Add support for nitrokey 3 distinction between the secrets app firmware and the device firmware versions #43

sosthene-nitrokey · 2024-11-20T10:09:52Z

tlaurion · 2024-11-21T14:06:02Z

@sosthene-nitrokey just want to make sure we are at the same page:

<nk3

HOTP code verification application, version 1.7
Connected device status:
Card serial: 0x7BE66C6C
         Firmware Nitrokey 2: v1.7.1
OpenPGP smartcard PIN counters : Admin: 3, User: 3
Operation success

nk3:

HOTP code verification application, version 1.7
Connected device status:
Card serial: 0x7BE66C6C
         Firmware Nitrokey 3: v1.7.1
         Firmware Secrets app: v4.13
Secret app PIN counter : 6
OpenPGP smartcard PIN counters : Admin: 3, User: 3
Operation success

Originally posted by @tlaurion in #38 (comment)

nestire · 2024-11-27T10:24:19Z

Test with nk pr + nk stroage

ls -lh hotp_verification
-rwxr-xr-x 1 user user 59K Nov 27 11:20 hotp_verification
sha256sum hotp_verification
4a6db3c562d75bc637e23394080f3821c47774175780d8f72e45430fb9897181  hotp_verification
[user@work nitrokey-hotp-verification (more-info)]$ lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 013: ID 20a0:4108 Clay Logic Nitrokey Pro
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
[user@work nitrokey-hotp-verification (more-info)]$ ./hotp_verification info
HOTP code verification application, version 1.6

Connected device status:
	Card serial: 0xFFFFFFFF
	Firmware Nitrokey 3: v3.14980.0
	Firmware Secrets App: v255.0
	Card counters: Admin 3, User 3
Operation success
[user@work nitrokey-hotp-verification (more-info)]$ lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 014: ID 20a0:4109 Clay Logic Nitrokey Storage
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
[user@work nitrokey-hotp-verification (more-info)]$ ./hotp_verification info
HOTP code verification application, version 1.6

Connected device status:
	Card serial: 0xFFFFFFFF
	Firmware Nitrokey 3: v0.0.0
	Firmware Secrets App: v255.0
	Card counters: Admin 3, User 3
Operation success
[user@work nitrokey-hotp-verification (more-info)]$

tlaurion · 2024-12-02T19:42:28Z

I repeat

You proposed :

See also issue #36
Change this:


HOTP code verification application, version 1.6
Connected device status:
	Card serial: 0x7BE66C6C
	Firmware: v4.13
	Card counters: Admin 6, User 6
Operation success

To

HOTP code verification application, version 1.6
Connected device status:
	Card serial: 0x7BE66C6C
        Firmware Nitrokey 3: v1.7.1
	Firmware Secrets app: v4.13
	Secret app pin counters : Admin 6, User 6
Operation success

I proposed and restated:

Even more sensical: no secret app even named anywhere because there is none on non nk3(regression), so no version of non existing secret app, no secret app pin, just real information :

HOTP code verification application, version 1.7
Connected device status:
Card serial: 0x7BE66C6C
         Firmware Nitrokey 2: v1.7.1
OpenPGP smartcard PIN counters : Admin: 3, User: 3
Operation success

For nk3:

HOTP code verification application, version 1.7
Connected device status:
Card serial: 0x7BE66C6C
         Firmware Nitrokey 3: v1.7.1
         Firmware Secrets app: v4.13
Secret app PIN counter : 6
OpenPGP smartcard PIN counters : Admin: 3, User: 3
Operation success

Originally posted by @tlaurion in #38 (comment)

This now adds the secrets app version and the nitrokey 3 firmware version, and also the gpg pins

sosthene-nitrokey · 2024-12-05T15:51:24Z

Updated to give the following with an NK3:

$ hotp_verification info
HOTP code verification application, version 1.6
...
Connected device status:
	Card serial: 0xADF72B1E
	Firmware Nitrokey 3: v1.8.0
	Firmware Secrets App: v4.13
	Secrets app PIN counter: 8
	GPG Card counters: Admin 3, User 3
Operation success

No change with other devices.

TODO: check logic in this file because assumptions on PINs retry count are wrong and will depend on Nitrokey/nitrokey-hotp-verification#43 not tested here Signed-off-by: Thierry Laurion <[email protected]>

…instead of Nitrokey/nitrokey-hotp-verification#46 for hotp-verification info parsing and validation of oem-factory-reset and seal-hotp Signed-off-by: Thierry Laurion <[email protected]>

- oem-factory-reset: fix strings for nk3 is from Nitrokey/nitrokey-hotp-verification#43 is Secrets app, not Secret App singular, not App capitalized - initrd/bin/seal-hotpkey: adapt to check nk3 Secrets App PIN counter if nk3, keep Card counters for <nk3 from Nitrokey/nitrokey-hotp-verification#43 - Unattended hotp_initialize output removed since we need physical presence to seal HOTP until Nitrokey/nitrokey-hotp-verification#41 is fixed - Finally make seal_hotp use logic to detect if public key <1m old, use HOTP related PIN by default if counter is not <3, warn that re-ownership needs to be ran to change it since no security offered at all otherwise with HOTP Tested in local tree against https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/43.patch, removing https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/46.patch - will revert the change above in PR once testing is over Signed-off-by: Thierry Laurion <[email protected]>

…fef5d1c82a014e0e2bf79346 directory: waiting for Nitrokey/nitrokey-hotp-verification#43 and Nitrokey/nitrokey-hotp-verification#46 to be merged to change modules/hotp-verification commit Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-12-06T16:45:02Z

@sosthene-nitrokey Adapted linuxboot/heads#1850 (comment) and tested this successfully.

Please tell me when #43 merged alongside #46

…instead of Nitrokey/nitrokey-hotp-verification#46 for hotp-verification info parsing and validation of oem-factory-reset and seal-hotp Signed-off-by: Thierry Laurion <[email protected]>

- oem-factory-reset: fix strings for nk3 is from Nitrokey/nitrokey-hotp-verification#43 is Secrets app, not Secret App singular, not App capitalized - initrd/bin/seal-hotpkey: adapt to check nk3 Secrets App PIN counter if nk3, keep Card counters for <nk3 from Nitrokey/nitrokey-hotp-verification#43 - Unattended hotp_initialize output removed since we need physical presence to seal HOTP until Nitrokey/nitrokey-hotp-verification#41 is fixed - Finally make seal_hotp use logic to detect if public key <1m old, use HOTP related PIN by default if counter is not <3, warn that re-ownership needs to be ran to change it since no security offered at all otherwise with HOTP - unify format with linting tool Tested in local tree against https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/43.patch, removing https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/46.patch - will revert the change above in PR once testing is over Signed-off-by: Thierry Laurion <[email protected]>

…fef5d1c82a014e0e2bf79346 directory: waiting for Nitrokey/nitrokey-hotp-verification#43 and Nitrokey/nitrokey-hotp-verification#46 to be merged to change modules/hotp-verification commit Signed-off-by: Thierry Laurion <[email protected]>

Add support for nitrokey 3 distinction between the secrets app firmware and the device firmware versions

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

TODO: check logic in this file because assumptions on PINs retry count are wrong and will depend on Nitrokey/nitrokey-hotp-verification#43 not tested here Signed-off-by: Thierry Laurion <[email protected]>

…instead of Nitrokey/nitrokey-hotp-verification#46 for hotp-verification info parsing and validation of oem-factory-reset and seal-hotp Signed-off-by: Thierry Laurion <[email protected]>

- oem-factory-reset: fix strings for nk3 is from Nitrokey/nitrokey-hotp-verification#43 is Secrets app, not Secret App singular, not App capitalized - initrd/bin/seal-hotpkey: adapt to check nk3 Secrets App PIN counter if nk3, keep Card counters for <nk3 from Nitrokey/nitrokey-hotp-verification#43 - Unattended hotp_initialize output removed since we need physical presence to seal HOTP until Nitrokey/nitrokey-hotp-verification#41 is fixed - Finally make seal_hotp use logic to detect if public key <1m old, use HOTP related PIN by default if counter is not <3, warn that re-ownership needs to be ran to change it since no security offered at all otherwise with HOTP - unify format with linting tool Tested in local tree against https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/43.patch, removing https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/46.patch - will revert the change above in PR once testing is over Signed-off-by: Thierry Laurion <[email protected]>

…fef5d1c82a014e0e2bf79346 directory: waiting for Nitrokey/nitrokey-hotp-verification#43 and Nitrokey/nitrokey-hotp-verification#46 to be merged to change modules/hotp-verification commit Signed-off-by: Thierry Laurion <[email protected]>

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

TODO: check logic in this file because assumptions on PINs retry count are wrong and will depend on Nitrokey/nitrokey-hotp-verification#43 not tested here Signed-off-by: Thierry Laurion <[email protected]>

…instead of Nitrokey/nitrokey-hotp-verification#46 for hotp-verification info parsing and validation of oem-factory-reset and seal-hotp Signed-off-by: Thierry Laurion <[email protected]>

