3

I set up login with smartcard (actually a yubikey, but over PKCS#11/PIV).

I restarted and logged in with my smartcard+pin instead of with my password, and I was prompted to give my old password to update my keychain. I foolishly entered my current password confusedly.

I then rebooted again and was asked for my current keychain password as it wasn't the password I entered on boot (apparently). I tried both my current and previous passwords and neither work. I suspect it's been set to something based on my smartcard encrypting something, but I have no idea what and can't find it online.

Not only do I not have access to my keychain now, but I'm constantly prompted for my keychain password.

Suggestions as to how to figure out my current keychain password? or to induce logging in with smartcard/PIN instead of password so it magically works?

2 Answers 2

1
+100

If you performed your initial login and profile setup using your "smartcard" then your login keychain password will be your PIN.

If you find this is not the case (& no passwords you enter work either), you may just have to trash your login keychain by deleting the login.keychain & login.keychain-db files from ~/Library/Keychains, restarting, logging in again with your "smartcard" & PIN to create a new login keychain, the password for which will then be the same as your PIN.

1
  • This seems to be true. Thanks so much! This system entirely reduces the security of the smartcard system though - the point is that I can use a simple password because only the smartcard hardware (actually a yubikey) will be verifying my password, but this indicates that the system will be able to do so too...
    – aaazalea
    Commented Dec 6, 2016 at 6:04
0

Based on Apple Forums.

By default, your keychain password is the same as your login password (the password you use to log in to the computer). If you change the login password in Users & Groups preferences, the keychain password is automatically updated to match it. If your login password is reset by an administrator, your keychain password is not reset automatically, and you’re asked to reset the keychain password the next time you log in. You can also update the keychain password to match your new login password. To unlock your keychain and change the password, you must know the current keychain password (which is usually the same as the previous computer login password).

Change your keychain password to match your login password

  1. Choose Edit > Change Password for Keychain “login.”

  2. If the keychain is locked, enter the previous login password for the computer, then click OK.

  3. If you entered the correct password, a new window appears. Enter the previous login password again in the Current Password field.

  4. Enter the current login password in the New Password field.

  5. Reenter the current login password in the Verify field, then click OK.

If your login password was reset because you forgot your password, and you can’t provide the old password for the keychain, you won’t be able to access the information in the old keychain, and a new blank keychain is created.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .