Share via

Windows Smart Card Technical Reference

  • Article

Updated: February 18, 2010

Applies To: Windows 7, Windows Server 2008 R2

The Smart Card Technical Reference describes the Windows smart card infrastructure and how smart card–related components work in Windows. This document also contains information about tools that information technology (IT) developers and administrators can use to troubleshoot, debug, and deploy smart card–based strong authentication in the enterprise.

Audience

This document explains how the Windows smart card infrastructure works. To understand this information, you should have basic knowledge of public key infrastructure (PKI) and smart card concepts. This document is intended for:

  • Enterprise IT developers, managers, and staff who are planning to deploy or deploying smart cards in their organization.

  • Smart card vendors who write smart card minidrivers or credential providers.

What are smart cards?

Smart cards are tamper-resistant, portable storage devices that can enhance the security of tasks, such as client authentication, code signing, securing e-mail, and logging on with a Windows domain account.

Smart cards provide:

  • Tamper-resistant storage for protecting private keys and other forms of personal information.

  • Isolation of security-critical computations involving authentication, digital signatures, and key exchange from other parts of the computer. The security-critical operations are performed on the smart card.

  • Portability of credentials and other private information between computers at work, home, or on the road.

Smart cards can be used to log on to domain accounts only, not local accounts. When you use a password to log on interactively to a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates.

In this technical reference

Additional resources