Subject: Intel killed the smart ID-card

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 13 Apr 2004 17:44:38 +0200

From a recent Intel pressrelease:

The Intel PXA27x family of processors, formerly code-named "Bulverde," adds a number of new technologies to address the needs of cell phone and PDA users. It is the first product to integrate the Intel Wireless MMX technology, providing additional performance for 3-D games and advanced video while improving battery-life. The new chip also utilizes Wireless Intel SpeedStep technology, enabling significant power savings by intelligently managing voltage and frequency changes similar to the technology used in the company´s notebook processors. 

Also for the first time, Intel has integrated important security features through its Intel Wireless Trusted Platform to provide services such as trusted boot, secure storage of private information and cryptographic keys, and support for common security protocols.

--------------------------------------------------------------------------------

If you have a device that you already use extensively for other purposes, that can connect to various services including to local PCs using WLAN, and this device has a processor of the type above, why would you ever want a smart ID card that only supports a fraction of the other device's ID-related use-cases?

--------------------------------------------------------------------------------

---

From: Stephen Kent <[email-masked]>
Date: Tue, 13 Apr 2004 13:02:52 -0400

At 5:44 PM +0200 4/13/04, Anders Rundgren wrote:
>The Intel PXA27x family of processors, formerly 
>code-named "Bulverde," adds a number of new 
>technologies to address the needs of cell phone 
>and PDA users. It is the first product to 
>integrate the Intel Wireless MMX technology, 
>providing additional performance for 3-D games 
>and advanced video while improving battery-life. 
>The new chip also utilizes Wireless Intel 
>SpeedStep technology, enabling significant power 
>savings by intelligently managing voltage and 
>frequency changes similar to the technology used 
>in the company´s notebook processors.
>
>Also for the first time, Intel has integrated 
>important security features through its Intel 
>Wireless Trusted Platform to provide services 
>such as trusted boot, secure storage of private 
>information and cryptographic keys, and support 
>for common security protocols.
>
>
>If you have a device that you already use 
>extensively for other purposes, that can connect 
>to various services including to local PCs using 
>WLAN, and this device has a processor of the 
>type above, why would you ever want a smart ID 
>card that only supports a fraction of the other 
>device's ID-related use-cases?

maybe because a smart card is less likely to be 
corrupted by e-mail viruses or the raft of other 
code that the smart phone is likely to process, 
and because I have less than complete confidence 
in the folks who can't do floating point division 
properly, to do security properly :-)

Steve

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 13 Apr 2004 22:06:21 +0200

Re: Intel killed the smart ID-cardSteve,

IMO you should rather be happy as this means that the technology you have been preaching about since ages ago, may finally become mainstream.  Yes, it will also bring new life to "indirect" PKI schemes like SAML and 3D Secure, but I believe this is just fine.

The only major reason why smart cards may be more secure than mobile phones (here not including physical attacks on the chips) is that they are so powerless in comparison to the latter. 

Talking about security:  How secure is it really to use PIN-codes in public or unknown PCs?  Using the described concept, PIN-codes never leave your trusted device.

Assume you are on a the road and don't bring your laptop around, where would you be able to use your smart ID card?  Probably nowhere.  Using mobile phones as "carriers", you are much more likely to have the ID (and be able to use it) when you actually need it.

Smart ID cards will indeed survive, but only in the DoD and similar places where it is OK to burn any amount of tax-payer money in the name of the nation.

The smart card vendors have had ample of time to launch a ubiquitous PKI card and free software but they didn't.  Now it is "harvest time" :-)

Anders

  ----- Original Message ----- 
  From: Stephen Kent 
  To: Anders Rundgren 
  Cc: [email-masked] 
  Sent: Tuesday, April 13, 2004 19:02
  Subject: Re: Intel killed the smart ID-card

----------------------------------------------------------------------------

  maybe because a smart card is less likely to be corrupted by e-mail viruses or the raft of other code that the smart phone is likely to process, and because I have less than complete confidence in the folks who can't do floating point division properly, to do security properly :-)

  Steve

---

From: Stephen Kent <[email-masked]>
Date: Fri, 16 Apr 2004 17:21:14 -0400

At 10:06 PM +0200 4/13/04, Anders Rundgren wrote:
>Steve,
>
>IMO you should rather be happy as this means that the technology you 
>have been preaching about since ages ago, may finally become 
>mainstream.  Yes, it will also bring new life to "indirect" PKI 
>schemes like SAML and 3D Secure, but I believe this is just fine.

you would :-)

>  The only major reason why smart cards may be more secure than 
>mobile phones (here not including physical attacks on the chips) is 
>that they are so powerless in comparison to the latter. 

or, stated differently, a simple device has a much better chance of 
performing a limited set of functions correctly (and securely) than a 
much more complex device. The original Palms are a good example, vs. 
Pocket PCs.

>  Talking about security:  How secure is it really to use PIN-codes 
>in public or unknown PCs?  Using the described concept, PIN-codes 
>never leave your trusted device.

I don't use public PCs.  In fact, as a Mac user, I try to never use PCs at all.

>  Assume you are on a the road and don't bring your laptop around, 
>where would you be able to use your smart ID card?  Probably 
>nowhere.  Using mobile phones as "carriers", you are much more 
>likely to have the ID (and be able to use it) when you actually need 
>it.

I always bring my laptop with me.

>  Smart ID cards will indeed survive, but only in the DoD and 
>similar places where it is OK to burn any amount of tax-payer money 
>in the name of the nation.

I am still amazed at the naivete re DoD criteria as expressed by 
those with no direct knowledge of such criteria.

>The smart card vendors have had ample of time to launch a ubiquitous 
>PKI card and free software but they didn't.  Now it is "harvest 
>time" :-)

Please do hold your breath.

Steve