# Authenticating with a document

Hope you're having a nice day.

I need to implement an authentication system between a "document" (it's not exactly a document, but an object without any computing capacity, only able to store information) and a computer. The document will have some sort of information stored there by the computer, and then it will be given to an user and kept away from the computer. When the computer detects the document again, it will identify its possessor as the user to whom it was given to and authenticate it.

However, the computer isn't assumed secure, so I need the information stored there to don't be enough to replicate the document and to let us know if the computer has been modified.

On the one hand, I would like to know if the implementation I was thinking to use would be insecure: I was thinking of using RSA; I'll store the private key in the document and the public in the computer. Then, for authenticating, I'll encrypt and decrypt a random number less than N (the modulo) and see if it results the original one. This will be right, wouldn't it?

On the other hand, I would like to know if there is some research done about this topic and if there are any papers developing it. I've tried to search it by myself, but I don't know how to describe precisely without needing quite a long text. Is there any term for this type of security?

Please, don't hesitate to ask me more details in case I haven't explained myself very well. Thank you so much in advance for your help.

• While the storage device / document is attached, is the computer assumed to be secure? – SEJPM Aug 29 '15 at 20:13
• @SEJPM It is as long as we don't store any information. The calculations or operations it computes, the memory it uses or the information displayed on the screen will be assumed to be completely secure, but any information we store on a permanent file could be instantaneously accessed. – AlexGasconB Aug 29 '15 at 20:53
• So it's a legitmate threat to assume the attacker will just "steal" the credential from the storage device / document as soon as it's written and still attached? – SEJPM Aug 29 '15 at 20:56
• No, the storage device / document is assumed to be secure even when it is connected to the computer – AlexGasconB Aug 29 '15 at 21:28

Note that there are practical problems here, which may lead to side channel attacks. For example, doing anything on a general purpose computer usually involves a chance that the memory you are using hits the swap on the disk, unless you use something like mlock.