0

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy?

For example suppose I have a government issued ID that stores a set of keys for encryption and another set for non-repudiation. I then store an additional 3rd party key on it.

  • When I authenticate (or encrypt) government data, (versus 3rd party data) how can I "choose" the certificate being used?

  • Is certificate selection a feature of the OS, smart card driver, or smart card itself?

When choosing certificates on the card itself, I envision a button I can press like this one here:

enter image description here

The reason I ask this question is so I can understand not only normal smart card usage, but also instances where several UProve tokens are issued to a similar card (the interactions are likely going to be the same)

Improve this question

1 Answer 1

Reset to default
1

Theoretically, on a Windows system, the Certificate Propagation Service automatically extracts all the certificates from any smart card which is inserted, and copies them into the "My" store of the current user. Each such certificate is registered with a link back to the corresponding private key, which is in the smart card. When the smart card is to be used, the application actually looks for a matching certificate, potentially prompting the user for the choice of certificate; once the certificate is selected, the application then tries to reach the private key, at which point (and only at that point) the smart card driver is invoked (internally, the application talks to the "Microsoft Base Smart Card CSP" which itself talks to the card-specific "minidriver").

The main idea is that applications don't see "smart cards"; they use private keys which they locate by their certificate. Whether a given private key is in a smart card or not, or whether two keys are from the same smart card, is kept in the OS internals. Application can fiddle directly with smart cards (using winscard.dll), but most do not (e.g. Internet Explorer, when dealing with a SSL server which requests client certificates, only looks at certificates and does not care about smartcardness).

Things vary on other operating systems, or with some applications. Firefox, for instance, uses only PKCS#11, a generic API for "cryptographic devices", and completely disregards the OS support when it is run on Windows. Then, what happens entirely depends on how Firefox decides to manage smart cards. The main principle is still active, though: user choices are centred on certificates.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .