Smart cards

Smart cards are a tamper-resistant and portable way to provide security solutions for tasks such as client authentication, logging on to a Windows 2000 domain, code signing and securing e-mail.

  • Checklist: Deploying smart cards for logging on to Windows
  • How To
  • Concepts


Checklist: Deploying smart cards for logging on to Windows

Step | Reference
Review concepts about smart cards | Smart Card Concepts
Setup certification authorities and certification hierarchy |
If you have not already done so, follow the checklist for deploying certification authorities and public key infrastructure (PKI) on an intranet | Checklist: Deploying certification authorities and PKI for an intranet
For each domain |
Set the security permissions and delegate control of the Smart Card User, Smart Card Logon and Enrollment Agent certificate templates. | Set security permissions and delegate control of certificate templates
For each certification authority issuing smart card certificates |
Set up the certification authority to issue smart card certificates | Prepare a certification authority to issue smart card certificates
If you did not do so in the previous step, set up a certification authority to issue Enrollment Agent certificates | Establish the certificate types an Enterprise certification authority can issue
Set up a smart card enrollment station |
Install a smart card reader | Install a smart card reader on a computer
Get an Enrollment Agent certificate for the person(s) who will be setting up smart cards for users | Prepare a smart card certificate enrollment station
For each smart card user |
Set up smart cards | Set up a smart card for user logon
Install a smart card reader on the smart card user's computer | Install a smart card reader on a computer
Review smart card log on | Log on to a computer with a smart card


How To ...

  • Install a smart card reader on a computer
  • Log on to a computer with a smart card
  • Administer smart cards


Install a smart card reader on a computer

To install a smart card reader on a computer

  1. Shut down and turn off the computer.
  2. Depending on the type of reader you have purchased, attach your reader to an available serial port or insert the PC card reader into an available PCMCIA Type II slot.
  3. Restart your computer and log on as an administrator.
  4. Do one of the following:
    • The installation of the driver will take place without any prompting by the user if the device driver software for the smart card reader is available in the driver.cab file (installed on the hard drive as part of the Windows 2000 installation). This may take a few minutes.

      You can confirm that installation has successfully taken place by the appearance of the Unplug or Eject Hardware icon in the toolbar (if it was not previously present) and by the appearance of the just-installed reader in the list of hardware devices in the Unplug or Eject Hardware dialog box.

    • If the device driver software for the smart card reader is not available in the driver.cab file, the Add/Remove Hardware wizard will start. Follow the directions for installing the device driver software.

Important

  • Smart card readers generally come with setup instructions from the manufacturer. If your reader comes with instructions, you should use those. If not, then use these general procedures.

Notes

  • If the smart card reader is not installed automatically or the Add/Remove Hardware wizard does not start automatically, then your smart card reader may not be Plug and Play–compliant. You should contact the smart card reader manufacturer for the device driver and the instructions on how to install and configure the device.
  • When using the the Add/Remove Hardware wizard to install a smart card reader, you may need the media (such as CD or floppy disk) from the smart card reader manufacturer that contains the device driver. Alternatively, your administrator may provide you a network share from which to obtain the driver.


Log on to a computer with a smart card

To log on to a computer with a smart card

  1. At the Windows logon screen, insert your smart card in the smart card reader.
  2. Type the personal identification number (PIN) for the smart card when prompted by your computer.

Notes

  • If the PIN you enter is recognized as legitimate, this logs you on to the computer and to the Windows domain, based on the permissions assigned to your user account by the domain administrator.
  • If you enter the incorrect PIN for a smart card several times in a row, you will be unable to log on to the computer using that smart card. The number of allowable invalid log on attempts before lock out occurs varies according to the smart card manufacturer. Contact your administrator for a replacement.

Related Topics


Administer smart cards

Administrators can use the following procedures to deploy smart cards for logging on to Windows, securing e-mail, and other public key cryptography functions.

  • Prepare a certification authority to issue smart card certificates
  • Prepare a smart card certificate enrollment station
  • Set up a smart card for user logon

See also Checklist: Deploying smart cards for logging on to Windows.


