Re: Re[2]: What's the mean of PIN cache in smart card csp

Hi Skybird Le,

The PIN cache described by the Smart Card Cryptographic Service Provider
Cookbook is the PIN cache as it should be implemented by (i.e., inside) the
smart card CSP. E.g., during smart card logon, Windows will be passing the
PIN the user provided in the logon screen to the CSP using a
CryptSetProvParam call. Then, e.g. a CPSignHash function is called on the
CSP in order to sign a hash with the card's private key. The CSP will then
fetch the previously received PIN from its cache, because it will be needed
somehow to authenticate to the card to perform the signing operation.

This PIN cache is an internal impelementation of the CSP and is indeed not
shared by different processes. (It does however need to be accessible by
different threads within the same process.)

FYI, another PIN cache exists in Windows. It is the PIN cache that is used
by the Kerberos client to provide the PIN to the smart card CSP when a new
Kerberos TGT needs to be acquired from the Kerberos server. However, this
PIN cache is entirely undocumented. This is not the PIN cache as described
in the Cookbook.

Hope this can clarify things a bit for you.

Cheers,
Jan.


"Skybird Le" <skybird.le@xxxxxxxxx> wrote in message
news:20071212163651.7847.SKYBIRD.LE@xxxxxxxxxxxx
Can any one give me some help?


On Tue, 11 Dec 2007 18:04:49 +0800
Skybird Le <skybird.le@xxxxxxxxx> wrote:

I know how to get logon id by using Windows function OpenProcessToken,
OpenThreadToken
and GetTokenInformation(TokenStatistics), but should SR_Service.exe and
SR_CAPI.exe share the pin cache ?



On Tue, 11 Dec 2007 17:47:31 +0800
Skybird Le <skybird.le@xxxxxxxxx> wrote:

Hi, every one
In "The Smart Card Cryptographic Service Provider Cookbook"
whose URL is http://msdn2.microsoft.com/en-us/library/ms953432.aspx,
there is a "PIN caching" Design Considerations. I read it one time and
again and again, but still can not get its mean. How can I add the PIN
to the cache with the logon ID for the security context of the current
thread?
I notice it is very important, because the "Microsoft Base Smart Card
Crypto Provider"
can behave correctly with "checkpoint SecureClient NGX R60 HFA2" in
vista, but my csp can not work perfectly. Checkpoint SecureClient's
SR_Service.exe is a service, it call csp at first and then create a
child process SR_CAPI.exe with normal user's identity. The SR_CAPI.exe
calls csp to generate rsa key pair and sigh hash, during this progress
the csp will require smart card PIN with prompting PIN dialog, so
SR_CAPI.exe process's csp state is smart card pin provided and the pin
is cached in process. Now the SR_Service.exe will call csp to sign hash
using the generated rsa key bu SR_CAPI.exe, the "Microsoft Base Smart
Card Crypto Provider" does not
prompt PIN dialog as this process's csp state is pin provided and
cached,
but my csp will prompt to require smart card PIN.
According to smart card csp cookbook, the pin cache is
per-process, so the pin cache should not shared by two process, but why
"Microsoft Base Smart Card Crypto Provider" can share the pin cache in
two different process?

I expect your help!

Skybird Le





.

Relevant Pages

  • RE: Certs on smart card, re-prompting for PIN (Internet Explorer 6)
    ... If the CERTIFICATE is protected with PIN, ... Most Smart Card software allows the caching of the PIN (ie. won't prompt ... would establish an SSL connection between client and server - and the ... I notice that the smart card "middleware" has settings for either ...
    (microsoft.public.platformsdk.security)
  • Whats the mean of PIN cache in smart card csp
    ... How can I add the PIN ... I notice it is very important, because the "Microsoft Base Smart Card Crypto Provider" ... but my csp can not work perfectly. ...
    (microsoft.public.platformsdk.security)
  • Certs on smart card, re-prompting for PIN (Internet Explorer 6)
    ... The problem that we're encountering is that when we do the above, we are seeing the popup window asking for the smart card PIN, but this window is appearing multiple times, sometimes 10-20 times before we start seeing the initial partial webpage. ... I notice that the smart card "middleware" has settings for either caching the PIN, or for the middleware temporarily copying the client cert into the Certificate Store, and I'm pretty sure if we enabled either or both of these settings, that we'd avoid the multiple popup PIN windows. ... As mentioned above, the smart card middleware appears to have some settings that would also prevent the re-prompting for the PIN, but the workstations are locked down, and even if we could it would be a major process to get approval to change the settings, so I'm wondering if there is possibly something else that we can do to avoid the popup PIN windows from re-appearing. ...
    (microsoft.public.platformsdk.security)
  • Re: Caching PIN
    ... I know how a CSP name associated with a card be identified.But after getting ... The usual approach taken by smart card CSP's implementors is to cache the ... PIN in the context of the CSP dll, thus you don't need to care about the ... I had a list of available readers on the system and the PIN is ...
    (microsoft.public.platformsdk.security)
  • Re: Certs on smart card, re-prompting for PIN (Internet Explorer 6)
    ... Its purely a sign of poor card handling of your middleware. ... As mentioned we're using Apache as the webserver. ... normally the PIN is needed only when the PRIVATE KEY ... If the server requires authentication of EACH request then the smart card ...
    (microsoft.public.platformsdk.security)