SCEP for VPN Client : Security Problem !?

[berndtonn]

Hello,

I believe there is a security problem the SCEP implementation of the

VPN clients (at least using W2000), but perhaps I am missing something :

When a client receives a certificate using SCEP, this certificate is saved in the Cisco store. From my point of view this is unsecure, because anyone with access to the PC can copy the files (including the private key). Of course it is possible to encrypt the certificate using a password, but as far as I know there is no way to ensure that the user really does this.

Is there a way to enforce certificate encryption ?

Or better : Is it possible to put the certificates (more or less automatically) into the Microsoft store ? In the Microsoft Certificate Store the certificates are automatically encrypted using the user's login password.

Or am I missing something and there really is no problem ?

Any hints would be apprectiated.

Best regards,

Bernd

[Philip D'Ath]

With security there is always a better (more extreme option).

If your worried about people copying the security store, I guess you should be worried about people taking a ghost of the hard drive.

If you don't have any physical security, then you need to look at external security measures, like the eAlladin USB security token cards.

[berndtonn]

Even with a ghost copy of the whole disk you need the user's password to decrypt the file system. This provides some (for us : sufficient) level of security.

We (my company, my boss, ...) don't want to use token cards (at least at the moment). My question is : How can we take benifit from the best of both :

1) certificate enrollment elegant like SCEP

2) security as high as Microsoft certificate store

Is this possible, at least to some degree ?