#Pinless signing

#Specification (applet 3.x)

Signing using the pinless path can be done without opening a Secure Channel. Since in such a scenario no sensitive data is being transferred, the reasoning was that neither encryption nor authentication was needed.

#Defining a pinless path

Defining which path is used for pinless signing requires PIN authentication and thus a Secure Channel. This means only the owner can define which wallet is allocated for this operation. The SDK call is

cmdSet.setPinlessPath("m/44'/0'/0'/0/200").checkOK();

#Signing with pinless path

When a pinless path is defined, a wallet (or POS terminal) can invoke signPinless without knowing the path. If no pinless path was defined, the Status Word 0x6A88 is returned. Opening a Secure Channel and authenticating with the PIN before sending this command is allowed but not necessary.

cmdSet.signPinless(hashToSign).checkOK();

#Alternatives on 4.0

• For unattended signing where the service must not hold the key, use a Shell and its on-device confirmation step.
• Where a device genuinely cannot prompt for a PIN, keep the value in the account low and treat the path as public — the same advice applied here before, but the card no longer pretends to enforce it.