Using two or more smartcard with smartcard enabled ID

Hello,

I want to know if it’s possible to use two or more smartcards with the smartcard-enabled ID ?

I saw that when I enable smartcard support for an ID, Notes will generate a CKO_DATA object on the card. This object is composed of the following fields :

Token, Private, Modifiable : true

Application : Lotus Notes

Label : Password : XXXXXXXXX (16 chars)

Value : Hex data

What is the meaning of the Label field ? Is the password string is the real password of the ID ? What is the meaning of the Value field ?

Is it possible to copy the content of this CKO_DATA object to another card ?

Also, how can I programmatically smartcard enable an ID ?

Thank you,

Anton.

Subject: Using two or more smartcard with smartcard enabled ID

I want to know if it’s possible to use two or more smartcards with the smartcard-enabled ID ?

When you smartcard-enable an ID file, information identifying the token is stored in the ID file. Notes will then prompt the user to enter the correct smartcard if a different token is in the reader.

Also, how can I programmatically smartcard enable an ID ?

You can use SECManipulateSC to programatically smartcard-enable an ID file. I’ve included some fairly sloppy pseudocode for SECManipulateSC below. As always, real code should check for errors and actually do something with return values. :slight_smile: SECManipulateSC is well documented in the C API Notes/Domino Reference; you should be able to find more useful details there.

Good luck,

dave

error = SECManipulateSC (SC_manip_GetVersion,

                         NULLSCMCTX,

			 NULL,

			 &Version,

			 NULL);

/* Initialize the PKCS#11 context.

*/

SCMCTX Context = NULLSCMCTX;

error = SECManipulateSC (SC_manip_InitializeContext,

			&Context,

			NULL, NULL, NULL);

/* Unlock the smartcard

*/

error = SECManipulateSC (SC_manip_EnterPIN,

			&Context,

			NULL,

			&dwPINLen,

			PIN);

/* Note – SC_manip_EnterPIN will use an external authentication path if it exists. If the token doesn’t support a protected authentcation path, SC_manip_EnterPIN will use the supplied PIN if one exists or generate a prompt if a NULL or zero-length PIN was used. */

/* Set up the ID file

*/

error = SECManipulateSC (SC_manip_EnterIDFile,

			&Context,

			 NULL, 

			&dwIDLen,

			IDPath);

/* Smartcard-enable the ID file

*/

error = SECManipulateSC (SC_manip_SCEnableID,

			&Context, 

			NULL, 

                       &dwPasswordLen,

                       pPassword);

/* Clean up

*/

SECManipulateSC (SC_manip_TerminateContext,

	   &Context, 

             NULL, NULL, NULL);

Subject: RE: Using two or more smartcard with smartcard enabled ID

Thank you Dave,

But if a user have two smart cards (one for backup), the only way to enable the second card is to pass through recovery process (to disable the first one)? Right ?

I’ve done different tests and remarked that if I have the extension manager that is registered for EM_GETPASSWORD, the method is always called even if I use smart card enabled ID. What’s the point here ?

Thanks,

Anton.

Subject: RE: Using two or more smartcard with smartcard enabled ID

UPDATE: EM_GETPASSWORD support for smartcard-enabled IDs was added to 6.0.4/6.5.1

But if a user have two smart cards (one for backup), the only way to enable the second card is to pass through recovery process (to disable the first one)? Right ?

Correct.

I’ve done different tests and remarked that if I have the extension manager that is registered for EM_GETPASSWORD, the method is always called even if I use smart card enabled ID. What’s the point here ?

That’s a bug. The extension manager cannot unlock an ID file that is protected by a smartcard. I’m looking into the possibility of adding support for that into a future release.

dave

Subject: EM_GETPASSWORD with smartcard-protected ID files

I’ve done different tests and remarked that if I have the extension manager that is registered for EM_GETPASSWORD, the method is always called even if I use smart card enabled ID. What’s the point here ?

You’ll be able to use EM_GETPASSWORD extension manager callouts to unlock smartcard-protected IDs by passing the smartcard’s PIN in through the extension manager in 6.0.4 and 6.5.1.

dave