Private Key Component - Revision history

Tom: /* Solutions */

2024-11-05T16:57:46Z

‎Solutions

2024-11-05T16:54:46Z

‎Problems

2021-11-19T01:33:10Z

‎References

2020-08-04T22:02:35Z

‎Cryptography Next Generation (CNG)

2020-08-04T18:41:04Z

‎Windows Specific Technology

2020-08-04T18:40:26Z

‎Windows Specific Technology

2020-08-04T18:36:50Z

‎Cryptography Next Generation (CNG)

2020-08-04T18:36:18Z

‎Cryptography Next Generation (CNG)

2020-08-04T18:34:49Z

‎Cryptography Next Generation (CNG)

2020-08-04T05:37:47Z

‎Cryptography Next Generation (CNG)

@@ Line 19: / Line 19: @@
 * NIST SP 800-63-3B established authentication assurance level (AAL) the reports the protection level of the user's private key components.
 * Note that web URLs are case-insensitive which means that string comparisons to find keys or certificates must also be case insensitive.
 ===Windows Specific Technology===

@@ Line 14: / Line 14: @@
 *Governments have been the primary customers for keeping secrets and, so, the primary customers for cryptography.
 *The challenge with providing good secrecy became a challenge to (1) find a good cryptography algorithm and (2) getting the cryptographic key security into the hands of those who need it.
 ==Solutions==

@@ Line 75: / Line 75: @@
 [[Category:Glossary]]
 [[Category:Security]]
-[[Category:Cryptography]]
+[[Category: Cryptography]]

@@ Line 33: / Line 33: @@
 dir cert:\localmachine\my
 certutil.exe -store my
-dir C:\ProgramData\Microsoft\Keys
+dir C:\ProgramData\Microsoft\Crypto\Keys
 </pre>
 * use the value in the localmachine directory to select the thumbprint of the certificate that is needed.

@@ Line 21: / Line 21: @@
 ===Windows Specific Technology===
 Windows has two cryptography technologies that use quite different technologies to protect [[Private Key Component]]s.
 There is a potential issue with case as it is not significant in URLs but is significant in file names and other places.
 * [https://docs.microsoft.com/en-us/dotnet/api/system.string.contains?redirectedfrom=MSDN&view=netcore-3.1#System_String_Contains_System_String_ case insensitive compares]
@@ Line 29: / Line 28: @@
 ====Cryptography Next Generation (CNG)====
 This is new technology that created the abstraction know a a Key Storage Provider (KSP) to differentiate the function of protecting the [[Private Key Component]] from the function of storing credentials that could be renew every year while the KSP was unaffected. Now the permissions for each key storage file can be independently set.
 * [https://www.sysadmins.lv/blog-en/retrieve-cng-key-container-name-and-unique-name.aspx Retrieve CNG key container name and unique name]
 <pre>

@@ Line 34: / Line 34: @@
 * use the value in the localmachine directory to select the thumbprint of the certificate that is needed.
 * Use that thumbprint to find the unique container name from the certutil output
-* Ensure that thumbprint exists as a file name in the folder C:\ProgramData\Microsoft\Keys
+* Ensure that container name exists as a file name in the folder C:\ProgramData\Microsoft\Keys
 * [https://stackoverflow.com/questions/40046916/how-to-grant-permission-to-user-on-certificate-private-key-using-powershell/40046917#40046917 The site with the script for setting the permissions on a KSP file.]  Call with the name of the account to get permission to use and a variable containing the certificate. The KSP may, or may not, allow export of the key itself. For the best security it should not be allowed. If you know that the key is present you be remove the part after the "else".
 <pre>