Get best of the week

Tensor Certification Authority may compromise customer private keys

The foregoing in this article is my value judgment, but I suggest that the reader objectively evaluate the facts.

Company Tensortensor_sbis has its own certification center and issues certificates of verification of electronic signature keys to individuals and legal entities.

For those who are new to domestic electronic signatures, a small introduction. We generally store electronic signature keys in four ways:

  1. in a file on disk (or in the registry) - the least protected option;
  2. on a “dumb” key medium where your key is protected by a PIN code - medium security;
  3. on a “smart” key medium - here the medium can independently perform cryptographic operations, therefore the private key never leaves the medium.

    All operations are performed on a chip. Therefore, keys on such media are called non-removable;
  4. cloud (on cloud) - this is when you give your private key to someone, in the hope that he himself will not use it and will not give it to anyone. Words to describe this insanity are not enough, but it is present on the market. The emphasis is on convenience, which is known to be at the other end of security.

I use the third option - the “smart” key carrier. Crypto Pro 5th version finally learned how to use on-board cryptography tools on key media and absolutely transparent (for a program using cryptography) generation and use of hardware keys became possible. This is a very important point - if nothing is done on purpose, it just works.

For some time they worked worthy of all praise, but in December I needed to get a new certificate, and then I suddenly ran into a number of difficulties. Further, the bare facts:

  1. , (100 ) , . , . , . — , , . . .
  2. ( ) 2019-, , «» - . , , , .
  3. , , . .
  4. , , - , .

The mode of bare facts off. Further my reasoning.

We recall the thesis above that if you just do nothing, then smart media just works. So there is a (evil-) intentional attempt to disable this feature. What for? We recall the first fact above. Work when generating a key is possible only online. The software sends a certificate request to the CA. But is it just that? There is no simple opportunity to check what else is sent to the CA, there is no - the exchange is encrypted. However, nothing prevents to send together the certificate request and the key itself. After all, by banning all “smart” key carriers, the software now has the ability to retrieve the newly generated private key and send it to the CA (or to someone else).

Update : A very interesting comment has been received.

Update 2:: no less interesting comment

Source: https://habr.com/ru/post/undefined/

More articles:


All Articles