3
\$\begingroup\$

I would like to use a regular SIM card to store an AES key to be used by an AVR micro-controller. I think that a SIM is secure enough (isn't it?).

My problem is that I can find nothing about interfacing a SIM card with Arduino (for prototyping) as secure storage and not as GSM. Do I have to flash a custom OS to the SIM card? Or should I just buy an ordinary smart card and just cut it in SIM card dimensions?

\$\endgroup\$
  • \$\begingroup\$ What's wrong with Atmel's security solutions? \$\endgroup\$ – Ignacio Vazquez-Abrams Jan 4 '15 at 19:01
  • \$\begingroup\$ I took a look at the AES CryptoAuthentication module and it's not for my use. It's regular AES implementation, so to be secure enough it requires a random key, and what I want to do is store somewhere the random key used in my AES application \$\endgroup\$ – dzervas Jan 4 '15 at 20:02
  • \$\begingroup\$ Why not store the key in the AVR? It's probably not 100% secure, but it is no less secure than reading a key from something else over wires that can be snooped. Even if you encrypt the key as it traverses the wire, the key to decrypt that has to be on the AVR and so depend on its security mechanism. \$\endgroup\$ – Chris Stratton Jan 4 '15 at 20:14
  • \$\begingroup\$ There has to be a way of authentication. If I require a PIN, will it be safe. Also the EEPROM is very easily readable, isn't it? \$\endgroup\$ – dzervas Jan 4 '15 at 22:38
  • \$\begingroup\$ Interesting project; I'd start by reading the 3GPP documents which specify the SIM card interface. \$\endgroup\$ – pjc50 Jan 5 '15 at 0:00
2
\$\begingroup\$

literal answer

The "SIM Reader" and a few wires appears to be all the hardware needed to interface a SIM card to an Arduino. There seem to be some Python scripts designed to talk to it over a serial port; perhaps you wouldn't find it too difficult to translate to something (C++) that runs on an Arduino.

Or should I just buy an ordinary smart card ...?

"A SIM card is a smart card." -- Thomas Pornin. "Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?"

Most SIM cards today have "applications" that run on the little CPU in the SIM card stored in the flash of the SIM card. -- "A brief introduction to the SIM-cards"

more general answer

No matter which chip the crypto software is running on, it seems better to generate and keep the key inside that same chip.

It seems to be easier to write software that implements public-key encryption to run on a AVR than to run on a smart card. If you run the crypto on the AVR chip, then it would be better to keep the secure key inside the AVR chip rather than try to store it externally.

Public-key encryption (combined with symmetric encryption like AES) seems to be more generally useful than any symmetric encryption system alone. It sounds like you may be interested in the "Pico: No more passwords!" system; see also the early "Pico: No More Passwords!" video.

| improve this answer | |
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.