Re: 3rd pary software interferes with the cryptographic services

From: Todor Todorov (cdm_at_community.nospam)
Date: 06/05/05

  • Next message: Dan: "Re: Enumerating current login windows from LocalSystem" 
    Date: Sun, 5 Jun 2005 03:15:56 +0200

    Hi Rhett and thanks for the answer.

    I've done some tracing and here is what my app does to find the private
    key's container (in simplified pseudocode).

    hStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0,
    CERT_SYSTEM_STORE_CURRENT_USER, "My");
    pCertCtx = CertFindCertificateInStore(hStore, PKCS_7_ASN_ENCODING |
    X509_ASN_ENCODING, 0, CERT_FIND_KEY_IDENTIFIER, blob, 0);
    result = CryptAcquireCertificatePrivateKey(pCertCtx, 0, 0, out hCrytProv,
    out keySpec, out freeProv);
    CRYPT_KEY_PROV_INFO cpvi = .....
    result = CertGetCertificateContextProperty(pCertCtx,
    CERT_KEY_PROV_INFO_PROP_ID, cpvi, len)

    This is the C# code (the certificate and it's private key container name
    have beed found):

    CspParameters params = new CspParameters();
    params.KeyContainerName = cpvi.pwszContainerName;
    params.ProviderName = null;
    params.ProviderType = cpvi.dwProvType;
    params.KeyNumber = cpvi.dwKeySpec;
    RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(params);
    byte[] decrypted = rsa.Decrypt(encrypted, false); // FAILS HERE !!!

    I've noticed that the KeyContainerName is different on both machines, which
    is as expected. But the ProvName returned by
    CertGetCertificateContextProperty is also different! On the machine where
    things work, it returns "Microsoft Strong Cryptographic Provider", and on
    the machine where things fail, it returns "CRYPTOMATHiC RSA Full Provider
    1.2". This confirms what the developers at TDC (the certificate issuer)
    wrote to me. Here's a rought translation:

    "As default the digital signature is installed in MS CAPI in a special CSP
    which we've developed. This is to ensure that a reasonable password is
    required for the (private) key.

    We have no knowledge of apps that use CAPI and can't use our digital
    signature (and the CSP). The issue here is that we can't give access to the
    private key without asking the end-user to enter his/her password" ....

    -----------------

    So, if I am correct, the RSA.Decrypt() method does not like the Cryptomatic
    CSP. Can you tell me what the Decrypt method does and what I can do to trace
    and get more info about the issue? BTW, the password dialog box is never
    shown! Any ideas for work arounds? Is this a problem in the .NET framework,
    the CAPI or the CSP or a combination?

    Thanks!

    -- Todor Todorov

    "Rhett Gong [MSFT]" <v-raygon@online.microsoft.com> wrote in message
    news:u8ApO3AaFHA.3896@TK2MSFTNGXA01.phx.gbl...
    > Hello Todor,
    > "Bad Data" exception will be thrown if either the binary data passed in to
    > RSA.Decrypt() method is wrong or the imported RSA private key does not
    > match with the RSA public key that is used for encryption.
    >
    > I noticed you are prompted whenever you used the cert, do you ever recieve
    > any dialog to input password when your code runs? if you did not get any
    > dialog and get this error, that may be because you failed to pass their
    > auth and it fails silently. you may try your code to export private keys
    > of
    > these 2 test machines and see if they are identical.
    >
    > Thanks,
    > Rhett Gong [MSFT]
    > Microsoft Online Partner Support
    > Get Secure! - www.microsoft.com/security
    > http://support.microsoft.com/default.aspx?scid=/servicedesks/msdn/nospam.asp
    > &SD=msdn
    >
    > This posting is provided "AS IS" with no warranties and confers no rights.
    >

  • Next message: Dan: "Re: Enumerating current login windows from LocalSystem"

    Relevant Pages

    • Re: Moving Private keys among CSPs
      ... you doing this on and which is the CSP you are trying to import into? ... work in any CSP (as long as it's a match i.e. RSA Signature/KeyExchange). ... Is the same true of the private keys? ... > Am I better off just generating a new Private key using CryptoAPI (I ...
      (microsoft.public.platformsdk.security)
    • Re: Client certificate private key prompt
      ... Okej, so upgrading to IIS6 will make the problem a bit smaller, but not ... We saw the difference in TCP behaviour between IIS5 and IIS6 using Ethereal ... > the private key. ... IE also cashes a lot of client info in the process like the private ...
      (microsoft.public.dotnet.framework)
    • Re: Private key access security
      ... Is there other ways to provide better protection of private key? ... >> I have a client program which contacts my Web Service through SSL. ...
      (microsoft.public.security)
    • Re: Private key access security
      ... Is there other ways to provide better protection of private key? ... >> I have a client program which contacts my Web Service through SSL. ...
      (microsoft.public.dotnet.security)
    • Re: Private key access security
      ... Is there other ways to provide better protection of private key? ... >> I have a client program which contacts my Web Service through SSL. ...
      (microsoft.public.windowsxp.security_admin)
    • Quantcast