2

Does anybody know if it's possible to store private keys, belonging to service account or computer account, on Windows 8 VSC (virtual smart card)?

As far as I understand, requirement for 8-symbols (at least) PIN prevents it. Service process, like IIS, cannot authenticate against VSC with the PIN, and I didn't find how to set empty PIN for the VSC.

Are there any workarounds? It's awful pity to lose the non-exportability feature, which TPM provides, for server-side certificate keys just because of this PIN thing.

Improve this question

1 Answer 1

Reset to default
3

No, you cannot set an empty PIN on a Windows 8 Virtual Smart Card.

At first I said "having a smart card with no PIN defeats the purpose." But that was too flippant of me. I have Bitlocker enabled on my laptop with a TPM, and I don't need to enter a PIN manually every time I boot up to unlock it. But the fact remains that you can't set an empty PIN on a Windows 8 VSC.

The authoritative MSDN spec documentation for VSC is MS-TPMVSC, found here:

http://download.microsoft.com/download/9/5/E/95EF66AF-9026-4BB0-A41D-A4F81802D92C/[MS-TPMVSC].pdf

pbPin: An array of bytes containing the desired PIN for the new VSC. Its length MUST be between 4 and 127 bytes, inclusive.

I don't know really what you are trying to do exactly, but I'm not sure you have anything to gain by pursuing this over just encrypting the volume where the keys are stored with Bitlocker.

Improve this answer
3
  • Thanks, Ryan. but I'm not sure you have anything to gain by pursuing this over just encrypting the volume where the keys are stored with Bitlocker I want to make it impossible, even for admins, to export out certificates used by services. Currently such certs can be retrieved with tools like this (isecpartners.com/tools/application-security/jailbreak.aspx). The only way to achieve that today is to install an HSM (for example - safenet-inc.com/data-encryption/hardware-security-modules-hsms) - and I think it's a pity to have to do it, when you have the TPM onboard.
    – Cat Mucius
    Jun 24, 2014 at 11:52
  • It's a good question, but one of the cardinal rules of computer security is that you can't prevent administrators from being administrators and trying to do so is a fool's errand. If the operating system can perform an action such as extracting a private key from a certificate store, and I am able to emulate the actions of the operating system because I have admin access, then I can do all the same things that the OS can.
    – Ryan Ries
    Jun 24, 2014 at 13:06
  • Hmm, isn't the whole idea of a crypto-container, such as smart card / HSM / TPM, that the secret keys cannot be extracted, no matter who does that? I don't see any real technical limitation here: if HSM can do it, why TPM can't? Moreover, I know for sure that TPM knows to do it: package for TPM developed by Infineon does contain a CSP called "Infineon TPM Platform Cryptographic Provider", which does exactly this (bit.ly/ThFWtt, page 8). But it's limited to TPM chips produced by Infineon, so I wondered if there's a generic Microsoft solution. VSC would do, except for the PIN thing.
    – Cat Mucius
    Jun 25, 2014 at 6:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .