Re: S/MIME in Thunderbird

2009-07-02 Thread Jean-Marc Desperrier
Nelson B Bolyard wrote: If Microsoft has merely taken a DER-encoded object from another standard and has incorporated it into a cert extension, that seems fine to me. I hope they did it in such a way that existing BER/DER parsers of the sMIMECapabilities attribute can just parse the extension

Problem reading certificate from hardware token

2009-07-02 Thread Udo Puetz
Hi all, I've googled to and fro and have only found another poster having roughly the same problem as I. The situation is this: I want to authenticate against a juniper SA 2500 firewall with a user and password AND a certificate. I have a safenet iKey 1032 token where I imported the p12

Re: Problem reading certificate from hardware token

2009-07-02 Thread Anders Rundgren
I can't help you with the specific problem [:-(] but I can help you with a diagnostic at least. Which is? Smart card vendors have spent decades on fighting each other on the spec/middleware side and naturally we all have to pay the price. Tokens for consumers have therefore been [rightfully]

Re: Problem reading certificate from hardware token

2009-07-02 Thread Nelson B Bolyard
On 2009-07-02 02:58 PDT, Udo Puetz wrote: I want to authenticate against a juniper SA 2500 firewall with a user and password AND a certificate. I have a safenet iKey 1032 token where I imported the p12 certificate. In firefox (tried 2.0.x, 3.0.x and 3.5.x) I imported the safenet K1PK112.DLL

Re: Problem reading certificate from hardware token

2009-07-02 Thread Michael Ströder
Anders Rundgren wrote: Linux: doesn't even provide a crypto service API, or does it? There's a PKCS#11 driver implementation by OpenSC project (see http://www.opensc.org/). Ciao, Michael. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org

Re: Problem reading certificate from hardware token

2009-07-02 Thread Eddy Nigg
On 07/02/2009 10:17 PM, Anders Rundgren: If you want to use Hardware tokens, PKCS #11, and Firefox you either must be nuts, a masochist, very smart, or highly committed. For all those which are nuts, masochists, smart and highly committed I blogged this article which shows how easy it can

Re: Problem reading certificate from hardware token

2009-07-02 Thread Kyle Hamilton
USB does actually have a PKCS#10 device reader profile. If you were to extend that by adding a generic oh, it also has a device in a slot that performs these functions layer that was exposed through the device-reader profile, it would be universal -- and universally implemented in the platform

Re: Problem reading certificate from hardware token

2009-07-02 Thread Anders Rundgren
PKCS #10? I guess you really meant PKCS #11. I'm not aware of any such profile. There is smart card profile but I doubt it has much to do with PKCS #11, it is rather about 7816. Anyway, the way Firefox is linked to PKCS #11 is probably OK in Linux-land. However, in Windows-land where 80% of

USB device profile for smart-card readers (was: Problem reading certificate from hardware token)

2009-07-02 Thread Kyle Hamilton
On Thu, Jul 2, 2009 at 1:06 PM, Anders Rundgrenanders.rundg...@telia.com wrote: PKCS #10?  I guess you really meant PKCS #11. I'm not aware of any such profile.  There is smart card profile but I doubt it has much to do with PKCS #11, it is rather about 7816. You're right, PKCS#11.

Re: USB device profile for smart-card readers (was: Problem reading certificate from hardware token)

2009-07-02 Thread Anders Rundgren
Kyle Hamilton wrote: 3) There is no desire at/for the bank to allow smart-card login, because there are alternatives that are more useful Exactly! It doesn't work for the really useful applications that could drive the market. Anders PS. There were some oddities in the

Re: Problem reading certificate from hardware token

2009-07-02 Thread Nelson B Bolyard
On 2009-07-02 12:17 PDT, Anders Rundgren wrote: If you want to use Hardware tokens, PKCS #11, and Firefox you either must be nuts, a masochist, very smart, or highly committed. For ordinary users it makes little sense. Hardware tokens: there are any number of different types PKCS #11: the

Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-02 Thread Anders Rundgren
Nelson B Bolyard wrote: If you want to use Hardware tokens, PKCS #11, and Firefox you either must be nuts, a masochist, very smart, or highly committed. Anders, The user has made a decision and we're helping him with it. That's fine, I have personally noted that these kinds of problems are