I have a use-case where i need to sign the hash using digital signature which is present in utimaco hsm. I cannot directly send the cka_label for signing. I have to fetch the serial number of DSC which is stored in HSM using the cka_label in java. Please share some keypoints to achieve this. Thanks.
Related
I try to read the certificates from my PKI smart card with C#.
I read that the certificates are copied from the smart card into the certificate store on my computer when I insert my smart card into the card reader.
But when I check the number of the certificates in the different areas (My, AuthRoot, Root, ...) of my certificate store I get the same number, it does
not matter if the smart card is inserted or not.
Here is how I check the number of certificates on my store:
var myStore = new X509Store(StoreName.AuthRoot, StoreLocation.CurrentUser);
myStore.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
var count = myStore.Certificates.Count;
So how can I access the cerfificate on my smart card to verify the private key?
Thanks and kind regards
Friedhelm Drecktrah
This depends on the card type. On a native card (one having a file system), each certificate is simply stored in a file and can be read using standard commands, most likely READ BINARY. To find out the file ID(s) you typically have to look into support information, like PKCS-11 or PKCS-15/ISO 7816-15 directory files your card provides. In case of several certificates you have to resolve for the purpose (typically also in the file).
In my app i need to implement digital signature of some text, extracted from DB data (customer bill, for example), to send a text by e-mail together with it's signature in PKCS#7 format. Both because of high load and data volumes, and a fact that an e-mail app is provided by external developers, it's highly desired to include a text signature in SQL Server resultset, which returns all the data (e-mail attachments) to e-mail app.
The problem is that SQL Server uses x509 v.3 certificate format. It is not a problem while importing certificate and a key - I can convert it to x509 v.3 using OpenSSL before import, it's a one-time deal. But is there a way to convert a SQL Server signature to PKCS#7 format inside SQL Server, or do I have to implement a signing process outside of it?
The RSA algorithm is used for encryption (plain text to cipher text) and decryption (cipher text to plain text) of data. What is the need for using public keys in these sites; why is data encrypted as everything is viewed by everyone?
Why do we need to use public key cryptography in Google; how does it provide security?
What is the need for using public keys in these sites?
It is required to set up a shared secret (a big random number) that is used for further symmetric crypto. Public-private key crypto allows one to share a secret message (symmetric key material) even when each and every message is monitored and eavesdropped. See Hot does SSL works? for more info.
The problem with public-private key crypto is that it is dead slow, whereas symmetric crypto is dead fast. The benefit is that public-private key crypto uses two keys for encryption and decryption and this is what allows to securely share a secret through the insecure channel, whereas symmetric crypto uses a shared key for both operations and you need both parties to have the same shared key.
Why is data is encrypted as everything is viewed by everyone?
When data is encrypted all that an observer can see is pure random noise. An observer cannot understand anything from the encrypted communication. Unless storing encrypted communication, like NSA does, and later asking Google and other companies for their private key. In this way they can decrypt old communication.
Why do we need to use public key cryptography in Google; how does it provide security?
Many agencies would like to know what people search for: "how to make a bomb", political disputes, etc. Advertisers would like to know what people interested in so that they can bring relevant ads. If something is provided to you for free, you are the product. You sell your information (your interests) and when this is done on a global scale suddenly huge money become involved.
Public-private key crypto in this sense provides privacy. Only you and the server can understand the traffic, but no one else: no intermediate hubs, your ISP or government body.
Before Facebook switched to SSL-by-default, all traffic was indeed plain text. This made it possible to build a graph of connections on a truly global scale. The rational I guess was to possibly aid anti-terrorist forces to catch the bad guys. From the other side all population's activities were tracked. See PRISM for more info.
I need to write a code to check the validity of the digital certificate present in an etoken.
I am not familiar with etokens. Can anyone please answer my following questions,
How to access the digital certificate content from etoken?
Can we access the private key stored in etoken?
When we plug the etoken to an computer then does it copy the digital certificate on the computer or not? If yes then where does it copy it?
I need to write C++ program for the same. Can we use Cryptographic API's (like CrypImportKey() CryptExportKey() ) provided by Microsoft for the above requirement?
"etoken" was the name of one of first USB cryptotokens produced by Aladdin. What you are asking for is usually referred to as security token. This is a hardware device with it's own memory, in which certificates and private keys are stored.
Tokens need drivers to be installed in order to work properly. The driver set includes implementation of CSP (Cryptographic Service Provider) for CryptoAPI. CSP does the job of presenting certificates, stored in the token, to CryptoAPI. To answer your questions:
Via CryptoAPI or PKCS#11 interface (drivers for both are supplied by the vendor).
You can perform certain operations with the private key by calling the appropriate API. But the key itself is not extractable.
I can't say for sure but for me it looks like certificates are copied to in-memory certificate store for speed of operations.
In relation to your second question, I believe it is possible to access the private key on the security token. The security token had to be pre-programmed and loaded with a private key somehow. Also, the last time we renewed our certificate, we did it online, using the issuer's web interface which installed an ActiveX module that uploaded the new certificate to the device. I don't know if this procedure also uploaded a new key but possibly not, since I don't believe you need to change your private key to create a new public certificate for yourself (which needs to be signed by the issuer to be trusted I believe).
Sorry I might not make much sense as I am new to the whole idea of Public Key Infrastructure.
If someone else could validate/invalidate my claims, please share your knowledge.
EDIT: I found this hardware hack for Alladin devices: http://seclists.org/bugtraq/2000/May/48
Basically, it is possible to read the date on the eToken but it requires a direct hardware interface to the device's on-board memory.
I need to digitally sign a data packet of size 50 MB in a distributed environment. Signing takes place at the central server and the clients will be sending the data packets to the central server. I wanted to avoid the bottlenecks in the network by sending huge packets of data.
My question is
Can i generate the Hash at the client end and just send the hash to the central server for signing?
Is there any security flaws in this approach?
Thanks
You can sign the hash received from the client, yet there's a security problem here -- you need to find a way to ensure that the hash is derived from the data that is authorized to be hashed. Imagine the situation where your server uses corporate certificate to sign executables that your dev.team compiles. Now a hacker creates a troyan and finds a way to send signing request (by passing only the hash) to your server. And he gets a troyan, signed using your company certificate. This is less real for external attacks, but not for internal ones.
Blindly signing a hash seems like a risky proposal. There are a few questions that seem pertinent in this situation:
Are the clients "trusted"?
Is the communications channel trusted?
Does the server perform any verification of the data that it receives and signs?
The last one may be the most critical. If the server does not verify the data and just blindly signs it, then it probably is not really any different than blindly signing a hash. Either process allows anyone to get any piece of data signed.