2

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? OR is it both?.

What are the differences in the behaviour of the browser between typical certificate authentication (certificate is imported to the browser) vs. certificate authentication via a smart card?

This is very similar to the question I want answers to, but it is unanswered. Does Chrome cache smartcard PIN?

1 Answer 1

2

Assuming you use windows.

The PIN is cached to avoid having to re-enter it. The certificate is on the smart card and cannot be cached as the pin is used to unlock it. I don't think Chrome can cache the pin as it's handled by the credential providers and not the application itself.

Relevant info from https://docs.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-architecture#pin-caching:

PIN caching

The PIN cache protects the user from entering a PIN every time the smart card is unauthenticated. After a smart card is authenticated, it will not differentiate among host-side applications—any application can access private data on the smart card.

To mitigate this, the smart card enters an exclusive state when an application authenticates to the smart card. However, this means that other applications cannot communicate with the smart card and will be blocked. Therefore, such exclusive connections are minimized. The issue is that a protocol (such as the Kerberos protocol) requires multiple signing operations. Therefore, the protocol requires exclusive access to the smart card over an extended period, or it require multiple authentication operations. This is where the PIN cache is used to minimize exclusive use of the smart card without forcing the user to enter a PIN multiple times.

The following example illustrates how this works. In this scenario, there are two applications: Outlook and Internet Explorer. The applications use smart cards for different purposes.

  • The user starts Outlook and tries to send a signed e-mail. The private key is on the smart card.

  • Outlook prompts the user for the smart card PIN. The user enters the correct PIN.

  • E-mail data is sent to the smart card for the signature operation. The Outlook client formats the response and sends the e-mail.

  • The user opens Internet Explorer and tries to access a protected site that requires Transport Layer Security (TLS) authentication for the client.

  • Internet Explorer prompts the user for the smart card PIN. The user enters the correct PIN.

  • The TLS-related private key operation occurs on the smart card, and the user is authenticated and signed in.

  • The user returns to Outlook to send another signed e-mail. This time, the user is not prompted for a PIN because the PIN is cached from the previous operation. Similarly, if the user uses Internet Explorer again for another operation, Internet Explorer will not prompt the user for a PIN.

The Base CSP internally maintains a per-process cache of the PIN. The PIN is encrypted and stored in memory. The functions that are used to secure the PIN are RtlEncryptMemory, RtlDecryptMemory, and RtlSecureZeroMemory, which will empty buffers that contained the PIN.

3
  • Hi @Wrexthor, I understand that this is the behaviour of the OS when smart cards are used. What I specifically want to know is the behaviour of the browser when smart cards are used to certificate-based authentication. Jan 31, 2019 at 6:05
  • I think it also depends on the protection mode of the certificate, in highest security it asks for use every time.
    – eckes
    Mar 2, 2019 at 1:10
  • @RaveenAthapaththu I cannot remember whether it is ultimately a property of Microsoft's layer, or the layer provided by the smart-card software, but it is possible for application software to either purge the cache and/or require the PIN to be entered every time use is made of a smart-card's facilities (this is certainly possible with eSigner from Gemalto).
    – TripeHound
    Oct 28, 2019 at 10:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .