21–30 of 90 posts
Didn't notice it at first, but this is Ruben Santamarta's site.
Not a name known to me. But he seems to understand his business.
Here's his site, for those who don't want to do a search right now: [1].
Earlier quoted context omitted.
I would not bet on it. But there is pretty low constraints on what you can do and can not with an NFC chip. Your budget in term of compute and memory is extremely low. I would be surprised a proper RSA/ECDSA signature from an X509 certificate can hold there. Very likely I would say no. And that's why the home made crypto.
> Your budget in term of compute and memory is extremely low. I would be surprised a proper RSA/ECDSA signature from an X509 certificate can hold there. The latest versions of the Java Card spec have VMs on them and have HTTP interfaces: * https://en.wikipedia.org/wiki/Java_Card There is nothing constrained about modern smart cards: it's just a matter of how much you want to spend on the card and its capabilities.
The fashion for Smartcard is over, mainly due to the necessity of specialized reader.
The wind blows in favor of NFC cards & badge because they are smartphone compatible. But these comes with limitations.
Earlier quoted context omitted.
> Your budget in term of compute and memory is extremely low. I would be surprised a proper RSA/ECDSA signature from an X509 certificate can hold there. The latest versions of the Java Card spec have VMs on them and have HTTP interfaces: * https://en.wikipedia.org/wiki/Java_Card There is nothing constrained about modern smart cards: it's just a matter of how much you want to spend on the card and its capabilities.
Smartcard and NFC are two different beast. The fashion for Smartcard is over, mainly due to the necessity of specialized reader. The wind blows in favor of NFC cards & badge because they are smartphone compatible. But these comes with limitations.
Does anyone know why a private govtech business like Palantir doesn’t take over all these use cases? Governments are notoriously bad at tech, why isn’t there a massive private corporation catering to all these use cases and ensuring state of the art security? Instead of hiring local clowns that release half baked solutions like this.
Earlier quoted context omitted.
Palantir is a particularly bad example, it being american. France care a lot about sovereignty and would never allow (and for good reasons) an external entity to have that much control. It probably did ask for a contractor on an "appel d'offre" to build this so it's the same but with a french actor.
We, French, do actually have seriously competent people in charge of central government IT infrastructure. Local governments not so much and that is an euphemism, but French central government doesn't cut corners about that. Also, ANSSI is among the world's best in security auditing and they take very diligently their public service role of sticking their noses into your information system if you are legally classifi…
This is so good and important to show that these identity schemes are more about surveillance than security, as the security guarantees are limited and insufficient for any long period of time. An additional approach I might recommend for exploration would be to find the "offline mode," where it would have to re-use IVs and challenges over a short window when the app can't validate against the back end service. Other…
Earlier quoted context omitted.
> Your budget in term of compute and memory is extremely low. I would be surprised a proper RSA/ECDSA signature from an X509 certificate can hold there. The latest versions of the Java Card spec have VMs on them and have HTTP interfaces: * https://en.wikipedia.org/wiki/Java_Card There is nothing constrained about modern smart cards: it's just a matter of how much you want to spend on the card and its capabilities.
Smartcard and NFC are two different beast. The fashion for Smartcard is over, mainly due to the necessity of specialized reader. The wind blows in favor of NFC cards & badge because they are smartphone compatible. But these comes with limitations.
> I'm currently analyzing the possibilities of using Yubikeys for TLS client certificate authentication over NFC on iOS devices as part of a single sign-on process, but from what I have been able to gather only OTP seems to been supported? Are there any plans for supporting PIV over NFC?
* https://github.com/Yubico/yubikit-ios/issues/5 (functionality added)
> This paper introduces a new online payment protocol called EMV-TLS, dealing with NFC enabled mobiles. EMV-TLS results from the merging of three technologies: EMV payment applications, SSL/TLS secure channels, and Near Field Communication radio interfaces. The main idea of this protocol is to remotely use an EMV-TLS chip, thanks to a secure TLS channel established with a server. The mobile acts as a passive modem that manages TCP/IP resources. Two classes of servers are defined; N1 class may only read the embedded information (card number, bearer name, validity date,), while N2 class has access to all chip resources and may generate cryptograms. A first experimental platform including an EMV-TLS chip, an Android mobile, and a TLS payment server has been realized as an early proof of concept.
* https://ieeexplore.ieee.org/document/6867565
> This paper introduces a new mobile service, delivering keys for hotel rooms equipped with RFID locks. It works with Android smartphones offering NFC facilities. Keys are made with dual interface contactless smartcards equipped with SSL/TLS stacks and compatible with legacy locks. Keys cards securely download keys value from dedicated WEB server, thanks to Internet and NFC connectivity offered by the Android system. We plan to deploy an experimental platform with industrial partners within the next months.
* https://eudl.eu/pdf/10.1007/978-3-642-32320-1_30
This document describes the support of the TLS protocol over the NFC
(Near Field Communication) LLCP (Logical Link Control Protocol)
layer, which is referred as LLCPS. The NFC peer to peer (P2P)
protocol may be used by any application that needs communication
between two devices at very small distances (a few centimeters).
LLCPS enforces a strong security in NFC P2P exchanges, and may be
deployed for many services, in the Internet of Things (IoT)
ecosystem, such as payments, access control or ticketing operations.
Applications secured by LLCPS are identified by the service name
"urn:nfc:sn:tls:service".
Earlier quoted context omitted.
Palantir is a particularly bad example, it being american. France care a lot about sovereignty and would never allow (and for good reasons) an external entity to have that much control. It probably did ask for a contractor on an "appel d'offre" to build this so it's the same but with a french actor.
We, French, do actually have seriously competent people in charge of central government IT infrastructure. Local governments not so much and that is an euphemism, but French central government doesn't cut corners about that. Also, ANSSI is among the world's best in security auditing and they take very diligently their public service role of sticking their noses into your information system if you are legally classifi…
Earlier quoted context omitted.
We, French, do actually have seriously competent people in charge of central government IT infrastructure. Local governments not so much and that is an euphemism, but French central government doesn't cut corners about that. Also, ANSSI is among the world's best in security auditing and they take very diligently their public service role of sticking their noses into your information system if you are legally classifi…
Palantir is not trusted, at all anywhere outside the U.S.
Earlier quoted context omitted.
Why not do the same thing credit cards or access smartcards do? There are many electronic ID systems in EU already and none of them have homegrown crypto...
> Why not do the same thing credit cards or access smartcards do? I think you would be surprised how bad the security on these systems is. The credit card security relies mainly on the ability of the bank to rollback in case of "a shit happened" and in the payment terminal itself. Probably not something you want to see to protect against identity thief nation wide. And you also can not trust individuals smartphone to…
It very happens that the father of the smart card technology to be a french guy [1] and the current biggest provider of this technology is the french aero-space/defense/security company Thales Group[2] followed by another frech company called IDEMIA.
There is a very nice biography of the technology [3].
[1] https://artsandculture.google.com/story/roland-moreno-s-ubiq...
[2] https://www.thalesgroup.com/en/markets/digital-identity-and-...