Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add device reset command #110

Merged
merged 3 commits into from
Jun 27, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Yubico.Core/tests/Yubico.Core.UnitTests.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ limitations under the License. -->
<DefineConstants>Linux</DefineConstants>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Xunit.SkippableFact" Version="1.4.13" />
<ProjectReference Include="..\src\Yubico.Core.csproj" />
<PackageReference Include="coverlet.collector" Version="6.0.2" PrivateAssets="all" IncludeAssets="runtime; build; native; contentfiles; analyzers; buildtransitive" />
<PackageReference Include="xunit" Version="2.8.0" />
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ public void Encrypt_Decrypt_Succeeds()
Assert.True(isValid);
}

[Fact]
[SkippableFact(typeof(System.PlatformNotSupportedException))]
public void Encrypt_Decrypt_Succeeds_RandomValues_Succeed()
{
var random = RandomNumberGenerator.Create();
Expand Down
10 changes: 10 additions & 0 deletions Yubico.YubiKey/src/Yubico/YubiKey/IYubiKeyDevice.cs
Original file line number Diff line number Diff line change
Expand Up @@ -693,5 +693,15 @@ void SetLegacyDeviceConfiguration(
/// </remarks>
/// <param name="value">The touch threshold to apply to the YubiKey. Must be a value greater than `6`.</param>
void SetTemporaryTouchThreshold(int value);

/// <summary>
/// Perform device wide reset.
/// </summary>
/// <remarks>
/// <para>
/// Only available on YubiKey Bio Multi-protocol.
/// </para>
/// </remarks>
void DeviceReset();
DennisDyallo marked this conversation as resolved.
Show resolved Hide resolved
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
// Copyright 2024 Yubico AB
//
// Licensed under the Apache License, Version 2.0 (the "License").
// You may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

using System;
using Yubico.Core.Iso7816;

namespace Yubico.YubiKey.Management.Commands
{
/// <summary>
/// Execute device reset.
/// </summary>
/// <remarks>
/// This class has a corresponding partner class <see cref="DeviceResetResponse"/>
/// </remarks>
public class DeviceResetCommand : IYubiKeyCommand<DeviceResetResponse>
{
private const byte DeviceResetInstruction = 0x1F;

/// <summary>
/// Gets the YubiKeyApplication to which this command belongs.
/// </summary>
/// <value>
/// <see cref="YubiKeyApplication.Management"/>
/// </value>
public YubiKeyApplication Application => YubiKeyApplication.Management;

/// <summary>
/// Initializes a new instance of the <see cref="DeviceResetCommand"/> class.
/// </summary>
public DeviceResetCommand()
{

}

/// <inheritdoc />
public CommandApdu CreateCommandApdu() => new CommandApdu
{
Ins = DeviceResetInstruction
};

/// <inheritdoc />
public DeviceResetResponse CreateResponseForApdu(ResponseApdu responseApdu) =>
new DeviceResetResponse(responseApdu);
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
// Copyright 2024 Yubico AB
//
// Licensed under the Apache License, Version 2.0 (the "License").
// You may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

using System;
using Yubico.Core.Iso7816;

namespace Yubico.YubiKey.Management.Commands
{
/// <summary>
/// The response to the <see cref="DeviceResetCommand"/> command, containing the YubiKey's
/// device configuration details.
/// </summary>
public class DeviceResetResponse : YubiKeyResponse
{
/// <summary>
/// Constructs a DeviceResetResponse instance based on a ResponseApdu received from the YubiKey.
/// </summary>
/// <param name="responseApdu">
/// The ResponseApdu returned by the YubiKey.
/// </param>
public DeviceResetResponse(ResponseApdu responseApdu) :
base(responseApdu)
{

}
}
}
41 changes: 40 additions & 1 deletion Yubico.YubiKey/src/Yubico/YubiKey/YubiKeyDevice.Instance.cs
Original file line number Diff line number Diff line change
Expand Up @@ -741,6 +741,45 @@ public void SetTemporaryTouchThreshold(int value)
}
}

/// <inheritdoc />
/// <exception cref="NotSupportedException">
/// The YubiKey does not support this feature.
/// </exception>
/// <exception cref="InvalidOperationException">
/// The YubiKey encountered an error and could not set the setting.
/// </exception>
public void DeviceReset()
{
if (!this.HasFeature(YubiKeyFeature.DeviceReset))
{
throw new NotSupportedException(
string.Format(
CultureInfo.CurrentCulture,
ExceptionMessages.NotSupportedByYubiKeyVersion));
}
IYubiKeyConnection? connection = null;
try
{
if (TryConnect(YubiKeyApplication.Management, out connection))
{
var command = new MgmtCmd.DeviceResetCommand();
IYubiKeyResponse response = connection.SendCommand(command);
if (response.Status != ResponseStatus.Success)
{
throw new InvalidOperationException(response.StatusMessage);
}
}
else
{
throw new NotSupportedException(ExceptionMessages.NoInterfaceAvailable);
}
}
finally
{
connection?.Dispose();
}
}

private IYubiKeyResponse SendConfiguration(MgmtCmd.SetDeviceInfoBaseCommand baseCommand)
{
IYubiKeyConnection? connection = null;
Expand Down Expand Up @@ -1049,7 +1088,7 @@ private void WaitForReclaimTimeout(Transport newTransport)
// Newer YubiKeys are able to switch interfaces much, much faster. Maybe this is being paranoid, but we
// should still probably wait a few milliseconds for things to stabilize. But definitely not the full
// three seconds! For older keys, we use a value of 3.01 seconds to give us a little wiggle room as the
// YubiKey's measurement for the reclaim timout is likely not as accurate as our system clock.
// YubiKey's measurement for the reclaim timeout is likely not as accurate as our system clock.
TimeSpan reclaimTimeout = CanFastReclaim() ? TimeSpan.FromMilliseconds(100) : TimeSpan.FromSeconds(3.01);

// We're only affected by the reclaim timeout if we're switching USB transports.
Expand Down
5 changes: 5 additions & 0 deletions Yubico.YubiKey/src/Yubico/YubiKey/YubiKeyFeature.cs
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,11 @@ public enum YubiKeyFeature
/// </summary>
TemporaryTouchThreshold,

/// <summary>
/// The YubiKey supports proprietary reset.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AdamVe what does "proprietary" mean here exactly?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great catch! The propietary in here is referring to a function of the YubiKey which is only available on the YubiKey (and is not part of the PIV standard). The reasoning is:

When both applications (FIDO and PIV) are enabled AND configured with credentials, a Yubico proprietary factory reset will be the only way to reset both FIDO and PIV, simultaneously.

Maybe instead of "proprietary" it is better to use "device wide factory" because it will reset all the applications (FIDO and PIV in this context) on the device:

The YubiKey supports device wide factory reset.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah ok, interesting. So does this mean that a reset that only affects the PIV application (Yubico.YubiKey.Piv.PivSession.ResetApplication) adheres to the PIV standard?

And if this reset only affects the FIDO and PIV applications, shouldn't we specify that? When I read "device-wide", I would assume that affects all YubiKey applications (Yubico OTP, etc).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, I have forgotten to mention that this instruction is available only on YubiKey Bio Multi-Protocol Edition devices. There are only FIDO and PIV application available on these devices. These application share the PIN and the fingerprint sensor (you can use the same pin/fingerprints for both FIDO and PIV authentication) which causes that you cannot reset the PIV or FIDO applications with the "PivSession.ResetApplication" (and vice versa for FIDO) because it would invalidate the other application as well. That is why the device wide reset was created - it will reset all the applications on the YubiKey (currently FIDO and PIV).

Once you do some setup of FIDO (for example add passkeys) or PIV (for example import a certificate), the PivSession.ResetApplication (or the FIDO reset) will not be possible to call because of the reason I described in the previous paragraph. The only way how to reset such YubiKey is to use the device wide reset.

I think it should be added to the documentation that this is available only on YubiKey Bio MPE.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very cool, I didn't know that!

I added some additional info about the DeviceReset in my PR in this commit: 3b234d5. Let me know if this covers it sufficiently.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great! That is much better. I added a comment there to clarify a detail. Thank you :)

/// </summary>
DeviceReset,

// OTP application features

/// <summary>
Expand Down
3 changes: 3 additions & 0 deletions Yubico.YubiKey/src/Yubico/YubiKey/YubiKeyFeatureExtensions.cs
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,9 @@ public static bool HasFeature(this IYubiKeyDevice yubiKeyDevice, YubiKeyFeature
YubiKeyFeature.FastUsbReclaim =>
yubiKeyDevice.FirmwareVersion >= FirmwareVersion.V5_6_0,

YubiKeyFeature.DeviceReset =>
yubiKeyDevice.FirmwareVersion >= FirmwareVersion.V5_6_0,

YubiKeyFeature.TemporaryTouchThreshold =>
yubiKeyDevice.FirmwareVersion >= FirmwareVersion.V5_3_1,

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -262,5 +262,10 @@ public void SetTemporaryTouchThreshold(int value)
{
throw new NotImplementedException();
}

public void DeviceReset()
{
throw new NotImplementedException();
}
}
}
Loading