Windows Forum
by brian_e
LoveAnne,
You almost answered your own question.
Exporting a users certificate to a floppy actually packages all relevent files into a single PFX file (Personal Information Exchange).
Importing does the reverse.
EFS implemented in Windows 2000 is still premature (as an example, you cannot share files encrpyted by a user). Eventually, I would expect this function to improve.
Certificates can be stored on a smartcard.
Regards,
Brian
by loveanne
Brian, thank you for the information. Importing is saving the relevant information such as the certificates and the private key itself to the hard drive; you are right.
But my problem is how can I use the relevant information in the data disk in itself without importing it?
When the information is imported, you can remove the disk and the files are still accessible. What about if I want that the disk is there all the time that if it is removed, the files are totally inaccessible?
by brian_e
The files exported are stored in a "package" file on the diskette.
Even if you could change all relevent registry settings to refer to A:, all the files are packaged. Like a ZIP file.
You cannot use the contents of a zip file without first unzipping them.
If you dont want to unzip them then don't zip them.
In other words, if you dont want to import the keys do not export them. You will have to find another method of exporting the keys that do not package the relevent files into a package file.
by brian_e
by loveanne
Thank you very much for the additional information. But such a method exists like the use of the Smart Card or so I understand.
My remaining and most important question now is "how can I change all relevant registry settings to refer to A" disregarding the condition of the files being packed in there?
Please be patient with me Sir.
by brian_e
Security by obscurity.
MS has hidden the keys in the registry. There are methods to extract these keys to a packaged file and to a smart card.
Microsoft does not support extracting these keys for use directly from the floppy disk. (re: my earlier comment about the current EFS implementation is rather basic).
I personally wouldn't trust finding every reference to a key in the registry when the retrieval of important data is at stake (otherwise, why would it be encrypted?)
I understand what you're trying to do.
Authentication is accomplished by:
1. What you know (ie. userid and password)
2. What you have (ie. a smart card or this "token" disk")
3. What you are (ie. biometrics like fingerprints or retinal scans).
Combinations of the above are ideal.
I wish you luck in your search. Your best bet is to search newsgroups. I too am doing this to accomplish the exact same thing.
I will most likely implement a smartcard.
Regards,
Brian
by loveanne
by loveanne
This discussion is closed to new replies.
Sort by Trending