turnkey/openpgp-card
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Uniformly use 'YubiKey' styling.

Browse source
This commit is contained in:
Heiko Schaefer 2022-07-26 09:43:27 +02:00
parent d4f7b8d1b0
commit 202b0ef5ce
No known key found for this signature in database
GPG key ID: 4A849A1904CCBD7D
10 changed files with 15 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
card-functionality/README.md
View file

@ -45,12 +45,12 @@ behavior.
## Example for card-specific behavior that contradicts the spec ## Example for card-specific behavior that contradicts the spec
Yubikey 5 fails to handle the VERIFY command with empty data YubiKey 5 fails to handle the VERIFY command with empty data
(see OpenPGP card spec, 7.2.2: "If the command is called (see OpenPGP card spec, 7.2.2: "If the command is called
without data, the actual access status of the addressed password is without data, the actual access status of the addressed password is
returned or the access status is set to 'not verified'"). returned or the access status is set to 'not verified'").
The Yubikey 5 erroneously returns Status 0x6a80 ("Incorrect parameters in The YubiKey 5 erroneously returns Status 0x6a80 ("Incorrect parameters in
the command data field"). the command data field").

2
openpgp-card/src/card_do/algo_info.rs
View file

@ -74,7 +74,7 @@ fn parse_tl_list(input: &[u8]) -> nom::IResult<&[u8], Vec<(KeyType, Algo)>> {
pub(self) fn parse(input: &[u8]) -> nom::IResult<&[u8], Vec<(KeyType, Algo)>> { pub(self) fn parse(input: &[u8]) -> nom::IResult<&[u8], Vec<(KeyType, Algo)>> {
// Handle two variations of input format: // Handle two variations of input format:
// a) TLV format (e.g. Yubikey 5) // a) TLV format (e.g. YubiKey 5)
// b) Plain list (e.g. Gnuk, FOSS-Store Smartcard 3.4) // b) Plain list (e.g. Gnuk, FOSS-Store Smartcard 3.4)
// -- Gnuk: do_alg_info (uint16_t tag, int with_tag) // -- Gnuk: do_alg_info (uint16_t tag, int with_tag)

2
openpgp-card/src/card_do/extended_cap.rs
View file

@ -128,7 +128,7 @@ mod test {
#[test] #[test]
fn test_yk5() { fn test_yk5() {
// Yubikey 5 // YubiKey 5
let data = hex!("7d 00 0b fe 08 00 00 ff 00 00"); let data = hex!("7d 00 0b fe 08 00 00 ff 00 00");
let ec = ExtendedCapabilities::try_from((&data[..], 0x0304)).unwrap(); let ec = ExtendedCapabilities::try_from((&data[..], 0x0304)).unwrap();

2
openpgp-card/src/card_do/historical.rs
View file

@ -187,7 +187,7 @@ impl TryFrom<&[u8]> for HistoricalBytes {
// Ignore final two (status) bytes: // Ignore final two (status) bytes:
// according to the spec, they 'normally' show [0x90, 0x0] - but // according to the spec, they 'normally' show [0x90, 0x0] - but
// Yubikey Neo shows [0x0, 0x0]. // YubiKey Neo shows [0x0, 0x0].
// It's unclear if these status bytes are ever useful to process? // It's unclear if these status bytes are ever useful to process?
let cc = cc.map(CardCapabilities::from); let cc = cc.map(CardCapabilities::from);

2
openpgp-card/src/keys.rs
View file

@ -293,7 +293,7 @@ pub(crate) fn determine_ecc_attrs(
// Note: Looking up ecc_type in the card's "Algorithm Information" // Note: Looking up ecc_type in the card's "Algorithm Information"
// seems to do more harm than good, so we don't do it. // seems to do more harm than good, so we don't do it.
// Some cards report erroneous information about supported algorithms // Some cards report erroneous information about supported algorithms
// - e.g. Yubikey 5 reports support for EdDSA over Cv25519 and // - e.g. YubiKey 5 reports support for EdDSA over Cv25519 and
// Ed25519, but not ECDH. // Ed25519, but not ECDH.
// //
// We do however, use import_format from algorithm information. // We do however, use import_format from algorithm information.

2
openpgp-card/src/lib.rs
View file

@ -3,7 +3,7 @@
//! Client library for //! Client library for
//! [OpenPGP card](https://en.wikipedia.org/wiki/OpenPGP_card) //! [OpenPGP card](https://en.wikipedia.org/wiki/OpenPGP_card)
//! devices (such as Gnuk, Yubikey, or Java smartcards running an OpenPGP //! devices (such as Gnuk, YubiKey, or Java smartcards running an OpenPGP
//! card application). //! card application).
//! //!
//! This library aims to offer //! This library aims to offer

