Microsoft Authenticode

Transcription

1 www. t ha les-esecur it y. com Thales e-security Microsoft Authenticode Integration Guide for Microsoft Windows

2 Version: 1.0 Date: 03 July 2014 Copyright 2014 Thales UK Limited. All rights reserved. Copyright in this document is the property of Thales UK Limited. It is not to be reproduced, modified, adapted, published, translated in any material form (including storage in any medium by electronic means whether or not transiently or incidentally) in whole or in part nor disclosed to any third party without the prior written permission of Thales UK Limited neither shall it be used otherwise than for the purpose for which it is supplied. Words and logos marked with or are trademarks of Thales UK Limited or its affiliates in the EU and other countries. Information in this document is subject to change without notice. Thales UK Limited makes no warranty of any kind with regard to this information, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Thales UK Limited shall not be liable for errors contained herein or for incidental or consequential damages concerned with the furnishing, performance or use of this material. Microsoft Authenticode Integration Guide for Microsoft Windows 2

3 Contents Chapter 1: Introduction 1 This product 1 Product configuration 1 Supported Thales functionality 1 Requirements 1 This document 2 More information 2 Chapter 2: Procedures 3 Installing the Microsoft Windows SDK 3 Integrating the nshield HSM with Microsoft Authenticode 3 Signing and time-stamping the code with a Microsoft SDK 4 Signing and time-stamping the code with Microsoft SDK 6.1 using the SignTool Wizard 4 Chapter 3: Troubleshooting 6 Internet addresses 7 Microsoft Authenticode Integration Guide for Microsoft Windows 3

4 Chapter 1: Introduction Chapter 1: Introduction This product The Thales Hardware Security Module (HSM) integrates with Microsoft Authenticode to enable you to identify the publisher of a software component before it is downloaded from the Internet, and to verify that no one has altered the code after it has been signed. Authenticode relies on proven cryptographic techniques and the use of one or more private keys to sign and time-stamp the published software. It is important to maintain the confidentiality of these keys. Throughout this guide, the term HSM refers to nshield Solo modules, nshield Edge and nshield Connect products. (nshield Solo products were formerly known as nshield.) The benefits of using an HSM with Microsoft Authenticode include: Protection for the organizational credentials of the software publisher. Secure storage of the private key. FIPS level 3 validated hardware. Provision of a trusted time-stamp to Authenticode. Product configuration The following integrations have been validated: Operating system Thales TSS Version Microsoft SDK Version PCI Support PCIe Support Edge Support Connect Support Windows Vista Enterprise 32 Bit Yes Yes Yes Yes Windows Server 2008 R2 SP Yes Yes Yes Yes Windows Server Yes Yes Yes Yes Windows Vista Enterprise 64 Bit Yes Yes Yes Yes Windows 7 Enterprise 64 Bit Yes Yes Yes Yes Supported Thales functionality Soft Cards No K-of-N Card Set Yes Key Recovery Yes Module-only Key Yes Strict FIPS Yes Key Import No Fail Over Yes Key Generation Yes - - Key Management Yes Load Balancing No - - Requirements Before you attempt to install the software, we recommend that you familiarize yourself with the Microsoft Authenticode documentation and setup process, and have the nshield documentation available. Microsoft Authenticode Integration Guide for Microsoft Windows 1

5 Chapter 1: Introduction We also recommend that the following aspects of HSM administration are taken into account: The Administration Card Set (ACS) K-of-N and management of the card set. The type of protection for the application keys, that is, module protection or Operator Card Set (OCS) protection. The Operator Card Set K-of-N and management of the card set. Any requirement for a FIPS level 3 Security World. Key attributes, such as the key size, persistence, and time-out. This document This document explains how to set up and configure Microsoft Authenticode with an HSM. The instructions in this document have been thoroughly tested and provide a straightforward integration process. There may be other untested ways to achieve interoperability. This document may not cover every step in the process of setting up all the software. We assume you have read the HSM documentation and that you are familiar with the documentation and setup process for Microsoft Authenticode. For more information about installing Microsoft Authenticode, refer to the Microsoft documentation. More information For more information about OS support, contact your Microsoft sales representative or Thales Support. For more information about contacting Thales, see Internet addresses on page 7 at the end of this guide. Additional documentation produced to support your Thales product is in the document directory of the CD-ROM or DVD-ROM for that product. Microsoft Authenticode Integration Guide for Microsoft Windows 2

6 Chapter 2: Procedures Chapter 2: Procedures To install and configure Microsoft Authenticode with an HSM: Install the Thales hardware and software. Create the Security World. Install the ncipher CSP by running the ncipher CSP Install Wizard. Install the appropriate version of the Microsoft SDK for the operating system that is in use. For more information about Microsoft SDK versions, see Introduction on page 1. You can find details of how to install the nshield hardware in the Hardware Installation Guide, while information about software installation and Security World creation can be found in the appropriate User Guides. These guides are available from the installation disc. The installation procedures outlined here assume, for example purposes, that you are installing an offline root Certificate System. It is also assumed that a new root key is generated during installation, rather than a software key being imported from an existing installation. Installing the Microsoft Windows SDK The Authenticode programs (makecert, cert2spc, and so on) are installed with the Microsoft SDK. For more information, see the appropriate Microsoft SDK installation documentation. Integrating the nshield HSM with Microsoft Authenticode To integrate the HSM with Microsoft Authenticode, the ncipher provider ncipher Enhanced Cryptographic Provider must be used with the makecert command. Example: makecert -sk mykey -sp "ncipher Enhanced Cryptographic Provider" -r -n "CN=myCertificate, E=myName@ .com" -ss mystore mycert.cer Where: -sk The location of the key container of the subject, which holds the private key. -sp The subject CryptoAPI provider name. -r Create a self-signed certificate. -n The name of the certificate belonging to the publisher. -ss The name of the certificate store of the subject, where the generated certificate will be stored. Convert the certificate to an spc file by entering the following command: Microsoft Authenticode Integration Guide for Microsoft Windows 3

7 Chapter 2: Procedures cert2spc mycert.cer mycert.spc Converting the certificate from.cer to.spc file is not required in case of Microsoft SDK Version 7.1. Signing and timestamping of the code is also possible with mycert.cer certificate. For example: signtool sign /f mycert.cer /p pin /csp "ncipher Enhanced Cryptographic Provider" /v /k mykey /t MyProgram.exe Signing and time-stamping the code with a Microsoft SDK The Time Stamp Server (TSS) provides a secure Authenticode time-stamp service, which protects the Time Stamp Authority key, the Time Stamp Authority (TSA) Certificate and the Time Attribute Certificate (TAC) that attests to the time calibration within the TSS. These credentials are protected within the confines of an nshield FIPS level 3 HSM. These steps apply to both Microsoft SDK 6.1 and Microsoft SDK 7.1. You can sign and time-stamp the code as follows: 1. Open a command prompt and change the directory to: C:\Program Files\Microsoft SDKs\Windows\<SDK Version>\Bin 2. Enter the following command with the appropriate parameter values: signtool sign /f mycert.spc /p pin /csp "ncipher Enhanced Cryptographic Provider" /v /k mykey /t MyProgram.exe Note: The parameter values shown above are for example purposes only, and should be replaced by the appropriate values for your system. The Microsoft Authenticode configuration with the nshield HSM is now complete and ready for use. Signing and time-stamping the code with Microsoft SDK 6.1 using the SignTool Wizard You can sign and time-stamp the code as follows: 1. Open a command prompt and change the directory to: C:\Program Files\Microsoft SDKs\Windows\<SDK Version>\Bin 2. Use the signtool signwizard command to launch the Digital Signing Wizard. 3. When the Welcome window opens, click Next. The File Selection window opens. 4. Select the file (*.dll, *.exe, and so on) that you want to sign, and click Next. Example:..\MyCode\MyProgram.exe 5. When the Signing Options window opens, select Custom, and click Next. Microsoft Authenticode Integration Guide for Microsoft Windows 4

8 Signing and time-stamping the code with Microsoft SDK 6.1 using the SignTool Wizard The Signature Certificate window opens. 6. Click Select from File. 7. Navigate to and select the generated Software Publishing Certificate (*.spc file), and click Next. The Private Key window opens. 8. If the key is generated using a Cryptographic Service Provider (CSP), select Private Key in a CSP, the appropriate CSP, and the Key container. Otherwise, accept the default, and click Next. The Hash Algorithm window opens. 9. Select the desired Hash Algorithm, and click Next. The Additional Certificates window opens. 10. Select any additional certificates to include in the digital signature, and click Next. The Data Description window opens. 11. If you want to provide further information about the data being signed, add an optional text description, or a Web URL, and click Next. The Timestamping window opens. 12. Select Add a timestamp to the data and insert the Timestamp service URL. Example: In the Completing the Digital Signature Wizard window, click Finish. 14. In The Digital Signing Wizard was completed successfully window, click OK. The Microsoft Authenticode configuration with the nshield HSM is now complete and ready for use. Microsoft Authenticode Integration Guide for Microsoft Windows 5

9 Chapter 3: Troubleshooting Chapter 3: Troubleshooting Use the following table to troubleshoot the error messages shown. Error Message ncipher CSP Providers are not displayed in the list of CSPs in the signtool signwizard utility. When Finish is clicked in the signtool signwizard utility, the message "The timestamping process did not complete" displays. Resolution Ensure that the ncipher CSP Wizard has been run with Set the ncipher CSP as the default SChannel CSP selected. Ensure that the URL is correct and includes.../tss/authenticodets. Microsoft Authenticode Integration Guide for Microsoft Windows 6

10 Internet addresses Web site: Support: Online documentation: International sales offices: Addresses and contact information for the main Thales e-security sales offices are provided at the bottom of the following page. Microsoft Authenticode Integration Guide for Microsoft Windows 7

11 www. t ha les-esecur it y. com About Thales e-security Thales e-security is a leading global provider of data encryption and cyber security solutions to the financial services, high technology manufacturing, government and technology sectors. With a 40-year track record of protecting corporate and government information, Thales solutions are used by four of the five largest energy and aerospace companies, 22 NATO countries, and they secure more than 80 percent of worldwide payment transactions. Thales e-security has offices in Australia, France, Hong Kong, Norway, United Kingdom and United States. For more information, visit Follow us on: