Collaborate Disseminate
I’m a bit confused with PKCS11 (v3) standard…
In particular, it’s blurry to me if one can invoke C_DeriveKey, passing, say, CKM_SHA512_KEY_DERIVATION (or some HKDF) to it as the mechanism and also set the following in the template:
CKA_… Continue reading Deriving EC keypairs pairs via PKCS11?
How are the above devices built and what is the mechanism that seals them off from giving out private keys? Are the sign/decrypt operations somehow soddered into their hardware, is it a tiny piece of software which only API is to perform t… Continue reading What mechanism stops smartcards and YubiKeys from exporting private keys?
I am trying to write a small explanation for a customer, who wants to understand why his Mifare Desfire transponders are safe from being cloned.
I was trying to search for an easy scheme or text that explains how the authetication process … Continue reading Mifare Desfire authentication process / cloning protection
I’m having the same issue of this fellow user.
I have a certificate stored in the Windows user personal store and in a YubiKey. When I plug the YubiKey, the Certificate Propagation Service discovers the certificates in the PIV applet and a… Continue reading Windows Certificate Propagation Service configuration
Trying to use my smartcards, suddenly the certificates do not propagate. I try starting and restarting the Certificate Propagation Service, but it immediately stops.
An event is created in the Event Viewer "Application Error":
F… Continue reading Certificate Propagation Service CertPropSvc immediately stops
Forgive my Naivety on the topic, I was only recently (this month) pushed into the application & data security rabbit hole and am still learning.
I have a smart card issued by my organization, it allows me, as a representative of the or… Continue reading Self signing keystore certificates using smart card
Is there a way I can use a PGP certificate to login on my computer, but without a smartcard? I have multiple self made certificates for document encryption and also a state issued one for legal signing (and gov website login)
I’ve been loo… Continue reading Login with self-signed PGP/GPG cert. without security key
I seen you can associate a smart card when you encrypt the drive with bitlocker, but I am not sure if …
You can unlock with a smart card as an alternative to your password that you set (not the recovery key);
Or it is the smart card an … Continue reading Can you require both a password and a smart card to unlock a bitlocker drive?
I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and separate them from those that do not in … Continue reading Determine if the client certificate comes from a smarcard in mTLS
I have been searching for a way to use challenge-response over PKCS11, is that possible? I have found that it is possible for Windows Minidriver, but all the PKCS11 challenge-response protocols are custom and vendor defined.
How can someon… Continue reading How to implement challenge-response authentication using PKCS11