OK, I read the full file. Does the card support PIN based authentication at all? Why doesn't the external authenticate command return the retry counter? Given that for all other parts of OpenSC you actually do receive a PIN as input, the authentication failure indeed should be mapped to incorrect PIN. Epass was a token only, so secure PIN entry via pinpad is anyway not possible, correct?