Tamper Resistance of SmartCards -- NitroKey Pro/ KernelConcepts

[Andreas Fenkart]

Hi,

I'm comparing NitroKey Pro and KernelConcepts OpenPGP card.

https://shop.nitrokey.com/shop/product/nitrokey-pro-3
http://shop.kernelconcepts.de/#openpgp

I'm only interested in creating signatures for FW releases. What
confuses me is the claim made by NitroKey that it is "tamper
resistant". I guess kernelconcepts card being a BasicCard[1] should be
"tamper resistant" as well.

I did a bit of googling:

https://github.com/Nitrokey/nitrokey-pro-hardware
- uses STM32F103TB
- the chip supports JTAG
- no special counter measures, or security section in the specification

https://secure.zeitcontrol.de/shop/BasicCard_1
- http://www.basiccard.com/
- didn't find the exact BOM, but probably it's there

Probably either cards resist hardware attacks, "side-channel", etc...
- http://www.wrankl.de/SCH/Attacks.pdf

https://www.yubico.com/2016/05/secure-hardware-vs-open-source/
-  "What is the attack scenario you’re most worried about — a backdoor
or bug, accessible via the standard interface over the network,
someone owning your computer while extracting sensitive information
from your security token, or that someone in possession of your key
could retrieve such information?"

I'm okay with number one. I don't want anybody to extract the key
while it's connected to a computer that I don't trust. I'm not so much
concerned about the smartcard being stolen and the key extracted, by
observing heat ouput or JTAG. But I have to make sure the key never
leaves the hands of people I fully trust,

that means:
- don't send it via postal service
- if it's lost/found key must be revoked

Nonetheless, what are the low hanging fruit, to improve its tamper resistance?
- kernelconcepts / NitroKey are they equivalent?
- of course change admin/user pin
- what is the card manager key mentionned in the yubic link? Do I need
to change something?


/Andreas

[1]  Manufacturer: ZeitControl
reported by gpg2 --card-status
https://wiki.debian.org/Smartcards#Some_common_cards

[2] discussion discussing internals of various vendors
https://plus.google.com/+KonstantinRyabitsev/posts/4a7RNxtt7vy