The OpenPGP application on CanoKey uses a user PIN, an Admin PIN, and an optional Reset Code, and can additionally require a physical touch before cryptographic operations. This page describes the default values and the policy semantics.
| Item | Default | Minimum Length | Maximum Length |
|---|---|---|---|
| PIN | 123456 |
6 | 64 |
| Admin PIN | 12345678 |
8 | 64 |
| Reset Code | empty | 8 | 64 |
| Signature PIN | forced (PIN verification required for each signature) | — | — |
| Touch Policy (SIG, DEC, AUT) | off | — | — |
| Touch Cache Time | 0 | — | — |
| Retry counters (PIN, Reset Code, Admin PIN) | 3 | — | — |
Firmware version 3.1.1 and later allow management software to set the retry counters for PIN, Reset Code, and Admin PIN from 1 to 15. Changing these values resets PIN and Admin PIN to their defaults. An existing Reset Code is not changed, but its retry counter is reset.
For DEC and AUT keys, after the PIN verification is successful, verification will not be required again until CanoKey is disconnected and reinserted.
For SIG, if forcesig is on, a PIN is required for each signature; otherwise, a PIN is only required for the first signature after power-on.
Touch policy is only effective when using the USB interface.
Depending on the firmware version, you can set the touch policy for SIG, DEC, and AUT in the CanoKey Console or via the gpg command. The value of touch cache time ranges from 0 to 255 seconds (0 means no cache).
Please use the “Settings” application in the CanoKey Console to modify the touch policy.
Please use GnuPG to modify the touch policy.