Problem with CryptSignMessage

From: Ron Currier (rcurrier_at_pobox.com)
Date: 04/28/04


Date: 28 Apr 2004 12:40:59 -0700

I'm writing a GINA extension (based on PropCert) to read a cert from a
smartcard and use it to sign a message. The code works fine when built
as a console app and run from a command prompt, but fails with "Cannot
find the certificate and private key for decryption" when run as part
of the GINA DLL. The certificate is retrieved correctly but the
CryptSignMessage call fails. Based on other postings related to this
error, I'm guessing its a permissions problem. But since this is not a
.NET or ASP program and the certificate is always coming from the
smartcard (not a user store), the other postings give no clue as to
how I can fix the permissions. The problem occurs on both w2k and XP.
Any clues would be appreciated.

   - Ron



Relevant Pages

  • Re: Problem with CryptSignMessage use in GINA DLL
    ... Except that smartcard based certificates are not associated with a user (at ... certs on smartcards is to eliminate the password). ... The certificate is read from the smartcard correctly ... >> postings give no clue as to a solution. ...
    (microsoft.public.platformsdk.security)
  • RE: Relative Security Provided by Cached Domain Credentials?
    ... So when a user logs on the w2k terminal using a smartcard + pin no (rather ... If it does then EFS ... profile currently logged on for the private certificate. ...
    (Focus-Microsoft)
  • Re: SmartCards
    ... Smartcards can contain many authentication id's. ... client certificates can be stored on the smartcard. ... The user must provide the PKI ... certificate. ...
    (Security-Basics)
  • Re: Setting up AD (W2K3) for SmartCard Authentication
    ... The SmartCards can log into on AD Forest, ... Looked that the article on 3rd party CA's, ... Does the certificate contain the user's UPN in the subject alternative name ... Does the DomainController's certificate contain the SmartCard Logon ...
    (microsoft.public.security)
  • Re: Key archival and smartcard CSP
    ... the first question is that does your smartcard ... CSP allow the public/private key pair to be imported into its own store? ... > - When the certificate has been issued, i get the container name and the ...
    (microsoft.public.platformsdk.security)