SmartCard

Net iD Client tries to use all smart cards with known ATRs (answer to reset). But there are situations when other clients should handle specific smart cards, so you can add a whitelist or blacklist of supported ATRs.

The AutoUpdateKeyId parameter updates all connecting objects when CKA_ID is updated for an object. CKA_ID is used to connect private-key, public-key, and certificate. When this parameter is activated, an update of a private-key will also update the public-key and certificate.

Net iD Client uses any algorithm supported by the smart card. Some smart cards can configure support of the raw RSA algorithm so that the smart cards look identical. They will sometimes support raw RSA and sometimes not. To tell that raw RSA is supported when it is not can result in applications failing to use the smart card. This parameter disables raw RSA support even when the smart card implementation supports it.

The CalculateUsedTime adds an internal counter that tracks the execution time and records that to the trace file.

CheckExpire checks the validity period on the certificate. CheckExpire returns a value of the remaining time in seconds when less than or equal to the set value. If the remaining time is greater than the set value, it returns -1.

Command chaining is a method of sending data to the smart card that exceed 256 bytes. Normally this is handled by the smart card implementation, so never change this value.

The update counter is needed to track updates of objects or PIN on the smart cards. Some smart cards have a built-in update counter, and other allows the creation of a custom data object that will store this information. This parameter controls the creation and will only create if enabled.

The smart card cache stores all public data from the smart card to avoid reading the same data many times since the reading can be slow. The cache uses the cache service if it is available. It can also store the data on disk to keep the data even if the computer is rebooted.

Default profile is used when it is not possible to identify the smart card profile. It is used to investigate the smart card but should never be used for production environments.

Acceptable values are:

Most smart cards have an EFDIR file that can contain information about the smart card profile. Use the IgnoreEFDIR parameter to disable the reading of EFDIR.

The minimum and maximum sizes of RSA are specified in the smart card implementation. But it is possible to change those values for some smart cards. The upper WORD contains the minimum size, and the lower WORD contains the maximum size.

The minimum and maximum sizes of ECC are specified in the smart card implementation. But it is possible to change those values for some smart cards. The upper WORD contains the minimum size, and the lower WORD contains the maximum size.

Most smart card profiles have their own way to specify smart card label, but may also be stored in EFDIR.

LoginTimeout specifies the number of seconds the login procedure can be inactive. The counter resets when the PIN is used.

Resets the counter:

Does not reset the counter:

The MaxProfiles parameter tells the maximum number of smart card profiles. Usually, only one profile is required, but some smart cards contain many profiles.

Most smart cards create objects using primary PIN, even for secondary PIN objects. But some require secondary PIN when creating secondary PIN objects.

Multi-PIN tokens usually update the tokens using PIN1, even for objects connected to PIN2. The NoWriteMapping parameter contains a semicolon-separated list of smart card profiles that require PIN2 for the update of objects connected to PIN2.

Certificates are sorted based on certificate issuing date. The complete representation of date and time of day is given by 1970-01-01 00:00:00.

Sorting can be based on date, date and time of day, or no sorting.

The PinExpire parameter tells the number of days until a PIN change is required. Smart cards that support update counter with timestamps for PIN change can also include an automatic PIN expire functionality. This means that the end-user is forced to change the PIN at regular intervals.

PIN policy should be stored in the smart card profile. But the configuration can add more requirements. The PinMaxLen parameter tells the maximum number of characters in the PIN.

PIN policy should be stored in the smart card profile But the configuration can add more requirements. The PinMinLen parameter tells the minimum number of characters in the PIN.

PIN policy should be stored in the smart card profile But the configuration can add more requirements. The PinType parameter tells that a specific PIN policy is necessary.

The ProfileOrder parameter tells the search sequence in which to identify the smart card profile.

Separate the values with a comma.

There is some special handling for temporary smart cards. The TemporaryModel parameter contains a list of semicolon-separated models that are considered to be temporary.

There is some special handling for temporary smart cards. The TemporaryValidity parameter tells the validity period for models that are considered to be temporary.

Challenge-response to unlock PIN is supported on some smart cards. The UseChallengeResponse parameter tells which smart card models that can use challenge-response. Some smart cards use challenge-response for PIN1, and PUK for PIN2, so it is possible to specify different values for each PIN.

Some smart cards have an update counter, but may not store a timestamp. Some of those smart cards allows creation of data object, which will allow creation of an internal update counter that can use a timestamp. This timestamp then allows for the PIN expire functionality.

Some smart cards have a reference to the last update counter but did not make this counter updateable, so it must be disabled.

There are situations when the smart card is updated by external management software in parallel with our updating. The ValidateUpdateCounter parameter validates the current update counter before starting the smart card update.