Prepare a certification authority to issue smart card certificates

To prepare a certification authority to issue smart card certificates

  1. Confirm that the proper security permissions are set on the Smart Card Logon, Smart Card User, and Enrollment Agent certificate templates. For more information, see Related Topics.
  2. Log on with administrator rights to the certification authority (CA) you will be using to issue smart card certificates.
  3. Open Certification Authority.
  4. If you want to issue certificates that are only for Windows logon via smart cards:
    1. In the console tree, click Policy Settings.

      Where?

      • Certification Authority (computer)
      • CA name
      • Policy Settings
    2. On the Action menu, point to New, and then click Certificate to Issue.
    3. Click the Smart Card Logon certificate template, and then click OK.
  5. If you want to issue certificates that can be used for secure e-mail as well as Windows logon via smart cards:
    1. In the console tree, click Policy Settings.

      Where?

      • Certification Authority (computer)
      • CA name
      • Policy Settings
    2. On the Action menu, point to New, and then click Certificate to Issue.
    3. Click the Smart Card User certificate template, and then click OK.
  6. (See Notes before doing this step) In the console tree, click Policy Settings.

    Where?

    • Certification Authority (computer)
    • CA name
    • Policy Settings
  7. On the Action menu, point to New, and then click Certificate to Issue.
  8. Click the Enrollment Agent certificate template, and then click OK.

Notes

  • To open Certification Authority, click Start, point to Programs, point to Administrative Tools, and then click Certification Authority
  • The security permission setting of a certificate template indicates who is allowed to request a certificate of that type.
  • The Enrollment Agent certificate does not have to be issued from the same CA that will issue certificates for smart cards (as illustrated in this procedure). The issuing CA for the Enrollment Agent certificate just needs to be a trusted enterprise CA in the domain. In that case, you need to make sure that there is an enterprise CA in your domain capable of issuing Enrollment Agent certificates by following steps 1, 2 and 5-7 on that CA.
  • This procedure only applies to enterprise CAs.

Related Topics


Prepare a smart card certificate enrollment station

To prepare a smart card certificate enrollment station

  1. On the computer that you will use to set up smart cards, install a smart card reader, following the manufacturer's instructions.
  2. Log on as the user or administrator who will be installing certificates on smart cards.
  3. Click Start, click Run and type mmc.
  4. On the Console menu, click Add/Remove Snap-in, and then click Add.
  5. In Snap-in, double-click Certificates. If you are logged on as a user, the Certificates snap-in automatically loads.
    • If you are logged on as an Administrator, click My user account, and then click Finish.
  6. Click Close.
  7. Double-click Certificates - Current User.
  8. In the console tree, click Personal.

    Where?

    • Certificates - Current User
    • Personal
  9. On the Action menu, point to All Tasks, and then click Request New Certificate.
  10. In the Certificate Request wizard, select the Enrollment Agent certificate template. You'll also be asked to provide a friendly name and a description for the certificate.
  11. When prompted by the Certificate Request wizard, click Install Certificate. You now have the certificate necessary for requesting smart card certificates on behalf of users.

Notes

  • Before requesting smart card logon certificates for users, a smart card administrator must have an Enrollment Agent certificate available to generate smart card certificate requests on the behalf of others. That is the purpose of this procedure.
  • To do this procedure, you must have security permissions to access the Enrollment Agent certificate template. See Related Topics for more information about Enrollment Agent certificates and enrolling for a smart card certificate.
  • The Enrollment Agent certificate can be installed on a smart card if that is desired. In that case, you would need to use the smart card manufacturer's CSP when requesting the certificate. (Click the Advanced Options button in the Certificate Request wizard to select a smart card CSP for the Enrollment Agent certificate.)
  • These tasks can be performed on any Windows 2000 computer (Professional or Server) that you want to use as a smart card certificate enrollment station.

