Yubikey PIV and PIN Policy

[Valtteri Vuorikoski]

On Wed, Sep 16, 2026 at 03:00:00PM +0900, NIIBE Yutaka via Gnupg-devel wrote:
> Hello,
> 
> I'm currently creating a patch for: 
> 
>     https://dev.gnupg.org/T8442
> 
> The problem is Yubikey PIV support.  Currently, for the PIV.9C signing
> key, PIN verification is always required and this restriction is forced
> by scdaemon side (as well as the device itself).  It is the default
> behavior of the device and it conforms to the NIST SP 800-73-5.
> 
> On the other hand, Yubikey supports PIV policy setting per key slot, and
> a user can change the behavior, not requiring the PIN verification
> always, but once.
> 
> Currently, scdaemon doesn't care about the device setting, which should
> be fixed.
> 
> I don't have any experience with PIV.  Could someone help to evaluate
> the patch?

Fixed PivApplet and the scdaemon patch works fine for me now with that. The GET
METADATA command was broken for imported keys but working for on-card generated
keys.

It might be a good idea to preserve the old logic where slot 9C is hardcoded to
always-ask to deal with old Yubikey 4 devices (firmware older than 5.3) that
don't support GET METADATA and non-Yubico PIV cards.

 -valtteri