PKCS#11 driver prompts for PIN for each key

Question

I am using CardOS API driver from Siemens as PKCS#11 driver to load certificates from a PKI card as follows:

char[] pin = "123456".toCharArray();
KeyStore.PasswordProtection pp = new KeyStore.PasswordProtection(pin);
KeyStore keyStore = KeyStore.Builder.newInstance("PKCS11", Security.getProvider("SunPKCS11-verinice"), pp).getKeyStore();
keyStore.load(null,pin);
keyStore.getKey("key 1", pin);
keyStore.getKey("key 2", pin);

The driver prompts for a PIN for each key although i pass it as a parameter. Is there any other way to pass the PIN by API? Is there any "PIN cache" i can activate?

Answer 1

You can use a custom CallbackHandler capable of handling a PasswordCallback, as described in section 3.1 of the Java PKCS#11 guide. Caching passwords should be done with appropriate caution, of course.