Related Topics


Set up a smart card for user logon

To set up a smart card for user logon

  1. Log on as an enrollment agent for the domain where the user's account is located.
  2. Open Internet Explorer.
  3. From Internet Explorer, in Address, type the address of the certification authority (CA) that issues smart card logon certificates, and then press ENTER.
  4. Click Request a certificate, and then click Next. Click Advanced request, and then click Next.
  5. Click Request a certificate for a smart card on behalf of another user using the Smart Card Enrollment Station, and then click Next. If you are prompted to accept the smart card signing certificate, click Yes.
  6. On the Smart Card Enrollment Station Web page, in Certificate Template, do one of the following:
    • Click Smart card Logon if you want to use the smart card for logging on to Windows only.
    • Click Smart card User if you want to use the smart card for secure e-mail as well as logging on to Windows.
  7. In Certification Authority, click the name of the CA you want to issue the smart card certificate.
  8. In Cryptographic Service Provider, select the cryptographic service provider (CSP) of the smart card's manufacturer.
  9. In Administrator Signing Certificate, click the Enrollment Agent certificate that will sign the enrollment request.
  10. In Enter User Name, click the appropriate user account, and then click Submit Certificate Request.
  11. When prompted by the system, insert the smart card into the smart card reader on your computer, click OK, and then, when prompted by the system, enter the personal identification number (PIN) for the smart card.
  12. (Optional) If the smart card you are setting up has a previously installed certificate on it, a message appears, asking whether you want to replace the existing credentials on the card. Click Yes.
  13. After the certificate is installed on the smart card, the CA Web page will give you the option of viewing the certificate you just installed or beginning a new smart card certificate request.

Notes

  • For step 1, anyone in the domain who has an Enrollment Agent certificate and has security permissions to issue smart card certificates is considered an "enrollment agent".
  • The address of the certification server is the name of the server followed by "/Certsrv". For example, in order to connect to the CA on a server named SmartcardCA, you would connect to:

    http://SmartcardCA/Certsrv

    Be sure to use the name of the server that the CA is installed on, not the CA name itself. In many cases, these names will be different.

  • If you have no certification authority available, see Prepare a certification authority to issue smart card certificates.
  • If you have no Enrollment Agent certificate available, see Prepare a smart card certificate enrollment station.

Related Topics


Concepts

This section provides general information about smart cards:

  • Smart cards overview
  • Understanding smart cards
  • Using smart cards


Overview of smart cards

Smart cards are a tamper-resistant and portable way to provide security solutions for tasks such as client authentication, logging on to a Windows 2000 domain, code signing and securing e-mail.

Support for cryptographic smart cards is a key feature of the public key infrastructure (PKI) that Microsoft has integrated into Windows 2000.

Smart cards provide:

  • Tamper-resistant storage for protecting private keys and other forms of personal information.
  • Isolation of security-critical computations involving authentication, digital signatures, and key exchange from other parts of the organization that do not have a "need to know".
  • Portability of credentials and other private information between computers at work, home, or on the road.

For more conceptual information, see Understanding smart cards and Using smart cards.

For smart card administrative and user procedures see How To.

For the smart deployment checklist see Checklist: Deploying smart cards for logging on to Windows


Understanding smart cards

Logging on to a network with a smart card provides a strong form of authentication because it uses cryptography-based identification and proof of possession when authenticating a user to a domain.

For example, if a malicious person obtains a user's password, that person can assume the user's identity on the network simply through use of the password. Many people choose passwords they can remember easily, which makes passwords inherently weak and open to attack.

In the case of smart cards, that same malicious person would have to obtain both the user's smart card and the personal identification number (PIN) to impersonate the user. This combination is obviously more difficult to attack because an additional layer of information is needed to impersonate a user. An additional benefit is that, after a small number of unsuccessful PIN inputs occur consecutively, a smart card is locked, making a dictionary attack against a smart card extremely difficult. (Note that a PIN does not have to be a series of numbers, it can also use other alphanumeric characters.)

For more conceptual information, see Using smart cards.

For smart card administrative and user procedures, see How To.


Using smart cards

This section provides general information about using smart cards:

  • Smart card readers
  • Supported smart cards
  • Enrolling for a smart card certificate
  • Logging on to a computer with a smart card


Smart card readers

It is strongly recommended that only smart card readers that have been tested by the Microsoft Windows Hardware Quality Lab and have obtained the Windows-compatible logo be installed on Windows 2000 computers.

Smart card readers that are not Plug and Play-compliant are not recommended on computers running Windows 2000. If you are using such a reader, then you must obtain installation instructions (including associated device driver software) directly from the manufacturer of the smart card reader. Microsoft neither supports nor recommends the use of non-Plug and Play smart card readers.

For instructions on installing smart card readers, refer to the manufacturer's materials that are provided with the reader, or see Install a smart card reader on a computer.

The following smart card readers are supported by Windows 2000. Their drivers are installed only upon detection of the corresponding Plug and Play smart card reader hardware.

