1. Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | CEH | ondrej@sevecek.com | www.sevecek.com |

2. Smart card logon  Motivation  Kerberos smart card logon vs. TLS client certificate authentication  CA requirements  Certificate requirements  Enrollment agents

3. Motivation  Passwords shorter than 12 chars are insecure  Can be cracked from  AD, local databases, password caches, NLTM and Kerberos traffic, LDAP simple bind, stored passwords, …  Windows passwords are MD4  Certificates are SHA-1 or SHA2  random keys, not transported easily without smart cards

4. SHA-1 problems  General brute-force attack at 2^80 4

5. Windows passwords  8 characters password?  80^8 possible passwords  2^x = 80^8 ??  x * log 2 = 8 * log 80  x = 8 * log 80 / log 2  x ~= 51  10 characters ~= 2^63  12 characters ~= 2^76 5

6. Kerberos vs. TLS  Kerberos TGT generation  password  PKINIT with certificate  TLS client certificate logon  require client certificate  prevents before-authentication attacks

7. CA requirements  Trusted  NTAuth trusted  CRL/OCSP available

8. Certificate Requirements  Domain Controllers  name of the domain  Smart Card Logon + Kerberos Authentication  User certificates  Kerberos PKINIT: Smart Card Logon  TLS client certificate auth: Client Authentication

9. Domain TLS User with RSA ExtensionValue SubjectCommon Name or Distinguished Name SANUPN Exporatable Keyno? Archive Keyno, transport encryption only Key TypeSignature Key UsageDigital Signature CSPall Base, Enhanced, AES providers EKUClient Authentication 1.3.6.1.5.5.7.3.2 Autoenrollmentyes Publish in ADno

10. Domain SC User with RSA ExtensionValue SubjectCommon Name or Distinguished Name SANUPN or AD mapped subject (Windows 6.0+) Exporatable Keyno? Archive Keyno, transport encryption only Key TypeSignature (AllowSignatureOnlyKeys GPO on Windows 6.0+) Encryption (required on 2000+, more secure) Key UsageDigital Signature CSPSmart Card compatible provider EKUSmart Card Logon 1.3.6.1.4.1.311.20.2.2 can be empty on Windows 6.0+, but if present, must contain Smart Card Logon EKU Autoenrollmentno? Publish in ADno

11. Enrollment Agent  aka Registration Authority (RA)  Generates requests signed by its own RA certificate  AD CS can apply more granular policies

12. Smart card and certificate logon Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | CEH | ondrej@sevecek.com | www.sevecek.com |