I have a requirement to use a SmartCard as the authentication mechanism for a WPF app. I can easily get and read the certificate info from the store, and detect whether or not the card is actually inserted into the card reader. However, I want to prompt the user to enter their PIN as a part of the initial login. Just having the card isn’t enough to verify their identity to the app.
I can get the PIN prompt if I use the certificate to sign some data, and just use some dummy data to get the desired behavior, but it seems like the wrong way to go about it. I’d think I should be able to get the PIN prompt as a part of some other method that would just return a boolean result. Am I missing something?
That’s the correct thing to do. Now verify that the given signature actually contains your “random data” (the nonce) to cryptographically verify the identity. Just asking for the PIN is not authentication.