Feature request for future OpenPGP card: force PIN

[Peter Lebbing]

On 08/02/13 13:51, Werner Koch wrote:
> In any case it is not a security measure because the host may simply
> cache the PIN and and silently do a verify command before each sign
> operation.  To avoid that simple workaround, a pinpad reader which
> filters the VERIFY command would be needed.

I have an SCM SPR 532 reader with pinpad; I thought the host could not get at
the PIN when entered on the pinpad? The way I understood it, the host sends a
VERIFY command "template" to the reader which the reader fills in with the PIN
entered on the pinpad of the reader, and then forwards to the smartcard.

I understand that if you enter the PIN on the keyboard of your PC, the force
signature PIN flag is completely useless.

Thanks for sharing the rationale for the force signature PIN flag.

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at <http://digitalbrains.com/2012/openpgp-key-peter>