Features
Wallet private key is the main secret of the card. It will be generated by the card on the factory or by the user using the Create wallet method. It is never revealed and accessible by the host application via the NFC interface. COS will internally use a wallet private key only during execution of Sign and some attestation commands.
Blockchain reference
A public key is used to compute a unique address in the blockchain. A private key is used to sign transactions originating from this address. So only the owner of the private key can initiate the transfer of funds from this address. In other words, whoever owns the private key owns the crypto funds. In our case, who owns the card — owns the crypto funds.
Tangem Card is equipped with a True Random Number Generator that's used for generating private keys. This approach makes it impossible to generate the same key, as well as the ability to predict the result of the operation.
Cards can carry up to 40 wallets.
Supported elliptic curves and signing algorithms:
Curve | Signing Algorithm |
secp256r1 |
COS provides a special mechanism to protect against proximity attacks on a card without Access code or Passcode. For that, COS can enforce a “security delay” up to 45 seconds long between reception and execution of a command. During the delay, the card must be kept within the NFC field of the terminal and the NFC session shall remain active until the delay countdown is finished on the card. Security delay duration depends on cards settings and configues at the factory.
If the access code is set on the card, all commands, including Scan Card, will be required to sumbit this code. So if the Access code is lost, there is no way to recover the data or even retrieve the public key. Access codes may be enabled or disabled during card configuration at the factory. Also, it’s possible to prohibit removing the access code from the card once it’s set.
Passcode protects signing and operations that can alter security parameters, including Create Wallet and Purge wallet. Passcode may be enabled or disabled during card configuration at the factory. Also, it’s possible to prohibit removing the passcode from the card once it’s set.
This feature allows users to link one device to a specific card which helps speed up the security verification process. In order to do it, the user has to perform the first signing operation and wait security delay. After this all the next operations with the same app will skip security delay and will be performed instantly.
COS supports three options of communication:
1. Plain data packets with non-encrypted Payload:
This option is not recommended for large-scale commercial projects, because it potentially exposes the card to eavesdropping and replay attacks.
2. Fast symmetric encryption with mutual challenges.
Fast encryption is optimal for most use cases.
3. Strong encryption with ECDH shared secret (elliptic curve Diffie-Hellman):
Communication is encrypted by AES256 and fully protected against eavesdropping, man-in-the-middle and replay attacks. The downside is 2x lower performance and longer card’s reaction time.
Every Tangem card supports strong encryption mode. Issuer can opt to enable fast encryption and non-encrypted mode during personalization. App can choose a desirable encryption mode among those supported by the card. If the card does not support chosen encryption mode, it will respond with error.
The NFC Data Exchange Format (NDEF) is a standardised data format that can be used to exchange information between any compatible NFC device and the card. The data format consists of NDEF Messages and NDEF Records.
Tangem Card can be configured to open/install the right app or web-site when you tap it to an unlocked phone.
Last modified 1yr ago