5 ms·

As a DoD CAC user and developer, this is correct (although the card readers at my company are built into the laptop or inserted via a USB adapter). I don't thi

by jleehey 13y ago

As a DoD CAC user and developer, this is correct (although the card readers at my company are built into the laptop or inserted via a USB adapter). I don't think there is a background agent that maintains the key though, I just think the card reader is queried when the certificate is needed. After the cert has been verified, you're free to pull the card out.

gknoy 13y ago
The key never leaves the smartcard: the card hardware will not allow it to be retrieved. Rather, your system has drivers which ask the card to do all of the signing operations which your system would normally do if it had access to a key.
snuxoll 13y ago
> After the cert has been verified, you're free to pull the card out. Last time I checked DoD systems are configured to automatically log you out of your session upon removal of your CAC.
- count 13y ago
  This is an unrelated security measure, but you are correct. And if you pull the card out, you can't access anything anymore that requires it (and on a Windows domain that DOESNT lock / terminate the session, you'll be able to access things until your kerberos ticket expires or you need to get to something you don't have a ticket for).
  - michaelt 13y ago
    I once volunteered at a hospital where they made use of a smart card security system - among other things, it would log you out if you removed your card from the reader. This closed all the programs you were running - and logging back in was a slow process. Needless to say, the smart cards stayed in the users' PCs even when they weren't at their desks.
    - snuxoll 13y ago
      That's disappointing, Windows has multiple options to handle a smart card's removal, one of which is simply locking the screen, sad they decided to use the "force log off" setting instead.
- AjithAntony 13y ago
  I think this is a feature of the ActiveClient middleware. Also handles the PIN entry when you insert. Default windows behavior is to leave the certs in the cert store.

by jleehey 13y ago

gknoy 13y ago

The key never leaves the smartcard: the card hardware will not allow it to be retrieved. Rather, your system has drivers which ask the card to do all of the signing operations which your system would normally do if it had access to a key.

snuxoll 13y ago

> After the cert has been verified, you're free to pull the card out. Last time I checked DoD systems are configured to automatically log you out of your session upon removal of your CAC.

count 13y ago
This is an unrelated security measure, but you are correct. And if you pull the card out, you can't access anything anymore that requires it (and on a Windows domain that DOESNT lock / terminate the session, you'll be able to access things until your kerberos ticket expires or you need to get to something you don't have a ticket for).
- michaelt 13y ago
  I once volunteered at a hospital where they made use of a smart card security system - among other things, it would log you out if you removed your card from the reader. This closed all the programs you were running - and logging back in was a slow process. Needless to say, the smart cards stayed in the users' PCs even when they weren't at their desks.
  - snuxoll 13y ago
    That's disappointing, Windows has multiple options to handle a smart card's removal, one of which is simply locking the screen, sad they decided to use the "force log off" setting instead.
AjithAntony 13y ago
I think this is a feature of the ActiveClient middleware. Also handles the PIN entry when you insert. Default windows behavior is to leave the certs in the cert store.