ECC Smart card logon

This procedure sets up ECC (Elliptic Curve Cryptography) for Active Directory smart card logon. You need a read/write smart card that supports one of these ECC curves: prime256v1 / secp256r1, prime384v1 / secp384r1, or prime521v1. The steps below were written using a SmartCard-HSM with the OpenSC minidriver.

Part 1 — Issue an ECC certificate
Prepare the ECC certificate template
1

Open the Certification Authority console → right-click Certificate Templates → Manage

CA console - manage templates
2

Locate the Smart Card Logon template → right-click → Duplicate Template

Duplicate template
3

In the General tab, give it a name (e.g. Smartcard Logon ECC). In the Cryptography tab, change the Algorithm name to e.g. ECDG_P256. Optionally change the hash from SHA1 to SHA256.

ECC cryptography settings
Deploy the template

Back in the CA console, right-click Certificate Templates → New → Certificate Template to Issue → select your new template.

Deploy ECC template
Request the ECC certificate
1

Open certmgr.msc → Personal store → right-click → All Tasks → Request New Certificate

Request new certificate
2

Select Smartcard Logon ECC → click Properties

Select ECC template
3

Private Key tab → expand Cryptographic Service Provider → select the KSP associated with your smart card (usually Microsoft Smart Card Key Storage Provider)

Select KSP
4

Validate — the certificate will be issued and stored on the card. Verify with certutil -scinfo.

Certificate issued
Part 2 — Enable ECC certificates at logon

By default, ECC certificates are not shown on the Windows logon screen. Enable the Group Policy setting:

Computer Configuration → Administrative Templates → Windows Components → Smart Card → Allow ECC certificates to be used for logon and authentication

ECC GPO setting
Group Policy setting to enable ECC at logon

Alternatively, set via registry:

HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider
"EnumerateECCCerts"=dword:00000001

Knowledge Base articles

← Security Expertise