We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result with 3DES. The problem is primary the key storage and management.

The keys will be provided by government agency using an SmartCard (Cryptoflex) or by sending a file encrypted with our certificate.

The question is, can be construct such system using exclusively software modules, not HSM or similar, being such system FIPS 140-2 Level 2 compliant?

The idea is to load the keys into Windows CNG using Windows software KSP (Windows Server 2008 R2) and then, requesting CNG performing the cryptographic operations over the data to be signed.

Alternatively the system could be CC-1 low level or EAL 5 compliant.

Microsoft CNG is FIPS 140-2 Level 1 and seems there are plans to be Level 2 compliant. Also is stated that can be used to construct a system Level 2 compliant. Our question is about avoiding HSM or any HW solution to store the keys and/or performing cryptographic operations. Key loading using an Smart Card reader is ok due to is a cheap device (<100$?).

Any other software library can be used, in conjunction with Microsoft CNG or a complete replacement like some implementations of PKCS#11. Library must be .Net, preferably .Net 4. The last and final/harder question is, we are thinking executing this software in Microsoft IIS as a web application (intranet only), interacting with local database and local filesystem, this is a problem and should be designed as an standalone Windows application?

Any advice is appreciated.