Card specific keys

Question

My card implements the mutual authentication. For that purpose the external application and the card must share the set of secret keys. The first key is relevant for encryption and the other for the MAC calculation. At this point I am putting these keys on the card during the personalization. These keys are the same for all cards. Now I am thinking is this secure enough. I read that it is recommended to use derived (card specific) keys such that only one card is affected if a key is compromised. How can I calculate the card specific keys? If I will have this, then if someone finds out the initial secret keys and the algorithm how the card specific keys are made, then the card is again compromised. Right?

Answer 1

You said that the random key is more secure way. You mean that during the personalization I can generate random key on the card. The operating system takes care of the security of such object. But, this random key has to be shared with the external party which is communicating with the card. Both of them need it in order to establish the secure channel. At some point it has to be extracted and given to the terminal side. Right? Or the random key has to be generated on the perso dll during the personalization. Then the outside world has to have some kind of lookup table in which the relation token serial number, random key has to be stored and before executing the mutual authenticate method, the external party has to for the particular token serial number extract its random key. What if the secure channel has to be made from the middleware API that is installed on the user’s PC. If the lookup table is stored somewhere like HSM it is impossible use case because the user’s PC is located in his home. With random keys, each key would be generated at perso time and injected into the card manager with PUT KEY over a secure channel. You could use the unique card identifier as the label for the key in the HSM so there is no lookup table. You could use the same data you would use to diversify a key since it should also be unique. I am assuming you have some way of having a connection back to a HSM from the middleware? If not, this model sounds worrying to me. If you have your keys exposed to every client client then you are opening up a security risk. You can assume the client machine is secure.
You said:
It is easier to secure a single set of master keys (and rotate as required) that are used like this than a master key that is shared
I did not understand how this will work. In case of mutual authenticate method. The external party is using one master secret key from the set of secret key set. When the command comes to the card, the card has to verify it. But how the card knows with which key the message is encrypted.If you have keys in a HSM you need some way of knowing what key to use. You could map cards to a master key. Some security organisations recommendations on key rotation and usage policies which are designed to limit the exposure of sensitive keys. It adds overhead but you gain additional security (if a key is compromised only a limited number of your cards are compromised).
Cheers,
Shane