6
openpgp-card/src/openpgp.rs
View file

@ -214,10 +214,10 @@ impl<'a> OpenPgpTransaction<'a> {
/// [`set_cardholder_certificate`](OpenPgpTransaction::set_cardholder_certificate) /// [`set_cardholder_certificate`](OpenPgpTransaction::set_cardholder_certificate)
/// in OpenPGP card. /// in OpenPGP card.
/// ///
/// `yk_workaround`: Yubikey 5 up to (and including) firmware version 5.4.3 need a workaround /// `yk_workaround`: YubiKey 5 up to (and including) firmware version 5.4.3 need a workaround
/// for this command. Set to `true` to apply this workaround. /// for this command. Set to `true` to apply this workaround.
/// (When sending the SELECT DATA command as defined in the card spec, without enabling the /// (When sending the SELECT DATA command as defined in the card spec, without enabling the
/// workaround, bad Yubikey firmware versions (<= 5.4.3) return /// workaround, bad YubiKey firmware versions (<= 5.4.3) return
/// [`IncorrectParametersCommandDataField`](StatusBytes::IncorrectParametersCommandDataField)) /// [`IncorrectParametersCommandDataField`](StatusBytes::IncorrectParametersCommandDataField))
/// ///
/// (This library leaves it up to consumers to decide on a strategy for dealing with this /// (This library leaves it up to consumers to decide on a strategy for dealing with this
@ -241,7 +241,7 @@ impl<'a> OpenPgpTransaction<'a> {
let mut data = tlv.serialize(); let mut data = tlv.serialize();
if yk_workaround { if yk_workaround {
// Workaround for Yubikey 5. // Workaround for YubiKey 5.
// This hack is needed <= 5.4.3 according to ykman sources // This hack is needed <= 5.4.3 according to ykman sources
// (see _select_certificate() in ykman/openpgp.py). // (see _select_certificate() in ykman/openpgp.py).

2
openpgp-card/src/tlv.rs
View file

@ -134,7 +134,7 @@ mod test {
#[test] #[test]
fn test_tlv_yubi5() -> Result<(), Error> { fn test_tlv_yubi5() -> Result<(), Error> {
// 'Yubikey 5 NFC' output for GET DATA on "Application Related Data" // 'YubiKey 5 NFC' output for GET DATA on "Application Related Data"
let data = hex!("6e8201374f10d27600012401030400061601918000005f520800730000e00590007f740381012073820110c00a7d000bfe080000ff0000c106010800001100c206010800001100c306010800001100da06010800001100c407ff7f7f7f030003c5500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cd1000000000000000000000000000000000de0801000200030081027f660802020bfe02020bfed6020020d7020020d8020020d9020020"); let data = hex!("6e8201374f10d27600012401030400061601918000005f520800730000e00590007f740381012073820110c00a7d000bfe080000ff0000c106010800001100c206010800001100c306010800001100da06010800001100c407ff7f7f7f030003c5500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cd1000000000000000000000000000000000de0801000200030081027f660802020bfe02020bfed6020020d7020020d8020020d9020020");
let tlv = Tlv::try_from(&data[..])?; let tlv = Tlv::try_from(&data[..])?;

6
tools/README.md
View file

@ -626,7 +626,7 @@ be prompted to enter the user or Admin PINs where needed.
Yubico implements a [proprietary extension](https://developers.yubico.com/PGP/Attestation.html) to the OpenPGP card Yubico implements a [proprietary extension](https://developers.yubico.com/PGP/Attestation.html) to the OpenPGP card
standard to *"cryptographically certify that a certain asymmetric key has been generated on device, and not imported"*. standard to *"cryptographically certify that a certain asymmetric key has been generated on device, and not imported"*.
This feature is available on Yubikey 5 devices with firmware version 5.2 or newer. This feature is available on YubiKey 5 devices with firmware version 5.2 or newer.
#### Attestation key/certificate #### Attestation key/certificate
@ -634,7 +634,7 @@ This feature is available on Yubikey 5 devices with firmware version 5.2 or newe
The template and key are replaceable, which permits an individual or organization to issue attestations verifiable The template and key are replaceable, which permits an individual or organization to issue attestations verifiable
with their own CA if they prefer. If replaced, the Yubico template can never be restored."* with their own CA if they prefer. If replaced, the Yubico template can never be restored."*
This tool does not currently support replacing the attestation key on a Yubikey. This tool does not currently support replacing the attestation key on a YubiKey.
It only supports use of the Yubico-provided attestation key to generate "attestation statements". It only supports use of the Yubico-provided attestation key to generate "attestation statements".
The attestation certificate on a card can be inspected as follows: The attestation certificate on a card can be inspected as follows:
@ -667,7 +667,7 @@ Generation of an attestation requires the User PIN. By default it also requires
#### Viewing an attestation statement #### Viewing an attestation statement
When the Yubikey generates an attestation statement, it gets stored in a `cardholder certificate` data object on the card. When the YubiKey generates an attestation statement, it gets stored in a `cardholder certificate` data object on the card.
After an attestation statement has been generated, it can be read from the card and viewed in pem-encoded format: After an attestation statement has been generated, it can be read from the card and viewed in pem-encoded format:

2
tools/debian/control
View file

@ -20,4 +20,4 @@ Built-Using: ${cargo:Built-Using}
Description: tool to manage OpenPGP hardware tokens Description: tool to manage OpenPGP hardware tokens
The opgpcard tool allows you to inspect, configure, administer, The opgpcard tool allows you to inspect, configure, administer,
factory reset, and generally manage OpenPGP cards (hardware tokens), factory reset, and generally manage OpenPGP cards (hardware tokens),
such as Gnuk, Yubikeys, Nitrokeys, and similar. such as Gnuk, YubiKeys, Nitrokeys, and similar.