I've been researching smart card auth and the pass the hash vulnerabilities that go along with it. There is a case I'm interested in but can't find documentation on.
Some of the devices I've looked at - notably the Yubikey 4 - only provide support for a single PIV certificate. From MS's documentation this cert can easily be mapped to multiple accounts, providing an easy way to switch between security contexts / levels.
This is great in theory, but if I'm recycling the same hash having multiple accounts isn't really providing any real security. Does using this single mapped certificate on the back end result in having the same hash across accounts?