CN105227312A - Intelligent code key password authentification extracting method - Google Patents

Abstract

What the present invention relates to is a kind of extraction and verification method of encrypted message of intelligent code key.The key information of intelligent code key exports in KEYBLOB data block by the present invention, afterwards by obtaining the cleartext information of key to the deblocking of KEYBLOB data block.According to the key obtained, verification of correctness can be carried out to the algorithm of intelligent code key.The compliance that this invention can be applied to intelligent code key detects, and has certain using value for the production firm of intelligent code key and Product checking department.

Description

Intelligent code key password authentification extracting method

Technical field

The invention provides a kind of extraction and verification method of intelligent code key USBKey encrypted message, encrypted message here refers to the session key information be stored in intelligent code key, instead of the PIN code that user inputs usually.Utilize the present invention can detect the correctness of algorithm of intelligent code key.The invention belongs to information security field.

Background technology

Intelligent code key, as one of the instrument of authenticating user identification, is having a very wide range of applications at present.At some in particular cases, such as to intelligent code key carry out compliance detect time, need read the key information stored in intelligent code key and obtain whole clear datas, with work such as the checkings after carrying out.Microsoft formulate CryptoAPI be the interface standard that intelligent code key is managed more common at present, based on CryptoAPI interface standard and intelligent code key, various secure authentication technology and system can be realized.

Through finding the data-searching of prior art, CryptoAPI does not provide the method directly derived the plaintext of the key information that intelligent code key stores.Only in the help and support website of Microsoft (http://support.microsoft.com/kb/228786/en-us), a kind of method based on the session key information importing and exporting of " index 1 " key is provided.Although this method can carry out derivation and the importing of key, complicated operation, the session key information producing " index 1 " double secret key intelligent code key is dexterously needed to be encrypted or to decipher.This can affect the performance of detection system to a great extent, and when generating " index 1 " key, generally need the PIN code inputting intelligent key key just can obtain corresponding authority, this is the restrictive condition suffered by said method.

Summary of the invention

The present invention is directed to the deficiencies in the prior art, provide a kind of intelligent code key key information based on CryptoAPI interface extract and verify the method for intelligent code key cryptographic algorithm correctness.This method, when reading session key information, does not need input PIN code to extract.Therefore the restrictive condition of this method is less, also can extract session key information when not knowing PIN code.

The present invention is achieved through the following technical solutions, first the present invention obtains the KEYBLOB blocks of files information of key by the CryptExportKey method of CryptoAPI, secondly corresponding data processing is carried out to KEYBLOB blocks of files information, finally obtain the cleartext information of key.After obtaining the cleartext information of key, other Encryption Tool is utilized to carry out correctness test to the algorithm of intelligent code key.Because common session key information can directly derive in PLAINTEXTKEYBLOB mode, in this manner, do not need to produce other double secret key session key information and carry out extra cryptographic operation, therefore can not produce the operation of input PIN code yet.Thus simplify the process extracting key information.

The present invention includes following steps:

Step one, obtains intelligent code key key handles, and key handles obtains by CryptGenKey or CryptGetUserKey method, and session key handle stores with HCryptKey type in CryptoAPI.

Step 2: utilize CryptExportKey method to derive the KEYBLOB blocks of files of the session key that intelligent code key stores.KEYBLOB blocks of files is the packet after encapsulating key data, according to the type of key and the setting of deriving method parameter, there is polytype KEYBLOB blocks of files.If adopt ciphertext mode to derive, then need the key of specifying encryption key data.

Step 3: according to the type of KEYBLOB blocks of files, deblocking KEYBLOB block header information, deciphering KEYBLOB data message, obtains the cleartext information of key.If the type of KEYBLOB blocks of files is PLAIBTEXTKEYBLOB, so data message is without the need to being decrypted, and what obtain after removing header information is exactly key plain information; If KEYBLOB blocks of files is other types, as SIMPLEBLOB, so after removal header information, also need decrypt data, the key of deciphering comes from step 2 the key used when deriving KEYBLOB.

Step 4: first three step has completed the extraction of key information, the cryptographic algorithm of this step to intelligent code key is verified.Use intelligent code key to be expressly encrypted appointment, utilize other Encryption Tool to be encrypted identical plaintext, the result obtained after comparing encryption simultaneously.

The method of the invention is extracted by analyzing the key information of KEYBLOB block data structure to intelligent code key and verifies, for common session key, achieves the extraction just carrying out key information when not inputting PIN code.Achieve the system to intelligent code key cryptographic algorithm verifying correctness on this basis.

Accompanying drawing explanation

Fig. 1: intelligent code key code extraction and checking flow chart.

Fig. 2: PLAINTEXTKEYBLOB data deblocking flow process.

Fig. 3: SIMPLEBLOB data deblocking flow process.

