As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control the readers.
Our manufacturer can provide these cards with a PIN enabled or set to a predefined value.
What are the recommended workflows or processes for deploying PIN protected SAMs? Somebody mentioned that the SAM has a predefined PIN which is changed to a new random PIN by the terminal on first run. This PIN is then persisted locally?
Another approach is to use the SAMs identity. According to the SAM API doc, each SAM has it's own 32byte Identifier, which the API doc says can be used for local SAM PIN generation.
Any suggestions are welcome. I am also interested to get any recommendations for books on the topic of Smart card development.