Re: PKCS#11 Module for TPM availiable

2009-07-06 Thread Martin Schneider
Hello Arshad, I want to use Firefox with TPM preferably in Ubuntu Linux. I'm not sure what I've got to do to link Firefox with the PKCS#11 interface. Do you need to implement some code or is this a mere configuration thing? The next question is: How does the creation of a TPM protected certifica

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-06 Thread Julien R Pierre - Sun Microsystems
Martin, Martin Paljak wrote: This is because currently tokens are used for low level internet pipe things in the form of SSL/TSL. It is impossible to bring those network level events to the UI level, and it would not make much sense either. NSS allows the password prompting callback to be c

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-06 Thread Kyle Hamilton
Users are never told that a PIN is a password is a passphrase. So, they believe that a "PIN" is not a "password", and a "password" is not a "passphrase". So they think "I have to type my password to get access to this", not "the device is asking for my PIN to do what it's been asked to do." User

Re: PKCS#11 Module for TPM availiable

2009-07-06 Thread Nelson B Bolyard
On 2009-07-06 07:41 PDT, Martin Schneider wrote: > I want to use certificates which according private key is protected > inside a Trusted Platform Module and use these Certificates for client > side authentication towards a web based service running on an Apache. > > As far as I understand, there

Re: CEN TS 15480 (Re: USB device profile for smart-card readers)

2009-07-06 Thread Jean-Marc Desperrier
Anders Rundgren wrote: we see the start of going out of that through the European Citizen Card (ECC) standard "CEN TS 15480" This is something I really hate: http://www.evs.ee/product/tabid/59/p-165216-cents-15480-22007.aspx Paying for *open* standards! In fact, I'm not sure I directed you to

Re: PKCS#11 Module for TPM availiable

2009-07-06 Thread Arshad Noor
Hi Martin, Yes, TSS does apparently give you a PKCS#11 interface when layered with openCryptoki (http://trousers.sourceforge.net/pkcs11.html). I haven't used this configuration personally (I'm trying to work with a specific vendors PKCS#11 library and access the TPM using Java through the SunPKC

PKCS#11 Module for TPM availiable

2009-07-06 Thread Martin Schneider
Hello everybody, I'm new to this topic, so it would be kind if some of you people could give me some input. I want to use certificates which according private key is protected inside a Trusted Platform Module and use these Certificates for client side authentication towards a web based service ru

PKI GUI. (Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token))

2009-07-06 Thread Anders Rundgren
Martin Paljak wrote: It accepts ascii-numeric pins, but it is a PIN (with numbers) for several reasons: 1. People know PIN codes and use them on ATMs => cards have PINs which are made of numbers 2. I use pinpad readers for obvious reasons, which only have numbers 3. You are not married to your

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-06 Thread Martin Paljak
On 06.07.2009, at 1:38, Nelson B Bolyard wrote: On 2009-07-05 05:57 PDT, Martin Paljak wrote: The problem is that an average users thinks like this: "password is something like 'topsecret123', PIN code is something like '1234', I'm asked for a password, let me see, which passwords I know that

Re: Problem reading certificate from hardware token

2009-07-06 Thread Anders Rundgren
M.Hunstock wrote: Anders Rundgren schrieb: BTW, we still don't have a credible system for *remote* provisioning of smart cards on any OS, so we shouldn't expect too much progress here because PKCS #11 can't do that job actually! Why? What are you missing? http://webpki.org/papers/keygen2/se

Re: Problem reading certificate from hardware token

2009-07-06 Thread M.Hunstock
Anders Rundgren schrieb: > BTW, we still don't have a credible system for *remote* provisioning of > smart cards on any OS, so we shouldn't expect too much progress here > because PKCS #11 can't do that job actually! Why? What are you missing? -- dev-tech-crypto mailing list dev-tech-crypto@list