Add device reset command #110
Conversation
Test Results: Windows 2 files 2 suites 4s ⏱️ Results for commit f1fedc1. ♻️ This comment has been updated with latest results. |
Test Results: Ubuntu 2 files 2 suites 9s ⏱️ Results for commit f1fedc1. ♻️ This comment has been updated with latest results. |
Test Results: MacOS 2 files 2 suites 3s ⏱️ Results for commit f1fedc1. ♻️ This comment has been updated with latest results. |
|
Is this ready for review @AdamVe ? |
|
LGTM! |
Minimum allowed line rate is |
| @@ -74,6 +74,11 @@ public enum YubiKeyFeature | |||
| /// </summary> | |||
| TemporaryTouchThreshold, | |||
|
|
|||
| /// <summary> | |||
| /// The YubiKey supports proprietary reset. | |||
There was a problem hiding this comment.
@AdamVe what does "proprietary" mean here exactly?
There was a problem hiding this comment.
Great catch! The propietary in here is referring to a function of the YubiKey which is only available on the YubiKey (and is not part of the PIV standard). The reasoning is:
When both applications (FIDO and PIV) are enabled AND configured with credentials, a Yubico proprietary factory reset will be the only way to reset both FIDO and PIV, simultaneously.
Maybe instead of "proprietary" it is better to use "device wide factory" because it will reset all the applications (FIDO and PIV in this context) on the device:
The YubiKey supports device wide factory reset.
There was a problem hiding this comment.
Ah ok, interesting. So does this mean that a reset that only affects the PIV application (Yubico.YubiKey.Piv.PivSession.ResetApplication) adheres to the PIV standard?
And if this reset only affects the FIDO and PIV applications, shouldn't we specify that? When I read "device-wide", I would assume that affects all YubiKey applications (Yubico OTP, etc).
There was a problem hiding this comment.
Oh, I have forgotten to mention that this instruction is available only on YubiKey Bio Multi-Protocol Edition devices. There are only FIDO and PIV application available on these devices. These application share the PIN and the fingerprint sensor (you can use the same pin/fingerprints for both FIDO and PIV authentication) which causes that you cannot reset the PIV or FIDO applications with the "PivSession.ResetApplication" (and vice versa for FIDO) because it would invalidate the other application as well. That is why the device wide reset was created - it will reset all the applications on the YubiKey (currently FIDO and PIV).
Once you do some setup of FIDO (for example add passkeys) or PIV (for example import a certificate), the PivSession.ResetApplication (or the FIDO reset) will not be possible to call because of the reason I described in the previous paragraph. The only way how to reset such YubiKey is to use the device wide reset.
I think it should be added to the documentation that this is available only on YubiKey Bio MPE.
There was a problem hiding this comment.
Great! That is much better. I added a comment there to clarify a detail. Thank you :)
Description
Adds command for device reset
Type of change
Please delete options that are not relevant.
How has this been tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
Test configuration:
Checklist:
dotnet formatto format my code