Is force_login supposed to force the user to re-enter their PIN?

[totszwai]

The line described in here:
https://github.com/OpenSC/libp11/blame/8e391f4f961be30581aaac02049cd38edab82881/src/util_uri.c#L493C13-L493C24

If force_login is true, it doesn't actually do anything... we currently have our own patch to do this:

+	// The force_login flag wasn't .. actually .. forcing a relogin?
+	// Maybe I'm misinterpreting what it was supposed to do?
+	if (ctx->force_login && slot_logged_in(ctx, slot))
+        	pkcs11_logout(slot);

Could you clarify what's the actual meaning of force_login? Thanks.

[mtrojnar]

The force_login option makes engine/provider invoke the PKCS11_login() libp11 API function even though CK_TOKEN_INFO does not include CKF_LOGIN_REQUIRED. See https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html for details.

[dengert]

If you want to force a login for each use of a key, Set the CKA_ALWAYS_AUTHENTICATE attribute of the private key.

"Re-authentication occurs by calling C_Login with userType set to CKU_CONTEXT_SPECIFIC
immediately after a cryptographic operation using the key has been initiated (e.g. after C_SignInit)."

Examples in:
https://github.com/OpenSC/libp11/blob/master/src/p11_key.c#L779-L830
https://github.com/OpenSC/OpenSC/blob/master/src/tools/pkcs11-tool.c#L2715-L2726

For example, PIV card with the 9C signing key enforce this on card by requiring a PIN APDU immediately before the crypto operation.