Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement support for Yubikeys and potential other tokens via wireless NFC using smartcard readers (Rebase) #6895

Merged
merged 6 commits into from
Oct 1, 2021

Commits on Sep 29, 2021

  1. Support NFC readers for hardware tokens using PC/SC

    This requires a new library dependency: PCSC.
    The PCSC library provides methods to access smartcards. On Linux, the third-party pcsc-lite package is used. On Windows, the native Windows API (Winscard.dll) is used. On Mac OSX, the native OSX API (framework-PCSC) is used.
    
    * Split hardware key access into multiple classes to handle different methods of communicating with the keys.
    
    * Since the Yubikey can now be a wireless token as well, the verb "plug in" was replaced with a more
    generic "interface with". This shall indicate that the user has to present their token to the reader, or plug it in via USB.
    
    * Add PC/SC interface for YubiKey challenge-response
    
    This new interface uses the PC/SC protocol and API
    instead of the USB protocol via ykpers. Many YubiKeys expose their functionality as a CCID device, which can be interfaced with using PC/SC. This is especially useful for NFC-only or NFC-capable Yubikeys, when they are used together with a PC/SC compliant NFC reader device.
    
    Although many (not all) Yubikeys expose their CCID functionality over their own USB connection as well, the HMAC-SHA1 functionality is often locked in this mode, as it requires eg. a touch on the gold button. When accessing the CCID functionality wirelessly via NFC (like this code can do using a reader), then the user interaction is to present the key to the reader.
    
    This implementation has been tested on Linux using pcsc-lite, Windows using the native Winscard.dll library, and Mac OSX using the native PCSC-framework library.
    StarGate01 authored and droidmonkey committed Sep 29, 2021
    Configuration menu
    Copy the full SHA
    7a33b16 View commit details
    Browse the repository at this point in the history
  2. Remove PC/SC ATR whitelist, instead scan for AIDs

    Before, a whitelist of ATR codes (answer to reset, hardware-specific)
    was used to scan for compatible (Yubi)Keys.
    Now, every connected smartcard is scanned for AIDs (applet identifier),
    which are known to implement the HMAC-SHA1 protocol.
    
    This enables the support of currently unknown or unreleased hardware.
    StarGate01 authored and droidmonkey committed Sep 29, 2021
    Configuration menu
    Copy the full SHA
    c54078f View commit details
    Browse the repository at this point in the history
  3. Cleanup code

    droidmonkey committed Sep 29, 2021
    Configuration menu
    Copy the full SHA
    20cc87d View commit details
    Browse the repository at this point in the history

Commits on Sep 30, 2021

  1. Use explicit downcast for PC/SC error codes

    The error code datatype differs across OSX, Linux and Windows,
    so we align it to int32_t, because we dont care for the actual constant
    values at all.
    StarGate01 committed Sep 30, 2021
    Configuration menu
    Copy the full SHA
    2482b48 View commit details
    Browse the repository at this point in the history

Commits on Oct 1, 2021

  1. Fix YubiKey duplicate detection regression

    Without this check, keys that have more than one slot
    configured show up multiple times instead of listing
    multiple slots.
    StarGate01 committed Oct 1, 2021
    Configuration menu
    Copy the full SHA
    a760f9f View commit details
    Browse the repository at this point in the history
  2. Some more cleanup

    droidmonkey committed Oct 1, 2021
    Configuration menu
    Copy the full SHA
    912c51e View commit details
    Browse the repository at this point in the history