The following paper was originally published in the
Proceedings of the Second USENIX
Workshop on Electronic Commerce (EC96)
Oakland, California, November 18-21, 1996.

For more information about USENIX Association contact:

1. Phone:	(510) 528-8649
2. FAX:	(510) 548-5738
3. Email:	office@usenix.org
4. WWW URL:	https://www.usenix.org

Smart Cards in Hostile Environments

Abstract:

One often hears the claim that smart cards are the solution to a number of security problems, including those arising in point-of-sale systems. In this paper, we characterize the minimal properties necessary for the secure smart card point-of-sale transactions. Many proposed systems fail to provide these properties: problems arise from failures to provide secure communication channels between the user and the smart card while operating in a potentially hostile environment (such as a point-of-sale application.) Moreover, we discuss several types of modifications that can be made to give smart cards additional input/output capacity with a user, and describe how this additional I/O can address the hostile environment problem. We give a notation for describing the effectiveness of smart cards under various environmental assumptions. We discuss several security equivalences among different scenarios for smart cards in hostile environments. Using our notation, these equivalences include:

• private input private output
• trusted input + one-bit trusted output trusted output + one-bit trusted input
• secure input secure output

• Introduction
• Our Model
  • Notation
• Methods
  • Achieving these Properties
  • Equivalence
    • Private input private output.
    • Secure input secure output.
    • Trusted input + one bit of trusted output trusted output.
    • Symmetry of input and output.
    • Private output private input.
    • Secure output secure input.
    • Trusted output with one bit of trusted input trusted input.
• Achieving Secure Transactions
  • Examples
    • Private output private input.
    • Private input private output.
    • Trusted input with one bit of trusted output general trusted output.
    • Trusted output with one bit of trusted input general trusted input.
• Conclusion
• References
• About this document ...