PKIBlackbox .NET - Vendor

What's new in SecureBlackbox PKIBlackbox 9.0:

• Added TElCAdESProcessor class, a high-level CAdES signature creation and processing component

SecureBlackbox PKIBlackbox - completely managed PKI components for .NET
PKI (Public Key Infrastructure) is a set of technologies, that utilize asymmetric cryptography for signing and encryption of sensitive data, and for authentication of various entities, such as web servers, individuals and organizations. One of the most important parts of PKI are X.509 certificates (also incorrectly called SSL certificates) which "certify" authenticity of the person or software, which presents the certificate. The certificates are also used for signing and encryption of data.

PKIBlackbox (.NET edition, part of SecureBlackbox software product) is a collection of managed components for PKI support in your C#, VB.NET. C++.NET, ASP.NET applications.

PKIBlackbox offers complete support for PKI infrastructure including X.509 certificates, certificate storages, data signing and encryption using certificates etc.

X.509 certificates were originally designed as a part of X.500 infrastructure. Since then, they have been adopted as a reliable source of authentication and integrity validation.

For a long time X.509 certificates were used for securing SSL sessions. Now certificates have become an integral part of other technologies, such as IPSec (low-level internet security), SSH (secure connection tunneling), S/MIME (Secure Mail), OpenPGP, PDF and XML signing and encryption and other.

PKIBlackbox lets you add PKI functionality to your software. This includes certificate management, data processing (signing, encryption, timestamping), executables signing. You can also build server-side functions for timestamping and online certificate status validation into your applications.

With PKIBlackbox you can use cryptographic hardware (cryptocards, USB tokens), compliant to PKCS#11 interface, in your PKI operations.

PKIBlackbox is a clean-room implementation of all supported algorithms, standards and protocols. It does not use CryptoAPI, OpenSSL or other third-party cryptographic library.

Basic functions of PKIBlackbox are included into all packages of SecureBlackbox. Advanced functions, namely PKCS#11 interface, TSP and OCSP servers, Authenticode, X.509 certificate generation and CRL signing require a license for PKIBlackbox, SecureBlackbox Transports, SecureBlackbox Data Security, SecureBlackbox Standard or SecureBlackbox Professional package.

Reasons to choose SecureBlackbox:

• Security. Strict observance of the standards and the most secure algorithms, used in the industry, ensures highest level of security of the offered solutions.
• Easy to use architecture. SecureBlackbox was carefully designed by software architects, who have extensive experience in software development and design.
• Flexible support policy. EldoS Corporation offers many support options, from forums and knowlegebase to free individual support and expert services.
• Flexibility. SecureBlackbox is an integrated suite of instruments, equally applicable for building complex security-related software solutions and for adding data protection to existing applications.
• Readiness for use. You can use SecureBlackbox even if you only have basic knowledge of information security and cryptography.

Feature list:
Most features or PKIBlackbox are included into all SecureBlackbox packages and they don't require a separate license. Those features, that require a license for PKIBlackbox, SecureBlackbox Standard or SecureBlackbox Professional, are marked as such.

Certificates - SecureBlackbox includes support for certificates in X.509 (versions 1-3) format. The following features and operations are offered:

• support for key length from 512 to 16384 bits;
• support for RSA, DSA and DH keys;
• support for Elliptic Curve Cryptography (ECC) - ECDSA keys;
• support for both standard (predefined) and custom certificate extensions (as defined by X.509 v3);
• saving and loading of X.509 certificates in DER, PEM (base64-encoded DER), PKCS#7, PKCS#8 and PKCS#12 (PFX) formats;
• saving and loading of private keys in DER, PEM (base64-encoded DER), PKCS#12 (PFX) and PVK formats;
• generation of self-signed and CA-signed certificates (PKIBlackbox license is required);
• validation of certificate integrity;
• (optional) FIPS-compliant operation mode

Certificate requests - SecureBlackbox supports creation and use of Certificate Requests in PKCS#10 format. Namely, the following operations are supported:

• generation of certificate requests and corresponding private keys;
• saving and loading of certificate requests in DER and PEM (base64-encoded DER) formats;
• saving and loading of private keys in DER, PEM (base64-encoded DER) and PVK formats;
• generation of certificates from certificate requests

PKIBlackbox license is required for PKCS#10 support.

