"Ernst Lippe" wrote in message ...
Even though there are some possible attacks, in general it is very
difficult to extract those keys from the smart card.

No it isn't. You rip the lid off the chip and put the EEPROM under
a special microscope. I forget the actual technique used but its been done.
Admittedly its way out of the league of your one man operation but don't
think that professional fraud gangs arn't able to do it.

Companies always expect the software attack but they never think of the
hardware attack. If you can physcally read the transister/capacitor values
then you can get the data out and given that the memory in most of these
cards is only a few kilobytes this wouldn't take too long. Even encrypting
the data is a waste of time since even if you the fraudster doesn't understand
what he's seeing he can still make an exact copies of it onto operationally
identical hardware (ie duplicate the cards).

Of course whether a duplicated card or any data extracted from it is any
use is another question.

B2003