper]

Do I have to plug it in and then wait 45 seconds for the java virtual machine to load before it lets me do anything?

Also, now that it has java, does that mean I can run Project Looking Glass?

What is this good for?

[bentfork]

Smart cards are a great way to keep you private encryption key(s) and passwords safe, OFF your computer harddrive, and out of your computer memory.

Why? Because you the user can not know if the computer you are typing on is safe ( think spyware, malware etc... ) .

Current smartcard technology has been problimatic because you can only store tiny amounts of data on them. By tiny I mean really small, shorter than a few SMS (text based cellphone) message amount of data. ( dont forget the file allocation table takes up space...)

You also dont really store data on them, they store data for you. Smart cards are basically little computers, that will only respond with the correct password to give you your data. Pretty clever really.

Now it looks like they will be able to store much more data, like a couple 1024 bit keys, your encrypted passwords and lots of other great stuff like that.

That is what it could be used for... but I am sure everyone is going to buy them because they can save their IE Favorites, and their Email Address book on it.

Re:What is this good for?

[AndroidCat]

The nice part is that you can check biometric data without exposing the actual data outside the card. For example, you plug the card into a fingerprint reader and the reader gives the print data to the card. The card compares it to the stored data, and if it's a close-enough match, says OK and unlocks access to other data.

If it wasn't "smart", an outside system would have to have access to the real data to compare against the finger or password attempt.

Re:OS

[WhiteDeath]

actually, linux runs just fine without an MMU - see uclinux

There doesn't seem to be a 2.6 version (only 2.4), but then I'm not sure if 2.6 hasn't had uclinux merged in. (a quick look at the config says no)

The 20 Year Cycle

[Etcetera]

20 years ago, Apple was figuring out how to squeeze a graphical operating system into 128K of RAM. Permanent storage that didn't cost 5 figures was in the 400K range.

In this day of multi-gigabyte OS installs, it's refreshing to see people return to the "lean and mean" OS mentality, even if it's out of necessity. Hell, even 10 years ago, you could still install an entire installation of Mac OS 7.6 on a set of 10-12 floppies.

Those were the days. Nice to see such "hack"ish talent used again.

Re:The 20 Year Cycle

[phasmal]

So you would expect in 20 years time we will be developing 1MB systems for our nanobots?

-- phasmal

Just a bunch more Flash

[nervesystem]

This is really just about adding high density flash to an existing smart card platform. Other then having alot of flash this (16 bit CPU, 4-8K RAM) card is just like most other JavaCards out there (such as in your cell phone or AMEX Blue card). The innovative smart cards these days have 32 bit CPUs such as the P9SC648 from Philips and ST22N256 from ST Micro. The Philips card is alot more powerful then IBM/Sharp's card and still has 512 KB Flash. The ST card has 256 KB Flash and 368 ROM and is shipping now for $4 to $5 in quantity.

Here is the confusion

[GoClick]

The confusion here is that the average /.er doesn't know that a SmartCard is not a SmartMedia Card.

A SmartCard is NOT for holding pictures of your cat. It's primarily for identity verification. See
SmartCard

A SmartMedia Card IS for storing pictures of your cat or whatever else you might have. This is the large card that goes in SOME digital cameras. SmartMedia is a trademark of Toshiba. It is a flash memory format Please see
SmartMedia

Size

[cuteseal]

Give it a few years, and everyone will be wanting 40 gig versions to store their mp3 collection on.

Re:OS

[Trejkaz]

Dude. That would be awesome!

Then I could run Linux on Java on Linux on Java on Linux on Java on Linux on Java on Linux on Java ...

elliptic curve, not "elliptical"

[__aazofn1209]

I'm sure this card incorporates some form of elliptic curve cryptography, rather than "elliptical curve encryption", which doesn't mean anything AFAIK.

I guess all of the other mathematicians are watching election coverage rather than pointing out slashdot editing errors...