When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a smartcard PIN.
I have not removed the smartcard from the computer during this time.
The smartcard private key must be used again in sending the
CertificateVerify message of the TLS handshake when creating a new TLS session.
When I invalidate the TLS session AND remove the smartcard from the computer, I am reprompted for a pin when using Chrome.
When using Internet Explorer 9, invalidating the TLS session and not removing the smartcard (leaving it in) results in the windows security PIN prompt again.
Does Chrome cache the smartcard PIN for the duration of the smartcard being inserted into the computer?
*Also, the "more information link" in the Windows security prompt notes that the PIN is obviously passed in plaintext to the application requesting it. I did a quick search in the chromium source code but did not find anything. *