Crypto Talk at 28C3: Ein Mittelsmannangriff auf ein digitales Signiergerät, Day 2, 18:30, Saal 3

Alexander Koch will be presenting the results of his bachelor thesis at 28C3. In his thesis, he implemented a person-in-the-middle-attack (don’t call it man-in-the-middle attack) against a USB chipcard reader for digital signatures. Instead of modifying  the software on the users PC, he implemented a USB hardware device, that can be plugged in between the chip card reader and the host PC. Because the device behaves passively as long as no signature is made, it is hard to detect from any kind of security software from the PC side. When a signature is made, the device can transmit a different message digest (another document is signed) to the chipcard reader. The generated signature is stored and can later be retrieved from the attacker using a wireless link.

I think this is a good demonstration that shows, why digital signature made on (secure) devices, that cannot display the signed document are not a good idea. Also, a hardware device is hard to detect in software, because it acts like a valid chip card reader to the PC.

See the talk, Day 2, 18:30, Saal 3

Author: Erik Tews