|
Posted by Can Balioglu on April 7, 2007, 5:56 am
If you were Registered and logged in, you could reply and use other advanced thread options
The information in the blog is actually wrong. As first, there is no such a
thing as "non-exportable certificate". The correct term must be "certificate
having a non-exportable private key". And you can never export a
non-exportable private key. This would be one of the biggest vulnerabilities
in Windows history.
Calling the CertSaveStore function just serializes the specified certificate
store including all certificates in that store and all *Microsoft specific
certificate context properties* associated with these certificates. One of
these context properties points to the key container of the certificate's
private key. So only the "name" of the key container is serialized. If this
all serialization/deserialization process occurs in the same system, then
both the original and the duplicated version of the certificate will point
to the same key container which makes you think that you also have a
duplicated private key.
If you deserialize the store in a different system, then the "View
Certificate" dialog of CryptoAPI mistakenly indicates that the certificate
has a private key without checking the existence of the key container.
However, if you try to use any functionality requiring the private key
(signing, encrypting, etc.) you will receive the error NTE_BAD_KEYSET
meaning that the key container does not exists.
So do not worry about exportable "non-exportable certificates".
Regards...
Can Balioglu
can.balioglu at averina.com
Averina Software - Code Signing and IT Security Solutions
http://www.averina.com
> As we know non-exportable certificate can be exported along with
> privatekey programmatically or not even using any program,
> (http://matrixalaya.blogspot.com/2007/03/exporting-non-exportable-
> certificates.html) how to make privatekey of a certificate entirely
> non exportable from personal store?
>
> In my case the security of the certificate is very important and the
> machine owner should not be bothered about any password after the
> certificate is once installed in the machine. It is also important
> that the privatekey need to be entirely non exportable.
>
> Is it possible or any work around?
>
> Thanks in advance,
> GNUlihd
>
| 
XML site map