In Mozilla products, the softoken can be in two (optional) different operating modes: FIPS mode or default mode. After inspecting the user profile folder in the Windows installation and after using a software monitoring tool (EasyHook filemon), we found that users’ keys and certificates are stored in the following files: ke圓db.db and cert8db.db, all under the user controlled Profiles/PROFILEUNIQUEID (on Windows 7). Rather, they are profile- centric as shown in Figure 1. Although common to all Mozilla products, we found that the NSS and softoken installations and related infrastructure are not shared among different Mozilla products’ installations: imported or generated keys and certificates in one Mozilla instance are not visible by the others. The certification authority and certificates were generated using the OpenSSL application and stored in files for later import into the applications. 2) Key Storage: Before starting with our experiments, we generated a simple certification tree composed by a Certifica- tion Authority (named Unicamp-SERASA) and three user keys and certificates (Roberto Gallo A1, Ricardo Dahab A1, and Eliane Otoni A1). The softoken perform every cryptographic operation required for Mozilla products, which in- cludes (i) mutual authentication of SSL connections, (ii) encryption and decryption operations for S/MIME messaging, and (iii) signature and verification operations for messaging (e-mail). In NSS implementation, the softoken, a dynamically load- able library, is the responsible for storing the user’s private keys and certificates. PKCS#11 devices are capable of performing all major cryptographic operations regarding both asymmetrical and symmetrical encryption and can be used to store critical security parameters (keys, certificates, others). In NSS, keys and certificate life cycles are handled by the Software Token Device (softoken), a virtual cryptographic device compliant to RSA Labs Public Key Cryptography Standard #11, the Cryptographic Token Interface (Cryptoki).

Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, SMIME, X.509 v3 certificates, and other security standards. NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Instead, they rely on the platform independent Netscape’s Network Security Services (NSS) framework. 1) Introduction: Mozilla products do not use the underlying operating system key storage and management facilities. C ONDUCTED A TTACKS In this section we propose and conduct attacks to commonly used software cryptographic service providers.

Firefox os x forefox cert store