DoD PKI Automatic Key Recovery Philip Noble (520)

DoD PKI Automatic Key Recovery Philip Noble (520)

DoD PKI Automatic Key Recovery Philip Noble (520) 538-7608 or DSN 879-7608, [email protected] U.S. Army Information Systems Engineering Command Fort Huachuca, AZ 85613-5300 ISEC: Excellence in Engineering

The Problem: One problem in the past with the DoD PKI infrastructure was the inability to recover Common Access Card (CAC) private encryption keys and certificates that were either expired or revoked. This becomes necessary when a CAC is lost and its certificates are revoked or when a CAC and the certificates it contains simply expires and is surrendered to DEERS/RAPIDS before the users encrypted emails have been decrypted.

An Auto Key Recovery capability has been fielded by DISA to permit holders of new CACs to retrieve encryption keys/certificates from previous cards to permit decryption of old email. ISEC: Excellence in Engineering The Solution: Steps to Recover

Private Encryption Keys The following slides identify steps to recover private encryption keys, escrowed by DISA, from CACs that do not have the Auto Key Recovery functionality. ISEC: Excellence in Engineering URL for Key Recovery https://ara-1.c3pki.chamb.disa.mil/ara/Key

Or https://ara-2.c3pki.den.disa.mil/ara/Key This is the Automatic Key Recovery URL. Note: The URL address shown above is case sensitive . When you go to this link, you must identify yourself with PKI credentials. Use ONLY your identity certificate! ISEC: Excellence in Engineering

At this time open the URL https://ara-1.c3pki.chamb.disa.mil/ara/Key Or https://ara-2.c3pki.den.disa.mil/ara/Key ISEC: Excellence in Engineering Choose Your

CAC Identity Certificate You will be prompted to identify yourself. Highlight your Identification Certificate from your CAC. Select it by clicking OK. Note: Do NOT choose any that contain the word EMAIL from the Issuer column. ISEC: Excellence in Engineering Warning Banner

Dismiss the warning by clicking OK. ISEC: Excellence in Engineering Processing Your Request The Automated Key Recovery Agent will compile a list of Recoverable Keys. Please Wait

ISEC: Excellence in Engineering Key Selection Browse through the list and locate the appropriate key you want to recover. When located, click the adjacent associated Recover button. ISEC: Excellence in Engineering Acknowledgement of

DoD Subscriber Select OK. ISEC: Excellence in Engineering Processing Request The Automated Key Recovery Agent is processing your request.

Please Wait ISEC: Excellence in Engineering One-time PIN This is your one-time PIN to access your Private Encryption Key if its saved as a separate file. Also, you will find instructions for both Netscape and

Internet Explorer web browsers. ISEC: Excellence in Engineering Installing the Certificate Open You will be given the opportunity to install the certificate, click Open.

ISEC: Excellence in Engineering Installing the Certificate (Contd) Click Next. ISEC: Excellence in Engineering

Installing the Certificate (Contd) Click Next. ISEC: Excellence in Engineering Installing the Certificate (Contd) Leave the check blocks unchecked, enter your Password, and click Next.

ISEC: Excellence in Engineering Installing the Certificate (Contd) Ensure that Automatically select the certificate store based on the type of certificate is selected (as shown above) and click Next. ISEC: Excellence in Engineering

Installing the Certificate (Contd) Click Finish. ISEC: Excellence in Engineering Installing the Certificate (Contd)

Click Set Security Level ISEC: Excellence in Engineering Installing the Certificate (Contd) Select High and Next ISEC: Excellence in Engineering

Installing the Certificate (Contd) Enter Your CAC PIN as a Password and Click Finish Note Vista requires a 14 character password for this step ISEC: Excellence in Engineering

Installing the Certificate (Contd) Click OK ISEC: Excellence in Engineering Installing the Certificate (Contd) Click OK.

