Configure PIN Policy

This policy setting configures the requirements for PIN usage.

If you enable this policy setting, the default application behavior will be overriden.

The PIN Requirement Policy setting will only be shown for the certificate slots listed. These certificate slot identifiers are supported:
9a - Authentication
9c - Digital Signature
9d - Key Management
9e - Card Authentication

When the PIN Requirement Policy is set to a value other than "Slot defaults", the PIV standard for when the PIN is required for using a particular slot will be overridden.

Non-zero PIN expiration interval causes a timestamp to be written when the PIN is changed, and to force a PIN change after the specified number of days.

If you disable or do not configure this policy setting, slot-specific PIN policy will not be configurable through the UI.

Registry Hive	HKEY_CURRENT_USER
Registry Path	Software\Yubico\YubiKey PIV Manager
Value Name	pin_policy_slots
Value Type	REG_MULTI_SZ
Default Value

PIN Requirement Policy:

0. User-defined
   

   Registry Hive	HKEY_CURRENT_USER
   Registry Path	Software\Yubico\YubiKey PIV Manager
   Value Name	pin_policy
   Value Type	REG_DWORD
   Value

1. Slot defaults
   

   Registry Hive	HKEY_CURRENT_USER
   Registry Path	Software\Yubico\YubiKey PIV Manager
   Value Name	pin_policy
   Value Type	REG_SZ
   Value	default

2. Never
   

   Registry Hive	HKEY_CURRENT_USER
   Registry Path	Software\Yubico\YubiKey PIV Manager
   Value Name	pin_policy
   Value Type	REG_SZ
   Value	never

3. Once
   

   Registry Hive	HKEY_CURRENT_USER
   Registry Path	Software\Yubico\YubiKey PIV Manager
   Value Name	pin_policy
   Value Type	REG_SZ
   Value	once

4. Always
   

   Registry Hive	HKEY_CURRENT_USER
   Registry Path	Software\Yubico\YubiKey PIV Manager
   Value Name	pin_policy
   Value Type	REG_SZ
   Value	always

Enforce complex PINs and PUKs

Registry Hive	HKEY_CURRENT_USER
Registry Path	Software\Yubico\YubiKey PIV Manager
Value Name	complex_pins
Value Type	REG_SZ
Default Value	false
True Value	true
False Value	false

PIN expiration interval (days):

Registry Hive	HKEY_CURRENT_USER
Registry Path	Software\Yubico\YubiKey PIV Manager
Value Name	pin_expiration
Value Type	REG_DWORD
Default Value	0
Min Value
Max Value	1096

Derive the Management Key from PIN

Registry Hive	HKEY_CURRENT_USER
Registry Path	Software\Yubico\YubiKey PIV Manager
Value Name	pin_as_key
Value Type	REG_SZ
Default Value	false
True Value	true
False Value	false