Local Smart Card authentication

Question

I have a smart card which has PKCS#11 or other similar interface and it contains certificate and private key.

I would like to do a local (no network) authentication of user using the smart card and data on it protected by PIN.

What is a good scheme/algorithm to do it and trust it?

My first idea is to do the following:

1. Enter username/PIN
2. Log in as user to smart card (if fails, return false)
3. Check the validity of certificate (if not valid, return false)
4. Check if username equals CN in certificate (if not, return false)
5. Generate random data and sign it using private key on smart card
6. Check if the signature is valid (if not, return false)
7. Return true

Does it makes sense? Or are there any standards regarding this?

Answer 1

I suggest the following changes

1. Enter username/PIN
2. Log in as user to smart card (if fails, return false)

Usually smartcard with digital certificates do not have an "username". The pin it is needed to unlock the private key of the selected certificate

3. Check the validity of certificate (if not valid, return false)

Correct, this is needed to filter the available certificates. You can have several (I do not know if this is your scenario)

4. Check if username equals CN in certificate (if not, return false) This step is usually done after digital signature, because you do not what certificate the user is going to select.

Also you are assuming that user is logged and CN contains the username. When using smartcards to authenticate the process usually is the reverse: The user selects the certificate, and the username is extracted from a certificate attribute (CN, SERIALNUMBER or a custom one)

5. Generate random data and sign it using private key on smart card
6. Check if the signature is valid (if not, return false)

7. Check revocation of used certificate
8. Extract username from certificate and check if it is authorized

9. Return true

Answer 2

since this is a rather theoretical Question and you did not specified platform - Windows/Linux/Mac and infrastructure AD/standalone/workgroup. Rollout scheme/requirements etc. And since without network infrastructure - running a Certification Authority to issue a certificates is not possible.

My suggestion to simplify your approach:

1. Use PKCS#11 feature to custom data.
2. Elaborate data format to save UserLogin/Password/WorkstationName on the Card
3. Save smartcard serial number in a List of allowed cards.

In order to authenticate:

1. User insert Card and Enter PIN. Verify PIN. Login to card.
2. Reader Data from PKCS#11.
3. Check if user name / workstation name / Card Serial are OK - this will be your Factor 2 authentication
4. pass user name / password (from card) to local system Authenticaton (Windows/Mac/Windows)
5. handle error and display the UI

Spoofing smartcard serial number is rather complex attack and unlikely to happen.