On Tuesday 28 November 2006 00:29, Andreas Jellinghaus wrote: > but while we will be able to agree on most parts, I think there > won't be one solution that fits everyone. for example some people > are fine with pin in config files, even want that. (if my root > partition is encrypted, why not store sensitive data like that on > it?)
I don't think so... It is just like you define GUI requirements for applications. This is another area developers are failing... For example, many developers don't none mouse functionality, which in turns make the application unusable for disabled people. Another example is the use of colors, which makes application unusable for color blinded people. There is a set of rules of how to write GUI applications... But many people just not follow them. Exactly the same should be for smartcards... The existence of such baseline will enable use to provide proper support. > > 3. If the user removes and inserts his card, the application > > should reprompt for PIN when private object is accessed. > > > > 4. If the user removes the card from one reader and insert it to > > another reader, the application should detect that it is the same > > card, and not prompt the user for credentials again. > > I think the moment a card is removed the pin for it should be > forgotten. sure, your logic makes sence too, so people want choice. Application MUST support external PIN entry, application MAY support hardcoded PIN. > also I find it most interesting how some people use smart cards: > with pinpad reader, enter the pin once to verify, and then the > card remains in a state where the key can be used any number of > times. I would like to have that too! but it is not a solution > for everyone, for example for eid cards with lawful "qualified" > signature keys it is not allowed to have that in some countries. This is handled by the provider... No need to develope application support for this. > > 7. If application uses persistence connection, such as VPN or SSL > > session which initiated by smartcard operation, the session > > should be disconnected (if requested by user) once the smartcard > > is removed. > > I want my screen to lock when I remove my smart card, but why > shouldn't that cp command finish or the mail client continue to > check for emails and download new ones? again I think users will > have different opinions on this so they need choice. I don't understand... Lock if smartcard is removed is exactly what I mean... If you use the smartcard to perform logon, something should prevent other users to use your account when you remove the smartcard. Locking the session is good enough. > > 9. If application supports a standard interface, such as PKCS#11, > > it should allow to load more than one provider, so application > > can serve different users with different devices. > > several pkcs#11 modules at the same time? I thought pcsc would > make trouble with that - two connects to the same slot block one > of them with no option for testing "is this card in use?" to avoid > that. Multi vendors... > still even with different preferences, it would be great to put > this into a web page as reference for everyone who has plans for > adding smart card support to his applications. knowing all the > issues involved should make it easier to pick the right design if > you know about these advanced topics. Right! > lets start simple and see how we can walk from there. > A simple list of applications, structured in groups somehow, > with name and a small line what it does, and status yes/no/partial. > the name could be the link to a wiki page, where we put all the > details, like longer description, links to web page and friends, > which features are available, cavets, such reviews for specific > features and so on? > > or any other structure etc? Following some some samples... Best Regards, Alon Bar-Lev. Project: OpenVPN Middleware: pkcs11-helper, pkcs#11 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: yes. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: yes. 5. Ask for token: yes. 6. Protected authentication: yes. 7. Disconnect when card removed: next version? 8. Time out for PIN: yes. 9. Multi-provider: yes. 10. Multi-cards: yes. Project: OpenSSH - Native Middleware: opensc 1. Allow dynamic PIN entry: no. 2. Request PIN only when required: no. 3. Request PIN after card remove/insert: no. 4. Recognize card in differnet reader: no. 5. Ask for token: no. 6. Protected authentication: no. 7. Disconnect when card removed: no. 8. Time out for PIN: no. 9. Multi-provider: opensc. 10. Multi-cards: yes. Project: OpenVPN - PKCS#11 patch Middleware: pkcs11-helper, pkcs#11 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: yes. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: yes. 5. Ask for token: yes. 6. Protected authentication: yes. 7. Disconnect when card removed: no. 8. Time out for PIN: yes. 9. Multi-provider: yes. 10. Multi-cards: yes. Project: gnupg Middleware: native 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: yes. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: yes. 5. Ask for token: yes. 6. Protected authentication: ???. 7. Disconnect when card removed: n/a. 8. Time out for PIN: ???. 9. Multi-provider: n/a. 10. Multi-cards: partially, during learn only one card can exist. Project: gnupg-pkcs11-scd Middleware: pkcs11-helper, pkcs#11 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: yes. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: yes. 5. Ask for token: yes. 6. Protected authentication: yes. 7. Disconnect when card removed: n/a. 8. Time out for PIN: yes. 9. Multi-provider: yes. 10. Multi-cards: yes. Project: QCA Middleware: pkcs11-helper, pkcs#11 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: yes. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: yes. 5. Ask for token: yes. 6. Protected authentication: yes. 7. Disconnect when card removed: yes/events. 8. Time out for PIN: yes. 9. Multi-provider: yes. 10. Multi-cards: yes. Project: xsupplicant Middleware: engine_pkcs11, pkcs#11 1. Allow dynamic PIN entry: no. 2. Request PIN only when required: no. 3. Request PIN after card remove/insert: no. 4. Recognize card in differnet reader: no. 5. Ask for token: no. 6. Protected authentication: no. 7. Disconnect when card removed: no. 8. Time out for PIN: no. 9. Multi-provider: no. 10. Multi-cards: no. Project: wpa_supplicant Middleware: engine_pkcs11, pkcs#11 1. Allow dynamic PIN entry: no. 2. Request PIN only when required: no. 3. Request PIN after card remove/insert: no. 4. Recognize card in differnet reader: no. 5. Ask for token: no. 6. Protected authentication: no. 7. Disconnect when card removed: no. 8. Time out for PIN: no. 9. Multi-provider: no. 10. Multi-cards: no. Project: mozilla/firefox Middleware: nss, pkcs#11 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: no. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: no. 5. Ask for token: no. 6. Protected authentication: by provider attributes, may lead to incompatabilities. 7. Disconnect when card removed: no. 8. Time out for PIN: no. 9. Multi-provider: yes. 10. Multi-cards: yes. Project: thunderbird Middleware: nss, pkcs#11 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: no. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: no. 5. Ask for token: no. 6. Protected authentication: by provider attributes, may lead to incompatabilities. 7. Disconnect when card removed: n/a. 8. Time out for PIN: no. 9. Multi-provider: yes. 10. Multi-cards: yes. Project: openoffice Middleware: firefox, nss, pkcs#11 - unusable because of this relationship. 1. Allow dynamic PIN entry: yes. 2. Request PIN only when required: no. 3. Request PIN after card remove/insert: yes. 4. Recognize card in differnet reader: no. 5. Ask for token: no. 6. Protected authentication: by provider attributes, may lead to incompatabilities. 7. Disconnect when card removed: n/a. 8. Time out for PIN: no. 9. Multi-provider: yes. 10. Multi-cards: yes. _______________________________________________ opensc-devel mailing list opensc-devel@lists.opensc-project.org http://www.opensc-project.org/mailman/listinfo/opensc-devel
