5

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option as shown in the picture below, but when I request for a certificate under this template the mmc crashes.

So this is what I'm wondering about:

  1. Is this happening because key archival is not allowed in the smart card and CSP I'm using?

  2. Are there any smart cards and CSPs that allow key archival?

Screenshot: Creating a SmartCard template with key archival:

enter image description here

Screenshot: Here is the error in the event viewer when the MMC crashes: enter image description here

Update: Sometimes the mmc did not crash and certificate request failed due to this issue: "Invalid type specified"

Screenshot: Error in the certificate request

enter image description here

Improve this question

1 Answer 1

Reset to default
2

The client-side CSP (the Smart Card CSP in this case) must support key archival for key archival to function:

CSP support for key archival operations In order to securely transmit and archive private keys, CSPs on CAs and domain member computers must support symmetric and asymmetric encryption. Additionally, support is required for generating exportable keys, either by manually submitting a certificate request and selecting the option to allow the key to be exported or by using the CRYPT_ARCHIVABLE flag with the CryptGenKey function during programmatic key generation.

Source: Troubleshooting Key Archival and Recovery

The idea of smart cards (vs software private key storage) is that the private key never leaves the card. However, according to the authoritative Brian Komar, Smart Card CSPs can support the CRYPT_ARCHIVABLE flag:

If a smart card fails, the encryption private keys stored on the smart card are lost. If the smart card cryptographic service provider (CSP) supports key archival (through the enabling of the CRYPT_ARCHIVABLE flag), the private key is archived at the issuing CA.

Source: Windows Server 2008 PKI and Certificate Security book

That said, I would strongly recommend not exporting the smart card private key in the first place as this undermines the security provided by a solution that uses smart cards.

I don't know what your requirements are, but there are broadly speaking two functions for certificates: signature and encryption.

If you are using your smart card certificate for the encryption of data, you might be better off archiving or backing up the symmetric encryption key used to encrypt the data instead. This could be achieved through the use of a 'Data Recovery' certificate also stored on a smart card, which is used to encrypt backup copies of the symmetric encryption key. The legacy Microsoft Encrypting File System is a well-documented example of a system that operates in this way.

If you are using your smart card certificate for the signature (client authentication, digital signatures etc), I would again recommend avoiding key archival completely:

Private keys that are used for signing should never be archived or recovered because the potential for more than one person to possess and use a private key introduces non-repudiation issues.

Source: Active Directory Certificate Services PKI Key Archival and Management

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .