-
Notifications
You must be signed in to change notification settings - Fork 60
Add device reset command #110
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,56 @@ | ||
// Copyright 2024 Yubico AB | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"). | ||
// You may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
using System; | ||
using Yubico.Core.Iso7816; | ||
|
||
namespace Yubico.YubiKey.Management.Commands | ||
{ | ||
/// <summary> | ||
/// Execute device reset. | ||
/// </summary> | ||
/// <remarks> | ||
/// This class has a corresponding partner class <see cref="DeviceResetResponse"/> | ||
/// </remarks> | ||
public class DeviceResetCommand : IYubiKeyCommand<DeviceResetResponse> | ||
{ | ||
private const byte DeviceResetInstruction = 0x1F; | ||
|
||
/// <summary> | ||
/// Gets the YubiKeyApplication to which this command belongs. | ||
/// </summary> | ||
/// <value> | ||
/// <see cref="YubiKeyApplication.Management"/> | ||
/// </value> | ||
public YubiKeyApplication Application => YubiKeyApplication.Management; | ||
|
||
/// <summary> | ||
/// Initializes a new instance of the <see cref="DeviceResetCommand"/> class. | ||
/// </summary> | ||
public DeviceResetCommand() | ||
{ | ||
|
||
} | ||
|
||
/// <inheritdoc /> | ||
public CommandApdu CreateCommandApdu() => new CommandApdu | ||
{ | ||
Ins = DeviceResetInstruction | ||
}; | ||
|
||
/// <inheritdoc /> | ||
public DeviceResetResponse CreateResponseForApdu(ResponseApdu responseApdu) => | ||
new DeviceResetResponse(responseApdu); | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,38 @@ | ||
// Copyright 2024 Yubico AB | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"). | ||
// You may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
using System; | ||
using Yubico.Core.Iso7816; | ||
|
||
namespace Yubico.YubiKey.Management.Commands | ||
{ | ||
/// <summary> | ||
/// The response to the <see cref="DeviceResetCommand"/> command, containing the YubiKey's | ||
/// device configuration details. | ||
/// </summary> | ||
public class DeviceResetResponse : YubiKeyResponse | ||
{ | ||
/// <summary> | ||
/// Constructs a DeviceResetResponse instance based on a ResponseApdu received from the YubiKey. | ||
/// </summary> | ||
/// <param name="responseApdu"> | ||
/// The ResponseApdu returned by the YubiKey. | ||
/// </param> | ||
public DeviceResetResponse(ResponseApdu responseApdu) : | ||
base(responseApdu) | ||
{ | ||
|
||
} | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -74,6 +74,11 @@ public enum YubiKeyFeature | |
/// </summary> | ||
TemporaryTouchThreshold, | ||
|
||
/// <summary> | ||
/// The YubiKey supports proprietary reset. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @AdamVe what does "proprietary" mean here exactly? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Great catch! The propietary in here is referring to a function of the YubiKey which is only available on the YubiKey (and is not part of the PIV standard). The reasoning is: When both applications (FIDO and PIV) are enabled AND configured with credentials, a Yubico proprietary factory reset will be the only way to reset both FIDO and PIV, simultaneously. Maybe instead of "proprietary" it is better to use "device wide factory" because it will reset all the applications (FIDO and PIV in this context) on the device:
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ah ok, interesting. So does this mean that a reset that only affects the PIV application (Yubico.YubiKey.Piv.PivSession.ResetApplication) adheres to the PIV standard? And if this reset only affects the FIDO and PIV applications, shouldn't we specify that? When I read "device-wide", I would assume that affects all YubiKey applications (Yubico OTP, etc). There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Oh, I have forgotten to mention that this instruction is available only on YubiKey Bio Multi-Protocol Edition devices. There are only FIDO and PIV application available on these devices. These application share the PIN and the fingerprint sensor (you can use the same pin/fingerprints for both FIDO and PIV authentication) which causes that you cannot reset the PIV or FIDO applications with the "PivSession.ResetApplication" (and vice versa for FIDO) because it would invalidate the other application as well. That is why the device wide reset was created - it will reset all the applications on the YubiKey (currently FIDO and PIV). Once you do some setup of FIDO (for example add passkeys) or PIV (for example import a certificate), the PivSession.ResetApplication (or the FIDO reset) will not be possible to call because of the reason I described in the previous paragraph. The only way how to reset such YubiKey is to use the device wide reset. I think it should be added to the documentation that this is available only on YubiKey Bio MPE. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Great! That is much better. I added a comment there to clarify a detail. Thank you :) |
||
/// </summary> | ||
DeviceReset, | ||
|
||
// OTP application features | ||
|
||
/// <summary> | ||
|
Uh oh!
There was an error while loading. Please reload this page.