Hello, I have studied how the Smartcard support is included and played with it a bit. Good news that it is created but it looks overcomplicated to me.
If understandand well one has to:
-
Bind “Your Smartcard” to PKCS#11 dll
-
Make one’s ID recoverable (organizationally difficult process)
-
Enable Smartcard login, this pushes one’s Notes keys onto the smartcard, they are not any longer in one’s ID - this is good for those who are scary about their ID file, but I am not.
-
Get Internet Certificate (X.509) from a Smartcard.
-
Set this 4th step cert to become the default signing cert in MIME mail.
I wonder why only these steps are not the enough:
a) Bind “Your Smartcard” to PKCS#11 dll
b) Get Internet Certificate from a Smartcard, my ID file would get a bit bigger but Notes keys stay here, no backup or ID recovery is necessary
c) Set this b’ step cert to become the default signing cert in MIME mail.
The reason is that the internet cert (and related private key) which I use does create legally binding signature and this is why I stress on its location on the smartcard. The Notes ID is the intra-company issue only and it is not so critical for me.
Questions:
-
Is not the latter approach a-b-c possible?
-
If not, must the ID recovery be really created? Is it not enough to backup the entire ID file on the floppy or CD and place it somewhere securely? This backup ID should retain all keys, is it not?
Thanks if anybody knows, Vojtech
Subject: 6.0.5/6.5.3
In 6.0.5/6.5.3, we made it possible to import an X.509 cert off a smartcard without first locking the ID file with a smartcard. ID File Recovery is the recommended method of backing up an ID file, since it will automatically backup key and name changes, but the traditional approach of a copy on a floppy disk still works just fine, or even no backups at all, if you’re feeling especially brave (or foolhardy).
Here’s the release note:
Notes/Domino 6.0.2 introduced the ability to import pre-loaded X.509 certificates from smartcards or other cryptographic tokens and use the corresponding private key on the token for cryptographic operations.
In Notes/Domino 6.0.5, or 6.5.3, it is now possible to perform this import without first smartcard-enabling the ID file. This allows users to use keys that were pre-loaded onto read-only tokens and therefore cannot currently be used to lock the Notes ID file. As long as the PKCS#11 library is correctly configured and a token is present in the reader, then the “Import Internet Certificates from a Smartcard” menu option will be available as described in the “Importing Certificates from Smartcards” release note.
However, there are limitations to this mode of operation in the current release.
Background processes, such as Just-In-Time encryption, are currently unable to prompt for the PIN, and so will only be able to use keys on the token if the token supports a protected authentication path and will therefore be able to prompt for the PIN itself.
If an ID file utilizing this feature is subsequently locked with a second smartcard, it may become impossible to use any keys on the initial token on a single-slot system, since removing the smartcard that locks the ID file from the reader to insert the initial token will log the user out of Notes.
Some older versions of Notes/Domino will be unable to use the key stored on the token.
In the current release, the SC_manip_ImportInetCert opcode for the SECManipulateSC C API function can only be used to import certificates from the smartcard that is locking that ID file. This prevents SECManipulateSC from being used to import certificates into ID files that are not smartcard-enabled.