james/yubikey.rs
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

move extensions used to other attestation doc

Browse Source
This commit is contained in:
Klas Lindfors
2016-05-24 15:28:08 +02:00
parent 563e2efe9f
commit 0f1fe34c28
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/Attestation.adoc
+3 -7
View File
@@ -1,6 +1,8 @@
Using Attestation
-----------------
This feature is only available in YubiKey 4.3 and newer.
Attestation works through a special key slot called “f9” this comes
pre-loaded from factory with a key and cert signed by Yubico, but can be
overwritten.
@@ -11,10 +13,4 @@ special key, this can be realised by using the yubico-piv-tool action attest:
...
$ yubico-piv-tool --action=attest --slot=9a
The output of this is a PEM encoded certificate, signed by the key in slot f9. There are a couple of special extensions on this certificate:
* +1.3.6.1.4.1.41482.3.3+: Firmware version, encoded as 3 bytes, like: 040300 for 4.3.0
* +1.3.6.1.4.1.41482.3.7+: Serial number, encoded as an integer.
* +1.3.6.1.4.1.41482.3.8+: Two bytes, the first encoding pin policy and the second touch policy
** Pin policy: 01 - never, 02 - once per session, 03 - always
** Touch policy: 01 - never, 02 - always, 03 - cached for 15s
The output of this is a PEM encoded certificate, signed by the key in slot f9.