CODEWITHSUNDEEP
c#cryptographyx509certificate2
user5271376
user5271376

Reputation: 156

How to decide that a certificate in the store is smart card related or not?

I can enumerate the certificates present on the inserted smart card but how can one decide that the certificates present in the windows certificate store are related to smart card even when there is no smart card inserted?

How can I know if a certificate from the store will ask for a PIN before using it when there is no smart card present?

Upvotes: 1

Views: 1123

Answers (1)

Crypt32
Crypt32

Reputation: 13944

If you have a certificate and associated private key (as an X509Certificate2 object), you can check certificate.PrivateKey.CspKeyContainerInfo.HardwareDevice property chain (HardwareDevice property). If the property returns true then the key is stored on a smart card and most likely (but not necesaary) will propmpt a PIN when you try to access the key. This will work if the key is stored in the legacy Cryptographic Service Provider (CSP).

Modern cards support modern provider types called Key Storage Provider (KSP) which is poorly supported in .NET. This means that if the key is stored in the hardware KSP, then HasPrivateKey property (of the X509Certificate2 object) will return True and PrivateKey will be null. In this case, you will have to do some extra work by calling native CryptoAPI functions in the NCrypt family. Though, starting with .NET 4.6+, there are several extension methods in X509Certificate2 class which can be used to retrieve provider information: X509Certificate2 Extension Methods.

Upvotes: 3

Related Questions