Case Study: On the Security of Key Storage on PCs

Abstract

In this work we review the security of the industry standard, software-based, cryptographic services providers Mozilla NSS Softoken and Microsoft CAPI CSPs. We also provide practical measurements of the user experienced security level. We found that this security level is much lower than expected and some service providers should be avoided.