什么是 etoken？
我需要编写一个代码来检查 etoken 中存在的数字证书的有效性。 我对 etoken 不熟悉。谁能回答我以下问题，
- 如何从etoken访问数字证书内容？
- 我们可以访问存储在 etoken 中的私钥吗？
- 当我们将etoken插入计算机时，它是否会复制计算机上的数字证书？如果是，那么它在哪里复制它？
我需要为此编写 C++ 程序。我们可以使用 Microsoft 提供的加密 API（如 CrypImportKey() CryptExportKey() ）来满足上述要求吗？
I need to write a code to check the validity of the digital certificate present in an etoken.
I am not familiar with etokens. Can anyone please answer my following questions,
- How to access the digital certificate content from etoken?
- Can we access the private key stored in etoken?
- When we plug the etoken to an computer then does it copy the digital certificate on the computer or not? If yes then where does it copy it?
I need to write C++ program for the same. Can we use Cryptographic API's (like CrypImportKey() CryptExportKey() ) provided by Microsoft for the above requirement?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
“etoken”是 Aladdin 生产的首批 USB 加密令牌之一的名称。您所要求的通常称为安全令牌。这是一个具有自己的内存的硬件设备，其中存储了证书和私钥。
令牌需要安装驱动程序才能正常工作。该驱动程序集包括 CryptoAPI 的 CSP（加密服务提供程序）的实现。 CSP 负责向 CryptoAPI 提供存储在令牌中的证书。回答您的问题：
"etoken" was the name of one of first USB cryptotokens produced by Aladdin. What you are asking for is usually referred to as security token. This is a hardware device with it's own memory, in which certificates and private keys are stored.
Tokens need drivers to be installed in order to work properly. The driver set includes implementation of CSP (Cryptographic Service Provider) for CryptoAPI. CSP does the job of presenting certificates, stored in the token, to CryptoAPI. To answer your questions:
关于你的第二个问题，我相信可以访问安全令牌上的私钥。安全令牌必须预先编程并以某种方式加载私钥。此外，上次更新证书时，我们使用发行者的 Web 界面在线进行更新，该界面安装了 ActiveX 模块，该模块将新证书上传到设备。我不知道此过程是否还上传了新密钥，但可能不会，因为我不认为您需要更改私钥来为自己创建新的公共证书（需要由颁发者签名才能信任）我相信）。
抱歉，我可能没有多大意义，因为我对公钥基础设施的整个概念还很陌生。
如果其他人可以验证/无效我的主张，请分享您的知识。
编辑：我发现了Alladin设备的硬件黑客：http://seclists.org/bugtraq/2000/May/48
基本上，可以读取 eToken 上的日期，但需要与设备板载内存有直接的硬件接口。
In relation to your second question, I believe it is possible to access the private key on the security token. The security token had to be pre-programmed and loaded with a private key somehow. Also, the last time we renewed our certificate, we did it online, using the issuer's web interface which installed an ActiveX module that uploaded the new certificate to the device. I don't know if this procedure also uploaded a new key but possibly not, since I don't believe you need to change your private key to create a new public certificate for yourself (which needs to be signed by the issuer to be trusted I believe).
Sorry I might not make much sense as I am new to the whole idea of Public Key Infrastructure.
If someone else could validate/invalidate my claims, please share your knowledge.
EDIT: I found this hardware hack for Alladin devices: http://seclists.org/bugtraq/2000/May/48
Basically, it is possible to read the date on the eToken but it requires a direct hardware interface to the device's on-board memory.