{"id":"https://openalex.org/W3143179398","doi":"https://doi.org/10.46586/tches.v2021.i3.176-201","title":"Security and Trust in Open Source Security Tokens","display_name":"Security and Trust in Open Source Security Tokens","publication_year":2021,"publication_date":"2021-07-09","ids":{"openalex":"https://openalex.org/W3143179398","doi":"https://doi.org/10.46586/tches.v2021.i3.176-201","mag":"3143179398"},"language":"en","primary_location":{"id":"doi:10.46586/tches.v2021.i3.176-201","is_oa":true,"landing_page_url":"https://doi.org/10.46586/tches.v2021.i3.176-201","pdf_url":"https://tches.iacr.org/index.php/TCHES/article/download/8972/8550","source":{"id":"https://openalex.org/S4210207404","display_name":"IACR Transactions on Cryptographic Hardware and Embedded Systems","issn_l":"2569-2925","issn":["2569-2925"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IACR Transactions on Cryptographic Hardware and Embedded Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://tches.iacr.org/index.php/TCHES/article/download/8972/8550","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5027484310","display_name":"Marc Schink","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136922","display_name":"Fraunhofer Institute for Applied and Integrated Security","ror":"https://ror.org/03w0bbr97","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210136922","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Marc Schink","raw_affiliation_strings":["Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany","institution_ids":["https://openalex.org/I4210136922"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053056145","display_name":"Alexander Wagner","orcid":"https://orcid.org/0000-0003-2853-3063"},"institutions":[{"id":"https://openalex.org/I4210136922","display_name":"Fraunhofer Institute for Applied and Integrated Security","ror":"https://ror.org/03w0bbr97","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210136922","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Alexander Wagner","raw_affiliation_strings":["Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany","institution_ids":["https://openalex.org/I4210136922"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023787283","display_name":"Florian Unterstein","orcid":"https://orcid.org/0000-0002-8384-2021"},"institutions":[{"id":"https://openalex.org/I4210136922","display_name":"Fraunhofer Institute for Applied and Integrated Security","ror":"https://ror.org/03w0bbr97","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210136922","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Florian Unterstein","raw_affiliation_strings":["Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany","institution_ids":["https://openalex.org/I4210136922"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5107225611","display_name":"Johann Heyszl","orcid":"https://orcid.org/0000-0002-8425-3114"},"institutions":[{"id":"https://openalex.org/I4210136922","display_name":"Fraunhofer Institute for Applied and Integrated Security","ror":"https://ror.org/03w0bbr97","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210136922","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Johann Heyszl","raw_affiliation_strings":["Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fraunhofer Institute for Applied and Integrated Security (AISEC), Germany","institution_ids":["https://openalex.org/I4210136922"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210136922"],"apc_list":null,"apc_paid":null,"fwci":1.1977,"has_fulltext":true,"cited_by_count":13,"citation_normalized_percentile":{"value":0.77910614,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"176","last_page":"201"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.8403093814849854},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7267016172409058},{"id":"https://openalex.org/keywords/password","display_name":"Password","score":0.6241453886032104},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.6012327671051025},{"id":"https://openalex.org/keywords/security-through-obscurity","display_name":"Security through obscurity","score":0.5799604058265686},{"id":"https://openalex.org/keywords/trustworthiness","display_name":"Trustworthiness","score":0.5728450417518616},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.5328757166862488},{"id":"https://openalex.org/keywords/security-testing","display_name":"Security testing","score":0.4590429663658142},{"id":"https://openalex.org/keywords/physical-security","display_name":"Physical security","score":0.4485069513320923},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.43695566058158875},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.3813683092594147},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.3541697561740875},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.29183000326156616},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.08328956365585327}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.8403093814849854},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7267016172409058},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.6241453886032104},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.6012327671051025},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.5799604058265686},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.5728450417518616},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.5328757166862488},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.4590429663658142},{"id":"https://openalex.org/C2776157020","wikidata":"https://www.wikidata.org/wiki/Q851598","display_name":"Physical