Avoid on-disk cache for private data?

[frankmorgner]

Problem Description

In discussing https://github.com/OpenSC/OpenSC/issues/2208, on-disk file caching was suggested to speed up initializing the card. This is uncritical for public data. However, some objects may be flagged as private (SC_PKCS15_CO_FLAG_PRIVATE), which require user authentication before allowing it to read. On the one hand, I think it would be useful to not save such data on disk to prevent an unauthorized read. On the other hand, the file caching directory is created so that nobody else can read it (mask 0700 on Unix; User's application data on Windows).

Should we try to avoid caching private data or is this unreasonable given the limited access to the caching directory?

[metsma]

And please use standard paths, even on macOS to avoid Sandbox issues

[frankmorgner]

Could you give more details?

[metsma]

https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html

Chapter: The App Sandbox Container Directory

[frankmorgner]

Let's get back to the original question:

Do you think that

• [ ] yes, we should avoid caching private data or
• [ ] no, we should cache private data, because its access is restricted to the current user?

Unfortunately, a "thumbs up" is ambigious, here...

[szszszsz]

Hi! I think having this configurable would solve the issue, and leave that dilemma to the end user selecting best way for his use case. Would that be possible? Having at least public data cached would be desirable for some.

[dengert]

I vote to never cache private data.

[Jakuje]

@szszszsz @frankmorgner @dengert can you check #2588 if it looks good for you?

[dengert]

Looks OK to me.

I should point out card-piv.c loads and caches certificates to obtain the public key type, size and parameters. This is the only way to determine existence of public and private keys and attributes. The internal caching was also added to avoid doing any other APDU to the card between a context specific verify APDU and a signature operation which is enforced be the card. Early versions of Mozilla code would do a C_Login then C_FindObjects for certificates then issue a C_Sign, which would fail if the certificate needed to be read off the card again.