Secure Internet Programming - menu
Secure Internet Programming
Home
Projects
People
Publications
Support
Seminar
History
FAQ
Princeton University
Department of Computer Science

sip@cs.princeton.edu

Hand-Held Computers Can Be Better Smart Cards

Authors
Dirk Balfanz
Ed Felten

Abstract
Smart cards are convenient and secure. They protect sensitive information (e.g., private keys) from malicious applications. However, they do not protect the owner from abuse of the smart card: An application could for example cause a smart card to digitally sign any message, at any time, without the knowledge of the owner. In this paper we suggest that small, hand-held computers can be used instead of smart cards. They can communicate with the user directly and therefore do not exhibit the above mentioned problem. We have implemented smart card functionality for a 3COM PalmPilot. Our implementation is a PKCS#11 module that plugs into Netscape Communicator and takes about 5 seconds to sign an email message. Generalizing from this experience, we argue that applications that are split between a PC and a hand-held device can be more secure. While such an application remains fast and convenient to use, it gains additional security assurances from the fact that part of it runs on a trusted device.

Published
Proceedings of USENIX Security '99. Washington, DC. August 1999

Text
GZip'ed Postscript (180k)
PDF (Adobe Acrobat) (1453k)

See Also
PilotKey Web site