Certificate Revocation Lists - SecureBlackbox provids support for Certificate Revocation Lists (CRL) according to RFC 3280, including

• creation and modification of CRLs (PKIBlackbox license is required);
• support for CRL extensions and CRL Item extensions;
• saving and loading of CRLs in DER and PEM (base64-encoded DER) formats;
• checking of certificate presence in CRL

In addition to CRLs, SecureBlackbox lets you check certificate status in real-time using OCSP (Online Certificate Status Protocol, RFC 2560). ElFileOCSPClient component can be used with any SecureBlackbox license. ElHTTPOCSPClient component uses ElHTTPSClient component, which requires a license for SSLBlackbox (client-only or client-server), Transports, Standard or Professional package.

OCSP server component lets you create your own OCSP responder (PKIBlackbox license is required).

Certificate Storage - with SecureBlackbox you can keep certificates in certificate storages. Certificate Storage management includes

• support for in-memory, file-based and system (Windows CryptoAPI) certificate storages;
• support for Cryptocards and USB Crypto Tokens via PKCS#11 and CryptoAPI interfaces (PKIBlackbox license is required for PKCS#11 interface);
• powerful search by various criteria, including issuer, subject, dates, e-mails and more;
• saving and loading of storages in PKCS#7 and PKCS#12 (PFX) formats;
• validation of certificates against certificates contained in the storage;
• multithreaded access to certificate storages;
• for Windows Certificate Storage - access to per-user and system-wide storages;
• for Windows Certificate Storage - access to system, registry and LDAP storages

Data encryption and signing - PKIBlackbox lets you encrypt, sign, decrypt and verify various data using X.509 certificates and offers

• implementation of CMS specification (RFC 3852);
• implementation of CAdES specification (RFC 5126);
• data encryption and decryption using RSA certificates and AES (128 to 256 bit), Triple DES (3DES), ARCFOUR, RC2, DES algorithms;
• data signing and verification using ECDSA (ECC-based), RSA and DSA certificates and HMAC, SHA512, SHA384, SHA256, SHA1, MD5, MD2 algorithms;
• data timestamping and timestamp verification using TSP (Timestamp Protocol, RFC 3161). Both TSP client and TSP server are available.

ElFileTSPClient component can be used with any SecureBlackbox license. ElHTTPTSPClient component uses ElHTTPSClient component, which requires a license for SSLBlackbox (client-only or client-server), Transports, Standard or Professional package.

TSP Server component requires a license for PKIBlackbox.

Code signing - with PKIBlackbox you can sign your executables and libraries in PE format using MS Authenticode™ technology and verify the signatures. Code signing with MS Authenticode™ is available in VCL and .NET editions. Code signing requires PKIBlackbox license.

Available editions
PKIBlackbox is available in several editions for various software platforms.

.NET edition. This edition of PKIBlackbox includes pure managed components, carefully optimized to achieve maximum performance, comparable to native processor code.
.NET edition requires .NET Framework 4.0, .NET Framework 3.5, .NET Framework 3.0, .NET Framework 2.0, .NET Framework 1.1, Silverlight 4, Silverlight 3, Mono 2.0, Mono 1.0, .NET CF (Compact Framework) 3.5, .NET CF 2.0, .NET CF 1.0.
.NET edition can be used on ASP.NET server systems, Windows desktop systems, Windows Mobile PDAs, Silverlight-enabled browsers, on Linux and MacOS X systems with Mono installed.

VCL edition. Blazingly fast native Delphi (Pascal) components for building native Windows and Linux applications. Usable with Delphi, C++ Builder or FreePascal (Win32 or x64, Linux/x86 or Linux/x64).
VCL edition works on any computer with Windows 98 and later or with Linux kernel 2.4 and later.

ActiveX/DLL edition. ActiveX controls and Dynamically-Linked Libraries are useable with virtually any development tool, which supports ActiveX or DLLs. This includes ASP web pages, Visual Basic 6 applications, native C/C++ applications for Windows, shell and server-side scripts.
ActiveX/DLL edition works on any computer with Windows 98 and later.

Support requests from customers with Priority support are served ahead of requests from regular customers and evaluation version users.