Reusing Java Keystore when accessing a smartcard on Windows

Question

I'm developing an application which uses SUNMSCAPI to access a smartcard (electronic id) and retrieve some certificates.

Until a while back I could create the keystore and sign a list of files, without re-creating the keystore but now I can only sign one file at a time.

When signing a list of files the first file is signed correctly; when signing the second file I get an "insert smartcard" dialog and the smartcard being used is greyed out.

Has anyone seen this behaviour?

Are you using multithreading? It might also be Windows or another application that prevents the application from getting (full) access to the card. — Maarten Bodewes, May 21 '12 at 20:38
As you've had very few responses, perhaps you could post some code examples to show what you're working with? You may also wish to address the question from @owlstead. — Duncan Jones, Jul 31 '12 at 10:36

score 3 · Answer 1 · answered Jul 31 '12 at 12:16

Yes, I have seen this before.

I was developing the front end and middleware for the Portuguese ID card to be used online and one particular feature was to be able to sign more than one file (electronically sign) and this was the exact behaviour we had!

The security model on smartcards ensure that one authentication lasts only one action. Signing a file is one action so we had to cache the authentication details (PIN code) and loop over the authentication procedure for every file we wished to sign.

Could very well be that this us the correct answer. Note that the access control to the signing operation is card specific and sometimes even user configurable. — Maarten Bodewes, Jul 31 '12 at 17:01

Reusing Java Keystore when accessing a smartcard on Windows

1 Answers1