  	r = sc_lock(card);
  	if (r) {
  		error("Unable to lock smartcard: %s", sc_strerror(r));
-@@ -173,7 +221,8 @@
- 	r = sc_prkey_op_init(rsa, &key_obj);
+@@ -161,6 +214,9 @@
+ 	return -1;
+ }
+ 
++#define SC_USAGE_DECRYPT	SC_PKCS15_PRKEY_USAGE_DECRYPT | \
++				SC_PKCS15_PRKEY_USAGE_UNWRAP
++
+ static int
+ sc_private_decrypt(int flen, u_char *from, u_char *to, RSA *rsa,
+     int padding)
+@@ -170,10 +226,11 @@
+ 
+ 	if (padding != RSA_PKCS1_PADDING)
+ 		return -1;	
+-	r = sc_prkey_op_init(rsa, &key_obj);
++	r = sc_prkey_op_init(rsa, &key_obj, SC_USAGE_DECRYPT);
  	if (r)
  		return -1;
 -	r = sc_pkcs15_decipher(p15card, key_obj, 0, from, flen, to, flen);

 	r = sc_connect_card(ctx->reader[sc_reader_id], 0, &card);
 	if (r)
 		goto err;
@@ -133,12 +139,54 @@
 	key = key_obj->data;
 	r = sc_pkcs15_find_pin_by_auth_id(p15card, &key_obj->auth_id,
 					  &pin_obj);

 	sc_unlock(card);
 	if (r < 0) {
 		error("sc_pkcs15_decipher() failed: %s", sc_strerror(r));
@@ -185,6 +242,9 @@
 	return -1;
 }
 
+#define SC_USAGE_SIGN 		SC_PKCS15_PRKEY_USAGE_SIGN | \
+				SC_PKCS15_PRKEY_USAGE_SIGNRECOVER
+
 static int
 sc_sign(int type, u_char *m, unsigned int m_len,
 	unsigned char *sigret, unsigned int *siglen, RSA *rsa)
@@ -193,7 +253,15 @@
 	int r;
 	unsigned long flags = 0;
 
-	r = sc_prkey_op_init(rsa, &key_obj);
+	/* XXX: sc_prkey_op_init will search for a pkcs15 private
+	 * key object with the sign or signrecover usage flag set.
+	 * If the signing key has only the non-repudiation flag set
+	 * the key will be rejected as using a non-repudiation key
+	 * for authentication is not recommended. Note: This does not
+	 * prevent the use of a non-repudiation key for authentication
+	 * if the sign or signrecover flag is set as well. 
+	 */
+	r = sc_prkey_op_init(rsa, &key_obj, SC_USAGE_SIGN);
 	if (r)
 		return -1;
 	/* FIXME: length of sigret correct? */
@@ -423,9 +491,14 @@
 		}
 		key_count = r;
 	}
