I have a smart card which has PKCS#11 or other similar interface and it contains certificate and private key.
I would like to do a local (no network) authentication of user using the smart card and data on it protected by PIN.
What is a good scheme/algorithm to do it and trust it?
My first idea is to do the following:
- Enter username/PIN
- Log in as user to smart card (if fails, return false)
- Check the validity of certificate (if not valid, return false)
- Check if username equals CN in certificate (if not, return false)
- Generate random data and sign it using private key on smart card
- Check if the signature is valid (if not, return false)
- Return true
Does it makes sense? Or are there any standards regarding this?