Forgive my Naivety on the topic, I was only recently (this month) pushed into the application & data security rabbit hole and am still learning.
I have a smart card issued by my organization, it allows me, as a representative of the org to sign emails, documents, authenticate myself, and encrypt/decrypt data. Said card is used to prove that the document, file, or email I created can be trusted. The card doesn't appear to explicitly disallow cert signing.
My impression though, is it's bad practice, or even dangerous to create and sign a certificate using one's smart card as proof of authenticity. (Delegated responsibility)
Why would a self-signed code signing certificate, or certificate keystore be any less trustworthy within the local environment than a signed excel document or pdf that's stuffed to the brim with macros?
In both instances aren't I declaring that said creation (Document, Email, Library, Application):
- Can be trusted to have originated from my/my teams own hand(s).
- That I have the authority to distribute said product.
- That I am who I say I am as I used my issued smart card and pin to sign said creation.
Addl. Info
I think, what I want to do is create a non-exportable certificate that can be installed onto several designated computer systems. The certificate will be used to store an AES encryption/decryption Key as well as a different MAC/HMAC generation key and be signed by me using my smart card to add a layer of authenticity. (I may be way off the mark here though.)
I've been experimenting with generating the self signed cert using the below PowerShell, but I'd like to actually sign the certificate as Issued By 'Me', and not just generate a random untrusted certificate.
#Code Signing Certificate
$certParms = @{
Type = "Custom"
CertStoreLocation = "Cert:\LocalMachine\My"
Subject = "CN=My Dept., OU=My Org. Unit, O=My Org., L=My Site, S=My State, C=My Country"
FriendlyName = "My App. Keystore"
NotAfter = (Get-Date).AddYears(2)
KeyExportPolicy = "NonExportable"
KeyDescription = "A self-signed keystore certificate for application testing."
KeyAlgorithm = "RSA"
KeyLength = 2048
HashAlgorithm = "SHA256"
Provider = "Microsoft Enhanced RSA and AES Cryptographic Provider"
KeySpec = "None"
KeyUsageProperty = "All"
KeyUsage = @("DataEncipherment", "KeyEncipherment")
TextExtension = @("2.5.29.37={text}1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2,")
#Signer = "My Card Signing Cert?"
#SignerPin = ######
#SignerReader = "Dell Smart Card Reader Keyboard 0"
}
$cert = New-SelfSignedCertificate @certParms
$cert | Format-List -Property *
}
That said, I'm likely way off the mark here on what my approach should be. But figured the best way to learn is by performing a few dozen(20-30) compartmentalized implementation experiments on an isolated dev station as I learn.
This question ties into a higher-level application data security process question I posted to the software engineering stack exchange. As I'm primarily seeking to validate my understanding of all I've read so far, I'd love any constructive guidance the InfoSec crowd has to offer on that question too. (If cross-linking questions isn't allowed, let me know and I'll remove this last paragraph!)
