Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just discovered that windows can store certificates and keys that an application uses in a 'crypto store'.

I would like to know how secure the store is? If I select for example high security and require a password to access the store when an application requests a crt or key, is it encrypted properly? Any idea what the encryption used is?

Other question is, if I don't require a password, then I can't see how it provides any security as the crt and keys must still be in plain text within the store and accessible to anyone who has access to my computer. In this usage case it seems about as secure as putting the crt and keys in a folder on the desktop called 'crypt store' or something. I.e it's just a way to organise things but doesn't add anything useful.

Thanks for info.

share|improve this question
up vote 1 down vote accepted

The default certificate store is as secure as any other system-encrypted file on your computer. E.g. if someone knows your Windows username/password and can log in, he can access the certificate without any problem. However, if someone just gain access to your hard disk, without knowing your Windows credentials, than he cannot get access to the certificate store. So, this is better than just plaintext file on your computer. But if you make that file encrypted, using default Windows tools, than their security is very similar: if you forget your password, or reinstall Windows, their contents are lost forever and cannot be recovered.

Obviously, since the certificate in the default store must be accessible to programs once you log in, stronger security is not possible without using external hardware.

share|improve this answer
I don't bother with having a password on my windows user account... It's too easy to bypass anyway. Looks like it's best to just select high security and set a password in the store. Just one more thing, do you know where the store is on the hdd? Can't browse it without using mmc. – starcraftcats Dec 24 '11 at 0:25
The certificate store is somewhere under c:\Users\All Users\Microsoft\Crypto, but don't mess with them directly. Just copying them won't work, e.g. for backup you need to use built-in functions, MMC, etc. – haimg Dec 24 '11 at 0:36
Thanks......... – starcraftcats Dec 24 '11 at 0:40
"I don't bother with having a password on my windows user account... It's too easy to bypass anyway." The only way to bypass the password is to have physical access to the machine. – surfasb Dec 25 '11 at 11:04
Your Windows credentials are used to protect the keys when encrypting stuff with the Data Protection API. If you forcefully reset the password without a proper system-generated password reset disk then the decryption keys are non-recoverable. If you use the High Security option then an additional password is used to protect the keys. The data cannot be recovered without knowing the Windows credentials as well as the High Security key. – Locutus Oct 29 '12 at 7:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .