More secure than smartcard or cryptostick against remote attacks?

[Faramir]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

El 06-02-2013 19:51, Robert J. Hansen escribió:
> On 2/6/13 4:28 AM, Peter Lebbing wrote:
>> Can you explain (broadly) how one would compromise the
>> signature/the device that you sign with?
> 
> Happily!
> 
> I have an OpenPGP smartcard and an SCM card reader.  I installed
> it under Fedora 16 and it worked beautifully.  Under Fedora 17 it's
> broken. After a few rounds of unfruitful debugging I gave Werner an
> account on an F17 box with this hardware plugged in, and even then
> we were unable to figure out what was wrong.  So, since this device
> clearly doesn't work under F17 (or F18, now, for that matter), I've
> elected to stop using it in favor of using my desktop PC.  Just
> makes sense.  Damned thing doesn't work.
> 
> -- And that is _exactly_ the attack I would use against any dongle
> you plug into a compromised PC in order to make signatures safely.
> If I've compromised the system, all I need to do is make the dongle
> not work properly.  After a few rounds of frustrating debugging and
> discovering the thing just doesn't work, you'll revert back to
> using your compromised PC.  You'll do it for the exact same reason
> that I stopped using my smartcard reader: "damned thing doesn't
> work."

  Ah, but there are situations in which that would not work... if the
secret key is ONLY present in the smartcard, and you are required by
law to only use a secret key from a smartcard, that attack would make
you unable to use digital signatures, but would not allow you to
obtain documents signed by the victim. Now, why did I came with that
case where law forces the use of smartcards? Easy, because that is
what chilean law says about digital signatures. Of course, it focus on
x.509 standard, and only if the certificate was issued by one of the
CAs in the short list of government approved CAs. You can use other
kind of digital signatures, but they won't be considered as legal as
the smartcard ones, the judge would have to decide how much prove
value to assign to those signatures... and that would be a bit scary ;)

  Best Regards

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBCAAGBQJRFDwCAAoJEMV4f6PvczxAFbwH/jEv4rKh0oX2yk+5c8F+cy4l
bgV/Yj4GLVv3ICtZ1whvdACLxo9eGKOntRRaHfio4lUVSwYQH9dcYDb+L7VMf//A
XGMLzO8YKuXYCtLYbPihkk6ElH4UmhOUjmTOEZ3thpNTLYpjQGu31NQSgW+cDX22
O+yEymizYpZTODJ+rNMMEg0658W7okcsRlJnvuYDaINlxJZn4YPusd+fmTpH03Mj
lw8jT5to2cMyKYgJ888AvFibQVJRaEzAsnMB+Y3+xZUz+kWblPsTE2waDTGe4vVb
bevO9UMOga0aNqYrDR1oYfOR4XxkIrBmNfIVwr7nIlrNRcn261SxmL4y+khrTZs=
=bY0L
-----END PGP SIGNATURE-----