ISEC: Excellence in Engineering Verifying the Download You can verify the successful download of your recovered Private Encryption Key by performing the following; Launch Internet Explorer, select Tools from the menu, and then Internet Options. ISEC: Excellence in Engineering

Verifying the Download (Contd) Certificates Click the Content tab. Now, click Certificates. ISEC: Excellence in Engineering

Verifying the Download (Contd) Select the Personal tab and you will see a list of your currently registered certificates, including the recovered new key certificate. ISEC: Excellence in Engineering Verifying the Download (Contd) Double-click on the certificate and you can view the specifics of

your recovered key (or other current keys) as illustrated above. ISEC: Excellence in Engineering Success Close the open window, you may now use the recovered key to access your encrypted email. Last Step: Delete the .P12 file from you computer as this is a

security vulnerability and will be detected in a Qtip Scan ISEC: Excellence in Engineering Recovery Notification Example A user has attempted to recover a key using the Automated Key Recovery Agent. The ID Certificate used for Authentication was: CN=NOBLE.PHILIP.EUGENE.1184204718,OU=USA,OU=PKI,OU=D

OD,O=U.S. GOVERNMENT,C=US, Serial: 0x0B5643, Issuer: DOD CLASS 3 CA-5. The key that was recovered was: CN=NOBLE.PHILIP.EUGENE.1184204718,OU=USA,OU=PKI,OU=D OD,O=U.S. GOVERNMENT,C=US, Serial: 0x0C8747, Issuer: DOD CLASS 3 EMAIL CA-3. If you did not perform this operation, please contact your local key recovery agent and ask that they check the logs for the key recovery at Fri Jul 01 16:48:12 GMT 2005 with session ID 1.c3pki.chamb.disa.mil23f%3A42c57335%3A68e46e9395fb9727. You will receive an email from

[email protected] with a subject ALERT! Key Recovery Attempt Using Automated Key Recovery Agent similar to the above Recovery Notification example notifying you of your recovery action. ISEC: Excellence in Engineering POC for Additional Information Philip E. Noble

USAISEC Information Assurance and Security Engineering Directorate (IASED) DSN 879-7608 CML 520-538-7608 FAX DSN 879-8709 CML 520-538-8709 [email protected] [email protected] [email protected]

[email protected] ISEC: Excellence in Engineering

Recently Viewed Presentations

  • What is Internal Audit - Administrative division

    What is Internal Audit - Administrative division

    In an "effective" internal control system, there are 5 components working to support the achievement of an entity's mission, strategies, and related business objectives. The Office of Internal Audits website has information on the mission of Internal Audits as well...
  • Choose a category. You will be given a

    Choose a category. You will be given a

    Choose a category. You will be given a question. You must give the correct answer. Click to begin. This visual illusion is the falsely perceived self-motion in relation to the motion of another object…..
  • Mental Math Math Mental March 18th - Your

    Mental Math Math Mental March 18th - Your

    Reflect & Share sheet . for your group. March 19th-Your next hand-in day is Monday, March 24. th- ... The bottom rectangular face will be covered in rubber and will not be painted. What is the total surface area Jessie...
  • Comparison of Robarts 3T and 7T MRI Machines

    Comparison of Robarts 3T and 7T MRI Machines

    Magnetization Prepared Rapid Acquisition Gradient Echo (MPRAGE) High Contrast, high spatial resolution 3D Structual. T1-weighted. Fats appear brighter than water. Stereotypical MRI image. Medical Biophysics 3970
  • Learning I: Introduction, Parameter Estimation

    Learning I: Introduction, Parameter Estimation

    Entropy of Hidden Markov Processes Or Zuk1 Ido Kanter2 Eytan Domany1 Weizmann Inst.1 Bar-Ilan Univ.2 Overview Introduction Problem Definition Statistical Mechanics approach Cover&Thomas Upper-Bounds Radius of Convergence Related subjects Future Directions HMP - Definitions Markov Process: X - Markov Process...
  • 2006 UAF Radiation Safety Training

    2006 UAF Radiation Safety Training

    The QF for neutron radiation is 10. The QF for alpha radiation is 20. Thus, alpha radiation is considered 20x more harmful than beta or gamma radiation with regard to biological damage. ... Needle should go into "BAT TEST" area.
  • Lecture 04: Knowledge Representation SIMS 202: Information Organization

    Lecture 04: Knowledge Representation SIMS 202: Information Organization

    Lecture 04: Knowledge Representation SIMS 202: Information Organization and Retrieval Prof. Ray Larson & Prof. Marc Davis UC Berkeley SIMS Tuesday and Thursday 10:30 am - 12:00 am
  • DV-B307: Microsoft User Experience Virtualization: How to ...

    DV-B307: Microsoft User Experience Virtualization: How to ...

    Security Group of UE-V Users - Full Control. NTFS permissions. Creator/Owner - Full Control - Subfolders and files only. Security group of UE-V users - List Folder / Read data, Create folders / Append Data . ... Dan Timpson. PowerShell...