How does a smartcard authenticate its holder, and what does its authenticator profile look like?
A chip on the card stores a private key and certificate; after the holder unlocks it with a PIN, the card signs a fresh nonce from the verifier, and the verifier checks the signature with the public key from the certificate.
* The private key never leaves the chip; the verifier only needs the public certificate. *
| Property | Smartcard |
|---|---|
| Type | Multi-factor (MF) |
| Category | Possession + knowledge (Besitz + kenntnisabhängig) |
| Secret value | Private key |
| Activation value | PIN |
| Authentication function | Digital signature |
| Output value | Signature over a nonce |
| Credential | Certificate / public key |
Smartcards are physical cards with an embedded microchip that stores cryptographic keys and certificates securely. They are read by inserting them into a reader or wirelessly via NFC (a contactless short-range radio link).
Compared with a password the profile is the opposite in every row: the secret never leaves the chip, a PIN must activate it, every output is fresh, and the credential on the server is public, so stealing it gives an attacker nothing.
Go deeper:
Smart card (Wikipedia) — design, contact and contactless interfaces, and use for authentication.- NIST SP 800-63B-4: Multi-factor cryptographic authenticators — the requirements a card with PIN must meet.