Which Cryptographic Service Provider (CSP) should be used for the Network Device Enrollment Service (NDES)?
When configuring a certificate template for the Registration Authority (RA) certificates for the Network Device Enrollment Service (NDES), the question arises, especially when using hardware security modules (HSM), which Cryptographic Service Provider (CSP) of the HSM manufacturer should be used.
The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Basics: Network Device Enrollment Service (NDES) ".
A Cryptographic Service Provider (CSP) is a key storage and usage abstraction for applications that use certificates. CSPs were replaced by key storage providers with Windows Server 2008 and Windows Vista. More information can be found in the article "Basics: Cryptographic Service Provider (CSP) and Key Storage Provider (KSP) ".
To answer this question, it is helpful to first check which CSP is used in an installation without HSM in the default setting.
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.
As can be seen, in both cases this is the "Microsoft Strong Cryptographic Provider". Details about this and other CSPs can be viewed with the following command line command:
certutil -csplistIf you configure your own certificate templates for the Registration Authority certificates, the "Microsoft RSA SChannel Cryptographic Provider" is selected for the CEP Encryption certificate template.
The provider type for the "Microsoft Strong Cryptographic Provider" is PROV_RSA_FULL.
If you look at the Microsoft documentation for the provider types, you will find the following description.
| Provider type | Description (Microsoft) |
|---|---|
| PROV_RSA_FULL | Supports both digital signatures and data encryption. It is considered a general purpose CSP. The RSA public key algorithm is used for all public key operations. |
| PROV_RSA_AES | Supports the same as PROV_RSA_FULL with additional AES encryption capability. |
| PROV_RSA_SCHANNEL | Supports both RSA and Schannel protocols. |
For the selection of the correct CSP of the HSM one looks now at the provider types of the respective HSM manufacturer.
Example Gemalto (SafeNet) Luna:
Provider Name: Luna Cryptographic Services for Microsoft Windows
Provider Type: 1 - PROV_RSA_FULL
Provider Name: Luna enhanced RSA and AES provider for Microsoft Windows
Provider Type: 24 - PROV_RSA_AES
Provider Name: Luna SChannel Cryptographic Services for Microsoft Windows
Provider Type: 12 - PROV_RSA_SCHANNELExample Utimaco CryptoServer:
Provider Name: Utimaco CryptoServer CSP
Provider Type: 1 - PROV_RSA_FULL
Provider Name: Utimaco CryptoServer RSA and AES CSP
Provider Type: 24 - PROV_RSA_AESThe documentation on provider types indicates that the PROV_RSA_AES and the PROV_RSA_SCHANNEL both have at least the same functionality as the PROV_RSA_FULL.
Conclusion
At least one CSP of type PROV_RSA_FULL should be selected for the Registration Authority (RA) certificates of the Network Device Enrollment Service.
For the common hardware security modules these would be:
- Gemalto (SafeNet): Luna Cryptographic Services for Microsoft Windows
- Utimaco (CryptoServer): Utimaco CryptoServer CSP
- Thales (nCipher): nCipher Enhanced Cryptographic Provider
The use of key storage providers (KSP) is not possible with the Network Device Enrollment Service. See also the article "List of use cases for certificates that require specific Cryptographic Service Providers (CSP) or Key Storage Providers (KSP) ".
Further security hardening
A poorly secured NDES installation can pose a significant risk to the company .
Hardening the Registration Authority certificates only makes sense if their signatures are also required by the device certificate template .
The use of a hardware security module (HSM) is neither the only nor the most effective means of hardening the security of an NDES installation.
Besides using HTTPS for the NDES administration website , it is highly recommended to remove the connected certification authority from the NTAuthCertificates object in Active Directory and either to use name constraints or to limit the scope of certificate requests with the TameMyCerts Policy Module .
External sources
- Cryptographic Provider Type (Microsoft)
- PROV_RSA_FULL (Microsoft)