Secure E-Commerce with Smart Cards

Your company might still consider smart cards to be a futuristic technology. To help make them a present reality, Windows 2000 (Win2K) will offer highly integrated support for smart cards. In this article, I introduce you to smart cards, show you why they're important, and explain how they work and how to start using them in Win2K. Specifically, I show you how to set up smart-card-based logon using Gemplus' GemSAFE smart card and GCR410 smart card reader. But smart cards aren't perfect, so I also show you some of their inherent risks.

Smart cards enable public key infrastructure (PKI), which in turn facilitates e-commerce. PKI lets you achieve a level of trust for electronic transactions that equals or surpasses that of the paper- and signature-based world. PKI can provide message integrity, privacy, and nonrepudiation. You can't deny you sent a message if you've signed it with your digital certificate because your public key verifies your signature. If a public key successfully verifies a signature, the only person who could have sent the message is the person with the private key. (For more information about PKI and public and private keys, see "Related Articles in Windows NT Magazine," page 87.) The cornerstone of PKI security is that the private key associated with a digital certificate must remain private. An intruder can use a private key to easily forge transactions. . . .