question confused me about key data storage?

Card Products

Moderator: horse dream

abc101
Posts: 1
Joined: Thu Aug 22, 2019 11:32 pm
Points :14
Contact:

question confused me about key data storage?

Post by abc101 » Fri Aug 23, 2019 12:00 am

Hello, everyone.
My question is below.
If the smartcard's platform hardware (not card os) has the certification of EAL4+ or EAL5+ level and I implement a security native COS myself, must I do some encryption and decryption for the very important data like a master key?

Thanks.

kuafu
Posts: 268
Joined: Thu Jun 25, 2015 2:09 am
Points :3307
Contact:

Re: question confused me about key data storage?

Post by kuafu » Thu Oct 10, 2019 11:28 pm

Yes .
well

tay00000
Posts: 149
Joined: Tue Sep 27, 2016 10:58 am
Points :2042
Contact:

Re: question confused me about key data storage?

Post by tay00000 » Wed Dec 11, 2019 1:24 am

Note that there's a difference between chip level certification and COS level certification. If both chip and COS are certified, it is even better.

Regarding sensitive data storage on the COS level, you should be doing encryption of highly sensitive data manually unless the chip specs specially mention of some secure master key storage region on the chip which you can leverage. Otherwise, it is always better to assume the lack of such chip level special features unless specified by the chip manufacturer.

Post Reply Previous topicNext topic

Who is online

Users browsing this forum: No registered users and 1 guest

JavaCard OS : Disclaimer