1

My employer asked me to write software that allows colleagues to digitally sign measurement data (Windows 10). I received a developer kit consisting of a card reader, smart cards and software to assign pins and certificates (https://www.acs.com.hk/en/products/495/evo-pki-kit-pki-software-solution/).

With the software from the smart card company, I was able to add a certificate to a card and to sign with it a PDF via adobe acrobat. But to speed up the measuring-signing-process, my employer would like to skip PDF/acrobat and use own software to put digital-signed measuring data (e.g. as a JSON string, containing the measuring data also as clear text) directly into a SQL database.

The most suited I could find so far is this library: https://github.com/LudovicRousseau/PyKCS11 but it relies on Visual studio 2010 SDK (https://marketplace.visualstudio.com/items?itemName=VisualStudioProductTeam.VisualStudio2010SP1SDK), whereby the official Microsoft download for it is no longer available.

As a former engineer/scientist, I have only had experience with Python programming in other areas. Now I am worried to waste time learning unsuitable or outdated libraries. Therefore, I am reaching out to you in hopes that someone has the experience to make languages/libraries/software (or even other hardware) recommendations.

EDIT: in the details of the certificate, which we want to use for digital signing, is written among other things:

  • signature algorithm: "sha256RSA"
  • signature hash algorithm: "sha256"
  • public key: "RSA (4096 Bits)

EDIT2: I will try https://github.com/LudovicRousseau/pyscard, any other suggestions are still welcome.

Improve this question
7
  • PKI stands for Public Key Infrastructure. That means you probably deal with Public Key/ Private Key Encryption like RSA. You can't encrypt a lot of data with that. Basically just as much as the key length, e.g. 2048 bits. And it is slow. That means: for more data, you use symmetric encryption, like AES. You then encrypt the symmetric key (AES key) with the private key (RSA key), so that nobody can crack your symmetric key. The card reader is just a safe store for the private key. You should be able to do everything without the smart card as well.
    – Thomas Weller
    Mar 20 at 15:29
  • The main question is: which programming languages can you use and what API does the vendor offer for this hardware? On which OS do you want to use the application?
    – Thomas Weller
    Mar 20 at 15:35
  • Explain to me "digitally sign measurement data". What does that means? Do they bring back temperature form a laboratory and you have to digitally sign the thermometer?
    – Francesco Mantovani
    Mar 21 at 8:25
  • @ThomasWeller we should be able to convert the measurement data to a hash first and then sign the hash. We just want to be able to proof later that the data was not changed anymore afterwards and add the info about who measured it when. – I used Python for 7 years, and little C#, but I can learn other languages as well. Regarding API I still try to figure out. On the first link in main question, second tab they write: ACS Middlewares comply with the following: PCKS #11, Microsoft® CryptoAPI, Microsoft®, CryptoAPI Next Generation. – OS for dev and use: Windows10
    – Leo
    Mar 21 at 9:51
  • @FrancescoMantovani see my answer above (2. sentence). So in your example we would want to sign/proof that the temperature had certain value at a certain timestamp. Smart cards seem to be the best option if you do not want to spread the private keys.
    – Leo
    Mar 21 at 9:59

1 Answer 1

Reset to default
0

I think we are reinventing the wheel here.

There must be already software out there that provide the same solution and Microsoft will deprecate virtual smart cards in the near future.

Microsoft will deprecate virtual smart cards in the near future. Customers using virtual smart cards are strongly encouraged to move to Windows Hello for Business. Microsoft will publish the deprecation date to ensure customers have adequate lead time to move to Windows Hello for Business. We recommend that new Windows deployments use Windows Hello for Business.

I suggest you to look around before starting the development of something that might already exists.

Improve this answer
2
  • Are virtual smart cards not different from smart cards? But yes sure, I am already looking for short cuts and thats why I was also asking for software or even hardware recommendations. But the solution should allow the company to keep the private keys locally.
    – Leo
    Mar 21 at 10:44
  • Well, I think Microsoft is going to the Hello directoin: learn.microsoft.com/en-us/windows/security/identity-protection/…
    – Francesco Mantovani
    Mar 21 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.