From ca6a355b5dd78b46edea9852440b27a098628524 Mon Sep 17 00:00:00 2001 From: Klas Lindfors Date: Thu, 25 Jun 2015 12:04:05 +0200 Subject: [PATCH] add touch tlv for generate and import-key --- lib/ykpiv.h | 4 ++++ tool/cmdline.ggo | 1 + tool/util.c | 12 ++++++++++++ tool/util.h | 1 + tool/yubico-piv-tool.c | 22 +++++++++++++++++----- 5 files changed, 35 insertions(+), 5 deletions(-) diff --git a/lib/ykpiv.h b/lib/ykpiv.h index a14b0e9..0edf065 100644 --- a/lib/ykpiv.h +++ b/lib/ykpiv.h @@ -152,6 +152,10 @@ extern "C" #define YKPIV_PINPOLICY_ONCE 2 #define YKPIV_PINPOLICY_ALWAYS 3 +#define YKPIV_TOUCHPOLICY_TAG 0xab +#define YKPIV_TOUCHPOLICY_NEVER 1 +#define YKPIV_TOUCHPOLICY_ALWAYS 2 + #define IS_ECKEY(a) ((a == YKPIV_ALGO_ECCP256 || a == YKPIV_ALGO_ECCP384)) #define IS_RSAKEY(a) ((a == YKPIV_ALGO_RSA1024 || a == YKPIV_ALGO_RSA2048)) diff --git a/tool/cmdline.ggo b/tool/cmdline.ggo index 50d346c..40aa65e 100644 --- a/tool/cmdline.ggo +++ b/tool/cmdline.ggo @@ -59,3 +59,4 @@ option "pin" P "Pin/puk code for verification" string optional option "new-pin" N "New pin/puk code for changing" string optional dependon="pin" option "sign" - "Sign data" flag off hidden option "pin-policy" - "Set pin policy for action generate or import-key" values="never","once","always" enum optional +option "touch-policy" - "Set touch policy for action generate or import-key" values="never","always" enum optional diff --git a/tool/util.c b/tool/util.c index 464b9ef..82e5126 100644 --- a/tool/util.c +++ b/tool/util.c @@ -418,3 +418,15 @@ unsigned char get_pin_policy(enum enum_pin_policy policy) { return 0; } } + +unsigned char get_touch_policy(enum enum_touch_policy policy) { + switch(policy) { + case touch_policy_arg_never: + return YKPIV_TOUCHPOLICY_NEVER; + case touch_policy_arg_always: + return YKPIV_TOUCHPOLICY_ALWAYS; + case touch_policy__NULL: + default: + return 0; + } +} diff --git a/tool/util.h b/tool/util.h index ea29d87..c7c9ccb 100644 --- a/tool/util.h +++ b/tool/util.h @@ -51,5 +51,6 @@ const EVP_MD *get_hash(enum enum_hash, const unsigned char**, size_t*); int get_hashnid(enum enum_hash, unsigned char); unsigned char get_piv_algorithm(enum enum_algorithm); unsigned char get_pin_policy(enum enum_pin_policy); +unsigned char get_touch_policy(enum enum_touch_policy); #endif diff --git a/tool/yubico-piv-tool.c b/tool/yubico-piv-tool.c index 055cdbd..92301b1 100644 --- a/tool/yubico-piv-tool.c +++ b/tool/yubico-piv-tool.c @@ -86,8 +86,9 @@ static void print_version(ykpiv_state *state, const char *output_file_name) { static bool generate_key(ykpiv_state *state, const char *slot, enum enum_algorithm algorithm, const char *output_file_name, - enum enum_key_format key_format, enum enum_pin_policy pin_policy) { - unsigned char in_data[8]; + enum enum_key_format key_format, enum enum_pin_policy pin_policy, + enum enum_touch_policy touch_policy) { + unsigned char in_data[11]; unsigned char *in_ptr = in_data; unsigned char data[1024]; unsigned char templ[] = {0, YKPIV_INS_GENERATE_ASYMMERTRIC, 0, 0}; @@ -127,6 +128,12 @@ static bool generate_key(ykpiv_state *state, const char *slot, *in_ptr++ = 1; *in_ptr++ = get_pin_policy(pin_policy); } + if(touch_policy != touch_policy__NULL) { + in_data[1] += 3; + *in_ptr++ = YKPIV_TOUCHPOLICY_TAG; + *in_ptr++ = 1; + *in_ptr++ = get_touch_policy(touch_policy); + } if(ykpiv_transfer_data(state, templ, in_data, in_ptr - in_data, data, &recv_len, &sw) != YKPIV_OK) { fprintf(stderr, "Failed to communicate.\n"); @@ -287,7 +294,7 @@ static bool set_pin_retries(ykpiv_state *state, int pin_retries, int puk_retries static bool import_key(ykpiv_state *state, enum enum_key_format key_format, const char *input_file_name, const char *slot, char *password, - enum enum_pin_policy pin_policy) { + enum enum_pin_policy pin_policy, enum enum_touch_policy touch_policy) { int key = 0; FILE *input_file = NULL; EVP_PKEY *private_key = NULL; @@ -405,6 +412,11 @@ static bool import_key(ykpiv_state *state, enum enum_key_format key_format, *in_ptr++ = 1; *in_ptr++ = get_pin_policy(pin_policy); } + if(touch_policy != touch_policy__NULL) { + *in_ptr++ = YKPIV_TOUCHPOLICY_TAG; + *in_ptr++ = 1; + *in_ptr++ = get_touch_policy(touch_policy); + } if(ykpiv_transfer_data(state, templ, in_data, in_ptr - in_data, data, &recv_len, &sw) != YKPIV_OK) { @@ -1674,7 +1686,7 @@ int main(int argc, char *argv[]) { break; case action_arg_generate: if(generate_key(state, args_info.slot_orig, args_info.algorithm_arg, args_info.output_arg, args_info.key_format_arg, - args_info.pin_policy_arg) == false) { + args_info.pin_policy_arg, args_info.touch_policy_arg) == false) { ret = EXIT_FAILURE; } else { fprintf(stderr, "Successfully generated a new private key.\n"); @@ -1716,7 +1728,7 @@ int main(int argc, char *argv[]) { break; case action_arg_importMINUS_key: if(import_key(state, args_info.key_format_arg, args_info.input_arg, args_info.slot_orig, args_info.password_arg, - args_info.pin_policy_arg) == false) { + args_info.pin_policy_arg, args_info.touch_policy_arg) == false) { ret = EXIT_FAILURE; } else { fprintf(stderr, "Successfully imported a new private key.\n");