Sample Header Ad - 728x90

PKCS#11 provider in OpenSSH: Is it possible to cache PIN?

3 votes
1 answer
832 views
I use a RSA key on a smartcard with an OpenSSH client. The smartcard is read by a smartcard reader with a pinpad. The key is protected with a PIN. Is it possible to cache the PIN somehow? I don't really like the need to write the PIN using the card reader keyboard every time I use ssh... It's not only annoying but it also makes IMHO too many possibilities for other people's eyes. My setup is Debian/Devuan + OpenSC + the typical "PKCS11Provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so" in .ssh/config. I tried to add to opensc.conf, framework pkcs15 following lines, but with no effect: use_pin_caching = true; pin_cache_counter = 64; pin_cache_ignore_user_consent = true; I use the same configuration on OpenBSD, and it's the same. As a smart card I use Aventra MyEID 4.5.5. As I am trying to learn as much as possible before using the technology in production, I have different card readers I can try: Cherry, Gemalto (now Thales) and SCM/Identiv.
Asked by d.c. (907 rep)
Mar 20, 2023, 09:51 PM
Last activity: Feb 12, 2024, 06:49 PM