Long login time via smart card

Question

Hello. We are using smart card login via RDP.

Login can be after entering pin code from 10 to 30 seconds.

How to diagnose this ?

Answer 1

Hi,

A couple of thoughts come to mind but it has been a while since I worked with Smart cards for login, so these may not be relevant.

First, I am going to make some assumptions. There is a certificate on the smart card. This is in an AD environment and you are using AD Certificate services for the PKI from which the smart card certificate was issued. The user is an AD User. That non-smart card logons are far quicker.

In this case when you are entering the PIN you are unlocking access to the private key for the smart card. The Smart card then does the crypto using that private key and sends the result back to windows. In your case this is over the RDP connection which can also add time.

1. If you are using large keys then the crypto function on the smart card can take longer than you think to process. Depedending on smart card capabilities.
2. your certficiate must be validate by windows. Trust checking and CRL/OCSP lookups can add to login times depedning on your environment.

Then windows logon takes over.

You can enable CAPI2 logging in event viewer to see if there are any issues there.

You can use wireshark or similar to check for delays with CRL/OCSP etc.

You can use a certificate with a shorter key length and see if that is any quicker.

Hope that helps

Answer 2

A couple of thoughts come to mind but it has been a while since I worked with Smart cards for login, so these may not be relevant.

First, I am going to make some assumptions. There is a certificate on the smart card. This is in an AD environment and you are using AD Certificate services for the PKI from which the smart card certificate was issued. The user is an AD User. That non-smart card logons are far quicker.

In this case when you are entering the PIN you are unlocking access to the private key for the smart card. The Smart card then does the crypto using that private key and sends the result back to windows. In your case, over the RDP connection.

1. If you are using large keys then the crypto function on the smart card can take longer than you think to process. Depedending on smart card capabilities.
2. your certficiate must be validate by windows. Trust checking and CRL/OCSP lookups can add to login times depedning on your environment.

Then windows logon takes over.

You can enable CAPI2 logging in event viewer to see if there are any issues there.

You can use wireshark or similar to check for delays with CRL/OCSP etc.

You can use a certificate with a shorter key length and see if that is any quicker.

Hope that helps