In our company domain we are now able to login to Windows using a smart card plus a 4 digit numeric PIN. The same smart card is used to sign e-mails too.
My understanding is that authentication to the domain does not involve the PIN directly, only the use of the private key stored on the smart card, in order to hash a given value that is then validated by the domain controller using the public key. The PIN is only used to 'unlock' access to the private key within the smart card.
Assume that I want to strengthen the credentials for authentication (analogous to increasing the minimum length and complexity, in domains where passwords are used). Given that a fixed number of invalid PIN entries will cause the smart card to lock itself, and given that the smart card is designed (e.g. tamper proofing) to prevent any other access to the private key it contains, which is more important:
- my ability to control the key length, algorithm and certificate expiry?
- my ability to control of the PIN length, character set and complexity?