# Smart Card - Entropy during on-board public key generation

I know that some (advanced) smart cards or tokens allow generating key pair directly on the device, but I wonder how the card can gather entropy during the process. Any idea ?

• I'm not sure such cards are so advanced; I have one and it didn't cost me much. – fkraiem Jan 2 '15 at 14:14
• All modern microprocessor Smart Cards ICs have a built-in true Random Number Generator. See this and this for information on the related test procedures. – fgrieu Jan 2 '15 at 14:29
• Not Sufficient, as the attacks reported by SmartFacts. the component Renesas HD65145C1 embed a Hardware Random Generator certified by FIPS. Unfortunatly a bad utilisation of the device gives a unsecure process. – Robert NACIRI Jan 2 '15 at 14:36
• @RobertNACIRI Any implementation - especially on smart cards - can come under attack. This doesn't invalidate the argument of fgrieu. There is too little space here to discuss all possible attacks on RNG's of smart cards. I've seen many errors and insecure implementations - although I might not be able to discuss any of them :) – Maarten Bodewes Jan 3 '15 at 15:07
• @MaartenBodewes-owlstead, Probably, but there is a big difference between theory and effective practice. For proof, the implementation and the hardware reported by smartfacts was certified by governemental organisation and FIPS. – Robert NACIRI Jan 3 '15 at 23:19

In short, they retrieve the entropy directly from a source on the chip.

From Wikipedia:

In computing, a hardware random number generator (TRNG, True Random Number Generator) is an apparatus that generates random numbers from a physical process, rather than a computer program. Such devices are often based on microscopic phenomena that generate low-level, statistically random "noise" signals, such as thermal noise, the photoelectric effect, and other quantum phenomena

All reasonably secure smart cards contain a hardware source of entropy. In that way they are not dependable on entropy from the outside. This is of course highly important for smart cards as they should consider any outside information as possibly tainted.

Often these sources of random entropy are post-processed by some form of whitening. And often they are fed into a Deterministic Random Number Generator before the data is used by an application or send to the outside world. On less secure cards this is often a LSFR, but on higher-end cards NIST modes such as CTR_DRBG are used. This is therefore somewhat similar to how RD_RAND operates on modern Intel CPU's.

Beware to check if on card key generation is actually certified in the field for the particular smart card. Even if the key generation is supported, it may not contain enough protection against side channel attacks in the field. In that case you should only use the on board key generation within a secure environment. This is particularly true for RSA key pair generation.

Just like all the other parts of a smart card processor, the entropy source as well as the post processing can come under attack. Furthermore there have been (many) mistakes in the implementation of random generation in smart cards. Some of these can be contributed to the sometimes extreme limitation of resources on smart cards chips (over-optimization).

This is a very interesting question, in the sense that every smart card provider claims the inviolability of its own process.

Nowadays, Smart cards can generate their cryptographic keys on the card itself using appropriate hardware. Entropy is generally generated by an embedded random generator. The hardware of the generator is generally certified by organization such FIPS, which release recommendations on the generation of cryptographic keys.

Despite all these precautions, these methods are not rigorously sufficient. Some attacks on collisions on a data base containing certified RSA key pairs, were reported during 2013. The Taiwan government had previously certified the security of the process.

A simple calculation of GCD between different RSA moduli from the data base found 184 distinct RSA moduli sharing a prime factor. By the examination of the shared prime moduli, the researcher concluded that the random number generator was biased during the Key generation process. This enhanced the attacks by that were performed using other patterns and attack variants such as the Coppersmith methods based on LLL. That made it possible to find more key values.

If you want to learn more consult this: http://smartfacts.cr.yp.to/index.html

• Although the initial two paragraphs sufficiently answer the question I think the last paragraphs are more some kind of introduction to the security analysis of some smart card implementations and therefore off-topic. – Maarten Bodewes Jan 3 '15 at 15:19