Yubikey PIV and PIN Policy

[Valtteri Vuorikoski]

On Wed, Oct 07, 2026 at 10:06:35AM +0900, NIIBE Yutaka wrote:
> It would make sense to extend GENKEY/WRITEKEY command of scdaemon, but
> currently, there is no way in GnuPG to configure this kind of
> device-specific metadata when it goes to GENKEY/WRITEKEY of scdaemon.
> (I assumed/assume that it is done by other tool.)
> 
> It would also make sense to extend SETATTR command of scdaemon.

Do you mean using SETATTR to set an internal state value in scdaemon to indicate
"make the next generated/written key have _this_ pinpolicy"? I guess that would
work too.

> Valtteri Vuorikoski wrote:
> > It might be a good idea to preserve the old logic where slot 9C is
> > hardcoded to always-ask to deal with old Yubikey 4 devices (firmware
> > older than 5.3) that don't support GET METADATA and non-Yubico PIV
> > cards.
> 
> Thank you for your suggestion.  Indeed, the patch I sent was not good
> for non-METADATA-supported device.
> 
> Attached is an update.  If no objections, this will be pushed to master.

I didn't have time to test the new version yet but the logic for falling back to
fixed decision looks good to me.

 -valtteri