Java 安全性 - MSCAPI 提供程序：如何仅从 USB 令牌中检索证书

Question

I have managed to use Sun's MSCAPI provider in my applet.

My applet simply lists certificates from Windows certificate store and lets user sign his/her transaction by allowing user select his/her preferred certificate.

I would like to prevent users from signing without a USB token/smart card, which means my applet shouldn't show/list a certificate if its private key is not stored in a USB token/smart card.

I retrieve certificates like this (Removed try catch block):

keyStore = KeyStore.getInstance("Windows-MY", "SunMSCAPI");
keyStore.load(null);

enumeration = keyStore.aliases();
while(enumeration.hasMoreElements()) {
    String alias = (String) enumeration.nextElement();
    Certificate ksCertificate = keyStore.getCertificate(alias);

    ...
}

I manage the signing like this (Removed try catch block):

// Retrieve private key
privateKey = (PrivateKey) keyStore.getKey(alias, null);

// Sign data by using certificate's signing algorithm
Signature signer = Signature.getInstance(certificate.getSigAlgName(), keyStore.getProvider());

signer.initSign(privateKey);
signer.update(data);
result = signer.sign();

I couldn't find any way to differentiate whether a certificate is from a USB token. I checked both Certificate and PrivateKey objects, however I couldn't find any attribute that could be helpful for me.

Any suggestions on how to do this with MSCAPI? Or any suggestions as MSCAPI alternative?

(The reason why I don't/can't use PKCS11 is that multiple brands of tokens need to be supported worldwide, and the requirement is that the applet shouldn't maintain the list of PKCS11 dll paths inside for each token. Retrieving dll paths from server side is also not accepted. So in this case I can't use PKCS11. Please correct me if I am wrong.)

Answer 1

I think it's too late reply.

Each USB token provider will give customized driver for their token. Ex.ePass or ProxKey has it's own driver. Location of driver (DLL/SO) file will be differ. File name of the Driver also will differ. So you can't read/initialize them in without mentioning proper driver path. You can go for https://github.com/joelhockey/jacknji11