Cockayne, Bill (NIH/CIT) [C] wrote:
Has anyone out there ever used a smartcard in a Blackberry sled to
provide “hands off” authentication to Bluetooth enabled workstations?
Not with the sled, but we have with the external bluetooth readers.
You can't do it with the RIM BT reader because the extra cryptographic
binding layer uses a OTP-like scheme. So you'd have to enter the OTP at
the workstation anyway.
The Apriva BT reader can work in this mode, but it can't be bound to
*both* the BB and the workstation at the same time. That's a bluetooth
limit *and* a limit of the additional crypto binding layer.
However:
1) It's not reliable.
2) It's a really *really* REALLY *REALLY* bad idea (i.e., it works
through walls, floors, and ceilings).
3) PIV authentication certs use the PIN-every-time access rule, so you'd
*still* have to enter the PIN on the workstation to log in.
Just Say No to your leadership on this one. (It's always senior leaders
who want this. And doctors. I suppose you have both. :)
-- Tim
<smime.p7s><ATT00001.txt>