security","level":2,"score":0.4485069513320923},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.43695566058158875},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.3813683092594147},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.3541697561740875},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.29183000326156616},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.08328956365585327},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.46586/tches.v2021.i3.176-201","is_oa":true,"landing_page_url":"https://doi.org/10.46586/tches.v2021.i3.176-201","pdf_url":"https://tches.iacr.org/index.php/TCHES/article/download/8972/8550","source":{"id":"https://openalex.org/S4210207404","display_name":"IACR Transactions on Cryptographic Hardware and Embedded Systems","issn_l":"2569-2925","issn":["2569-2925"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IACR Transactions on Cryptographic Hardware and Embedded Systems","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:d7c428c7cb84494892f996a4a238be33","is_oa":true,"landing_page_url":"https://doaj.org/article/d7c428c7cb84494892f996a4a238be33","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Transactions on Cryptographic Hardware and Embedded Systems, Vol 2021, Iss 3 (2021)","raw_type":"article"},{"id":"pmh:oai:fraunhofer.de:N-647386","is_oa":true,"landing_page_url":"http://publica.fraunhofer.de/documents/N-647386.html","pdf_url":null,"source":{"id":"https://openalex.org/S4306400801","display_name":"Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Fraunhofer AISEC","raw_type":"Journal Article"},{"id":"pmh:oai:null:publica/416192","is_oa":false,"landing_page_url":"https://publica.fraunhofer.de/handle/publica/416192","pdf_url":null,"source":{"id":"https://openalex.org/S4306400318","display_name":"Fraunhofer-Publica (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"journal article"}],"best_oa_location":{"id":"doi:10.46586/tches.v2021.i3.176-201","is_oa":true,"landing_page_url":"https://doi.org/10.46586/tches.v2021.i3.176-201","pdf_url":"https://tches.iacr.org/index.php/TCHES/article/download/8972/8550","source":{"id":"https://openalex.org/S4210207404","display_name":"IACR Transactions on Cryptographic Hardware and Embedded Systems","issn_l":"2569-2925","issn":["2569-2925"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IACR Transactions on Cryptographic Hardware and Embedded Systems","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7099999785423279}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3143179398.pdf","grobid_xml":"https://content.openalex.org/works/W3143179398.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W1461760393","https://openalex.org/W1567573409","https://openalex.org/W2219132820","https://openalex.org/W2474114598","https://openalex.org/W2753041928","https://openalex.org/W2785069933","https://openalex.org/W2896153685","https://openalex.org/W2926259481","https://openalex.org/W2949454685","https://openalex.org/W2951596751","https://openalex.org/W2970909215","https://openalex.org/W2985947210","https://openalex.org/W3047967072","https://openalex.org/W4256477176","https://openalex.org/W4295632672"],"related_works":["https://openalex.org/W2345270111","https://openalex.org/W2165898552","https://openalex.org/W2299494954","https://openalex.org/W2164920192","https://openalex.org/W2008985775","https://openalex.org/W1009702940","https://openalex.org/W2030343105","https://openalex.org/W2055319964","https://openalex.org/W2005134512","https://openalex.org/W2062411488"],"abstract_inverted_index":{"Using":[0],"passwords":[1],"for":[2],"authentication":[3],"has":[4],"been":[5],"proven":[6],"vulnerable":[7],"in":[8,77,113,139],"countless":[9],"security":[10,13,19,23,84,93,186,191],"incidents.":[11],"Hardware":[12],"tokens":[14],"effectively":[15],"prevent":[16],"most":[17],"password-related":[18],"issues":[20],"and":[21,56,85,103,108,152,161,187],"improve":[22,184],"indisputably.":[24],"However,":[25],"we":[26,80,106,168,193],"would":[27],"like":[28],"to":[29,43,171,178],"highlight":[30],"that":[31],"there":[32],"are":[33,121,133,159,169],"new":[34],"threats":[35],"from":[36,97,149],"attackers":[37],"with":[38],"physical":[39],"access":[40],"which":[41,132],"need":[42],"be":[44,73],"discussed.":[45],"Supply":[46],"chain":[47,151],"adversaries":[48],"may":[49,71],"manipulate":[50],"devices":[51,70,96],"on":[52,123],"a":[53,136],"large":[54,137],"scale":[55,138],"install":[57],"backdoors":[58],"before":[59],"they":[60],"even":[61,72],"reach":[62],"end":[63],"users.":[64],"In":[65],"evil":[66,153],"maid":[67,154],"scenarios,":[68],"specific":[69],"attacked":[74],"while":[75],"already":[76],"use.":[78],"Hence,":[79],"thoroughly":[81],"investigate":[82],"the":[83,98,146,157,180,185],"trustworthiness":[86,188],"of":[87,119,128,189],"seven":[88,115],"commercially":[89],"available":[90],"open":[91],"source":[92],"tokens,":[94,192],"including":[95],"two":[99,129],"market":[100],"leaders:":[101],"SoloKeys":[102],"Nitrokey.":[104],"Unfortunately,":[105],"identify":[107],"practically":[109],"verify":[110],"significant":[111,147],"vulnerabilities":[112,127],"all":[114],"examined":[116,181],"tokens.":[117],"Some":[118],"them":[120],"based":[122],"severe,":[124],"previously":[125],"undiscovered,":[126],"major":[130],"microcontrollers":[131],"used":[134],"at":[135],"various":[140],"products.":[141],"Our":[142],"findings":[143],"clearly":[144],"emphasize":[145],"threat":[148],"supply":[150],"scenarios":[155],"since":[156],"attacks":[158],"practical":[160],"only":[162],"require":[163],"moderate":[164],"attacker":[165],"efforts.":[166],"Fortunately,":[167],"able":[170],"describe":[172],"software-based":[173],"countermeasures":[174],"as":[175],"effective":[176],"improvements":[177],"retrofit":[179],"devices.":[182],"To":[183],"future":[190],"also":[194],"derive":[195],"important":[196],"general":[197],"design":[198],"recommendations.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}