<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div id="x_compose-container" itemscope="" itemtype="https://schema.org/EmailMessage" style="direction:ltr">
<span itemprop="creator" itemscope="" itemtype="https://schema.org/Organization"><span itemprop="name"></span></span>
<div>
<div style="direction:ltr">Hm, I remember I had a problem the other way around: I could not make the pin entry dialog stop popping up for protected keys. Passing in password or callback did not do the trick. So if you don’t see such a dialog it might be the
key is unprotected? (Besides the normal keystore Protection of the User)</div>
<div><br>
</div>
<div style="direction:ltr">Old screenshot: http://itblog.eckenfels.net/uploads/screen/screenshot-token.png</div>
<div><br>
</div>
<div class="x_acompli_signature">
<div>Gruss</div>
<div>Bernd</div>
<div>-- </div>
<div>http://bernd.eckenfels.net</div>
</div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> security-dev <security-dev-bounces@openjdk.java.net> on behalf of Jason Mehrens <jason_mehrens@hotmail.com><br>
<b>Sent:</b> Friday, December 1, 2017 9:01:13 PM<br>
<b>To:</b> security-dev<br>
<b>Subject:</b> KeyStore.login pin validation for smartcard.</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hello security-dev,<br>
<br>
Using the java.security.KeyStore API is there anyway to force validation of the smartcard pin (on Windows)?
<br>
<br>
When testing it seems like the KeyStore.load method ignores the password parameter as I can pass invalid pins and it will not throw an error.
<br>
It seems to just using the existing user session from when the workstation was unlocked to gain access to the certificates on the smartcard.
<br>
I've tried to use the KeyStore.CallbackHandlerProtection too but it doesn't see to force validation of the pin either.
<br>
<br>
Maybe there is something I'm missing?<br>
<br>
What would be ideal is if the KeyStore.load was passed null or empty password the existing session was used otherwise if a pin was given force a re-validation of the given pin before loading the store.<br>
<br>
Thanks,<br>
<br>
Jason</div>
</span></font>
</body>
</html>