Re: OpenSC at FOSDEM 2018

Il 07/01/2018 15:14, Douglas E Engert ha scritto:

> Note that much of the middleware including pkcs11 runs in the user
> applications not in the OS.
IMO that's one of the problems. Connect the daemon to the user's
processes ("session" is limiting...).

> Some call this a security requirement.
I call it lazyness. Many programs use long-term locking only because
it's simpler to handle. You don't risk that objects change without you
knowing.

History is becoming a weight that prevents further evolution. Many
limitations are rooted in assumptions that are no longer true.
We'd need PKCS11-2018, a complete revision of the standard that ditches
a lot of dead weight.

> Others would call this a bug.
Ill-planned feature, since there usually are many processes.

> There are some things you can do. For some cards, OpenSC can cache
> certificates
> and other data in in the user's home directory. OpenSC can try and leave
> the card
> in a logged instate if you set the disconnect = leave see the comments
> in opensc.conf.
> But other applications not using OpenSC can still lock the access to the
> card at the PCSC level.
All the SC-aware programs I tried in Linux required OpenSC :)

BYtE,
 Diego

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot