GlobalPlatformPro

> There shouldn't be such a thing as an "OpenPGP smartcard" (yet there is), there should just be generic programmable smartcards I can program with an application of my choice. That's in fact very possible! I've been doing just that, i.e. running an open source implementation [1] of the OpenPGP smartcard standard [2] on a physical card to which I have the root keys. The card specifications themselves are presumably behind NDAs, though, so I do have to trust the vendor to not have built in anything nefarious, e.g. a predictable/keyed RNG. > And you can't have one. I have three :) The specifications are indeed behind NDAs, but you don't really need those – you can just work with the (publicly accessible) Global Platform application management commands and the Java Card API. The excellent GlobalPlatformPro [3] can take care of much of the fo

JavaCard is the answer for smartcards. You can find example card software all over github, and you're looking for the JavaCard SDK from Oracle and GlobalPlatformPro to program them: https://github.com/martinpaljak/GlobalPlatformPro. There's even an ant task around somewhere that allows you to use ant tooling. Blank cards with "developer"/default keys can be picked up pretty much anywhere. Buy blank cards, write your applet, test in an emulator if you want, push to card, test for real with your software that talks to the card, profit. Be aware that if your goal is to write custom cryptography implementations in Java on the Javacard, these will be prohibitively slow. No need to take my word for it, Niels Duif did exactly this: https://research.tue.nl/en/studentTheses/smart-card-implemen... > Java Card proves to be a worthless platform for h

To read a bit of info about your credit card you can use this https://github.com/martinpaljak/GlobalPlatformPro, it will output something like Card CPLC: ICFabricator: 4790 ICType: 5049 OperatingSystemID: 8241 OperatingSystemReleaseDate: 2218 OperatingSystemReleaseLevel: 1520 ICFabricationDate: 3086 ICSerialNumber: 06575696 ICBatchIdentifier: 6664 ICModuleFabricator: 4810 ICModulePackagingDate: 3086 ICCManufacturer: 1180 ICEmbeddingDate: 3086 etc I guess it's enough information to concoct some kind of 2-factor auth, but what is stopping you from promoting your real smart card into "always-with-me"? Or one of smartcards, since you can have many. NFC-capable phones can act as a card reader for contactless smartcards AFAIK, so that's something you can look into also.

So it turns out the story is less grim: you can buy a blank JavaCard [0] and use GlobalPlatformPro [1] to load arbitrary applets. You can load gpgapplet, isoApplet, MuscleApplet, or any other JavaCard crypto software you like. This will be then be compatible with client-side software like OpenSC [2], at which point you get generic PKCS#11 or GPG functionality from it. You can get FIPS 140-2 Level 3 cards for, like, $11. Apparently there is some difficulty in correctly unlocking the card for applet loading, [0] https://github.com/martinpaljak/GlobalPlatformPro/tree/maste... [1] https://github.com/martinpaljak/GlobalPlatformPro I'll let you know how it goes :).