1. Cartão de Cidadão Security and authentication Bruno Duarte – ei07136 Pedro Barbosa – ei08036 Rúben Veloso – ei11001

2. The "cartão de cidadão" Physical and digital document that identifies citizens Simplify usage of public services via telephone or internet Objective

3. What is it? - SmartCard: - Incorporated microprocessor; - Allows cryptographic processing; - Allows storage; - Fulfill international standards.

4. Official Applications Similar application on Windows and Linux

5. Cards Architecture

6. Authentication eID PTPKCS#11 - Library to develop applications for “cartão do cidadão”; - Simpler interface; - Available for Java and.NET; - Developed above PKCS#11. - Appropriated for smartcards; - Cryptography patterns(RSA Laboratories); - Support for most used cryptographic methods (RSA, X.509,...); - Low Level interaction.

7. SOD Files PTEID_GetCertificates(); PTEID_GetADDR(); PTEID_GetPins(); PTEID_SetSOCAs() – define certificates location; PTEID_SetSODCheckin() – defines usage of above function. Basic security principles

8. Developed examples - Java Application using eidPT; - Application.NET C# Using eidPT; - Microsoft Office signature method test

9. .NET C# - Data read; - Address read and validation; - SWatcher.

10. Java - Data read; - Data read and validation;

11. Possibles failures Vulnerabilities: - key loggers; - Applications not using official library; - Trojans; - No evident failures with the system; - The reported error was not reproduced (PKCS#11);

12. Conclusions - Manual vs Digital signatures; - System is generally well conceived; - People need to be aware of vulnerabilities and try to avoid it