How CSP find the private key of certificate to perform cryptographic operations?

Thinh Nguyen Van

My question is: when an application invoke CSP for performing cryptographic operation, such as signing, how CSP find private key of certifcate respectively?
If a certificate imported to cert store that the private key not in local computer (on USB token, external storage, e.g. mobile device), it can found?

plstryagain

When you import a certificate to the system store, Windows creates a BLOB structure that contains an encoded certificate itself and it properties. BLOB has following structure:

property1_id (4 bytes)
reserved = 0x00000001
property1_length (4 bytes)
property1_data[property1_length]
...
cert_property_id = 0x00000020
reserved = 0x00000001
cert_data_length (4 bytes)
cert_data[cert_data_length]

Therefore, if you want that your imported certificate to have link to a private key, you need to set CERT_KEY_PROV_INFO_PROP_ID. You can achieve that with CRYPT_KEY_PROV_INFO structure and CertSetCertificateContextProperty function.

For example:

#include <Windows.h>
#include <wincrypt.h>

void SetKeyLink()
{
    HCERTSTORE hStore = NULL;
    CRYPT_KEY_PROV_INFO key_prov_info = { 0 };
    PCCERT_CONTEXT pCertContext = nullptr;
    std::vector<BYTE> der_encoded_cert;

    hStore = CertOpenSystemStore(NULL, L"MY");
    if (!hStore)
    {
        goto Exit;
    }

    der_encoded_cert = LoadFromFile();

    pCertContext = CertCreateCertificateContext(X509_ASN_ENCODING, der_encoded_cert.data(), der_encoded_cert.size());
    if (!pCertContext)
    {
        goto Exit;
    }

    /* For legacy CSP */
    key_prov_info.dwProvType = PROV_RSA_AES; // Or YOUR_PROVIDER_TYPE
    key_prov_info.dwKeySpec = AT_SIGNATURE; // Or AT_KEYEXCHANGE
    key_prov_info.pwszContainerName = L"Your_key_name";
    key_prov_info.dwFlags = CERT_SET_KEY_PROV_HANDLE_PROP_ID;
    key_prov_info.cProvParam = 0;
    key_prov_info.pwszProvName = nullptr;
    key_prov_info.rgProvParam = 0;

    /*
    Or if you use CNG Key storage provider:

    // Or L"Your_CNG_key_storage_provider_name"
    key_prov_info.pwszProvName = L"Microsoft Software Key Storage Provider"; 
    key_prov_info.pwszContainerName = L"Your_key_name";
    key_prov_info.dwFlags = CERT_SET_KEY_PROV_HANDLE_PROP_ID;
    key_prov_info.dwProvType = 0;
    key_prov_info.dwKeySpec = 0;
    key_prov_info.cProvParam = 0;
    key_prov_info.rgProvParam = 0;
    */

    if (!CertSetCertificateContextProperty(pCertContext, CERT_KEY_PROV_INFO_PROP_ID, 0, &key_prov_info))
    {
        goto Exit;
    }

    if (!CertAddCertificateContextToStore(hStore, pCertContext, CERT_STORE_ADD_ALWAYS, NULL))
    {
        goto Exit;
    }

    std::cout << "success";

Exit:

    if (pCertContext)
    {
        CertFreeCertificateContext(pCertContext);
    }

    if (hStore)
    {
        CertCloseStore(hStore, 0);
    }
    return;
}

For now your certificate will look something like this (sorry for not English):

test_cert

When Windows wants to get private key, it calls CryptAcquireCertificatePrivateKey which in turn calls CertGetCertificateContextProperty(..., CERT_KEY_PROV_INFO_PROP_ID, ...).

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

php openssl: how to match the private key with the certificate

From Dev

How to generate certificate if private key is in HSM?

From Dev

How do I convert a certificate to a private key?

From Dev

How to verify if the private key matches with the certificate..?

From Dev

How to locate the private key of a certificate in Windows

From Dev

How to find Private Key Location

From Dev

signtool fails to find certificate on Windows 10, due to private key filter

From Dev

SSL: Can't find the certificate "" and its private key in the Keychain

From Dev

openssl : How to create .pem file with private key, associated public certificate, and certificate chain all the way to the root certificate?

From Dev

How to load PEM certificate together with private key in libcurl using mbedtls

From Dev

How to access the OpenShift wildcard SSL certificate and private key

From Dev

JAVA : How to make SSL connection with public certificate and private key

From Dev

How to export Certificate and private key as a single file using java code?

From Dev

PKCS11Interop : How to extract certificate with private key?

From Java

Distribution certificate / private key not installed

From Dev

certificate and private key for push notification

From Dev

Getting "No certificate matches private key"

From Dev

Missing PFX or certificate + private key

From Dev

certificate and private key for push notification

From Dev

How to find application that wants access to private key

From Dev

Certificate generated by Openssl Contains "PRIVATE KEY" instead of "RSA PRIVATE KEY"

From Dev

In Java, how do I decrypt using the private key from an X509 certificate (public/private key pair) inside a JKS keystore?

From Dev

In Java, how do I decrypt using the private key from an X509 certificate (public/private key pair) inside a JKS keystore?

From Java

WildFly sending private key instead of certificate

From Dev

Certificate chain not found, but keystore contains private key

From Dev

Sign jar with certificate but without private key

From Dev

Asp Mvc prompt client certificate with private key

From Dev

link between private key and signed certificate in keystore

From Dev

Error when check private key with certificate

Related Related

  1. 1

    php openssl: how to match the private key with the certificate

  2. 2

    How to generate certificate if private key is in HSM?

  3. 3

    How do I convert a certificate to a private key?

  4. 4

    How to verify if the private key matches with the certificate..?

  5. 5

    How to locate the private key of a certificate in Windows

  6. 6

    How to find Private Key Location

  7. 7

    signtool fails to find certificate on Windows 10, due to private key filter

  8. 8

    SSL: Can't find the certificate "" and its private key in the Keychain

  9. 9

    openssl : How to create .pem file with private key, associated public certificate, and certificate chain all the way to the root certificate?

  10. 10

    How to load PEM certificate together with private key in libcurl using mbedtls

  11. 11

    How to access the OpenShift wildcard SSL certificate and private key

  12. 12

    JAVA : How to make SSL connection with public certificate and private key

  13. 13

    How to export Certificate and private key as a single file using java code?

  14. 14

    PKCS11Interop : How to extract certificate with private key?

  15. 15

    Distribution certificate / private key not installed

  16. 16

    certificate and private key for push notification

  17. 17

    Getting "No certificate matches private key"

  18. 18

    Missing PFX or certificate + private key

  19. 19

    certificate and private key for push notification

  20. 20

    How to find application that wants access to private key

  21. 21

    Certificate generated by Openssl Contains "PRIVATE KEY" instead of "RSA PRIVATE KEY"

  22. 22

    In Java, how do I decrypt using the private key from an X509 certificate (public/private key pair) inside a JKS keystore?

  23. 23

    In Java, how do I decrypt using the private key from an X509 certificate (public/private key pair) inside a JKS keystore?

  24. 24

    WildFly sending private key instead of certificate

  25. 25

    Certificate chain not found, but keystore contains private key

  26. 26

    Sign jar with certificate but without private key

  27. 27

    Asp Mvc prompt client certificate with private key

  28. 28

    link between private key and signed certificate in keystore

  29. 29

    Error when check private key with certificate

HotTag

Archive