When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a smartcard PIN.

I have not removed the smartcard from the computer during this time. The smartcard private key must be used again in sending the CertificateVerify message of the TLS handshake when creating a new TLS session.

When I invalidate the TLS session AND remove the smartcard from the computer, I am reprompted for a pin when using Chrome.

When using Internet Explorer 9, invalidating the TLS session and not removing the smartcard (leaving it in) results in the windows security PIN prompt again.

Does Chrome cache the smartcard PIN for the duration of the smartcard being inserted into the computer?

*Also, the "more information link" in the Windows security prompt notes that the PIN is obviously passed in plaintext to the application requesting it. I did a quick search in the chromium source code but did not find anything. *

example of dialogue

  • Could you share that "more information link"? – StackzOfZtuff Oct 3 '17 at 6:27
  • 1
    @StackzOfZtuff the PIN prompt dialog has a "more information" link, you click on it – lmiguelmh Oct 5 '17 at 15:14
  • @StackzOfZtuff I got around to adding a screenshot of the dialog to the post. – ansonl Nov 13 '17 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.