The Virtual Smartcard Architecture provides software to emulate a smartcard. The virtual smartcard is internally accessible via PCSC and externally via USB (as CCID reader) or NFC (using an OpenPICC).
The Virtual Smartcard Architecture consists of the following components:
A virtual smartcard: The purpose of the virtual smartcard is to emulate a smartcard and make it accessible through PCSC. Currently the virtual smartcard supports almost all commands of ISO-7816 including secure messaging. Besides a plain ISO-7816 smartcard it is also possible to emulate a German ePass (only basic access control) and a rudimentary Cryptoflex smartcard.
The virtual smartcard communicates with the virtual smartcard driver through a socket on port 35963.
NFC module
A USB CCID reader
The purpose of the program ccid is to forward a PCSC smartcard reader as a standard USB CCID reader. If the host system is in USB device mode, ccid forwards the local reader via USB to an other device. If in USB host mode, ccid virtually plugs in a USB CCID reader to the host system.
OpenPACE is an implementation of the Password-Authentication-Connection-Establishment (PACE) conforming to BSI TR-03110 version 2.02. OpenPACE enables applications to establish a strong session key using a weak password independent from the use of a smartcard. If a German "neuer Personalausweis" (nPA) is involved nevertheless, OpenPACE offers a smartcard abstraction layer to connect to the identity card.
The patch makes the protocol steps accessible through the OpenSSL libraries.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)
A smartcard library
The library abstracts from the APDU interface of smartcards to connect to the German "neuer Personalausweis (nPA)" using PACE.
Enrollment to Computer Sciences studies and account administration with password recovery
The aim of the project is to replace the manual process for enrollment of students and staff at the Institute of Computer Sciences by an electronic one. Currently, in compliance with privacy rules, the following data groups are being recorded: first name, name and current address. In addition, the user identifies himself with his identity card and the user's identity is manually verified by comparing him to the photograph. The current method scales poorly and requires simultaneous presence of both users and account managers. The same procedures have to be used for resetting a user password (in case of loss).
Using the electronic replacement, the enrollment procedures should be completely automated. The student registers by means of a valid registration number online (using a web form). Taking advantage of the "Chip authentication" and user authorization by entering the pin, the user's identity is verified without applying to someone in person. An account is automatically created. By means of the "restricted identification", a unique user-specific pseudonym is generated, which permits subsequent unambiguous recognition of a particular user. The use of this pseudonym ensures privacy and data economy. In addition, this pseudonym is persistent even if a student changes of the place of residence (which is particularly common). The restricted identification is the basis for all subsequent authentication procedures, in particular for the resetting the users password. The process can be conducted entirely online 24 hours a day, 7 days a week.
OpenMoko as "Standardleser" Smart card readers can not only be used as communications medium between a smart card and a host. They can also act as a security device independent from the host, which might be contaminated with malware. They ensure a safe authentication to the smart card with secure hardware and certified firmware. As if a smart card reader with pinpad was not expensive enough, some smart cards, like the German electronic identity card (neuer Personalausweis), have unique requirements. Mobile phones could fill the gap between the need of secure authentication and the costs of a suitable reader. This diploma thesis evaluates what level of security can be reached when implementing a smart card reader on a mobile phone. In the first step, a CCID-compliant smartcard reader will be emulated by the phone and can be recognized by any modern operating system. In the second step, the functionality of the emulated reader will be extended to what TR-03119 specifies as "Standardleser". This approach combines mobility, security and modern cryptography in one single and cheap device.
OpenMoko as mobile nPA-Terminal: Usability In November 2010, a new electronic identity card will be introduced in Germany. It will contain an ISO 14443 compliant chip that enables the holders of the card to authenticate themselves over the internet. The radio technology provides the possibility to use the new ID card in combination with a NFC enabled phone for mobile online authentication. Security procedures impose (by their very nature) limitations on the use of the applications they are protecting. An authentication technology might therefore affect the usability of the application. My diploma thesis will study the impact of eID-based authentication on the usability of mobile web usage and compare it with classical means of authentication. The core of the thesis will be a user study in which I will examine prototypes of eID based authentication scenarios with real users.
