Tag: Cryptographic service provider (CSP)

Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known

As computing power becomes increasingly available, the need to use stronger cryptographic keys also increases. In this course, there is often a need (for example, because the keys have to be protected by a Trusted Platform Module) to use keys based on elliptic curves (ECC) . For their use, it is essential that compatibility with the intended use cases is ensured.

Below is a list of use cases for which I know the compatibility.

Continue reading "List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known"

Basics: Cryptographic Service Provider (CSP) and Key Storage Provider (KSP)

Since Windows NT 4.0, Cryptographic Service Providers (CSP) have been part of the CryptoAPI.

The idea is that an application does not have to worry about the specific implementation of key management, but can leave this to generic operating system interfaces. This also prevents cryptographic keys from being loaded into the working memory in the security context of the user/application used (a fatal security incident based precisely on this problem was the Heartbleed incident ).

For example, it makes no technical difference to the certification authority software how its private key is protected - whether in software or with a hardware security module (HSM), for example. The call of the private key is always identical for the certification authority.

With Windows Vista and the introduction of Cryptography Next Generation (CNG) as a replacement for CryptoAPI, Key Storage Providers (KSP) were introduced.

Continue reading "Basics: Cryptographic Service Provider (CSP) and Key Storage Provider (KSP)"

Troubleshooting for automatic certificate request (autoenrollment) via RPC/DCOM (MS-WCCE)

Assume the following scenario:

  • A certificate template is configured for automatic certificate request (autoenrollment).
  • The certificate template is published on a certification authority (Enterprise Certification Authority) integrated into Active Directory.
  • However, the users or computers configured for automatic certificate request do not request certificates as intended.

The following is a troubleshooting guide.

Continue reading "Troubleshooting for automatic certificate request (autoenrollment) via RPC/DCOM (MS-WCCE)"

Details of the event with ID 58 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll

Event Source:Microsoft-Windows-CertificateServicesClient-CertEnroll
Event ID:58 (0x825A003A)
Event log:Application
Event type:Warning
Event text (English):The "%3" algorithm for the "%2" provider was not loaded because initialization failed.
Event text (German):Der "%3"-Algorithmus für den "%2"-Anbieter wurde aufgrund eines Initialisierungsfehlers nicht geladen.

Continue reading "Details of the event with ID 58 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

List of use cases for certificates that require specific Cryptographic Service Providers (CSP) or Key Storage Providers (KSP)

With Windows Server 2008, together with the NSA Suite B algorithms (also known as Cryptography Next Generation, CNG), key storage providers were introduced as a new, modern interface for generating, storing, and using private keys in the Windows ecosystem.

In most cases, it does not matter which CSP or KSP is used for certificates. However, some applications will not work or will not work correctly if the wrong provider is chosen.

Below is a list of use cases I know of for certificates that only work with a specific cryptographic service provider (CSP) or key storage provider (KSP).

Continue reading "List of use cases for certificates that require specific Cryptographic Service Providers (CSP) or Key Storage Providers (KSP)"

Requesting a certificate is not possible because the certificate template is not displayed. The error message is "Can not find a valid CSP in the local machine."

Assume the following scenario:

  • A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
  • Autoenrollment does not request a certificate from the desired certificate template, although it is enabled and the permissions are set accordingly.
  • The desired certificate template is not displayed when requesting manually via the Microsoft Management Console (MMC). If the "Show all templates" check box is selected, the following error message is displayed for the desired certificate template:
Cannot find object or property.
Can not find a valid CSP in the local machine.

Continue reading "Requesting a certificate is not possible because the certificate template is not displayed. The error message is "Can not find a valid CSP in the local machine.""

Details of the event with ID 18 of the source Microsoft-Windows-NetworkDeviceEnrollmentService

Event Source:Microsoft-Windows-NetworkDeviceEnrollmentService
Event ID:18 (0x12)
Event log:Application
Event type:Error
Symbolic Name:EVENT_MSCEP_FAIL_TO_DECRYPT_INNER
Event text (English):The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (%1). %2
Event text (German):Die PKCS7-Nachricht (%1) des Clients kann vom Registrierungsdienst für Netzwerkgeräte nicht entschlüsselt werden. %2

Continue reading "Details of the event with ID 18 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

Which Cryptographic Service Provider (CSP) should be used for the Network Device Enrollment Service (NDES)?

When configuring a certificate template for the Registration Authority (RA) certificates for the Network Device Enrollment Service (NDES), the question arises, especially when using hardware security modules (HSM), which Cryptographic Service Provider (CSP) of the HSM manufacturer should be used.

Continue reading "Which Cryptographic Service Provider (CSP) should be used for the Network Device Enrollment Service (NDES)?"

The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect."

Assume the following scenario:

  • An NDES server is configured on the network.
  • HTTP error 500 (Internal Server Error) is reported when accessing the NDES request web page (mscep) and the NDES administration web page (certsrv/mscep_admin).
  • Events no. 2 and 10 are logged in the Application event log:
The Network Device Enrollment Service cannot be started (0x80070057). The parameter is incorrect.
The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.

Continue reading "The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.""

How secure is the "Allow private key to be exported" setting in the certificate templates?

PKI administrators often assume that the option in the certificate template not to allow the private key to be exported is binding.

However, that is not the case.

Continue reading "How secure is the "Allow private key to be exported" setting in the certificate templates?"