6 ms·

The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc.

by count 13y ago

The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc. Works great!

akama 13y ago
I would love to hear more about this. I've been looking for a good sso solution that uses crypto cards.
- lcampbell 13y ago
  My understanding is that the private key is on a CAC card[1,2], which is issued to all DoD employees and contractors who need access to DoD resources. Readers are usually built into the keyboard, and I'm guessing that there's something similar to ssh-agent running to maintain the key until you're AFK. -- [1] http://en.wikipedia.org/wiki/Common_Access_Card http://en.wikipedia.org/wiki/Common_Access_Card [2] http://www.cac.mil/ http://www.cac.mil/
  - jleehey 13y ago
    As a DoD CAC user and developer, this is correct (although the card readers at my company are built into the laptop or inserted via a USB adapter). I don't think there is a background agent that maintains the key though, I just think the card reader is queried when the certificate is needed. After the cert has been verified, you're free to pull the card out.
    - gknoy 13y ago
      The key never leaves the smartcard: the card hardware will not allow it to be retrieved. Rather, your system has drivers which ask the card to do all of the signing operations which your system would normally do if it had access to a key.
    - snuxoll 13y ago
      > After the cert has been verified, you're free to pull the card out. Last time I checked DoD systems are configured to automatically log you out of your session upon removal of your CAC.
      - count 13y ago
        This is an unrelated security measure, but you are correct. And if you pull the card out, you can't access anything anymore that requires it (and on a Windows domain that DOESNT lock / terminate the session, you'll be able to access things until your kerberos ticket expires or you need to get to something you don't have a ticket for).
        michaelt 13y ago
        I once volunteered at a hospital where they made use of a smart card security system - among other things, it would log you out if you removed your card from the reader. This closed all the programs you were running - and logging back in was a slow process. Needless to say, the smart cards stayed in the users' PCs even when they weren't at their desks.
        snuxoll 13y ago
        That's disappointing, Windows has multiple options to handle a smart card's removal, one of which is simply locking the screen, sad they decided to use the "force log off" setting instead.
      - AjithAntony 13y ago
        I think this is a feature of the ActiveClient middleware. Also handles the PIN entry when you insert. Default windows behavior is to leave the certs in the cert store.
- count 13y ago
  ADFS and UAG - the crypto card is tied to an account in AD, AD is configured to trust certs signed by a given CA, and the UAG software then uses that authenticated user to provide SSO.
arscan 13y ago
True, it works great for the average dod user (and in an enterprise in general) because they have a helpdesk that sets everything up for them. Once its configured it works fine, which is consistent with the message of this article. Good luck to them if they want to install a different browser (non-IE) or do anything non-standard... if they even are allowed to do so.
- marshray 13y ago
  Firefox did a lot of work to make CAC cards work for the DoD, they didn't develop a FIPS module just for the fun of it.
- paxswill 13y ago
  For a while I was checking upcoming OS X releases for CAC compatibility. At least on OS X, it's surprisingly easy to get set up, with the hardest step finding a compatible card reader. Once you have that, you usually have to install a PKCS#11 module (usually CACKey for DoD). Once that's all done, it's presented as an additional Keychain for the rest of the system to use. I know Chrome and Safari work with it without further fiddling, and I'm pretty sure Firefox will as well.
wmf 13y ago
I've always liked the idea of smart cards, but I also wonder how I would use a smart card to simultaneously log in to a site from, say, my PC and phone. It seems like the card can only be plugged in one place.
- count 13y ago
  That is, in fact, the point :) Using cards with your phone is a serious pain in the neck still, either way. You could always get an alternate token/card, so you have two you can use.
- BHSPitMonkey 13y ago
  Well your phone already has one smart card plugged into it all the time (assuming it's a GSM phone). Perhaps there's a clever way to leverage that as one factor in the authentication process.
Spearchucker 13y ago
It's easy enough to use on a smart card, but try setting that up. I'm trivialising now, but you're looking at... - Card manufacture - Key handling - Enrolment - Card lifecycle - Certificate lifecycle - Identity synchronisation You could buy a stack of white-labelled cards, of it you're the DoD you'd roll your own. That's shopping for silicon wafers, contact plate assemblies, mag stripes, holograms, RFID blanks, plastic card blanks, and card stack. Regardless of DoD or not, you've got to manage secure key transfer (keys created at bureau, exported using GIS TX3 and multiple smartcards, sent to client via multiple motorcycles, key reassembled and imported into HSM). Enrolment is a hefty process. Apply for smart card. Personalise physical card (typically photo and name), provision (link card to user), give card to user, mail PIN to user (out of band), and then activate card. That's just card manufacture and provisioning. Doesn't cover provisioning and de-provisioning software and hardware, card lifecycle (suspend when lost, disable if stolen or not found or employment terminated, and so on). Then there's CA integration, (often multiple) directory integration, and hardware integration. The point of all this is that security can be easy, but it comes with a big fat price tag and some very specialised skill.
- tlrobinson 13y ago
  Sounds like a business opportunity.
  - yxhuvud 13y ago
    There are already companies in this space though. One example is secmaker.com, but I don't know if they operate outside .se yet.
  - hpagey 13y ago
    There are several companies in this space. I was a research lead for smartcard access project for iOS platforms. We had to perform two way handshake using the certificates on the smart card. The most difficult part was to get data signed by the private key on the card during the handshake process.
- stonemetal 13y ago
  Enrolment is a hefty process. Apply for smart card. Personalise physical card (typically photo and name), provision (link card to user), give card to user, mail PIN to user (out of band), and then activate card. You missed the part where you drive several hours to the closest military base and wait in line several hours(think DMV and TSA all rolled into one).

