Question

We have been handed a set of test sertificates on smart cards for developing a solution that requires XML messages to be signed using PKI. Each (physical) smart card seems to have two certificates stored on it. I import them into the Windows certificate store using software supplied by the smart card provider, and then use code resembling the following to iterate over the installed certificates:

foreach (X509Certificate2 x509 in CertStore.Certificates) {
  foreach (X509Extension extension in x509.Extensions) {
     if (extension.Oid.Value == "one we are interested in") {
        X509KeyUsageExtension ext = (X509KeyUsageExtension)extension;
        if ((ext.KeyUsages & X509KeyUsageFlags.DigitalSignature) != X509KeyUsageFlags.None) {
            // process certs here

We have been told to use the certificates that have the NonRepudiation key usage flag set to sign the XMLs. However, the certificate that has the NonRepudiation flag has this flag only, and not for instance the DigitalSignature flag which I check for above. Does this strike anyone but me as slightly odd? I am in other words told to sign with a certificate that does not (appear to) have the DigitalSignature usage flag set. Is this normal procedure? Any comments?

Thanks.

Answer 1

What key use does it have? You’re right, this is a little odd, however if, for example, the key was used to provide AD logins then it may not have the flags set for DigitalSignature use. That’s not to say you can’t use it for that, it just indicates that the certificate issuer provides no guarantee when you go outside the key’s indicated usage.