143181 - Key operations fail when CAC card is removed and reinserted.

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[Stephane Saux]

[NSS_TIP_20020503]
Using ActiveCard CAC card on Kai's special build, configure to sign emails.
remove the smart card,
re-insert the smart card.
Try to send and email:
  You get prompted for the card pwd.
  The card is accessed,
  Yet the signature operation fails.

Note that the certs are visible in the cert manager.
For client auth, if you have selected "Ask everytime", the cert pickers appears,
yet the cliant auth fails.

This leads me to believe that the cert is visible, but the key isn't.

Assign to Kai, just for tracking since he doens't have a smart card.

Comment 1

[Stephane Saux]

adding to status whiteboard.

Comment 2

[Kai Engert [:KaiE:]]

John, can you reproduce this problem with the test build, too?

Does it only occur with the test build, or does it occur, too, with the trunk
build from the same day?

Comment 3

[Stephane Saux]

I don't think John has a CAC card.

However, Bob Relyea does have one, and he should be able to reproduce it.

I think that the NSS_CLIENT_TAG is not very useful to test with CAC cards. There
were a lot of other problems that were fixed recently that are probably not in
the tag.

Comment 4

[Kai Engert [:KaiE:]]

In that case, I think this bug should not block us from landing the tip of NSS
on the NSS_CLIENT_TAG.

Comment 5

[Stephane Saux]

I've tested with NSS_TIP_20020510 and it's still a problem.

Comment 6

[Stephane Saux]

Depends on NSS bug 144605

Comment 7

[bill]

using: Mach V build 2002052304

I set my master password timeout to be 2 minutes.
I use the certs on my smartcard to sign emails and log into SSL/IMAP, SMTP servers.

I composed a long message and hit "send".  The timeout had occurred so after a
few seconds I was prompted for the ActivCard master password.  I entered it and
after a few more seconds of smartcard activity an error popped up saying that
the signing certificate could not be found.

I verified that the cert was visible in the cert picker from the mail
settings->security dialog.  I re-picked the same certs.

I then tried again, and the message was sent out.

I then immediately tried to send another signed email and it also worked.
I then removed the card, reinserted the card and successfully sent another
signed email.

So the bug appears fixed since I can't reproduce the first error I observed. 
This patch *definitely* makes the smartcard experience much better.

Comment 8

[Kai Engert [:KaiE:]]

Marking worksforme as per shadow's comments.

Comment 9

[John Unruh]

V