Random number generation Electronic commerce cards require built-in cryptographic functionality. Generating pseudo-random numbers is not an easy task, and doing so with the limited resources on a smart card may be even harder. Care must be taken that generators produce quality randomness, or crypto systems can be compromised. I have performed several such reviews focused on communication and encryption protocol analysis. Using both formal analysis methods and attack scenarios, my colleages at Reliable Software Technologies and I subject proposed design specifications to rigorous analysis.
Many smart cards offer multiple protocols using the same secret keys.
There is a risk that the multiple-protocol attack will compromise card security. The terminal problem Finally, smart cards must have some way of displaying information about their contents and transaction streams to card owners. This display must be unspoofable and trustworthy. Potential smart card users should think carefully about this risk. The most commonly proposed solution is to combine the use of smart cards with trusted Personal Digital Assistants.