CAPICOM

~ the eulogy ~

Microsoft shipped CAPICOM in May 2001 as a COM wrapper around CryptoAPI, which is a dull sentence hiding a specific kindness. Doing a digital signature against the real Windows crypto library meant C++ and a great deal of it. CAPICOM meant three lines of Visual Basic. You set the content and called Sign, and a PKCS#7 signature came back.

It was an ActiveX control, and that decided everything that happened to it afterward. VBScript and Active Server Pages could both call it, and so could a page open in Internet Explorer, which is how a browser came to sign documents with a certificate held on a smart card. John Lambert's introduction on MSDN called it a new security technology, available that day for download and free to redistribute.

I was at university while this was current, in a country where the bank and the tax office both assumed Internet Explorer and said so on the login page. That era is hard to describe to anyone who missed it. A site would instruct you to lower a security setting and accept a control before it would let you in, and you did it, because the alternative was going to a branch during working hours. CAPICOM is the component that made that pattern cheap enough to build everywhere.

~ the dossier ~

~ three lines of visual basic ~

It signed data as PKCS#7, attached or detached, and it could cosign, so more than one party could put a signature on the same contract. It verified signatures and could check revocation while doing it. Version 2.0 added Authenticode verification and AES. There was password-based symmetric encryption, and enveloping, which encrypted a session key separately for each recipient.

The certificate side was the part people used most. It could open the Windows stores by name and put up the standard picker dialog so a user chose their own certificate, and the key behind that certificate could sit in software or on a smart card or a USB token without the calling code caring which. For someone writing an internal signing tool in 2003, nothing else came near it for effort spent.

~ the security bill ~

On 8 May 2007 Microsoft published MS07-028, rated Critical. CVE-2007-0940: hand unexpected data to the CAPICOM.Certificates object and you got remote code execution, reachable from a web page. The official workaround was to set the kill bit on two CLSIDs, which is what Windows does instead of an uninstall when a control cannot be trusted to load.

The update could not even clean up after itself. CAPICOM was a redistributable that third-party installers dropped wherever they pleased, and the bulletin says outright that the update cannot determine where a given copy of the DLL came from, so old versions were left on disk for application compatibility. A scriptable crypto control that a web page could reach was exactly the shape Microsoft spent the following two years removing from Windows.

~ who got left behind ~

On 18 January 2009 Karin Meier posted that CAPICOM.dll had been removed from the Windows SDK for Windows 7 and should be considered a deprecated component. A colleague put it flatly that October: it had finally been deprecated and would not be supported on Windows 7. The last real build was 2.1.0.2, stamped April 2007. It was 32-bit only and had always been 32-bit only, and no x64 version was ever made. The download page hung on for another decade before it quietly became a 404 some time between October 2020 and April 2021.

The replacement guidance is a table of .NET classes, which is fine advice if you are writing .NET. For everyone else, Microsoft's own alternatives page still carries the sentence: none of the alternatives to CAPICOM offer a solution for scripts, therefore you must write your own ActiveX control. CAPICOM existed so that script authors would not have to write an ActiveX control. Under the deprecation posts sit long comment threads of developers with signed sidebar gadgets and browser-side signing forms, asking what they were supposed to do now and being told there was nothing anyone could do for them.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »