turnkey/openpgp-card
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Normalize PIN-Parameters in opgpcard.

Browse source 
"-P" is now always the admin pin file, while "-p" is the user pin file.
This commit is contained in:
Heiko Schaefer 2021-11-06 11:59:10 +01:00
parent 8d31ee80db
commit 9955c9e1be
No known key found for this signature in database
GPG key ID: 4A849A1904CCBD7D
3 changed files with 29 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
tools/README.md
View file

@ -59,7 +59,7 @@ $ opgpcard status -c ABCD:12345678
``` ```
Add `-v` for more verbose card status, including the list of supported Add `-v` for more verbose card status, including the list of supported
algorithms of the card: algorithms of the card (older cards may return no additional information):
``` ```
$ opgpcard status -c ABCD:12345678 -v $ opgpcard status -c ABCD:12345678 -v
``` ```
@ -69,7 +69,7 @@ $ opgpcard status -c ABCD:12345678 -v
Import private key onto a card. This works if at most one (sub)key Import private key onto a card. This works if at most one (sub)key
per role (sign, decrypt, auth) exists in `key.priv`: per role (sign, decrypt, auth) exists in `key.priv`:
``` ```
$ opgpcard admin -c ABCD:12345678 -p <pin-file> import key.priv $ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> import key.priv
``` ```
Import private key onto a card while explicitly selecting subkeys. Import private key onto a card while explicitly selecting subkeys.
@ -77,7 +77,7 @@ Explicitly specified fingerprints are necessary if more than one subkey
exists in `key.priv` for any role (note: spaces in fingerprints are exists in `key.priv` for any role (note: spaces in fingerprints are
ignored). ignored).
``` ```
$ opgpcard admin -c ABCD:12345678 -p <pin-file> import key.priv \ $ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> import key.priv \
--sig-fp "F290 DBBF 21DB 8634 3C96 157B 87BE 15B7 F548 D97C" \ --sig-fp "F290 DBBF 21DB 8634 3C96 157B 87BE 15B7 F548 D97C" \
--dec-fp "3C6E 08F6 7613 8935 8B8D 7666 73C7 F1A9 EEDA C360" \ --dec-fp "3C6E 08F6 7613 8935 8B8D 7666 73C7 F1A9 EEDA C360" \
--auth-fp "D6AA 48EF 39A2 6F26 C42D 5BCB AAD2 14D5 5332 C838" --auth-fp "D6AA 48EF 39A2 6F26 C42D 5BCB AAD2 14D5 5332 C838"
@ -89,19 +89,19 @@ keys will be imported for the other roles.
### Generate Keys on the card ### Generate Keys on the card
``` ```
$ opgpcard admin -c ABCD:12345678 -p <admin-pin-file> generate --user-pin-file <user-pin-file> -o <output-file> 25519 $ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> generate -p <user-pin-file> -o <output-cert-file> 25519
``` ```
### Set card metadata ### Set card metadata
Set cardholder name: Set cardholder name:
``` ```
$ opgpcard admin -c ABCD:12345678 -p <pin-file> name "Bar<<Foo" $ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> name "Bar<<Foo"
``` ```
Set cardholder URL: Set cardholder URL:
``` ```
$ opgpcard admin -c ABCD:12345678 -p <pin-file> url "https://keyurl.example" $ opgpcard admin -c ABCD:12345678 -P <admin-pin-file> url "https://keyurl.example"
``` ```
### Signing ### Signing
@ -110,7 +110,7 @@ For now, this tool only supports creating detached signatures, like this
(if no input file is set, stdin is read): (if no input file is set, stdin is read):
``` ```
$ opgpcard sign --detached -c ABCD:12345678 -p <pin-file> -s <cert-file> <input-file> $ opgpcard sign --detached -c ABCD:12345678 -p <user-pin-file> -s <cert-file> <input-file>
``` ```
### Decrypting ### Decrypting
@ -118,7 +118,7 @@ $ opgpcard sign --detached -c ABCD:12345678 -p <pin-file> -s <cert-file> <input-
Decryption using a card (if no input file is set, stdin is read): Decryption using a card (if no input file is set, stdin is read):
``` ```
$ opgpcard decrypt -c ABCD:12345678 -p <pin-file> -r <cert-file> <input-file> $ opgpcard decrypt -c ABCD:12345678 -p <user-pin-file> -r <cert-file> <input-file>
``` ```
### Factory reset ### Factory reset
@ -128,6 +128,8 @@ Factory reset:
$ opgpcard factory-reset -c ABCD:12345678 $ opgpcard factory-reset -c ABCD:12345678
``` ```
NOTE: you do not need a PIN to reset a card
## opgpcard-pin ## opgpcard-pin
An interactive tool to set the admin and user PINs, and to reset the user An interactive tool to set the admin and user PINs, and to reset the user

16
tools/src/bin/opgpcard/cli.rs
View file

@ -35,8 +35,8 @@ pub enum Command {
