Using performance results for many cards, we calculated how much individual pairs of cards differ in the performance of selected important operations (so-called TOP FUNCTIONS).
Each cell in the table represents the (di-) similarity of two cards. A value close to 100% means that these two cards are very similar, whereas going to 0% mean significant dissimilarity. When a cursor is placed above value, tooltip showing difference in supported algorithms of exact two cards appears.
From the practical experience, we can say that pair of cards with similarity value over 95% means either the identical card type or both being members of the same product family with same underlying hardware and very similar implementation of JavaCard Virtual Machine. The similarity in the range of 85% - 95% usually signals the same family of cards yet with detectable differences (possibly different co-processor for some of the supported algorithms). The global average is about 70%, with similarity below 50% encountered for cards from completely different manufacturers.
In contrast to ordinary computers, smart cards are on one side more deterministic (usually, no processes running in parallel) yet more specialized on the hardware level. There is not "just" single general purpose CPU running compiled cryptographic algorithm, but a set of specialized circuits dedicated to the acceleration of particular cryptographic algorithm (DES, AES, RSA, ECC co-processor), all optimized for the maximum speed and minimum die space. Performance measurements of cryptographic algorithms can be therefore used as a card's fingerprint which cannot be easily manipulated on the higher software level. For example, one cannot re-implement faster RSA on the card's main CPU to mimic the speed of another card. The fastest achievable modular multiplication, on that particular card, is given by the performance of card's co-processor circuit and cannot be improved by the main CPU.