Can I export my digital certificate to this emtec usb

Question

It is said here

http://www.emtec-international.com/sites/default/files/s530_aes_en_0.pdf

• 2048 bit RSA module: ready for PKI application
• SHA256 data hashing: ready for digital signature

Does it mean it is an usb token where I can export my digital certificate that will automatically prompt for pin code ?

Answer 1

Possibly. Or not. The data sheet is quite short and lacks details. Most of it is about AES encryption for data storage, which is orthogonal to usage as a private-key storage token. The two lines you quote are the only indication that the device may act as a smartcard-for-PKI at all. Come to that, there is not enough text on this PDF file to decide whether the most touted encryption system is applied correctly or not (it seems that the encryption occurs in the hardware, which is necessary, but not sufficient for appropriate security). A cursory look at EMTEC's Web site did not yield additional data (however, it did reveal a line of USB drives in the shape of Angry Birds, which is rather fascinating and might perplex a future archeologist a thousand years from now).

There is not a single trace of any kind of conformance to FIPS 140-2 or an EAL level. I would be wont to claim that such standards guarantee any kind security; but they still are widespread standards, and I find the lack of information about conformance to these standards quite discomforting.

Note that if the device is able to act as an asymmetric key store and signature engine (something which Windows would call a Cryptographic Service Provider), with the popup asking for the PIN code at the time of usage(*), then serious, competent setup would require private key generation on the module too. Ideally, the private key should never exist outside of the tamper-resistant hardware. That's one of the things about which FIPS 140-2 is rather insistent. RSA private key generation is heavier than simple signature computation, so some modules can do the latter but not the former.

(*) If the host PC handles the PIN code entry itself, then the security model must assume that the PC is secure and free of keyloggers, an assertion which verges on the preposterous.