NFC-phone as PACE-enabled electronic identity reader The project is aimed at combining a real life mobile phone with nearfield communication capability with the RFID chip of the new German electronic identity card. Operations that are specified as allowed by an unauthorized terminal like PIN management and updating the internal date timestamp through fresh certificate chains will be implemented.
SAR-PR-2014-10 Rücksetzen eines U2F-Accounts mit dem nPA, Samra Khan, 47 Seiten, Bachelorarbeit, 2014.
[SAR-PR-2014-10]
SAR-PR-2014-09 Zeitaktualisierung des nPA mit einer Android-App, Hera Khan, 49 Seiten, Bachelorarbeit, 2014. [SAR-PR-2014-09]
SAR-PR-2014-08 Host-based Card Emulation einer PKCS15-kompatiblen Smartcard,
Erik Nellessen, 67 Seiten, Bachelorarbeit, 2014.
[SAR-PR-2014-08][Code: Version 17.10.2014
zip][aktuell
git-Repository]
SAR-PR-2014-07 Prüfung von öffentlichen eID-Terminals mit einem Android-Smartphone,
Ole Richter, 29 Seiten, Bachelorarbeit, 2014.
[SAR-PR-2014-07]
SAR-PR-2014-04 Browser-History-Stealing: Ein Angriff auf die Privatsphäre,
Sylvio Rüdian, 51 Seiten,
Bachelorarbeit, 2014.
[SAR-PR-2014-04]
SAR-PR-2014-03 ISO/IEC-14443-4 Weiterleitung über Android-Smartphones, Kai Warncke, 28 Seiten,
Studienarbeit, 2014.
[SAR-PR-2014-03]
2013 Reports
SAR-PR-2013-05 Praxisorientierte Sicherheitsanalyse des verteilten Dateisystems XtreemFS, Sven Schröder, 52 Seiten,
Bachelorarbeit, 2013.
[SAR-PR-2013-05]
SAR-PR-2013-04 Eine Machbarkeitsstudie zum Einsatz eines zentralen Authentisierungssystems in Wireless Mesh Networks,
Christian Ricardo Kühne Gómez, 40 Seiten,
Studienarbeit, 2013.
[SAR-PR-2013-04]
SAR-PR-2013-01 Sichere Bereitstellung von Identitätstoken auf mobilen Endgeräten, Martin Schröder, 107 Seiten,
Diplomarbeit, 2012.
[SAR-PR-2013-01]
SAR-PR-2012-05 Mobiler Chipkartenleser für den neuen Personalausweis: Sicherheitsanalyse und Erweiterung des „Systems nPA“,Frank Morgner, 161 Seiten,
Diplomarbeit, 2012.
[SAR-PR-2012-05]
2011 Reports
SAR-PR-2011-16 [Univention
Absolventenpreis 2012
1. Platz] Software-gestütztes Reverse-Engineering von Logik-Gattern in
integrierten Schaltkreisen. Martin Schobert, Diplomarbeit, 180 Seiten, 2011.
[SAR-PR-2011-16]
SAR-PR-2011-15 Display-Javakarte mit dynamischer eID-PIN für den neuen Personalausweis.
Paul Bastian, Bachelorarbeit,
49 Seiten, 2011.
[SAR-PR-2011-15]
SAR-PR-2011-09 Benutzerkonten-Verwaltung mit dem neuen Personalausweis. Mathias Jeschke, Diplomarbeit,
99 Seiten, 2011.
[SAR-PR-2011-09]
SAR-PR-2011-08 SAML Identity Federation und die eID-Funktionalität des nPA.
Martin Schröder, Studienarbeit. 52 Seiten, 2011.
[SAR-PR-2011-08]
SAR-PR-2011-03 Peeling Away Layers of an RFID Security System. Henryk Plötz
and Karsten Nohl, 15 pages, Financial Cryptography and Data Security '11,
February 28–March 4, 2011, Saint Lucia.
