Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chuid with a deprecated field in yubikey #36

Open
FStelzer opened this issue Feb 1, 2023 · 2 comments
Open

chuid with a deprecated field in yubikey #36

FStelzer opened this issue Feb 1, 2023 · 2 comments

Comments

@FStelzer
Copy link
Contributor

FStelzer commented Feb 1, 2023

Hi,
I recently received a "new" yubikey 5 nano with already imported piv certs (corporate CA).
When running pivy-tool -d list this new key produces:
error = InvalidDataError: PIV device 'Yubico YubiKey FIDO+CCID 00 00' returned invalid or unsupported payload
in piv_read_chuid() at piv.c:1112
Caused by PIVTagError: Invalid tag 0x3d in PIV CHUID response
in piv_chuid_decode() at piv.c:7300

Tag 0x3d is a deprecated field and not even listed anymore in the latest PIV spec. An older one (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-73-2.pdf) still has it.
When i hack piv.c:7305:piv_chuid_decode() to just skip the tag I can successfully run the list command and get all the infos displayed. pivy-agent also seems to work just fine then.
I don't know why the key has this deprecated field (it's probably not regenerated when importing certs) but do you think adding it to the parser (and dropping its content) would hurt?

I'm attaching a pull request with my extremely simple patch.

@arekinath
Copy link
Owner

I'm going to keep this issue open (even though the PR is merged), because we will probably need to still keep a copy of this field in order to generate the to-be-signed CHUID for CHUID signature validation later.

Currently that code isn't finished in general, so it isn't super important, but it's coming.

@FStelzer
Copy link
Contributor Author

FStelzer commented Feb 2, 2023

Sure, thanks for your help and the quick response!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants