Re: HW Sec Workshop - Citizen Identity

I think you're correct: this scheme explicitly calls out PIV, and while
some sort of PKCS#11 bridge sounds like a great idea to PIV card
manufacturers, from my perspective (as someone sitting in the middle
between the PIV card manufacturers and the browsers) I do not think browser
vendors are interested in generally adopting a PKCS#11 bridge into
browsers. I agree with not exposing PKCS#11 into the browser:
authentication strategies for the web need to respect the Same-Origin
Policy, and PKCS#11 does not.

Without respecting SOP, users are asked to make decisions about the mapping
of origins to their hardware tokens, and any time you introduce user choice
into authentication you're making the user experience more hostile and
weakening security.

-- 
Tony Arcieri