What prevents a compromised laptop from reading your private key in the clear from your smartcard? Even if you need a fingerprint read or PIN, I mean at some point you need to get the decrypted key read from the card so that it can be used.
The private key is not accessible outside of the smart card. All the cryptographic operations that require the private key are done by the smart card itself. Cryptographic smart cards are not just a dumb storage device, they are basically a computer. They have a CPU (my card has a 66Mhz 32bit RISC CPU) and normally run some simple OS. You can actually write applications that can run on the smart card using, for example, a subset of Java or the .net framework.
You may be interested to know that RFID cards are also 'smart', although less so. They have hardware circuits that can perform some cryptographic routines, and receive enough power to perform many calculations. So an RFID reader will send a challenge, the card will perform some operations based on a secret key, and send back the result. The reader is connected to a central database, that also knows this secret, so it knows if the response is valid. As such you can't just 'copy' an RFID card, or even replay a valid request (since the challenge is unique).
This is straying out of my knowledge, but I'm pretty sure most smart cards perform the encryption on the card itself. The public key can be exported, but without specialized hardware and/or software (that you hopefully don't run all the time in an unlocked fashion), you can't extract/set the private key.
Comments
What prevents a compromised laptop from reading your private key in the clear from your smartcard? Even if you need a fingerprint read or PIN, I mean at some point you need to get the decrypted key read from the card so that it can be used.
The private key is not accessible outside of the smart card. All the cryptographic operations that require the private key are done by the smart card itself. Cryptographic smart cards are not just a dumb storage device, they are basically a computer. They have a CPU (my card has a 66Mhz 32bit RISC CPU) and normally run some simple OS. You can actually write applications that can run on the smart card using, for example, a subset of Java or the .net framework.
Edit: For example, you can view what is currently running on the smartcard: http://i.imgur.com/Pgwz4la.png or view the filesystem on the smartcard: http://imgur.com/aLsV6pf
Ah, I guess that's why they are called "smart". Thanks, learned something.
You may be interested to know that RFID cards are also 'smart', although less so. They have hardware circuits that can perform some cryptographic routines, and receive enough power to perform many calculations. So an RFID reader will send a challenge, the card will perform some operations based on a secret key, and send back the result. The reader is connected to a central database, that also knows this secret, so it knows if the response is valid. As such you can't just 'copy' an RFID card, or even replay a valid request (since the challenge is unique).
This is straying out of my knowledge, but I'm pretty sure most smart cards perform the encryption on the card itself. The public key can be exported, but without specialized hardware and/or software (that you hopefully don't run all the time in an unlocked fashion), you can't extract/set the private key.