在Win 8.1和Win 10下禁用虚拟智能卡的PIN缓存

Question

We want to store digital certificates for PDF signing in virtual smart cards. Due to regulatory reasons (FDA, we are developing medical devices), we have to assure that the PIN protecting the certificate has to be (re-)entered again for each document to be signed. The default behavior seems to be that the PIN has to be entered only for the first document during a windows session. Is there any option to configure a "always prompt" policy, like it can be usually done for conventional smart cards?

Answer 1

First check that you are actually relying on the smartcard itself and not a kerberos ticket or something derived liek that, try klist and klist purge .

Check the Base CSP PIN Cache Policy settings here .

Alternatively, you can forcefully remove the PIN from the cache if you are using an CSP with: CryptSetProvParam(hProv, PP_SIGNATURE_PIN, NULL, 0)