Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add device reset command #110
Add device reset command #110
Changes from all commits
224422d
3dff80d
f1fedc1
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@AdamVe what does "proprietary" mean here exactly?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great catch! The propietary in here is referring to a function of the YubiKey which is only available on the YubiKey (and is not part of the PIV standard). The reasoning is:
When both applications (FIDO and PIV) are enabled AND configured with credentials, a Yubico proprietary factory reset will be the only way to reset both FIDO and PIV, simultaneously.
Maybe instead of "proprietary" it is better to use "device wide factory" because it will reset all the applications (FIDO and PIV in this context) on the device:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah ok, interesting. So does this mean that a reset that only affects the PIV application (Yubico.YubiKey.Piv.PivSession.ResetApplication) adheres to the PIV standard?
And if this reset only affects the FIDO and PIV applications, shouldn't we specify that? When I read "device-wide", I would assume that affects all YubiKey applications (Yubico OTP, etc).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh, I have forgotten to mention that this instruction is available only on YubiKey Bio Multi-Protocol Edition devices. There are only FIDO and PIV application available on these devices. These application share the PIN and the fingerprint sensor (you can use the same pin/fingerprints for both FIDO and PIV authentication) which causes that you cannot reset the PIV or FIDO applications with the "PivSession.ResetApplication" (and vice versa for FIDO) because it would invalidate the other application as well. That is why the device wide reset was created - it will reset all the applications on the YubiKey (currently FIDO and PIV).
Once you do some setup of FIDO (for example add passkeys) or PIV (for example import a certificate), the PivSession.ResetApplication (or the FIDO reset) will not be possible to call because of the reason I described in the previous paragraph. The only way how to reset such YubiKey is to use the device wide reset.
I think it should be added to the documentation that this is available only on YubiKey Bio MPE.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Very cool, I didn't know that!
I added some additional info about the DeviceReset in my PR in this commit: 3b234d5. Let me know if this covers it sufficiently.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great! That is much better. I added a comment there to clarify a detail. Thank you :)