#[structopt(name = "card ident", short = "c", long = "card")] #[structopt(name = "card ident", short = "c", long = "card")]
ident: String, ident: String,
#[structopt(name = "Admin PIN file", short = "p", long = "pin-file")] #[structopt(name = "Admin PIN file", short = "P", long = "admin-pin")]
pin_file: PathBuf, admin_pin: PathBuf,
#[structopt(subcommand)] #[structopt(subcommand)]
cmd: AdminCommand, cmd: AdminCommand,
@ -45,8 +45,8 @@ pub enum Command {
#[structopt(name = "card ident", short = "c", long = "card")] #[structopt(name = "card ident", short = "c", long = "card")]
ident: String, ident: String,
#[structopt(name = "User PIN file", short = "p", long = "pin-file")] #[structopt(name = "User PIN file", short = "p", long = "user-pin")]
pin_file: PathBuf, user_pin: PathBuf,
#[structopt( #[structopt(
name = "recipient-cert-file", name = "recipient-cert-file",
@ -62,8 +62,8 @@ pub enum Command {
#[structopt(name = "card ident", short = "c", long = "card")] #[structopt(name = "card ident", short = "c", long = "card")]
ident: String, ident: String,
#[structopt(name = "user pin file", short = "p", long = "pin-file")] #[structopt(name = "User PIN file", short = "p", long = "user-pin")]
pin_file: PathBuf, user_pin: PathBuf,
#[structopt(name = "detached", short = "d", long = "detached")] #[structopt(name = "detached", short = "d", long = "detached")]
detached: bool, detached: bool,
@ -121,8 +121,8 @@ pub enum AdminCommand {
/// A signing key is always created, decryption and authentication keys /// A signing key is always created, decryption and authentication keys
/// are optional. /// are optional.
Generate { Generate {
#[structopt(name = "User PIN file", long = "user-pin-file")] #[structopt(name = "User PIN file", short = "p", long = "user-pin")]
user_pin_file: PathBuf, user_pin: PathBuf,
#[structopt( #[structopt(
about = "Output file (stdout if unset)", about = "Output file (stdout if unset)",

22
tools/src/bin/opgpcard/main.rs
View file

@ -36,15 +36,15 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
} }
cli::Command::Decrypt { cli::Command::Decrypt {
ident, ident,
pin_file, user_pin,
cert_file, cert_file,
input, input,
} => { } => {
decrypt(&ident, &pin_file, &cert_file, input.as_deref())?; decrypt(&ident, &user_pin, &cert_file, input.as_deref())?;
} }
cli::Command::Sign { cli::Command::Sign {
ident, ident,
pin_file, user_pin,
cert_file, cert_file,
detached, detached,
input, input,
@ -52,7 +52,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
if detached { if detached {
sign_detached( sign_detached(
&ident, &ident,
&pin_file, &user_pin,
&cert_file, &cert_file,
input.as_deref(), input.as_deref(),
)?; )?;
@ -68,7 +68,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
} }
cli::Command::Admin { cli::Command::Admin {
ident, ident,
pin_file, admin_pin,
cmd, cmd,
} => { } => {
let mut card = util::open_card(&ident)?.into(); let mut card = util::open_card(&ident)?.into();
@ -76,12 +76,12 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
match cmd { match cmd {
cli::AdminCommand::Name { name } => { cli::AdminCommand::Name { name } => {
let mut admin = util::get_admin(&mut open, &pin_file)?; let mut admin = util::get_admin(&mut open, &admin_pin)?;
let _ = admin.set_name(&name)?; let _ = admin.set_name(&name)?;
} }
cli::AdminCommand::Url { url } => { cli::AdminCommand::Url { url } => {
let mut admin = util::get_admin(&mut open, &pin_file)?; let mut admin = util::get_admin(&mut open, &admin_pin)?;
let _ = admin.set_url(&url)?; let _ = admin.set_url(&url)?;
} }
@ -91,7 +91,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
dec_fp, dec_fp,
auth_fp, auth_fp,
} => { } => {
let admin = util::get_admin(&mut open, &pin_file)?; let admin = util::get_admin(&mut open, &admin_pin)?;
let key = Cert::from_file(keyfile)?; let key = Cert::from_file(keyfile)?;
if (&sig_fp, &dec_fp, &auth_fp) == (&None, &None, &None) { if (&sig_fp, &dec_fp, &auth_fp) == (&None, &None, &None) {
@ -106,14 +106,14 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
} }
} }
cli::AdminCommand::Generate { cli::AdminCommand::Generate {
user_pin_file, user_pin,
output, output,
no_decrypt, no_decrypt,
no_auth, no_auth,
algo, algo,
} => { } => {
let pw3 = util::get_pin(&pin_file)?; let pw3 = util::get_pin(&admin_pin)?;
let pw1 = util::get_pin(&user_pin_file)?; let pw1 = util::get_pin(&user_pin)?;
generate_keys( generate_keys(
open, open,