Cartão de Cidadão Security and authentication Bruno Duarte – ei07136 Pedro Barbosa – ei08036 Rúben Veloso – ei11001

The "cartão de cidadão" Physical and digital document that identifies citizens Simplify usage of public services via telephone or internet Objective

What is it? - SmartCard: - Incorporated microprocessor; - Allows cryptographic processing; - Allows storage; - Fulfill international standards.

Official Applications Similar application on Windows and Linux

Cards Architecture

Authentication eID PTPKCS#11 - Library to develop applications for “cartão do cidadão”; - Simpler interface; - Available for Java and.NET; - Developed above PKCS#11. - Appropriated for smartcards; - Cryptography patterns(RSA Laboratories); - Support for most used cryptographic methods (RSA, X.509,...); - Low Level interaction.

SOD Files PTEID_GetCertificates(); PTEID_GetADDR(); PTEID_GetPins(); PTEID_SetSOCAs() – define certificates location; PTEID_SetSODCheckin() – defines usage of above function. Basic security principles

Developed examples - Java Application using eidPT; - Application.NET C# Using eidPT; - Microsoft Office signature method test

.NET C# - Data read; - Address read and validation; - SWatcher.

Java - Data read; - Data read and validation;

Possibles failures Vulnerabilities: - key loggers; - Applications not using official library; - Trojans; - No evident failures with the system; - The reported error was not reproduced (PKCS#11);

Conclusions - Manual vs Digital signatures; - System is generally well conceived; - People need to be aware of vulnerabilities and try to avoid it