Manufacturer | Smart card reader | Interface | Device driver
Bull CP8 | Smart TLP3 | RS-232 | Bulltlp3.sys
Gemplus | GCR410P | RS-232 | Gcr410p.sys
Gemplus | GPR400 | PCMCIA | Gpr400.sys
Litronic | 220P | RS-232 | Lit220p.sys
Rainbow Technologies | 3531 | RS-232 | Rnbo3531.sys
SCM Microsystems | SwapSmart | RS-232 | Scmstcs.sys
SCM Microsystems | SwapSmart | PCMCIA | Pscr.sys


Supported smart cards

When you install Windows 2000, support for the Gemplus GemSAFE and Schlumberger Cryptoflex smart cards is included in the default installation. You do not need to configure anything on the client or server to use either of these cards. Cryptographic smart cards can only be obtained directly from the respective companies and not from Microsoft Corporation.

While support for these cards is included in Windows 2000, other RSA-based cryptographic smart cards will also work with Windows 2000, provided the card vendor has developed a cryptographic service provider (CSP) for the card using CryptoAPI and the Smart Card Software Developer's Kit, which is available through Microsoft Developer's Network (MSDN).

Smart card personal identification numbers (PINs) can be changed anytime the CSP displays the private key PIN dialog box. PIN management is the responsibility of the card CSP and the user. Windows 2000 does not manage PINs.


Enrolling for a smart card certificate

A domain user cannot enroll for a Smart Card Logon certificate (which provides authentication) or a Smart Card User certificate (which provides authentication plus the capability to secure e-mail) unless a system administrator has granted the user access rights to the certificate template stored in Active Directory. Enrollment for a smart card certificate must be a controlled procedure, in the same manner that employee badges are controlled for purposes of identification and physical access.

The recommended method for enrolling users for smart card-based certificates and keys is through the Smart Card Enrollment station that is integrated with Certificate Services in Windows 2000 Server and Windows 2000 Advanced Server.

When an enterprise certification authority (CA) is installed, the installation includes the Smart Card Enrollment station. This allows an administrator to act on behalf of a user to request and install a Smart Card Logon certificate or Smart Card User certificate on the user's smart card. Prior to using the Smart Card Enrollment station , the smart card issuer must have obtained a signing certificate based on the Enrollment Agent certificate template. The signing certificate will be used to sign the certificate request generated on behalf of the smart card recipient.

By default, only domain administrators are granted permission to request a certificate based on the Enrollment Agent template. A user other than a domain administrator can be granted permission to enroll for an Enrollment Agent certificate by means of Active Directory Sites and Services. It's very important to note that once someone has an Enrollment Agent certificate, they can enroll for a certificate and generate a smart card on behalf of anyone in the organization. The resulting smart card could then be used to log on to the network and impersonate the real user.

Because of the powerful capability of the Enrollment Agent certificate, it is strongly recommended that your organization maintain very strong security policies over who has one. A scenario to minimize risk of Enrollment Agent misuse would be to have one subordinate CA with very tight administrative controls in your organization that is only used to issue Enrollment Agent certificates. Once the initial Enrollment Agent certificates have been issued, the administrator of the CA can disable the issuance of Enrollment Agent certificates until they are needed again. By restricting the administrators who can operate the CA service on the subordinate CA, the service can be kept online for the generation and distribution of certificate revocation lists (CRLs) if necessary. Other CAs in the hierarchy can still conceivably issue Enrollment Agent certificates if their policy settings are changed, but you can determine whether inappropriate Enrollment Agent certificates are issued by checking the Issued Certificates log for each CA regularly.

See Set security permissions and delegate control of certificate templates for information on how to change the security permissions for a certificate template.

The enrollment station does not provide any card personalization functions, such as creating a file structure or setting the personal identification number (PIN) because those are card-specific functions and can only be done using specialized software provided by the smart card manufacturer.

See Set up a smart card for user logon for instructions to enroll users for smart card certificates.


Logging on to a computer with a smart card

To log on to a computer with a smart card, users do not need to type CTRL+ALT+DEL. They simply insert the smart card into the smart card reader, and they are prompted for their personal identification number (PIN) instead of their user name and password (and, if applicable, domain).

For smart card logon procedures, see Log on to a computer with a smart card