  Although smartcards are widely used, secure smartcard interoperability has
remained a significant challenge. Usually each manufacturer provides a closed
environment for their smartcard based applications including the microchip,
associated firmware and application software. While the security of this
"package" can be tested and certified for example based on the Common Criteria,
the secure and convenient interoperability with other smartcards and smartcard
applications is not guaranteed. Ideally one would have a middleware that can
support various smartcards and smartcard applications. In our ongoing research
we study this scenario with the goal to develop a way to certify secure
smartcard interoperability in such an environment. Here we discuss and
experimentally demonstrate one critical security problem: if several smartcards
are connected via a middleware it is possible that a smartcard of type S
receives commands that were supposed to be executed on a different smartcard of
type S'. Such "external commands" can interleave with the commands that were
supposed to be executed on S. Here we demonstrate this problem experimentally
with a Common Criteria certified digital signature process on two commercially
available smartcards. Importantly, in some of these cases the digital signature
processes terminate without generating an error message or warning to the user.
