I know very little about smart card authentication in general so please point out or correct me if anything below doesn't make sense.

Lets say i have:

  • A Certificate Authority "X"-s smart card (non-exportable private key)
  • Drivers for that smart card written in C
  • A smart card reader
  • CA-s authentication OCSP web service
  • A requirement to implement user authentication in a .NET fat client application via a smart card, that was given out by the CA "X".

I tried searching info on the web but no prevail. What would the steps be ? My first thought was:

Set up a web service, that would allow saving of (for example) scores of a ping pong game for each user. Each time someone tries to submit a score via the client application, he can only do so by inserting the smart card into the reader.

Then the public key is read from the smart card by native c calls through .NET and sent to my custom web service, which in return uses the CA-s authentication OCSP web service to prove the validity of the public key/public certificate (?). If the public key is okay and valid, encrypt a random sequence of bytes with the public key and send it to the client application. If the client application sends back the correctly decrypted random sequence of bytes along with the score of the ping pong game, then the score is saved in the database for the given user.

My question is, is this the correct way to do it ? What else should i know about smart card authentication ?


That sounds far too complex, and heading in the complete wrong direction.

For starters, "A requirement to implement user authentication in a .NET client application". .Net applications run in user sessions, which implies that the user authentication already happened. It's too late.

But Smart Card logins are already supported out of the box. That's done by SCardSvr.exe (Smart Card Service) in conjunction with WinLogon. As a service, it's not limited in that way. But WinLogon isn't going to cooperate with your service in that way, obviously. That wouldn't be exactly secure.

The proper solution is to implement a "Smart Card Cryptographic Service Provider" (CSP). This is a highly non-trivial solution, if you're faced with such impossible requirements as you have.

| improve this answer | |
  • 1
    Please explain further, i don't understand what you mean by .NET applications running user sessions and authentication having already happened. My focus is purely on authentication through a smart card, not authentication by whatever means. – Dante Feb 20 '12 at 22:22
  • 1
    Windows itself manages smart cards, and you don't interact with the card directly. This smart card management is tied into the Windows authentication framework. That's something you'll have to learn, if you're going to work with smartcards on Windows. – MSalters Feb 21 '12 at 8:42
  • Why are you presuming that he wants/needs the Windows login to have anything to do with this? Maybe it's a kiosk-type application, or some other situation where the Windows user has nothing to do with what is happening in his application. – jlew Mar 26 '12 at 13:18
  • @jlew: I'm not presuming that. I'm pointing out that life is a lot easier when you make it so, if only because Windows already assumes that Smart Cards are managed by the OS. So, if you're trying to do it yourself, not only do you have to do the actual work, but you also have to stop Windows from doing its thing. – MSalters Mar 26 '12 at 13:42
  • I think the question is maybe a bit broad, but this answer is altogether insufficient to even address the points listed. – theMayer Oct 10 '18 at 15:42

Instead of trusting the operating system if you want to do authentication yourself, yes you are in right track.

AFAIK using smart cards in os level requires the domain authentication. If not your all of your users uses domain you have to authenticate yourself. (ex: internet user)

More practical way is;

  • [client] get the hash of score point (sha1, sha2 etc)
  • [client] encrypt the hash (it's actually called signature)
  • [client] send the signature + user's public certificate to web service
  • [server] Validate the user's certificate (ocsp)
  • [server] get hash of score (again)
  • [server] decrypt sent hash
  • [server] compare the calculated hash with sent hash (verifying the signature)

this way is more less chatty and less data transferred.

you may calculate the hash with by .net API or you can use the smart card it self but smart carts usually slow, i recommend the use .net API if security is not too tight.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.