feat: allow to read and write raw PIV objects

[impact-merlinzerbe]

the YubiKey allows to store raw data in PIV DataTags (see https://docs.yubico.com/yesdk/users-manual/application-piv/piv-objects.html). example use cases are storage of gpg public key counterparts of gpg private keys and encrypted storage of other key data (e.g. wireguard keys). this feature is also available in the official ykman app from Yubico (ykman piv objects import/export).

[ericchiang]

Thanks for the PR!

Couple of questions:

• What other systems might validate that the object is encoded correctly? Does the yubikey firmware do this, or is it up to other applications?
• Can there be multiple objects per slot, or only one?
• Should the API differentiate tag values from the object? E.g. SetObject(key []byte, slot Slot, tag uint64, obj []byte)

EDIT: The CI issues you're seeing should be fixed by #167

[impact-merlinzerbe]

Thanks for the quick response.

• What other systems might validate that the object is encoded correctly? Does the yubikey firmware do this, or is it up to other applications?

AFAIK the only the the yubikey validates is the initial tag and the length (https://docs.yubico.com/yesdk/users-manual/application-piv/piv-objects.html#the-data)

53 length
   something

• Can there be multiple objects per slot, or only one?

I think there can only be a single object per slot, but there are over 6 million possible slots. The total slot storage space is limited to 51000 bytes (https://docs.yubico.com/yesdk/users-manual/application-piv/piv-objects.html#table-1c-undefined-datatags):

It is possible for an application to store whatever information it wants on a YubiKey under an undefined DataTag. However, there are space limitations. It is possible to store at most approximately 3,052 bytes under any single undefined DataTag, and the total space on a YubiKey for all storage is about 51,000 bytes.

• Should the API differentiate tag values from the object? E.g. SetObject(key []byte, slot Slot, tag uint64, obj []byte)

I do not know. I currently use this API to store raw []byte (encrypted blobs). Could you elaborate what you mean by differentiating?