[SAR-PR-2011-03]
SAR-PR-2011-01 Mobiles Szenario für den neuen Personalausweis. Wolf Müller,
Frank Morgner und
Dominik Oepen, in 21. Smartcard-Workshop, 2.-3. Februar 2011, Darmstadt, Deutschland, 10 Seiten 179-188. Herausg. Ullrich Waldmann, ISBN 978-3-8396-0215-7
[SAR-PR-2011-01]
2010 Reports
SAR-PR-2010-13 "Die gesamte Technik ist sicher": Besitz und Wissen: Relay-Angriffe
auf den neuen Personalausweis. Frank Morgner und
Dominik Oepen, 27th Chaos
Communication Congress, 27.-30. Dezember 2010, Berlin, Deutschland, 6
Seiten.
[SAR-PR-2010-13][pdf][slides]
SAR-PR-2010-12 Mobile eCard-API. Kristian Beilke, 119 Seiten,
Diplomarbeit, 2010.
[SAR-PR-2010-12]
SAR-PR-2010-11 Authentisierung im mobilen Web: Zur Usability eID basierter Authentisierung auf einem NFC Handy. Dominik Oepen, 100 Seiten,
Diplomarbeit, 2010.
[SAR-PR-2010-11]
SAR-PR-2010-09 NFC-Telefon als PACE-fähiges Lesegerät für elektronische
Ausweisdokumente. Ingo Kampe, 66 Seiten,
Diplomarbeit, 2010.
[SAR-PR-2010-09]
SAR-PR-2010-08 Documentless Proof of Identity,Wolf Müller, Chapter
4 in Book: Handbook of eID Security: Concepts, Practical Experiences,
Technologies. Editors Walter Fumy, Manfred Paeschke. Publicis
Publishing, ISBN-13:
978-3895783791, 2010. [SAR-PR-2010-08]
SAR-PR-2009-14
Prüfstrategie für Chipkartensoftware von Ausweisdokumenten, Christopher Rudolf,
Diplomarbeit, 103 Seiten, 2009. [Diplomarbeit]
SAR-PR-2009-10 Eine virtualisierte Smartcardarchitektur für mobile Endgeräte.
Frank Morgner und Dominik Oepen. Studienarbeit. 72 Seiten.
[SAR-PR-2009-10]
SAR-PR-2009-04 Kryptographisch abgesicherter Mailsammeldienst für mobile Endgeräte.
Felix Bechstein. Diplomarbeit. 67
Seiten.
[SAR-PR-2009-04.pdf]
2008 Reports
SAR-PR-2008-21 Mifare Classic – Eine Analyse der Implementierung.Henryk Plötz,
Diplomarbeit (überarbeitete Version). 108 Seiten. [SAR-PR-2008-21]
SAR-PR-2008-18 Sybil Proof Anonymous Reputation Management. Wolf Müller1,
Henryk Plötz1,
Jens-Peter Redlich1,
Takashi Shiraki2 (1Humboldt
University Berlin, 2NEC Corporation), 10 pages,
SecureComm 2008: 4th International Conference on Security and Privacy in
Communication Networks, Istanbul, Turkey, 2008. [Abstract], [Conference
Paper]
SAR-PR-2008-16 Reverse-Engineering a Cryptographic RFID Tag. Karsten Nohl,
David Evans, Starbug
and Henryk Plötz, USENIX Security Symposium.
San Jose, CA. 31 July 2008. 9 pages.
University of Virginia, Chaos Computer Club Berlin,
Humboldt-Universität zu Berlin [SAR-PR-2008-16.pdf] [http://www.cs.virginia.edu/evans/pubs/usenix08/usenix08.pdf]
SAR-PR-2008-09 Chiptease: Verschlüsselung eines führenden Bezahlkartensystems geknackt.
Jan Krissler, Karsten Nohl, Henryk Plötz, ct magazin für computer technik, 8 /2008, Seiten 80-85.
[SAR-PR-2008-09]
SAR-PR-2008-08 Concepts of Anonymous Reputation Management.
Henryk Plötz, Studienarbeit, 21 Seiten.
[SAR-PR-2008-08]