Embodiment

Below in conjunction with accompanying drawing, embodiments of the invention are elaborated.Intelligent code key of the present invention extracts the method for encrypted message, utilize CryptoAPI interface that encrypted message is exported to KEYBLOB data, again KEYBLOB data deblocking is obtained to the cleartext information of key in intelligent code key, and realize the checking to cryptographic algorithm on this basis.

The present embodiment with structure key intelligent code key compliance detection system for target, and disclosed in supposing that the cryptographic algorithm that detects is.

With reference to shown in Fig. 1, intelligent code key code extraction and checking as follows:

The first step, after intelligent code key inserts detection system, obtains key handles.In this step, first need to utilize CryptAcquireContext method to obtain CSP(CryptographicServiceProvider, Cryptographic Service Provider) container, CSP, usually used as the driving of intelligent code key, is the realization of intelligent code key production firm to CryptoAPI interface.Afterwards, CryptGenKey or CryptGetUserKey method is used to obtain the key handles needing extraction.In the compliance detection system of intelligent code key, do not need to extract the key in the digital certificate in intelligent code key, only need to use CryptGenKey to produce interim session key.In the process producing session key, need the parameter of specifying key, comprise the second parameter of the ID(CryptGenKey of key algorithm) and whether support to derive (the 3rd parameter of CryptGenKey).The present invention needs to derive key, and therefore the 3rd parameter must be set to CRYPT_EXPORTABLE.The key handles that this step obtains stores with HCRYPTKEY form.

Second step, derives the KEYBLOB blocks of files of the session key that intelligent code key stores.In this step, need to call CryptExportKey method for twice and derive session key in KEYBLOB blocks of files.Wherein, first time calls the length that the method can obtain the KEYBLOB data block derived.Afterwards, according to the length obtained to internal memory application space, second time calls the method, then all exported in specified memory space by session key.It should be noted that, as the intelligent code key compliance detection system of checking conversation key safety, not needing the session key to deriving to be encrypted protection.Therefore, can be set to PLAINTEXTKEYBLOB to the KEYBLOB type parameter in CryptExportKey, processing procedure so below can be very simple.In other cases, KEYBLOB may be set to SIMPLEBLOB, now key data encrypted after export again, encryption key can produce with CryptGenKey, but it should be noted that, type of encryption key is now necessary for AT_KEYEXCHANGE, and generation exchange key generally needs input PIN code to obtain.

3rd step, deblocking KEYBLOB block header information, deciphering KEYBLOB data message, obtains the cleartext information of key.In this step, according to the type of KEYBLOB, corresponding process can be different.For the data block of PLAINTEXTKEYBLOB type, handling process as shown in Figure 2, directly removes front 12 bytes of data block, and what obtain is exactly the cleartext information of key; For the data block of SIMPLEBLOB type, as shown in Figure 3, equally also be need first to remove head 12 bytes, but SIMPLEBLOB data block is encrypted key, so also need to call CryptDecrypt method, use the exchange double secret key decrypt data in second step, finally obtain key data.

4th step, verifies the cryptographic algorithm of intelligent code key.In this step, need to utilize existing Encryption Tool, as online encrypting web program, the checking of secondary encryption algorithm.First, use intelligent code key to be encrypted fixing plaintext, encryption key parameters uses the key handles obtained in first step.Secondly, utilize ready-made Encryption Tool, the key data using the 3rd step to obtain is encrypted fixing plaintext.The encrypted result that both produce is contrasted, thus the correctness result of checking intelligent code key cryptographic algorithm.Here it is noted that two kinds of cipher modes must be consistent with encryption mode to the fill method of clear data.CryptoAPI acquiescence adopts PKCS(ThePublic-KeyCryptographyStandards) filling mode and ECB encryption mode.

Claims (3)

1. intelligent code key code extraction and verification method, is characterized in that comprising the steps:

Step one, obtains intelligent code key key handles;

Step 2, derives the KEYBLOB blocks of files of the session key that intelligent code key stores;

Step 3, according to the type of KEYBLOB blocks of files, deblocking KEYBLOB block header information, deciphering KEYBLOB data message, obtains the cleartext information of key;

Step 4, uses intelligent code key to be expressly encrypted appointment, utilizes other Encryption Tool simultaneously, uses the identical plaintext of the double secret key in step 3 to be encrypted, the result obtained after comparing encryption.

2. intelligent code key code extraction as claimed in claim 1 and verification method, it is characterized in that, the session key KEYBLOB derived can be PLAINTEXTKEYBLOB or SIMPLEBLOB type, and the former does not need to specify exchange key, and the latter must specify exchange key; Exchange key to be produced at random by CSP.

3. intelligent code key code extraction as claimed in claim 2 and verification method, is characterized in that, in KEYBLOB data block deblocking process, first removes 12 head byte datas; For PLAINTEXTKEYBLOB, directly obtain key data; For SIMPLEBLOB, the KEYBLOB decrypt data exchanging double secret key removal head is used to obtain key data.