by count 13y ago

The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc. Works great!

akama 13y ago

I would love to hear more about this. I've been looking for a good sso solution that uses crypto cards.

lcampbell 13y ago
My understanding is that the private key is on a CAC card[1,2], which is issued to all DoD employees and contractors who need access to DoD resources. Readers are usually built into the keyboard, and I'm guessing that there's something similar to ssh-agent running to maintain the key until you're AFK. -- [1] http://en.wikipedia.org/wiki/Common_Access_Card http://en.wikipedia.org/wiki/Common_Access_Card [2] http://www.cac.mil/ http://www.cac.mil/
- jleehey 13y ago
  As a DoD CAC user and developer, this is correct (although the card readers at my company are built into the laptop or inserted via a USB adapter). I don't think there is a background agent that maintains the key though, I just think the card reader is queried when the certificate is needed. After the cert has been verified, you're free to pull the card out.
  - gknoy 13y ago
    The key never leaves the smartcard: the card hardware will not allow it to be retrieved. Rather, your system has drivers which ask the card to do all of the signing operations which your system would normally do if it had access to a key.
  - snuxoll 13y ago
    > After the cert has been verified, you're free to pull the card out. Last time I checked DoD systems are configured to automatically log you out of your session upon removal of your CAC.
    - count 13y ago
      This is an unrelated security measure, but you are correct. And if you pull the card out, you can't access anything anymore that requires it (and on a Windows domain that DOESNT lock / terminate the session, you'll be able to access things until your kerberos ticket expires or you need to get to something you don't have a ticket for).
      - michaelt 13y ago
        I once volunteered at a hospital where they made use of a smart card security system - among other things, it would log you out if you removed your card from the reader. This closed all the programs you were running - and logging back in was a slow process. Needless to say, the smart cards stayed in the users' PCs even when they weren't at their desks.
        snuxoll 13y ago
        That's disappointing, Windows has multiple options to handle a smart card's removal, one of which is simply locking the screen, sad they decided to use the "force log off" setting instead.
    - AjithAntony 13y ago
      I think this is a feature of the ActiveClient middleware. Also handles the PIN entry when you insert. Default windows behavior is to leave the certs in the cert store.
count 13y ago
ADFS and UAG - the crypto card is tied to an account in AD, AD is configured to trust certs signed by a given CA, and the UAG software then uses that authenticated user to provide SSO.

arscan 13y ago

True, it works great for the average dod user (and in an enterprise in general) because they have a helpdesk that sets everything up for them. Once its configured it works fine, which is consistent with the message of this article. Good luck to them if they want to install a different browser (non-IE) or do anything non-standard... if they even are allowed to do so.

marshray 13y ago
Firefox did a lot of work to make CAC cards work for the DoD, they didn't develop a FIPS module just for the fun of it.
paxswill 13y ago
For a while I was checking upcoming OS X releases for CAC compatibility. At least on OS X, it's surprisingly easy to get set up, with the hardest step finding a compatible card reader. Once you have that, you usually have to install a PKCS#11 module (usually CACKey for DoD). Once that's all done, it's presented as an additional Keychain for the rest of the system to use. I know Chrome and Safari work with it without further fiddling, and I'm pretty sure Firefox will as well.

wmf 13y ago

I've always liked the idea of smart cards, but I also wonder how I would use a smart card to simultaneously log in to a site from, say, my PC and phone. It seems like the card can only be plugged in one place.

count 13y ago
That is, in fact, the point :) Using cards with your phone is a serious pain in the neck still, either way. You could always get an alternate token/card, so you have two you can use.
BHSPitMonkey 13y ago
Well your phone already has one smart card plugged into it all the time (assuming it's a GSM phone). Perhaps there's a clever way to leverage that as one factor in the authentication process.

Spearchucker 13y ago

It's easy enough to use on a smart card, but try setting that up. I'm trivialising now, but you're looking at... - Card manufacture - Key handling - Enrolment - Card lifecycle - Certificate lifecycle - Identity synchronisation You could buy a stack of white-labelled cards, of it you're the DoD you'd roll your own. That's shopping for silicon wafers, contact plate assemblies, mag stripes, holograms, RFID blanks, plastic card blanks, and card stack. Regardless of DoD or not, you've got to manage secure key transfer (keys created at bureau, exported using GIS TX3 and multiple smartcards, sent to client via multiple motorcycles, key reassembled and imported into HSM). Enrolment is a hefty process. Apply for smart card. Personalise physical card (typically photo and name), provision (link card to user), give card to user, mail PIN to user (out of band), and then activate card. That's just card manufacture and provisioning. Doesn't cover provisioning and de-provisioning software and hardware, card lifecycle (suspend when lost, disable if stolen or not found or employment terminated, and so on). Then there's CA integration, (often multiple) directory integration, and hardware integration. The point of all this is that security can be easy, but it comes with a big fat price tag and some very specialised skill.

tlrobinson 13y ago
Sounds like a business opportunity.
- yxhuvud 13y ago
  There are already companies in this space though. One example is secmaker.com, but I don't know if they operate outside .se yet.
- hpagey 13y ago
  There are several companies in this space. I was a research lead for smartcard access project for iOS platforms. We had to perform two way handshake using the certificates on the smart card. The most difficult part was to get data signed by the private key on the card during the handshake process.
stonemetal 13y ago
Enrolment is a hefty process. Apply for smart card. Personalise physical card (typically photo and name), provision (link card to user), give card to user, mail PIN to user (out of band), and then activate card. You missed the part where you drive several hours to the closest military base and wait in line several hours(think DMV and TSA all rolled into one).