- oem-factory-reset: fix strings for nk3 is from Nitrokey/nitrokey-hotp-verification#43 is Secrets app, not Secret App singular, not App capitalized - initrd/bin/seal-hotpkey: adapt to check nk3 Secrets App PIN counter if nk3, keep Card counters for <nk3 from Nitrokey/nitrokey-hotp-verification#43 - Unattended hotp_initialize output removed since we need physical presence to seal HOTP until Nitrokey/nitrokey-hotp-verification#41 is fixed - Finally make seal_hotp use logic to detect if public key <1m old, use HOTP related PIN by default if counter is not <3, warn that re-ownership needs to be ran to change it since no security offered at all otherwise with HOTP - unify format with linting tool Tested in local tree against https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/43.patch, removing https://patch-diff.githubusercontent.com/raw/Nitrokey/nitrokey-hotp-verification/pull/46.patch - will revert the change above in PR once testing is over Signed-off-by: Thierry Laurion <[email protected]>

…fef5d1c82a014e0e2bf79346 directory: waiting for Nitrokey/nitrokey-hotp-verification#43 and Nitrokey/nitrokey-hotp-verification#46 to be merged to change modules/hotp-verification commit Signed-off-by: Thierry Laurion <[email protected]>

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

tlaurion mentioned this pull request Nov 28, 2024

Test nk3 related hotp-verification patches upstream (unpaid by Nitrokey) linuxboot/heads#1866

Closed

sosthene-nitrokey mentioned this pull request Dec 3, 2024

Add pin-info command #44

Closed

daringer mentioned this pull request Dec 3, 2024

Add cli option to request secret app admin/user pin counts #39

Open

2 tasks

Add support for nitrokey 3 distinction between the secrets app and other

707c654

This now adds the secrets app version and the nitrokey 3 firmware version, and also the gpg pins

sosthene-nitrokey force-pushed the more-info branch from 02d0994 to 707c654 Compare December 5, 2024 15:50

sosthene-nitrokey marked this pull request as ready for review December 5, 2024 15:50

sosthene-nitrokey requested review from daringer, robin-nitrokey and nestire December 5, 2024 16:44

daringer approved these changes Dec 6, 2024

View reviewed changes

tlaurion mentioned this pull request Dec 6, 2024

WiP: Generate diceware passphrases in oem-factory-reset, output qr code of configured secrets prior of reboot linuxboot/heads#1850

Draft

tlaurion mentioned this pull request Dec 6, 2024

Add reset command for nitrokey 3 #46

Merged

sosthene-nitrokey merged commit 08e654b into master Dec 9, 2024
1 check passed

sosthene-nitrokey added a commit that referenced this pull request Dec 9, 2024

Merge pull request #43 from Nitrokey/more-info

5d91e48

Add support for nitrokey 3 distinction between the secrets app firmware and the device firmware versions

tlaurion added a commit to tlaurion/heads that referenced this pull request Dec 9, 2024

WiP: staging changes including linuxboot#1850 Nitrokey/nitrokey-hotp-…

94565dc

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

tlaurion added a commit to tlaurion/heads that referenced this pull request Dec 9, 2024

WiP: staging changes including linuxboot#1850 Nitrokey/nitrokey-hotp-…

fd24b6b

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

tlaurion added a commit to tlaurion/heads that referenced this pull request Dec 10, 2024

WiP: staging changes including linuxboot#1850 Nitrokey/nitrokey-hotp-…

c14a3ad

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

d-wid mentioned this pull request Dec 20, 2024

TESTING NEEDED: STAGING PR (quiet mode + diceware + nk3 fixes) linuxboot/heads#1875

Open

tlaurion added a commit to tlaurion/heads that referenced this pull request Dec 21, 2024

WiP: staging changes including linuxboot#1850 Nitrokey/nitrokey-hotp-…

1a4e066

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

tlaurion added a commit to tlaurion/heads that referenced this pull request Dec 21, 2024

WiP: staging changes including linuxboot#1850 Nitrokey/nitrokey-hotp-…

abc97fe

…verification#43 and Nitrokey/nitrokey-hotp-verification#46 Signed-off-by: Thierry Laurion <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for nitrokey 3 distinction between the secrets app firmware and the device firmware versions #43

Add support for nitrokey 3 distinction between the secrets app firmware and the device firmware versions #43

sosthene-nitrokey commented Nov 20, 2024

tlaurion commented Nov 21, 2024

nestire commented Nov 27, 2024

tlaurion commented Dec 2, 2024

sosthene-nitrokey commented Dec 5, 2024 •

edited

Loading

tlaurion commented Dec 6, 2024

Add support for nitrokey 3 distinction between the secrets app firmware and the device firmware versions #43

Add support for nitrokey 3 distinction between the secrets app firmware and the device firmware versions #43

Conversation

sosthene-nitrokey commented Nov 20, 2024

tlaurion commented Nov 21, 2024

nestire commented Nov 27, 2024

tlaurion commented Dec 2, 2024

sosthene-nitrokey commented Dec 5, 2024 • edited Loading

tlaurion commented Dec 6, 2024

sosthene-nitrokey commented Dec 5, 2024 •

edited

Loading