v0.8.0-pre.0 (#491 )

Bump asymmetric crypto dependencies; MSRV 1.65 (#490 )
Bumps the following dependencies to the latest versions: - `elliptic-curve` v0.13 - `k256` v0.13 - `p256` v0.13 - `p384` v0.13 - `pbkdf2` v0.12 - `rsa` v0.9.0-pre.0 - `signature` v2
2023-03-14 17:17:07 -06:00 · 2023-03-14 11:53:00 -06:00 · 2023-02-12 12:02:22 -07:00 · 2023-02-12 10:22:05 -07:00 · 2023-02-12 10:20:34 -07:00 · 2023-02-12 10:18:55 -07:00
37 changed files with 2189 additions and 919 deletions
@@ -1,5 +1,5 @@
 [advisories]
 ignore = [
-    "RUSTSEC-2020-0071", # time
-    "RUSTSEC-2020-0159", # chrono
-] 
+    "RUSTSEC-2020-0071", # chrono
+    "RUSTSEC-2021-0145", # atty
+] # advisory IDs to ignore e.g. ["RUSTSEC-2019-0001", ...]
@@ -36,13 +36,13 @@ jobs:
            toolchain: stable
            deps: true
          - platform: ubuntu-latest
-            toolchain: 1.51.0 # MSRV
+            toolchain: 1.65.0 # MSRV
            deps: sudo apt-get install libpcsclite-dev
          - platform: windows-latest
-            toolchain: 1.51.0 # MSRV
+            toolchain: 1.65.0 # MSRV
            deps: true
          - platform: macos-latest
-            toolchain: 1.51.0 # MSRV
+            toolchain: 1.65.0 # MSRV
            deps: true
    runs-on: ${{ matrix.platform }}
    steps:
@@ -82,7 +82,7 @@ jobs:
      - uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: 1.51.0 # MSRV
+          toolchain: 1.65.0
          components: clippy
          override: true
      - run: sudo apt-get install libpcsclite-dev
@@ -42,4 +42,4 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: audit
-          args: --deny warnings --ignore RUSTSEC-2019-0031 # spin
+          args: --deny warnings
@@ -4,6 +4,74 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## Unreleased
+### Added
+- `YubiKey::disconnect`
+- `impl Debug for {Context, YubiKey}`
+- `Error::AppletNotFound`
+
+### Changed
+- `Reader::open` now returns `Error::AppletNotFound` instead of `Error::Generic`
+  if the PIV applet is not present on the device. This is returned by non-PIV
+  virtual smart cards like Windows Hello for Business, as well as some smart
+  card readers when no card is present.
+- `Reader::open` now avoids resetting the card if an error occurs (equivalent to
+  calling `YubiKey::disconnect(pcsc::Disposition::LeaveCard)` if `Reader::open`
+  succeeds).
+
+### Fixed
+- `StatusWords::code` now returns the correct code (including embedded `tries`
+  count) for `StatusWords::VerifyFailError`. Previously the returned code lost
+  information and was not round-trip compatible with `StatusWords::from(u16)`.
+
+## 0.7.0 (2022-11-14)
+### Added
+- Display inner PC/SC errors ([#420])
+- Support for metadata command ([#371])
+- Better `certificate::Serial` inspection ([#437])
+
+### Changed
+- MSRV 1.60.0 ([#423])
+- Bump `rsa` to v0.7.1 ([#440])
+- Switch from `lazy_static` to `once_cell` ([#442])
+- Switch from `subtle-encoding` to `base16ct` ([#443])
+
+### Fixed
+- Use `chrono` v0.4.23 or newer ([#436])
+- `Certificate::issuer` was returning the subject instead ([#437])
+
+[#371]: https://github.com/iqlusioninc/yubikey.rs/pull/371
+[#420]: https://github.com/iqlusioninc/yubikey.rs/pull/420
+[#423]: https://github.com/iqlusioninc/yubikey.rs/pull/423
+[#436]: https://github.com/iqlusioninc/yubikey.rs/pull/436
+[#437]: https://github.com/iqlusioninc/yubikey.rs/pull/437
+[#440]: https://github.com/iqlusioninc/yubikey.rs/pull/440
+[#442]: https://github.com/iqlusioninc/yubikey.rs/pull/442
+[#443]: https://github.com/iqlusioninc/yubikey.rs/pull/443
+
+## 0.6.0 (2022-08-10)
+### Changed
+- 2021 edition upgrade ([#343])
+- RustCrypto crate upgrades; MSRV 1.57 ([#378])
+  - `des` v0.8
+  - `elliptic-curve` v0.12
+  - `hmac` v0.12
+  - `num-bigint-dig` v0.8
+  - `pbkdf2` v0.11
+  - `p256` v0.11
+  - `p384` v0.11
+  - `rsa` v0.6
+  - `sha1` v0.10 (replacing `sha-1`)
+  - `sha2` v0.10
+- Bump `uuid` to v1.0 ([#376])
+- Bump `der-parser` to v8.0 ([#402])
+- Bump `x509-parser` to v0.14 ([#402])
+
+[#343]: https://github.com/iqlusioninc/yubikey.rs/pull/343
+[#376]: https://github.com/iqlusioninc/yubikey.rs/pull/376
+[#378]: https://github.com/iqlusioninc/yubikey.rs/pull/378
+[#402]: https://github.com/iqlusioninc/yubikey.rs/pull/402
+
 ## 0.5.0 (2021-11-21)
 ### Changed
 - Update `rsa` dependency to 0.5 ([#315])
@@ -1,6 +1,6 @@
 [package]
 name = "yubikey"
-version = "0.5.0" # Also update html_root_url in lib.rs when bumping this
+version = "0.8.0-pre.0"
 description = """
 Pure Rust cross-platform host-side driver for YubiKey devices from Yubico with
 support for hardware-backed public-key decryption and digital signatures using
@@ -8,47 +8,49 @@ the Personal Identity Verification (PIV) application. Supports RSA (1024/2048)
 or ECC (NIST P-256/P-384) algorithms e.g, PKCS#1v1.5, ECDSA
 """
 authors = ["Tony Arcieri <tony@iqlusion.io>", "Yubico AB"]
-edition    = "2018"
 license = "BSD-2-Clause"
 repository = "https://github.com/iqlusioninc/yubikey.rs"
 readme = "README.md"
-categories = ["api-bindings", "cryptography", "hardware-support"]
+categories = ["api-bindings", "authentication", "cryptography", "hardware-support"]
 keywords = ["ecdsa", "encryption", "rsa", "piv", "signature"]
+edition = "2021"
+rust-version = "1.65"

 [workspace]
 members = [".", "cli"]

 [dependencies]
-chrono = "0.4"
+chrono = "0.4.23"
 cookie-factory = "0.3"
-der-parser = "6"
-des = "0.7"
-elliptic-curve = "0.10"
-hmac = "0.11"
+der-parser = "8"
+des = "0.8"
+elliptic-curve = "0.13"
+hex = { package = "base16ct", version = "0.2", features = ["alloc"] }
+hmac = "0.12"
 log = "0.4"
 nom = "7"
-num-bigint-dig = { version = "0.7", features = ["rand"] }
+num-bigint-dig = { version = "0.8", features = ["rand"] }
 num-traits = "0.2"
 num-integer = "0.1"
-pbkdf2 = { version = "0.9", default-features = false }
-p256 = "0.9"
-p384 = "0.8"
-pcsc = "2"
+p256 = "0.13"
+p384 = "0.13"
+pbkdf2 = { version = "0.12", default-features = false, features = ["hmac"] }
+pcsc = "2.3.1"
 rand_core = { version = "0.6", features = ["std"] }
-rsa = "0.5"
+rsa = "=0.9.0-pre.0"
 secrecy = "0.8"
-sha-1 = "0.9"
-sha2 = "0.9"
+sha1 = { version = "0.10", features = ["oid"] }
+sha2 = { version = "0.10", features = ["oid"] }
 subtle = "2"
-subtle-encoding = "0.5"
-uuid = { version = "0.8", features = ["v4"] }
+uuid = { version = "1.2", features = ["v4"] }
 x509 = "0.2"
-x509-parser = "0.12"
+x509-parser = "0.14"
 zeroize = "1"

 [dev-dependencies]
-env_logger = "0.9"
-lazy_static = "1"
+env_logger = "0.10"
+once_cell = "1"
+signature = "2"

 [features]
 untested = []
@@ -4,16 +4,19 @@

 [![crate][crate-image]][crate-link]
 [![Docs][docs-image]][docs-link]
-[![2-Clause BSD Licensed][license-image]][license-link]
-![Rust Version][rustc-image]
-[![Safety Dance][safety-image]][safety-link]
 [![Build Status][build-image]][build-link]
-[![dependency status][deps-image]][deps-link]
+[![Safety Dance][safety-image]][safety-link]
+[![Dependency Status][deps-image]][deps-link]
+[![2-Clause BSD Licensed][license-image]][license-link]
+![MSRV][msrv-image]

 Pure Rust cross-platform host-side driver for [YubiKey] devices from [Yubico]
 with support for public-key encryption and digital signatures using the
 [Personal Identity Verification (PIV)][PIV] application.

+Uses the Personal Computer/Smart Card ([PC/SC]) interface with cross-platform
+access provided by the [`pcsc` crate].
+
 [Documentation][docs-link]

 ## About
@@ -26,17 +29,44 @@ encryption (PKCS#1v1.5/ECIES) use cases are supported for either key type.
 See [Yubico's guide to PIV-enabled YubiKeys][yk-guide] for more information
 on which devices support PIV and the available functionality.

-If you've been wanting to use Rust to sign and/or encrypt stuff using a
-private key generated and stored on a Yubikey (with option PIN-based access),
+If you've been wanting to use Rust to sign and/or encrypt data using a
+private key generated and stored on a YubiKey (with option PIN-based access),
 this is the crate you've been after!

 Note that while this project started as a fork of a [Yubico] project,
 this fork is **NOT** an official Yubico project and is in no way supported or
 endorsed by Yubico.

+## Features
+
+### Personal Identity Verification (PIV)
+
+[PIV] is a [NIST] standard for both *signing* and *encryption*
+using SmartCards and SmartCard-based hardware tokens like YubiKeys.
+
+PIV-related functionality can be found in the [`piv`] module.
+
+This library natively implements the protocol used to manage and
+utilize PIV encryption and signing keys which can be generated, imported,
+and stored on YubiKey devices.
+
+See [Yubico's guide to PIV-enabled YubiKeys][yk-guide] for more information
+on which devices support PIV and the available functionality.
+
+### Supported Algorithms
+- **Authentication**: `3DES`
+- **Encryption**:
+  - RSA: `RSA1024`, `RSA2048`
+  - ECC: `ECCP256`, `ECCP384` (NIST curves: P-256, P-384)
+- **Signatures**:
+  - RSASSA-PKCS#1v1.5: `RSA1024`, `RSA2048`
+  - ECDSA: `ECCP256`, `ECCP384` (NIST curves: P-256, P-384)
+
+NOTE: RSASSA-PSS signatures and RSA-OAEP encryption may be supportable (TBD)
+
 ## Minimum Supported Rust Version

-Rust **1.51** or newer.
+Rust **1.60** or newer.

 ## Supported YubiKeys

@@ -59,6 +89,17 @@ an experimental stage and may still contain high-severity issues.

 USE AT YOUR OWN RISK!

+## Status
+
+Functionality which has been successfully tested is available by default.
+
+Any functionality which is gated on the `untested` feature has not been
+properly tested and is not known to function correctly.
+
+Please see the [`untested` functionality tracking issue] for current status.
+We would appreciate any help testing this functionality and removing the
+`untested` gating as well as writing more automated tests.
+
 ## Testing

 To run the full test suite, you'll need a connected YubiKey NEO/4/5 device in
@@ -68,7 +109,7 @@ Tests which run live against a YubiKey device are marked as `#[ignore]` by
 default in order to pass when running in a CI environment. To run these
 tests locally, invoke the following command:

-```
+```shell
 cargo test -- --ignored
 ```

@@ -77,14 +118,14 @@ information about what is happening. If you'd like to print this logging
 information while running the tests, set the `RUST_LOG` environment variable
 to a relevant loglevel (e.g. `error`, `warn`, `info`, `debug`, `trace`):

-```
+```shell
 RUST_LOG=info cargo test -- --ignored
 ```

 To trace every message sent to/from the card i.e. the raw
 Application Protocol Data Unit (APDU) messages, use the `trace` log level:

-```
+```text
 running 1 test
 [INFO  yubikey::yubikey] trying to connect to reader 'Yubico YubiKey OTP+FIDO+CCID'
 [INFO  yubikey::yubikey] connected to 'Yubico YubiKey OTP+FIDO+CCID' successfully
@@ -110,6 +151,14 @@ Yubico, which was originally written in C. It was mechanically translated
 from C into Rust using [Corrode], and then subsequently heavily
 refactored into safer, more idiomatic Rust.

+For more information on [yubico-piv-tool] and background information on how
+the YubiKey implementation of PIV works in general, see the
+[Yubico PIV Tool Command Line Guide][piv-tool-guide].
+
+## ⚠️ Security Warning
+
+No security audits of this crate have ever been performed.
+
 ## Code of Conduct

 We abide by the [Contributor Covenant][cc-md] and ask that you do as well.
@@ -123,7 +172,7 @@ Yubico's [yubico-piv-tool], a C library/CLI program. The original library
 was licensed under a [2-Clause BSD License][BSDL], which this library inherits
 as a derived work.

-Copyright (c) 2014-2021 Yubico AB, Tony Arcieri
+Copyright (c) 2014-2023 Yubico AB, Tony Arcieri
 All rights reserved.

 Redistribution and use in source and binary forms, with or without
@@ -159,13 +208,13 @@ or conditions.

 [//]: # (badges)

-[crate-image]: https://img.shields.io/crates/v/yubikey.svg
+[crate-image]:  https://buildstats.info/crate/yubikey
 [crate-link]: https://crates.io/crates/yubikey
 [docs-image]: https://docs.rs/yubikey/badge.svg
 [docs-link]: https://docs.rs/yubikey/
 [license-image]: https://img.shields.io/badge/license-BSD-blue.svg
 [license-link]: https://github.com/iqlusioninc/yubikey.rs/blob/main/COPYING
-[rustc-image]: https://img.shields.io/badge/rustc-1.51+-blue.svg
+[msrv-image]: https://img.shields.io/badge/rustc-1.65+-blue.svg
 [safety-image]: https://img.shields.io/badge/unsafe-forbidden-success.svg
 [safety-link]: https://github.com/rust-secure-code/safety-dance/
 [build-image]: https://github.com/iqlusioninc/yubikey.rs/workflows/CI/badge.svg?branch=main&event=push
@@ -176,9 +225,12 @@ or conditions.
 [//]: # (general links)

 [YubiKey]: https://www.yubico.com/products/yubikey-hardware/
-[PIV]: https://piv.idmanagement.gov/
-[yk-guide]: https://developers.yubico.com/PIV/Introduction/YubiKey_and_PIV.html
 [Yubico]: https://www.yubico.com/
+[PIV]: https://piv.idmanagement.gov/
+[NIST]: https://www.nist.gov/
+[PC/SC]: https://en.wikipedia.org/wiki/PC/SC
+[`pcsc` crate]: https://github.com/bluetech/pcsc-rust
+[yk-guide]: https://developers.yubico.com/PIV/Introduction/YubiKey_and_PIV.html
 [YubiKey NEO]: https://support.yubico.com/support/solutions/articles/15000006494-yubikey-neo
 [YubiKey 4]: https://support.yubico.com/support/solutions/articles/15000006486-yubikey-4
 [YubiKey 5]: https://www.yubico.com/products/yubikey-5-overview/
@@ -187,6 +239,7 @@ or conditions.
 [cc-web]: https://contributor-covenant.org/
 [cc-md]: https://github.com/iqlusioninc/yubikey.rs/blob/main/CODE_OF_CONDUCT.md
 [BSDL]: https://opensource.org/licenses/BSD-2-Clause
+[`untested` functionality tracking issue]: https://github.com/iqlusioninc/yubikey.rs/issues/280

 [//]: # (github issues)

@@ -4,6 +4,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## 0.7.0 (2022-11-14)
+### Changed
+- Bump `clap` to v4.0 ([#438])
+- Bump `x509-parser` to v0.14 ([#441])
+- Switch from `lazy_static` to `once_cell` ([#442])
+- Switch from `subtle-encoding` to `base16ct` ([#443])
+- Bump `yubikey` dependency to v0.7 ([#444])
+
+[#438]: https://github.com/iqlusioninc/yubikey.rs/pull/438
+[#441]: https://github.com/iqlusioninc/yubikey.rs/pull/441
+[#442]: https://github.com/iqlusioninc/yubikey.rs/pull/442
+[#443]: https://github.com/iqlusioninc/yubikey.rs/pull/443
+[#444]: https://github.com/iqlusioninc/yubikey.rs/pull/444
+
+## 0.6.0 (2022-08-10)
+### Changed
+- 2021 edition upgrade; MSRV 1.57 ([#343])
+- Migrate from `gumdrop` to `clap` v3 ([#379])
+- Bump `yubikey` dependency to v0.6 ([#403])
+
+[#343]: https://github.com/iqlusioninc/yubikey.rs/pull/343
+[#379]: https://github.com/iqlusioninc/yubikey.rs/pull/379
+[#403]: https://github.com/iqlusioninc/yubikey.rs/pull/403
+
 ## 0.5.0 (2021-11-21)
 ### Changed
 - Bump `yubikey` dependency to v0.5 ([#327])
@@ -1,25 +1,26 @@
 [package]
 name = "yubikey-cli"
-version = "0.5.0"
+version = "0.7.0"
 description = """
 Command-line interface for performing encryption and signing using RSA/ECC keys
 stored on YubiKey devices.
 """
 authors = ["Tony Arcieri <tony@iqlusion.io>"]
-edition    = "2018"
 license = "BSD-2-Clause"
 repository = "https://github.com/iqlusioninc/yubikey.rs"
 readme = "README.md"
 categories = ["command-line-utilities", "cryptography", "hardware-support"]
 keywords = ["ecdsa", "rsa", "piv", "pcsc", "yubikey"]
+edition = "2021"
+rust-version = "1.56"

 [dependencies]
-gumdrop = "0.8"
-env_logger = "0.9"
-lazy_static = "1"
+clap = { version = "4", features = ["derive"] }
+env_logger = "0.10"
+hex = { package = "base16ct", version = "0.2", features = ["alloc"] }
 log = "0.4"
-sha2 = "0.9"
-subtle-encoding = "0.5"
+once_cell = "1"
+sha2 = "0.10"
 termcolor = "1"
-x509-parser = "0.12"
-yubikey = { version = "0.5", path = ".." }
+x509-parser = "0.14"
+yubikey = { version = "0.8.0-pre.0", path = ".." }
@@ -18,7 +18,7 @@ utility with general-purpose public-key encryption and signing support.

 ## Minimum Supported Rust Version

-Rust **1.51** or newer.
+Rust **1.60** or newer.

 ## Supported YubiKeys

@@ -35,10 +35,6 @@ an experimental stage and may still contain high-severity issues.

 USE AT YOUR OWN RISK!

-## Status
-
-WIP. Check back later.
-
 ## Code of Conduct

 We abide by the [Contributor Covenant][cc-md] and ask that you do as well.
@@ -47,7 +43,7 @@ For more information, please see [CODE_OF_CONDUCT.md][cc-md].

 ## License

-Copyright (c) 2014-2021 Yubico AB, Tony Arcieri
+Copyright (c) 2014-2023 Yubico AB, Tony Arcieri
 All rights reserved.

 Redistribution and use in source and binary forms, with or without
@@ -88,7 +84,7 @@ or conditions.
 [docs-image]: https://docs.rs/yubikey-cli/badge.svg
 [docs-link]: https://docs.rs/yubikey-cli/
 [license-image]: https://img.shields.io/badge/license-BSD-blue.svg
-[rustc-image]: https://img.shields.io/badge/rustc-1.39+-blue.svg
+[rustc-image]: https://img.shields.io/badge/rustc-1.60+-blue.svg
 [maintenance-image]: https://img.shields.io/badge/maintenance-experimental-blue.svg
 [safety-image]: https://img.shields.io/badge/unsafe-forbidden-success.svg
 [safety-link]: https://github.com/rust-secure-code/safety-dance/
@@ -8,9 +8,9 @@
    unused_qualifications
 )]

-use gumdrop::Options;
+use clap::Parser;
 use yubikey_cli::commands::YubiKeyCli;

 fn main() {
-    YubiKeyCli::parse_args_default_or_exit().run();
+    YubiKeyCli::parse().run()
 }
@@ -4,62 +4,25 @@ pub mod readers;
 pub mod status;

 use self::{readers::ReadersCmd, status::StatusCmd};
-use crate::terminal::{self, STDOUT};
-use gumdrop::Options;
-use std::{
-    env,
-    io::{self, Write},
-    process::exit,
-};
-use termcolor::{ColorChoice, ColorSpec, WriteColor};
+use crate::terminal;
+use clap::Parser;
+use std::{env, process::exit};
+use termcolor::ColorChoice;
 use yubikey::{Serial, YubiKey};

 /// The `yubikey` CLI utility
-#[derive(Debug, Options)]
+#[derive(Debug, Parser)]
 pub struct YubiKeyCli {
-    /// Obtain help about the current command
-    #[options(short = "h", help = "print help message")]
-    pub help: bool,
-
-    /// Specify the serial number of the YubiKey to connect to
-    #[options(
-        short = "s",
-        long = "serial",
-        help = "serial number of the YubiKey to connect to"
-    )]
+    /// Serial number of the YubiKey to connect to
+    #[clap(short = 's', long = "serial")]
    pub serial: Option<Serial>,

    /// Subcommand to execute.
-    #[options(command)]
-    pub command: Option<Commands>,
+    #[clap(subcommand)]
+    pub command: Commands,
 }

 impl YubiKeyCli {
-    /// Print usage information
-    pub fn print_usage() -> io::Result<()> {
-        let mut stdout = STDOUT.lock();
-        stdout.reset()?;
-
-        let mut bold = ColorSpec::new();
-        bold.set_bold(true);
-
-        stdout.set_color(&bold)?;
-        writeln!(
-            stdout,
-            "{} {}",
-            env!("CARGO_PKG_NAME"),
-            env!("CARGO_PKG_VERSION")
-        )?;
-        stdout.reset()?;
-
-        writeln!(stdout, "{}", env!("CARGO_PKG_AUTHORS"))?;
-        writeln!(stdout, "{}", env!("CARGO_PKG_DESCRIPTION").trim())?;
-        writeln!(stdout)?;
-        writeln!(stdout, "{}", Commands::usage())?;
-
-        Ok(())
-    }
-
    /// Run the underlying command type or print usage info and exit
    pub fn run(&self) {
        // TODO(tarcieri): make this more configurable
@@ -70,10 +33,7 @@ impl YubiKeyCli {
            env_logger::builder().format_timestamp(None).init();
        }

-        match &self.command {
-            Some(cmd) => cmd.run(self.yubikey_init()),
-            None => Self::print_usage().unwrap(),
-        }
+        self.command.run(self.yubikey_init())
    }

    /// Initialize the YubiKey client driver
@@ -92,22 +52,18 @@ impl YubiKeyCli {
 }

 /// Subcommands of this application
-#[derive(Debug, Options)]
+#[derive(Debug, Parser)]
 pub enum Commands {
-    /// `help` subcommand
-    #[options(help = "show help for a command")]
-    Help(HelpOpts),
-
    /// `version` subcommand
-    #[options(help = "display version information")]
+    #[clap(about = "display version information")]
    Version(VersionOpts),

    /// `readers` subcommand
-    #[options(help = "list detected readers")]
+    #[clap(about = "list detected readers")]
    Readers(ReadersCmd),

    /// `status` subcommand
-    #[options(help = "show yubikey status")]
+    #[clap(about = "show yubikey status")]
    Status(StatusCmd),
 }

@@ -115,7 +71,6 @@ impl Commands {
    /// Run the given command
    pub fn run(&self, yubikey: YubiKey) {
        match self {
-            Commands::Help(help) => help.run(),
            Commands::Version(version) => version.run(),
            Commands::Readers(list) => list.run(),
            Commands::Status(status) => status.run(yubikey),
@@ -123,28 +78,8 @@ impl Commands {
    }
 }

-/// Help options
-#[derive(Debug, Options)]
-pub struct HelpOpts {
-    #[options(free, help = "subcommand to get help for")]
-    free: Vec<String>,
-}
-
-impl HelpOpts {
-    fn run(&self) {
-        if let Some(command) = self.free.first() {
-            if let Some(usage) = Commands::command_usage(command) {
-                println!("{}", usage);
-                exit(1);
-            }
-        }
-
-        println!("{}", Commands::usage());
-    }
-}
-
 /// Version options
-#[derive(Debug, Options)]
+#[derive(Debug, Parser)]
 pub struct VersionOpts {}

 impl VersionOpts {
@@ -1,7 +1,7 @@
 //! List detected readers

 use crate::terminal::STDOUT;
-use gumdrop::Options;
+use clap::Parser;
 use std::{
    io::{self, Write},
    process::exit,
@@ -10,7 +10,7 @@ use termcolor::{ColorSpec, StandardStreamLock, WriteColor};
 use yubikey::{Context, Serial};

 /// The `readers` subcommand
-#[derive(Debug, Options)]
+#[derive(Debug, Parser)]
 pub struct ReadersCmd {}

 impl ReadersCmd {
@@ -1,7 +1,7 @@
 //! Print device status

 use crate::terminal::{print_cert_info, STDOUT};
-use gumdrop::Options;
+use clap::Parser;
 use std::io::{self, Write};
 use termcolor::{ColorSpec, StandardStreamLock, WriteColor};
 use yubikey::{piv::*, YubiKey};
@@ -10,7 +10,7 @@ use yubikey::{piv::*, YubiKey};
 const NONE_STR: &str = "<none>";

 /// The `status` subcommand
-#[derive(Debug, Options)]
+#[derive(Debug, Parser)]
 pub struct StatusCmd {}

 impl StatusCmd {
@@ -1,14 +1,13 @@
 //! Status messages

-use lazy_static::lazy_static;
 use log::debug;
+use once_cell::sync::Lazy;
 use sha2::{Digest, Sha256};
 use std::{
    io::{self, Write},
    str,
    sync::Mutex,
 };
-use subtle_encoding::hex;
 use termcolor::{Color, ColorChoice, ColorSpec, StandardStream, StandardStreamLock, WriteColor};
 use x509_parser::parse_x509_certificate;
 use yubikey::{certificate::Certificate, piv::*, YubiKey};
@@ -59,16 +58,14 @@ macro_rules! status_err {
    };
 }

-lazy_static! {
-    /// Color configuration
-    static ref COLOR_CHOICE: Mutex<Option<ColorChoice>> = Mutex::new(None);
+/// Color configuration
+static COLOR_CHOICE: Lazy<Mutex<Option<ColorChoice>>> = Lazy::new(|| Mutex::new(None));

-    /// Standard output
-    pub static ref STDOUT: StandardStream = StandardStream::stdout(get_color_choice());
+/// Standard output
+pub static STDOUT: Lazy<StandardStream> = Lazy::new(|| StandardStream::stdout(get_color_choice()));

-    /// Standard error
-    pub static ref STDERR: StandardStream = StandardStream::stderr(get_color_choice());
-}
+/// Standard error
+pub static STDERR: Lazy<StandardStream> = Lazy::new(|| StandardStream::stderr(get_color_choice()));

 /// Obtain the color configuration.
 ///
@@ -140,14 +137,12 @@ impl Status {

    /// Print the given message to stdout
    pub fn print_stdout(self, msg: impl AsRef<str>) {
-        self.print(&*STDOUT, msg)
-            .expect("error printing to stdout!")
+        self.print(&STDOUT, msg).expect("error printing to stdout!")
    }

    /// Print the given message to stderr
    pub fn print_stderr(self, msg: impl AsRef<str>) {
-        self.print(&*STDERR, msg)
-            .expect("error printing to stderr!")
+        self.print(&STDERR, msg).expect("error printing to stderr!")
    }

    /// Print the given message
@@ -204,17 +199,25 @@ pub fn print_cert_info(
                print_cert_attr(
                    stream,
                    "Fingerprint",
-                    str::from_utf8(hex::encode(fingerprint).as_slice()).unwrap(),
+                    &hex::upper::encode_string(&fingerprint),
                )?;
                print_cert_attr(
                    stream,
                    "Not Before",
-                    cert.tbs_certificate.validity.not_before.to_rfc2822(),
+                    cert.tbs_certificate
+                        .validity
+                        .not_before
+                        .to_rfc2822()
+                        .unwrap(),
                )?;
                print_cert_attr(
                    stream,
                    "Not After",
-                    cert.tbs_certificate.validity.not_after.to_rfc2822(),
+                    cert.tbs_certificate
+                        .validity
+                        .not_after
+                        .to_rfc2822()
+                        .unwrap(),
                )?;
            }
            _ => {
@@ -195,6 +195,9 @@ pub enum Ins {
    /// Get device serial
    GetSerial,

+    /// Get slot metadata
+    GetMetadata,
+
    /// Other/unrecognized instruction codes
    Other(u8),
 }
@@ -219,6 +222,7 @@ impl Ins {
            Ins::SetPinRetries => 0xfa,
            Ins::Attest => 0xf9,
            Ins::GetSerial => 0xf8,
+            Ins::GetMetadata => 0xf7,
            Ins::Other(code) => code,
        }
    }
@@ -243,6 +247,7 @@ impl From<u8> for Ins {
            0xfa => Ins::SetPinRetries,
            0xf9 => Ins::Attest,
            0xf8 => Ins::GetSerial,
+            0xf7 => Ins::GetMetadata,
            code => Ins::Other(code),
        }
    }
@@ -348,6 +353,12 @@ pub(crate) enum StatusWords {
    /// Successful execution
    Success,

+    /// The requested data was too large for the response, and there is data remaining.
+    BytesRemaining {
+        /// The number of bytes remaining, as indicated in the response.
+        len: u8,
+    },
+
    /// https://github.com/Yubico/yubikey-manager/blob/1f22620b623c6b345dd9f9193ec765a542dddc80/ykman/driver_ccid.py#L53
    NoInputDataError,

@@ -405,8 +416,9 @@ impl StatusWords {
    pub fn code(self) -> u16 {
        match self {
            StatusWords::None => 0,
+            StatusWords::BytesRemaining { len } => 0x6100 | len as u16,
            StatusWords::NoInputDataError => 0x6285,
-            StatusWords::VerifyFailError { tries } => 0x63c0 & tries as u16,
+            StatusWords::VerifyFailError { tries } => 0x63c0 | tries as u16,
            StatusWords::WrongLengthError => 0x6700,
            StatusWords::SecurityStatusError => 0x6982,
            StatusWords::AuthBlockedError => 0x6983,
@@ -434,6 +446,9 @@ impl From<u16> for StatusWords {
    fn from(sw: u16) -> Self {
        match sw {
            0x0000 => StatusWords::None,
+            sw if sw & 0xff00 == 0x6100 => Self::BytesRemaining {
+                len: (sw & 0x00ff) as u8,
+            },
            0x6285 => StatusWords::NoInputDataError,
            sw if sw & 0xfff0 == 0x63c0 => StatusWords::VerifyFailError {
                tries: (sw & 0x000f) as u8,
@@ -461,3 +476,40 @@ impl From<StatusWords> for u16 {
        sw.code()
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::StatusWords;
+
+    #[test]
+    fn status_words_round_trip() {
+        let round_trip = |sw: StatusWords| {
+            assert_eq!(StatusWords::from(sw.code()), sw);
+        };
+
+        round_trip(StatusWords::None);
+        round_trip(StatusWords::BytesRemaining { len: 1 });
+        round_trip(StatusWords::BytesRemaining { len: 10 });
+        round_trip(StatusWords::BytesRemaining { len: 0xFF });
+        round_trip(StatusWords::Success);
+        round_trip(StatusWords::NoInputDataError);
+        round_trip(StatusWords::VerifyFailError { tries: 0x0F });
+        round_trip(StatusWords::VerifyFailError { tries: 3 });
+        round_trip(StatusWords::VerifyFailError { tries: 2 });
+        round_trip(StatusWords::VerifyFailError { tries: 1 });
+        round_trip(StatusWords::VerifyFailError { tries: 0 });
+        round_trip(StatusWords::WrongLengthError);
+        round_trip(StatusWords::SecurityStatusError);
+        round_trip(StatusWords::AuthBlockedError);
+        round_trip(StatusWords::DataInvalidError);
+        round_trip(StatusWords::ConditionsNotSatisfiedError);
+        round_trip(StatusWords::CommandNotAllowedError);
+        round_trip(StatusWords::IncorrectParamError);
+        round_trip(StatusWords::NotFoundError);
+        round_trip(StatusWords::NoSpaceError);
+        round_trip(StatusWords::IncorrectSlotError);
+        round_trip(StatusWords::NotSupportedError);
+        round_trip(StatusWords::CommandAbortedError);
+        round_trip(StatusWords::Other(0x1337));
+    }
+}
@@ -32,12 +32,7 @@

 use crate::{Error, Result, YubiKey};
 use rand_core::{OsRng, RngCore};
-use std::{
-    convert::TryInto,
-    fmt::{self, Debug, Display},
-    str,
-};
-use subtle_encoding::hex;
+use std::fmt::{self, Debug, Display};

 /// CCCID offset
 const CCC_ID_OFFS: usize = 9;
@@ -115,8 +110,14 @@ impl CccId {
    }
 }

-impl Display for CccId {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(str::from_utf8(&hex::encode(&self.0[..])).unwrap())
+impl AsRef<[u8]> for CccId {
+    fn as_ref(&self) -> &[u8] {
+        &self.0
+    }
+}
+
+impl Display for CccId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&hex::upper::encode_string(self.as_ref()))
    }
 }
@@ -47,9 +47,8 @@ use p256::NistP256;
 use p384::NistP384;
 use rsa::{PublicKeyParts, RsaPublicKey};
 use sha2::{Digest, Sha256};
-use std::convert::TryFrom;
-use std::fmt;
-use std::ops::DerefMut;
+use std::fmt::Display;
+use std::{fmt, ops::DerefMut};
 use x509::{der::Oid, RelativeDistinguishedName};
 use x509_parser::{parse_x509_certificate, x509::SubjectPublicKeyInfo};
 use zeroize::Zeroizing;
@@ -85,7 +84,7 @@ impl TryFrom<&[u8]> for Serial {

    fn try_from(bytes: &[u8]) -> Result<Serial> {
        if bytes.len() <= 20 {
-            Ok(Serial(BigUint::from_bytes_be(&bytes)))
+            Ok(Serial(BigUint::from_bytes_be(bytes)))
        } else {
            Err(Error::ParseError)
        }
@@ -96,10 +95,30 @@ impl Serial {
    fn to_bytes(&self) -> Vec<u8> {
        self.0.to_bytes_be()
    }
+    /// Returns itself formatted as x509 compatible hex string
+    pub fn as_x509_hex(&self) -> String {
+        let data = self.to_bytes();
+        let raw_hex_string = format!("{:02X?}", data);
+        raw_hex_string
+            .replace(", ", ":")
+            .replace([']', '['], "")
+            .to_lowercase()
+    }
+    /// Returns itself formatted as x509 compatible int string
+    pub fn as_x509_int(&self) -> String {
+        let Serial(buint) = self;
+        format!("{}", buint)
+    }
+}
+
+impl Display for Serial {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.as_x509_hex())
+    }
 }

 /// Information about how a [`Certificate`] is stored within a YubiKey.
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum CertInfo {
    /// The certificate is uncompressed.
    Uncompressed,
@@ -192,7 +211,7 @@ impl PublicKeyInfo {
    fn parse(subject_pki: &SubjectPublicKeyInfo<'_>) -> Result<Self> {
        match subject_pki.algorithm.algorithm.to_string().as_str() {
            OID_RSA_ENCRYPTION => {
-                let pubkey = read_pki::rsa_pubkey(subject_pki.subject_public_key.data)?;
+                let pubkey = read_pki::rsa_pubkey(&subject_pki.subject_public_key.data)?;

                Ok(PublicKeyInfo::Rsa {
                    algorithm: match pubkey.n().bits() {
@@ -212,10 +231,10 @@ impl PublicKeyInfo {
                    .ok_or(Error::InvalidObject)?;

                match read_pki::ec_parameters(algorithm_parameters)? {
-                    AlgorithmId::EccP256 => EcPublicKey::from_bytes(key_bytes)
+                    AlgorithmId::EccP256 => EcPublicKey::<NistP256>::from_bytes(key_bytes)
                        .map(PublicKeyInfo::EcP256)
                        .map_err(|_| Error::InvalidObject),
-                    AlgorithmId::EccP384 => EcPublicKey::from_bytes(key_bytes)
+                    AlgorithmId::EccP384 => EcPublicKey::<NistP384>::from_bytes(key_bytes)
                        .map(PublicKeyInfo::EcP384)
                        .map_err(|_| Error::InvalidObject),
                    _ => Err(Error::AlgorithmError),
@@ -320,6 +339,7 @@ impl x509::AlgorithmIdentifier for SignatureId {
 #[derive(Clone, Debug)]
 pub struct Certificate {
    serial: Serial,
+    #[allow(dead_code)]
    issuer: String,
    subject: String,
    subject_pki: PublicKeyInfo,
@@ -364,12 +384,12 @@ impl Certificate {
                &serial.to_bytes(),
                &signature_algorithm,
                // Issuer and subject are the same in self-signed certificates.
-                &subject,
+                subject,
                Utc::now(),
                not_after,
-                &subject,
+                subject,
                &subject_pki,
-                &extensions,
+                extensions,
            ),
            tbs_cert.deref_mut(),
        )
@@ -513,7 +533,7 @@ impl Certificate {

    /// Returns the Issuer field of the certificate.
    pub fn issuer(&self) -> &str {
-        &self.subject
+        &self.issuer
    }

    /// Returns the SubjectName field of the certificate.
@@ -588,6 +608,7 @@ pub(crate) fn write_certificate(

 mod read_pki {
    use der_parser::{
+        asn1_rs::Any,
        ber::BerObjectContent,
        der::{parse_der_integer, parse_der_sequence_defined_g, DerObject},
        error::BerError,
@@ -641,8 +662,8 @@ mod read_pki {
    ///   -- specifiedCurve  SpecifiedECDomain
    /// }
    /// ```
-    pub(super) fn ec_parameters(parameters: &DerObject<'_>) -> Result<AlgorithmId> {
-        let curve_oid = parameters.as_oid_val().map_err(|_| Error::InvalidObject)?;
+    pub(super) fn ec_parameters(parameters: &Any<'_>) -> Result<AlgorithmId> {
+        let curve_oid = parameters.as_oid().map_err(|_| Error::InvalidObject)?;

        match curve_oid.to_string().as_str() {
            OID_NIST_P256 => Ok(AlgorithmId::EccP256),
@@ -31,12 +31,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 use crate::{Error, Result, YubiKey};
-use std::{
-    convert::TryInto,
-    fmt::{self, Debug, Display},
-    str,
-};
-use subtle_encoding::hex;
+use std::fmt::{self, Debug, Display};
 use uuid::Uuid;

 /// FASC-N offset
@@ -131,8 +126,14 @@ impl ChuId {
    }
 }

-impl Display for ChuId {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(str::from_utf8(&hex::encode(&self.0[..])).unwrap())
+impl AsRef<[u8]> for ChuId {
+    fn as_ref(&self) -> &[u8] {
+        &self.0
+    }
+}
+
+impl Display for ChuId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&hex::upper::encode_string(self.as_ref()))
    }
 }
@@ -41,10 +41,7 @@ use crate::{
    Result,
 };
 use log::error;
-use std::{
-    convert::TryInto,
-    time::{Duration, SystemTime, UNIX_EPOCH},
-};
+use std::time::{Duration, SystemTime, UNIX_EPOCH};

 const CB_ADMIN_TIMESTAMP: usize = 0x04;
 const PROTECTED_FLAGS_1_PUK_NOBLOCK: u8 = 0x01;
@@ -45,6 +45,12 @@ pub enum Error {
    /// Applet error
    AppletError,

+    /// We tried to select an applet that could not be found.
+    AppletNotFound {
+        /// Human-readable name of the applet.
+        applet_name: &'static str,
+    },
+
    /// Argument error
    ArgumentError,

@@ -121,31 +127,40 @@ impl Error {
    }

    /// Error message
-    pub fn msg(self) -> &'static str {
+    pub fn msg(self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
-            Error::AlgorithmError => "algorithm error",
-            Error::AppletError => "applet error",
-            Error::ArgumentError => "argument error",
-            Error::AuthenticationError => "authentication error",
-            Error::GenericError => "generic error",
-            Error::InvalidObject => "invalid object",
-            Error::KeyError => "key error",
-            Error::MemoryError => "memory error",
-            Error::NotSupported => "not supported",
-            Error::NotFound => "not found",
-            Error::ParseError => "parse error",
-            Error::PcscError { .. } => "PC/SC error",
-            Error::PinLocked => "PIN locked",
-            Error::RangeError => "range error",
-            Error::SizeError => "size error",
-            Error::WrongPin { .. } => "wrong pin",
+            Error::AlgorithmError => f.write_str("algorithm error"),
+            Error::AppletError => f.write_str("applet error"),
+            Error::AppletNotFound { applet_name } => {
+                f.write_str(&format!("{} applet not found", applet_name))
+            }
+            Error::ArgumentError => f.write_str("argument error"),
+            Error::AuthenticationError => f.write_str("authentication error"),
+            Error::GenericError => f.write_str("generic error"),
+            Error::InvalidObject => f.write_str("invalid object"),
+            Error::KeyError => f.write_str("key error"),
+            Error::MemoryError => f.write_str("memory error"),
+            Error::NotSupported => f.write_str("not supported"),
+            Error::NotFound => f.write_str("not found"),
+            Error::ParseError => f.write_str("parse error"),
+
+            Error::PcscError {
+                inner: Some(pcsc_error),
+            } => f.write_fmt(format_args!("PC/SC error: {}", pcsc_error)),
+
+            Error::PcscError { .. } => f.write_str("PC/SC error"),
+
+            Error::PinLocked => f.write_str("PIN locked"),
+            Error::RangeError => f.write_str("range error"),
+            Error::SizeError => f.write_str("size error"),
+            Error::WrongPin { .. } => f.write_str("wrong pin"),
        }
    }
 }

 impl Display for Error {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(self.msg())
+        self.msg(f)
    }
 }

@@ -1,102 +1,10 @@
-//! **yubikey.rs**: pure Rust cross-platform host-side driver for [YubiKey]
-//! devices from [Yubico] using the Personal Computer/Smart Card ([PC/SC])
-//! interface as provided by the [`pcsc` crate].
-//!
-//! # Features
-//! ## Personal Identity Verification (PIV)
-//! [PIV] is a [NIST] standard for both *signing* and *encryption*
-//! using SmartCards and SmartCard-based hardware tokens like YubiKeys.
-//!
-//! PIV-related functionality can be found in the [`piv`] module.
-//!
-//! This library natively implements the protocol used to manage and
-//! utilize PIV encryption and signing keys which can be generated, imported,
-//! and stored on YubiKey devices.
-//!
-//! See [Yubico's guide to PIV-enabled YubiKeys][yk-guide] for more information
-//! on which devices support PIV and the available functionality.
-//!
-//! # Minimum Supported Rust Version
-//! Rust **1.51** or newer.
-//!
-//! # Supported YubiKeys
-//! - [YubiKey 4] series
-//! - [YubiKey 5] series
-//!
-//! NOTE: Nano and USB-C variants of the above are also supported.
-//!       Pre-YK4 [YubiKey NEO] series is **NOT** supported.
-//!
-//! # Supported Operating Systems
-//! - Linux
-//! - macOS
-//! - Windows
-//!
-//! # Supported Algorithms
-//! - **Authentication**: `3DES`
-//! - **Encryption**:
-//!   - RSA: `RSA1024`, `RSA2048`
-//!   - ECC: `ECCP256`, `ECCP384` (NIST curves: P-256, P-384)
-//! - **Signatures**:
-//!   - RSASSA-PKCS#1v1.5: `RSA1024`, `RSA2048`
-//!   - ECDSA: `ECCP256`, `ECCP384` (NIST curves: P-256, P-384)
-//!
-//! NOTE: RSASSA-PSS signatures and RSA-OAEP encryption may be supportable (TBD)
-//!
-//! # Status
-//! Functionality which has been successfully tested is available by default.
-//!
-//! Any functionality which is gated on the `untested` feature has not been
-//! properly tested and is not known to function correctly.
-//!
-//! Please see the [`untested` functionality tracking issue] for current status.
-//! We would appreciate any help testing this functionality and removing the
-//! `untested` gating as well as writing more automated tests.
-//!
-//! # History
-//! This library is a Rust translation of the [yubico-piv-tool] utility by
-//! Yubico, which was originally written in C. It was mechanically translated
-//! from C into Rust using [Corrode], and then subsequently heavily
-//! refactored into safer, more idiomatic Rust.
-//!
-//! For more information on [yubico-piv-tool] and background information on how
-//! the YubiKey implementation of PIV works in general, see the
-//! [Yubico PIV Tool Command Line Guide][piv-tool-guide].
-//!
-//! # Security Warning
-//! No security audits of this crate have ever been performed. Presently it is in
-//! an experimental stage and may still contain high-severity issues.
-//!
-//! USE AT YOUR OWN RISK!
-//!
-//! # Code of Conduct
-//! We abide by the [Contributor Covenant][cc-md] and ask that you do as well.
-//!
-//! For more information, please see [CODE_OF_CONDUCT.md][cc-md].
-//!
-//! # License
-//! **yubikey.rs** is a fork of and originally a mechanical translation from
-//! Yubico's [yubico-piv-tool], a C library/CLI program.
-//!
-//! The original library was licensed under a [2-Clause BSD License][BSDL],
-//! which this library inherits as a derived work.
-//!
-//! [YubiKey]: https://www.yubico.com/products/yubikey-hardware/
-//! [PIV]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-73-4.pdf
-//! [Yubico]: https://www.yubico.com/
-//! [PC/SC]: https://en.wikipedia.org/wiki/PC/SC
-//! [`pcsc` crate]: https://github.com/bluetech/pcsc-rust
-//! [NIST]: https://www.nist.gov/
-//! [yk-guide]: https://developers.yubico.com/PIV/Introduction/YubiKey_and_PIV.html
-//! [YubiKey NEO]: https://support.yubico.com/support/solutions/articles/15000006494-yubikey-neo
-//! [YubiKey 4]: https://support.yubico.com/support/solutions/articles/15000006486-yubikey-4
-//! [YubiKey 5]: https://www.yubico.com/products/yubikey-5-overview/
-//! [`untested` functionality tracking issue]: https://github.com/iqlusioninc/yubikey.rs/issues/280
-//! [yubico-piv-tool]: https://github.com/Yubico/yubico-piv-tool/
-//! [Corrode]: https://github.com/jameysharp/corrode
-//! [piv-tool-guide]: https://www.yubico.com/wp-content/uploads/2016/05/Yubico_PIV_Tool_Command_Line_Guide_en.pdf
-//! [cc-web]: https://contributor-covenant.org/
-//! [cc-md]: https://github.com/iqlusioninc/yubikey.rs/blob/main/CODE_OF_CONDUCT.md
-//! [BSDL]: https://opensource.org/licenses/BSD-2-Clause
+#![doc = include_str!("../README.md")]
+#![doc(
+    html_logo_url = "https://raw.githubusercontent.com/iqlusioninc/yubikey.rs/main/img/logo-sq.png"
+)]
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![forbid(unsafe_code)]
+#![warn(missing_docs, rust_2018_idioms, trivial_casts, unused_qualifications)]

 // Adapted from yubico-piv-tool:
 // <https://github.com/Yubico/yubico-piv-tool/>
@@ -128,14 +36,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-#![cfg_attr(docsrs, feature(doc_cfg))]
-#![doc(
-    html_logo_url = "https://raw.githubusercontent.com/iqlusioninc/yubikey.rs/main/img/logo.png",
-    html_root_url = "https://docs.rs/yubikey/0.5.0"
-)]
-#![forbid(unsafe_code)]
-#![warn(missing_docs, rust_2018_idioms, trivial_casts, unused_qualifications)]
-
 mod apdu;
 mod cccid;
 pub mod certificate;
@@ -149,6 +49,7 @@ mod mgm;
 mod mscmap;
 #[cfg(feature = "untested")]
 mod msroots;
+mod otp;
 pub mod piv;
 mod policy;
 pub mod reader;
@@ -33,7 +33,6 @@
 use crate::{Error, Result};
 use log::error;
 use rand_core::{OsRng, RngCore};
-use std::convert::{TryFrom, TryInto};
 use zeroize::{Zeroize, Zeroizing};

 #[cfg(feature = "untested")]
@@ -43,11 +42,21 @@ use crate::{
    yubikey::YubiKey,
 };
 use des::{
-    cipher::{generic_array::GenericArray, BlockDecrypt, BlockEncrypt, NewBlockCipher},
+    cipher::{generic_array::GenericArray, BlockDecrypt, BlockEncrypt, KeyInit},
    TdesEde3,
 };
 #[cfg(feature = "untested")]
-use {hmac::Hmac, pbkdf2::pbkdf2, sha1::Sha1};
+use {pbkdf2::pbkdf2_hmac, sha1::Sha1};
+
+/// YubiKey MGMT Applet Name
+#[cfg(feature = "untested")]
+pub(crate) const APPLET_NAME: &str = "YubiKey MGMT";
+
+/// MGMT Applet ID.
+///
+/// <https://developers.yubico.com/PIV/Introduction/Admin_access.html>
+#[cfg(feature = "untested")]
+pub(crate) const APPLET_ID: &[u8] = &[0xa0, 0x00, 0x00, 0x05, 0x27, 0x47, 0x11, 0x17];

 pub(crate) const ADMIN_FLAGS_1_PROTECTED_MGM: u8 = 0x02;

@@ -138,7 +147,7 @@ impl MgmKey {
        }

        let mut mgm = [0u8; DES_LEN_3DES];
-        pbkdf2::<Hmac<Sha1>>(pin, &salt, ITER_MGM_PBKDF2, &mut mgm);
+        pbkdf2_hmac::<Sha1>(pin, salt, ITER_MGM_PBKDF2, &mut mgm);
        MgmKey::from_bytes(mgm)
    }

@@ -191,7 +200,7 @@ impl MgmKey {
    pub fn set_manual(&self, yubikey: &mut YubiKey, require_touch: bool) -> Result<()> {
        let txn = yubikey.begin_transaction()?;

-        txn.set_mgm_key(&self, require_touch).map_err(|e| {
+        txn.set_mgm_key(self, require_touch).map_err(|e| {
            // Log a warning, since the device mgm key is corrupt or we're in a state
            // where we can't set the mgm key.
            error!("could not set new derived mgm key, err = {}", e);
@@ -405,7 +414,7 @@ fn is_weak_key(key: &[u8; DES_LEN_3DES]) -> bool {
        c = (c & 0x0F) + ((c >> 4) & 0x0F);

        // if count is even, set low key bit to 1, otherwise 0
-        tmp[i] = (key[i] & 0xFE) | (if c & 0x01 == 0x01 { 0x00 } else { 0x01 });
+        tmp[i] = (key[i] & 0xFE) | u8::from(c & 0x01 != 0x01);
    }

    // check odd parity key against table by DES key block
@@ -32,7 +32,6 @@

 use crate::{consts::CB_OBJ_MAX, piv::SlotId, serialization::*, Error, Result, YubiKey};
 use log::error;
-use std::convert::{TryFrom, TryInto};

 const OBJ_MSCMAP: u32 = 0x005f_ff10;

@@ -111,7 +111,7 @@ impl MsRoots {
        let mut data_chunk: usize;
        let data = &self.0;
        let data_len = data.len();
-        let n_objs: usize;
+
        let txn = yubikey.begin_transaction()?;

        if data_len == 0 {
@@ -119,7 +119,7 @@ impl MsRoots {
        }

        // Calculate number of objects required to store blob
-        n_objs = (data_len / (CB_OBJ_MAX - CB_OBJ_TAG_MAX)) + 1;
+        let n_objs: usize = (data_len / (CB_OBJ_MAX - CB_OBJ_TAG_MAX)) + 1;

        if n_objs > 5 {
            return Err(Error::SizeError);
@@ -0,0 +1,5 @@
+/// YubiKey OTP Applet Name
+pub(crate) const APPLET_NAME: &str = "YubiKey OTP";
+
+/// YubiKey OTP Applet ID. Needed to query serial on YK4.
+pub(crate) const APPLET_ID: &[u8] = &[0xa0, 0x00, 0x00, 0x05, 0x27, 0x20, 0x01, 0x01];
@@ -45,6 +45,7 @@
 use crate::{
    apdu::{Ins, StatusWords},
    certificate::{self, Certificate, PublicKeyInfo},
+    consts::CB_OBJ_MAX,
    error::{Error, Result},
    policy::{PinPolicy, TouchPolicy},
    serialization::*,
@@ -54,12 +55,16 @@ use crate::{
 };
 use elliptic_curve::sec1::EncodedPoint as EcPublicKey;
 use log::{debug, error, warn};
+use p256::NistP256;
+use p384::NistP384;
 use rsa::{BigUint, RsaPublicKey};
-use std::{convert::TryFrom, str::FromStr};
+use std::{
+    fmt::{Display, Formatter},
+    str::FromStr,
+};

 #[cfg(feature = "untested")]
 use {
-    crate::consts::CB_OBJ_MAX,
    num_bigint_dig::traits::ModInverse,
    num_integer::Integer,
    num_traits::{FromPrimitive, One},
@@ -68,6 +73,12 @@ use {
 #[cfg(feature = "untested")]
 use zeroize::Zeroizing;

+/// PIV Applet Name
+pub(crate) const APPLET_NAME: &str = "PIV";
+
+/// PIV Applet ID
+pub(crate) const APPLET_ID: &[u8] = &[0xa0, 0x00, 0x00, 0x03, 0x08];
+
 const CB_ECC_POINTP256: usize = 65;
 const CB_ECC_POINTP384: usize = 97;

@@ -83,7 +94,7 @@ const KEYDATA_RSA_EXP: u64 = 65537;

 /// Slot identifiers.
 /// <https://developers.yubico.com/PIV/Introduction/Certificate_slots.html>
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Ord, PartialOrd)]
 pub enum SlotId {
    /// This certificate and its associated private key is used to authenticate the card
    /// and the cardholder. This slot is used for things like system login. The end user
@@ -121,6 +132,9 @@ pub enum SlotId {
    /// attestation of other keys generated on device with instruction `f9`. This slot is
    /// not cleared on reset, but can be overwritten.
    Attestation,
+
+    /// Thse slots are used for management. PIN PUK and Management Key.
+    Management(ManagementSlotId),
 }

 impl TryFrom<u8> for SlotId {
@@ -133,7 +147,9 @@ impl TryFrom<u8> for SlotId {
            0x9d => Ok(SlotId::KeyManagement),
            0x9e => Ok(SlotId::CardAuthentication),
            0xf9 => Ok(SlotId::Attestation),
-            _ => RetiredSlotId::try_from(value).map(SlotId::Retired),
+            _ => RetiredSlotId::try_from(value)
+                .map(SlotId::Retired)
+                .or_else(|_| ManagementSlotId::try_from(value).map(SlotId::Management)),
        }
    }
 }
@@ -147,6 +163,17 @@ impl From<SlotId> for u8 {
            SlotId::CardAuthentication => 0x9e,
            SlotId::Retired(retired) => retired.into(),
            SlotId::Attestation => 0xf9,
+            SlotId::Management(mgmt) => mgmt.into(),
+        }
+    }
+}
+
+impl Display for SlotId {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            SlotId::Management(r) => write!(f, "{:?}", r),
+            SlotId::Retired(r) => write!(f, "{:?}", r),
+            _ => write!(f, "{:?}", self),
        }
    }
 }
@@ -161,7 +188,10 @@ impl FromStr for SlotId {
            "9d" => Ok(SlotId::KeyManagement),
            "9e" => Ok(SlotId::CardAuthentication),
            "f9" => Ok(SlotId::Attestation),
-            _ => s.parse().map(SlotId::Retired),
+            _ => s
+                .parse()
+                .map(SlotId::Management)
+                .or_else(|_| s.parse().map(SlotId::Retired)),
        }
    }
 }
@@ -175,6 +205,7 @@ impl SlotId {
            SlotId::KeyManagement => 0x005f_c10b,
            SlotId::CardAuthentication => 0x005f_c101,
            SlotId::Retired(retired) => retired.object_id(),
+            SlotId::Management(mgmt) => mgmt.object_id(),
            SlotId::Attestation => 0x005f_ff01,
        }
    }
@@ -182,7 +213,7 @@ impl SlotId {

 /// Retired slot IDs.
 #[allow(missing_docs)]
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
 pub enum RetiredSlotId {
    R1,
    R2,
@@ -293,6 +324,12 @@ impl From<RetiredSlotId> for u8 {
    }
 }

+impl Display for RetiredSlotId {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:?}", self)
+    }
+}
+
 impl RetiredSlotId {
    /// Returns the [`ObjectId`] that corresponds to a given [`RetiredSlotId`].
    pub(crate) fn object_id(self) -> ObjectId {
@@ -321,8 +358,90 @@ impl RetiredSlotId {
    }
 }

+/// Management slot IDs.
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq, Ord, PartialOrd)]
+pub enum ManagementSlotId {
+    /// Personal Identification Number (PIN).
+    Pin,
+
+    /// PIN Unblocking Key (PUK).
+    Puk,
+
+    /// Management Key.
+    Management,
+}
+
+impl TryFrom<u8> for ManagementSlotId {
+    type Error = Error;
+
+    fn try_from(value: u8) -> Result<Self> {
+        match value {
+            0x80 => Ok(ManagementSlotId::Pin),
+            0x81 => Ok(ManagementSlotId::Puk),
+            0x9b => Ok(ManagementSlotId::Management),
+            _ => Err(Error::InvalidObject),
+        }
+    }
+}
+
+impl FromStr for ManagementSlotId {
+    type Err = Error;
+
+    fn from_str(value: &str) -> Result<Self> {
+        match value {
+            "80" => Ok(ManagementSlotId::Pin),
+            "81" => Ok(ManagementSlotId::Puk),
+            "9b" => Ok(ManagementSlotId::Management),
+            _ => Err(Error::InvalidObject),
+        }
+    }
+}
+
+impl From<ManagementSlotId> for u8 {
+    fn from(slot: ManagementSlotId) -> u8 {
+        match slot {
+            ManagementSlotId::Pin => 0x80,
+            ManagementSlotId::Puk => 0x81,
+            ManagementSlotId::Management => 0x9b,
+        }
+    }
+}
+
+impl Display for ManagementSlotId {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:?}", self)
+    }
+}
+
+impl ManagementSlotId {
+    /// Returns the [`ObjectId`] that corresponds to a given [`ManagementSlotId`].
+    ///
+    /// These correspond to the "BER-TLV Tag" values from Table 3 of [NIST SP 800-73-4]:
+    /// "Object Identifiers of the PIV Data Objects for Interoperable Use".
+    ///
+    /// [NIST SP 800-73-4]: https://csrc.nist.gov/publications/detail/sp/800-73/4/final
+    pub(crate) fn object_id(self) -> ObjectId {
+        match self {
+            // Data Object: "X.509 Certificate for Key Management"
+            // OID: 2.16.840.1.101.3.7.2.1.2
+            // BER-TLV Tag: '5FC10B'
+            ManagementSlotId::Pin => 0x005f_c10b,
+
+            // Data Object: "Key History Object"
+            // OID: 2.16.840.1.101.3.7.2.96.96
+            // BER-TLV Tag: '5FC10C'
+            ManagementSlotId::Puk => 0x005f_c10c,
+
+            // Data Object: "Retired X.509 Certificate for Key Management 3"
+            // OID: 2.16.840.1.101.3.7.2.16.3
+            // BER-TLV Tag: '5FC10F'
+            ManagementSlotId::Management => 0x005f_c10f,
+        }
+    }
+}
+
 /// Personal Identity Verification (PIV) key slots
-pub const SLOTS: [SlotId; 24] = [
+pub const SLOTS: [SlotId; 27] = [
    SlotId::Authentication,
    SlotId::Signature,
    SlotId::KeyManagement,
@@ -347,6 +466,9 @@ pub const SLOTS: [SlotId; 24] = [
    SlotId::Retired(RetiredSlotId::R19),
    SlotId::Retired(RetiredSlotId::R20),
    SlotId::CardAuthentication,
+    SlotId::Management(ManagementSlotId::Pin),
+    SlotId::Management(ManagementSlotId::Puk),
+    SlotId::Management(ManagementSlotId::Management),
 ];

 /// Algorithm identifiers
@@ -574,97 +696,8 @@ pub fn generate(
        }
    }

-    // TODO(str4d): Response is wrapped in an ASN.1 TLV:
-    //
-    //    0x7f 0x49 -> Application | Constructed | 0x49
-    match algorithm {
-        AlgorithmId::Rsa1024 | AlgorithmId::Rsa2048 => {
-            // It appears that the inner application-specific value returned by the
-            // YubiKey is constructed such that RSA pubkeys can be parsed in two ways:
-            //
-            // - Use a full ASN.1 parser on the entire datastructure:
-            //
-            //     RSA 1024:
-            //     [127, 73, 129, 136, 129, 129, 128, [ 128 octets ], 130,  3, 1, 0, 1]
-            //     | tag   | len:136 |0x81| len:128 |    modulus    |0x82|len3|  exp  |
-            //
-            //     RSA 2048:
-            //     [127, 73, 130, 1, 9, 129, 130, 1, 0, [ 256 octets ], 130,  3, 1, 0, 1]
-            //     | tag   | len:265  |0x81| len:256  |    modulus    |0x82|len3|  exp  |
-            //
-            // - Skip the first 5 bytes and use crate::serialize::get_length during TLV
-            //   parsing (which treats 128 as a single-byte definite length instead of an
-            //   indefinite length):
-            //
-            //     RSA 1024:
-            //     [127, 73, 129, 136, 129, 129, 128, [ 128 octets ], 130,  3, 1, 0, 1]
-            //     |                      |0x81|len128|   modulus   |0x82|len3|  exp  |
-            //
-            //     RSA 2048:
-            //     [127, 73, 130, 1, 9, 129, 130, 1, 0, [ 256 octets ], 130,  3, 1, 0, 1]
-            //     |                  |0x81| len:256  |    modulus    |0x82|len3|  exp  |
-            //
-            // Because of the above, treat this for now as a 2-byte ASN.1 tag with a
-            // 3-byte length.
-            let data = &response.data()[5..];
-
-            let (data, modulus_tlv) = Tlv::parse(data)?;
-            if modulus_tlv.tag != TAG_RSA_MODULUS {
-                error!("Failed to parse public key structure (modulus)");
-                return Err(Error::ParseError);
-            }
-            let modulus = modulus_tlv.value.to_vec();
-
-            let (_, exp_tlv) = Tlv::parse(data)?;
-            if exp_tlv.tag != TAG_RSA_EXP {
-                error!("failed to parse public key structure (public exponent)");
-                return Err(Error::ParseError);
-            }
-            let exp = exp_tlv.value.to_vec();
-
-            Ok(PublicKeyInfo::Rsa {
-                algorithm,
-                pubkey: RsaPublicKey::new(
-                    BigUint::from_bytes_be(&modulus),
-                    BigUint::from_bytes_be(&exp),
-                )
-                .map_err(|_| Error::InvalidObject)?,
-            })
-        }
-        AlgorithmId::EccP256 | AlgorithmId::EccP384 => {
-            // 2-byte ASN.1 tag, 1-byte length (because all supported EC pubkey lengths
-            // are shorter than 128 bytes, fitting into a definite short ASN.1 length).
-            let data = &response.data()[3..];
-
-            let len = if let AlgorithmId::EccP256 = algorithm {
-                CB_ECC_POINTP256
-            } else {
-                CB_ECC_POINTP384
-            };
-
-            let (_, tlv) = Tlv::parse(data)?;
-
-            if tlv.tag != TAG_ECC_POINT {
-                error!("failed to parse public key structure");
-                return Err(Error::ParseError);
-            }
-
-            // the curve point should always be determined by the curve
-            if tlv.value.len() != len {
-                error!("unexpected length");
-                return Err(Error::AlgorithmError);
-            }
-
-            let point = tlv.value.to_vec();
-
-            if let AlgorithmId::EccP256 = algorithm {
-                EcPublicKey::from_bytes(point).map(PublicKeyInfo::EcP256)
-            } else {
-                EcPublicKey::from_bytes(point).map(PublicKeyInfo::EcP384)
-            }
-            .map_err(|_| Error::InvalidObject)
-        }
-    }
+    let value = response.data();
+    read_public_key(algorithm, value, true)
 }

 #[cfg(feature = "untested")]
@@ -891,3 +924,319 @@ pub fn decrypt_data(
    // don't attempt to reselect in crypt operations to avoid problems with PIN_ALWAYS
    txn.authenticated_command(input, algorithm, key, true)
 }
+
+/// Read metadata
+pub fn metadata(yubikey: &mut YubiKey, slot: SlotId) -> Result<SlotMetadata> {
+    let txn = yubikey.begin_transaction()?;
+    let templ = [0, Ins::GetMetadata.code(), 0, slot.into()];
+
+    let response = txn.transfer_data(&templ, &[], CB_OBJ_MAX)?;
+
+    if !response.is_success() {
+        if response.status_words() == StatusWords::NotSupportedError {
+            return Err(Error::NotSupported); // Requires firmware 5.2.3
+        } else {
+            return Err(Error::GenericError);
+        }
+    }
+
+    let buf = Buffer::new(response.data().into());
+
+    SlotMetadata::try_from(buf)
+}
+
+/// Metadata from a slot
+#[derive(Debug)]
+pub struct SlotMetadata {
+    /// Algorithm / Type of key
+    pub algorithm: ManagementAlgorithmId,
+    /// PIN and touch policy
+    pub policy: Option<(PinPolicy, TouchPolicy)>,
+    /// Imported or generated key
+    pub origin: Option<Origin>,
+    /// Pub key of the key
+    pub public: Option<PublicKeyInfo>,
+    /// Whether PIN PUK and management key are default
+    pub default: Option<bool>,
+    /// Number of retries left
+    pub retries: Option<Retries>,
+}
+
+impl TryFrom<Buffer> for SlotMetadata {
+    type Error = Error;
+
+    fn try_from(buf: Buffer) -> Result<Self> {
+        use nom::{
+            combinator::{eof, map_res},
+            multi::fold_many1,
+            number::complete::u8,
+        };
+
+        let out = fold_many1(
+            |input| Tlv::parse(input).map_err(|_| nom::Err::Error(())),
+            || {
+                Ok(SlotMetadata {
+                    algorithm: ManagementAlgorithmId::PinPuk,
+                    policy: None,
+                    origin: None,
+                    public: None,
+                    default: None,
+                    retries: None,
+                })
+            },
+            |acc: Result<SlotMetadata>, tlv| match acc {
+                Ok(mut metadata) => match tlv.tag {
+                    1 => {
+                        metadata.algorithm = ManagementAlgorithmId::try_from(tlv.value[0])?;
+                        Ok(metadata)
+                    }
+                    2 => {
+                        fn policy_parser(
+                            i: &[u8],
+                        ) -> nom::IResult<&[u8], (PinPolicy, TouchPolicy)> {
+                            let (i, pin) = map_res(u8, PinPolicy::try_from)(i)?;
+                            let (i, touch) = map_res(u8, TouchPolicy::try_from)(i)?;
+                            let (i, _) = eof(i)?;
+
+                            Ok((i, (pin, touch)))
+                        }
+
+                        metadata.policy =
+                            Some(policy_parser(tlv.value).map_err(|_| Error::ParseError)?.1);
+                        Ok(metadata)
+                    }
+                    3 => {
+                        fn origin_parser(i: &[u8]) -> nom::IResult<&[u8], Origin> {
+                            let (i, origin) = map_res(u8, Origin::try_from)(i)?;
+                            let (i, _) = eof(i)?;
+
+                            Ok((i, origin))
+                        }
+
+                        metadata.origin =
+                            Some(origin_parser(tlv.value).map_err(|_| Error::ParseError)?.1);
+                        Ok(metadata)
+                    }
+                    4 => {
+                        match metadata.algorithm {
+                            ManagementAlgorithmId::Asymmetric(alg) => {
+                                metadata.public = Some(read_public_key(alg, tlv.value, false)?);
+                            }
+                            _ => Err(Error::ParseError)?,
+                        }
+                        Ok(metadata)
+                    }
+                    5 => {
+                        fn default_parser(i: &[u8]) -> nom::IResult<&[u8], bool> {
+                            let (i, default) = u8(i)?;
+                            let (i, _) = eof(i)?;
+
+                            Ok((i, default == 1))
+                        }
+
+                        metadata.default =
+                            Some(default_parser(tlv.value).map_err(|_| Error::ParseError)?.1);
+                        Ok(metadata)
+                    }
+
+                    6 => {
+                        fn retries_parser(i: &[u8]) -> nom::IResult<&[u8], Retries> {
+                            let (i, retry_count) = u8(i)?;
+                            let (i, remaining_count) = u8(i)?;
+                            let (i, _) = eof(i)?;
+
+                            Ok((
+                                i,
+                                Retries {
+                                    retry_count,
+                                    remaining_count,
+                                },
+                            ))
+                        }
+
+                        metadata.retries =
+                            Some(retries_parser(tlv.value).map_err(|_| Error::ParseError)?.1);
+                        Ok(metadata)
+                    }
+
+                    _unsupported => {
+                        // New unsupported tags
+                        // https://docs.yubico.com/yesdk/users-manual/application-piv/apdu/metadata.html
+                        Ok(metadata)
+                    }
+                },
+                err => err,
+            },
+        )(buf.as_ref());
+
+        match out {
+            Ok((_, res)) => res,
+            _ => Err(Error::ParseError),
+        }
+    }
+}
+
+/// The number of retries used and remaining.
+#[derive(Debug, PartialEq, Eq)]
+pub struct Retries {
+    /// TODO
+    pub retry_count: u8,
+    /// Remaining attempts
+    pub remaining_count: u8,
+}
+
+/// Origin of a slot
+#[derive(Debug, PartialEq, Eq, Copy, Clone)]
+pub enum Origin {
+    /// The key has been imported
+    Imported,
+    /// The key has been generated on the YubiKey
+    Generated,
+}
+
+impl TryFrom<u8> for Origin {
+    type Error = Error;
+
+    fn try_from(value: u8) -> Result<Self> {
+        match value {
+            1 => Ok(Origin::Generated),
+            2 => Ok(Origin::Imported),
+            _ => Err(Error::GenericError),
+        }
+    }
+}
+
+fn read_public_key(
+    algorithm: AlgorithmId,
+    input: &[u8],
+    skip_asn1_tag: bool,
+) -> Result<PublicKeyInfo> {
+    // TODO(str4d): Response is wrapped in an ASN.1 TLV:
+    //
+    //    0x7f 0x49 -> Application | Constructed | 0x49
+    match algorithm {
+        AlgorithmId::Rsa1024 | AlgorithmId::Rsa2048 => {
+            // It appears that the inner application-specific value returned by the
+            // YubiKey is constructed such that RSA pubkeys can be parsed in two ways:
+            //
+            // - Use a full ASN.1 parser on the entire datastructure:
+            //
+            //     RSA 1024:
+            //     [127, 73, 129, 136, 129, 129, 128, [ 128 octets ], 130,  3, 1, 0, 1]
+            //     | tag   | len:136 |0x81| len:128 |    modulus    |0x82|len3|  exp  |
+            //
+            //     RSA 2048:
+            //     [127, 73, 130, 1, 9, 129, 130, 1, 0, [ 256 octets ], 130,  3, 1, 0, 1]
+            //     | tag   | len:265  |0x81| len:256  |    modulus    |0x82|len3|  exp  |
+            //
+            // - Skip the first 5 bytes and use crate::serialize::get_length during TLV
+            //   parsing (which treats 128 as a single-byte definite length instead of an
+            //   indefinite length):
+            //
+            //     RSA 1024:
+            //     [127, 73, 129, 136, 129, 129, 128, [ 128 octets ], 130,  3, 1, 0, 1]
+            //     |                      |0x81|len128|   modulus   |0x82|len3|  exp  |
+            //
+            //     RSA 2048:
+            //     [127, 73, 130, 1, 9, 129, 130, 1, 0, [ 256 octets ], 130,  3, 1, 0, 1]
+            //     |                  |0x81| len:256  |    modulus    |0x82|len3|  exp  |
+            //
+            // Because of the above, treat this for now as a 2-byte ASN.1 tag with a
+            // 3-byte length.
+            let data = if skip_asn1_tag { &input[5..] } else { input };
+
+            let (data, modulus_tlv) = Tlv::parse(data)?;
+            if modulus_tlv.tag != TAG_RSA_MODULUS {
+                error!("Failed to parse public key structure (modulus)");
+                return Err(Error::ParseError);
+            }
+            let modulus = modulus_tlv.value.to_vec();
+
+            let (_, exp_tlv) = Tlv::parse(data)?;
+            if exp_tlv.tag != TAG_RSA_EXP {
+                error!("failed to parse public key structure (public exponent)");
+                return Err(Error::ParseError);
+            }
+            let exp = exp_tlv.value.to_vec();
+
+            Ok(PublicKeyInfo::Rsa {
+                algorithm,
+                pubkey: RsaPublicKey::new(
+                    BigUint::from_bytes_be(&modulus),
+                    BigUint::from_bytes_be(&exp),
+                )
+                .map_err(|_| Error::InvalidObject)?,
+            })
+        }
+        AlgorithmId::EccP256 | AlgorithmId::EccP384 => {
+            // 2-byte ASN.1 tag, 1-byte length (because all supported EC pubkey lengths
+            // are shorter than 128 bytes, fitting into a definite short ASN.1 length).
+            let data = if skip_asn1_tag { &input[3..] } else { input };
+
+            let len = if let AlgorithmId::EccP256 = algorithm {
+                CB_ECC_POINTP256
+            } else {
+                CB_ECC_POINTP384
+            };
+
+            let (_, tlv) = Tlv::parse(data)?;
+
+            if tlv.tag != TAG_ECC_POINT {
+                error!("failed to parse public key structure");
+                return Err(Error::ParseError);
+            }
+
+            // the curve point should always be determined by the curve
+            if tlv.value.len() != len {
+                error!("unexpected length");
+                return Err(Error::AlgorithmError);
+            }
+
+            let point = tlv.value.to_vec();
+
+            match algorithm {
+                AlgorithmId::EccP256 => {
+                    EcPublicKey::<NistP256>::from_bytes(point).map(PublicKeyInfo::EcP256)
+                }
+                AlgorithmId::EccP384 => {
+                    EcPublicKey::<NistP384>::from_bytes(point).map(PublicKeyInfo::EcP384)
+                }
+                _ => return Err(Error::AlgorithmError),
+            }
+            .map_err(|_| Error::InvalidObject)
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+/// Algorithms as reported by the metadata command.
+pub enum ManagementAlgorithmId {
+    /// Used on PIN and PUK slots.
+    PinPuk,
+    /// Used on the key management slot.
+    ThreeDes,
+    /// Used on all other slots.
+    Asymmetric(AlgorithmId),
+}
+
+impl TryFrom<u8> for ManagementAlgorithmId {
+    type Error = Error;
+
+    fn try_from(value: u8) -> Result<Self> {
+        match value {
+            0xff => Ok(ManagementAlgorithmId::PinPuk),
+            0x03 => Ok(ManagementAlgorithmId::ThreeDes),
+            oth => AlgorithmId::try_from(oth).map(ManagementAlgorithmId::Asymmetric),
+        }
+    }
+}
+
+impl From<ManagementAlgorithmId> for u8 {
+    fn from(id: ManagementAlgorithmId) -> u8 {
+        match id {
+            ManagementAlgorithmId::PinPuk => 0xff,
+            ManagementAlgorithmId::ThreeDes => 0x03,
+            ManagementAlgorithmId::Asymmetric(oth) => oth.into(),
+        }
+    }
+}
@@ -1,12 +1,12 @@
 //! Enums representing key policies.

-use crate::{serialization::Tlv, Result};
+use crate::{serialization::Tlv, Error, Result};

 /// Specifies how often the PIN needs to be entered for access to the credential in a
 /// given slot.
 ///
 /// This policy must be set when keys are generated or imported, and cannot be changed later.
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum PinPolicy {
    /// Use the default PIN policy for the slot. See the slot's documentation for details.
    Default,
@@ -35,6 +35,20 @@ impl From<PinPolicy> for u8 {
    }
 }

+impl TryFrom<u8> for PinPolicy {
+    type Error = Error;
+
+    fn try_from(value: u8) -> Result<Self> {
+        match value {
+            0 => Ok(PinPolicy::Default),
+            1 => Ok(PinPolicy::Never),
+            2 => Ok(PinPolicy::Once),
+            3 => Ok(PinPolicy::Always),
+            _ => Err(Error::GenericError),
+        }
+    }
+}
+
 impl PinPolicy {
    /// Writes the `PinPolicy` in the format the YubiKey expects during key generation or
    /// importation.
@@ -50,7 +64,7 @@ impl PinPolicy {
 /// addition to the [`PinPolicy`].
 ///
 /// This policy must be set when keys are generated or imported, and cannot be changed later.
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum TouchPolicy {
    /// Use the default touch policy for the slot.
    Default,
@@ -90,3 +104,17 @@ impl TouchPolicy {
        }
    }
 }
+
+impl TryFrom<u8> for TouchPolicy {
+    type Error = Error;
+
+    fn try_from(value: u8) -> Result<Self> {
+        match value {
+            0 => Ok(TouchPolicy::Default),
+            1 => Ok(TouchPolicy::Never),
+            2 => Ok(TouchPolicy::Always),
+            3 => Ok(TouchPolicy::Cached),
+            _ => Err(Error::GenericError),
+        }
+    }
+}
@@ -3,8 +3,8 @@
 use crate::{Result, YubiKey};
 use std::{
    borrow::Cow,
-    convert::TryInto,
    ffi::CStr,
+    fmt,
    sync::{Arc, Mutex},
 };

@@ -20,6 +20,12 @@ pub struct Context {
    reader_names: Vec<u8>,
 }

+impl fmt::Debug for Context {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Context").finish_non_exhaustive()
+    }
+}
+
 impl Context {
    /// Open a PC/SC context, which can be used to enumerate available PC/SC
    /// readers (which can be used to connect to YubiKeys).
@@ -45,6 +51,7 @@ impl Context {
            c.list_readers(reader_names)?.collect()
        };

+        #[allow(clippy::needless_collect)]
        let readers: Vec<_> = reader_cstrs
            .iter()
            .map(|name| Reader::new(name, Arc::clone(ctx)))
@@ -65,7 +65,7 @@ impl Default for SettingSource {
 /// These can be configured globally in `/etc/yubico/yubikeypiv.conf` by a
 /// system administrator, or by the local user via `YUBIKEY_PIV_*` environment
 /// variables.
-#[derive(Copy, Clone, Debug)]
+#[derive(Copy, Clone, Debug, Default)]
 pub struct Setting {
    /// Boolean value
    pub value: bool,
@@ -99,7 +99,7 @@ impl Setting {
                }

                let (name, value) = {
-                    let mut parts = line.splitn(1, '=');
+                    let mut parts = line.splitn(2, '=');
                    let name = parts.next();
                    let value = parts.next();
                    match (name, value, parts.next()) {
@@ -130,12 +130,3 @@ impl Setting {
            })
    }
 }
-
-impl Default for Setting {
-    fn default() -> Self {
-        Self {
-            value: false,
-            source: SettingSource::default(),
-        }
-    }
-}
@@ -5,24 +5,18 @@ use crate::{
    apdu::{Apdu, Ins, StatusWords},
    consts::{CB_BUF_MAX, CB_OBJ_MAX},
    error::{Error, Result},
-    piv::{AlgorithmId, SlotId},
+    otp,
+    piv::{self, AlgorithmId, SlotId},
    serialization::*,
    yubikey::*,
    Buffer, ObjectId,
 };
 use log::{error, trace};
-use std::convert::TryInto;
 use zeroize::Zeroizing;

 #[cfg(feature = "untested")]
 use crate::mgm::{MgmKey, DES_LEN_3DES};

-/// PIV Applet ID
-const PIV_AID: [u8; 5] = [0xa0, 0x00, 0x00, 0x03, 0x08];
-
-/// YubiKey OTP Applet ID. Needed to query serial on YK4.
-const YK_AID: [u8; 8] = [0xa0, 0x00, 0x00, 0x05, 0x27, 0x20, 0x01, 0x01];
-
 const CB_PIN_MAX: usize = 8;

 #[cfg(feature = "untested")]
@@ -70,7 +64,7 @@ impl<'tx> Transaction<'tx> {
    pub fn select_application(&self) -> Result<()> {
        let response = Apdu::new(Ins::SelectApplication)
            .p1(0x04)
-            .data(&PIV_AID)
+            .data(piv::APPLET_ID)
            .transmit(self, 0xFF)
            .map_err(|e| {
                error!("failed communicating with card: '{}'", e);
@@ -82,7 +76,12 @@ impl<'tx> Transaction<'tx> {
                "failed selecting application: {:04x}",
                response.status_words().code()
            );
-            return Err(Error::GenericError);
+            return Err(match response.status_words() {
+                StatusWords::NotFoundError => Error::AppletNotFound {
+                    applet_name: piv::APPLET_NAME,
+                },
+                _ => Error::GenericError,
+            });
        }

        Ok(())
@@ -106,25 +105,32 @@ impl<'tx> Transaction<'tx> {

    /// Get YubiKey device serial number.
    pub fn get_serial(&self, version: Version) -> Result<Serial> {
-        let response = if version.major < 5 {
-            // YK4 requires switching to the yk applet to retrieve the serial
+        match version.major {
+            // YK4 requires switching to the YK applet to retrieve the serial
+            4 => {
                let sw = Apdu::new(Ins::SelectApplication)
                    .p1(0x04)
-                .data(&YK_AID)
+                    .data(otp::APPLET_ID)
                    .transmit(self, 0xFF)?
                    .status_words();

                if !sw.is_success() {
                    error!("failed selecting yk application: {:04x}", sw.code());
-                return Err(Error::GenericError);
+                    return Err(match sw {
+                        StatusWords::NotFoundError => Error::AppletNotFound {
+                            applet_name: otp::APPLET_NAME,
+                        },
+                        _ => Error::GenericError,
+                    });
                }

-            let resp = Apdu::new(0x01).p1(0x10).transmit(self, 0xFF)?;
+                let response = Apdu::new(0x01).p1(0x10).transmit(self, 0xFF)?;

-            if !resp.is_success() {
+                if !response.is_success() {
+                    // TODO(tarcieri): still reselect the PIV applet in this case?
                    error!(
                        "failed retrieving serial number: {:04x}",
-                    resp.status_words().code()
+                        response.status_words().code()
                    );
                    return Err(Error::GenericError);
                }
@@ -132,35 +138,41 @@ impl<'tx> Transaction<'tx> {
                // reselect the PIV applet
                let sw = Apdu::new(Ins::SelectApplication)
                    .p1(0x04)
-                .data(&PIV_AID)
+                    .data(piv::APPLET_ID)
                    .transmit(self, 0xFF)?
                    .status_words();

                if !sw.is_success() {
                    error!("failed selecting application: {:04x}", sw.code());
-                return Err(Error::GenericError);
+                    return Err(match sw {
+                        StatusWords::NotFoundError => Error::AppletNotFound {
+                            applet_name: piv::APPLET_NAME,
+                        },
+                        _ => Error::GenericError,
+                    });
                }

-            resp
-        } else {
-            // YK5 implements getting the serial as a PIV applet command (0xf8)
-            let resp = Apdu::new(Ins::GetSerial).transmit(self, 0xFF)?;
+                response.data().try_into()
+            }

-            if !resp.is_success() {
+            // YK5 implements getting the serial as a PIV applet command (0xf8)
+            5 => {
+                let response = Apdu::new(Ins::GetSerial).transmit(self, 0xFF)?;
+
+                if !response.is_success() {
                    error!(
                        "failed retrieving serial number: {:04x}",
-                    resp.status_words().code()
+                        response.status_words().code()
                    );
                    return Err(Error::GenericError);
                }

-            resp
-        };
+                response.data().try_into()
+            }

-        response.data()[..4]
-            .try_into()
-            .map(|serial| Serial::from(u32::from_be_bytes(serial)))
-            .map_err(|_| Error::SizeError)
+            // Other versions unsupported
+            _ => Err(Error::NotSupported),
+        }
    }

    /// Verify device PIN.
@@ -247,7 +259,7 @@ impl<'tx> Transaction<'tx> {

        let status_words = Apdu::new(Ins::SetMgmKey)
            .params(0xff, p2)
-            .data(&data)
+            .data(data)
            .transmit(self, 261)?
            .status_words();

@@ -388,11 +400,12 @@ impl<'tx> Transaction<'tx> {
                .data(&in_data[in_offset..(in_offset + this_size)])
                .transmit(self, 261)?;

-            sw = response.status_words().code();
+            sw = response.status_words();

-            if !response.is_success() && (sw >> 8 != 0x61) {
+            match sw {
+                StatusWords::Success | StatusWords::BytesRemaining { .. } => (),
                // TODO(tarcieri): is this really OK?
-                return Ok(Response::new(sw.into(), out_data));
+                _ => return Ok(Response::new(sw, out_data)),
            }

            if !out_data.is_empty() && (out_data.len() - response.data().len() > max_out) {
@@ -413,17 +426,15 @@ impl<'tx> Transaction<'tx> {
            }
        }

-        while sw >> 8 == 0x61 {
-            trace!(
-                "The card indicates there is {} bytes more data for us",
-                sw & 0xff
-            );
+        while let StatusWords::BytesRemaining { len } = sw {
+            trace!("The card indicates there is {} bytes more data for us", len);

            let response = Apdu::new(Ins::GetResponseApdu).transmit(self, 261)?;
-            sw = response.status_words().code();
+            sw = response.status_words();

-            if sw != StatusWords::Success.code() && (sw >> 8 != 0x61) {
-                return Ok(Response::new(sw.into(), vec![]));
+            match sw {
+                StatusWords::Success | StatusWords::BytesRemaining { .. } => (),
+                _ => return Ok(Response::new(sw, vec![])),
            }

            if out_data.len() + response.data().len() > max_out {
@@ -439,7 +450,7 @@ impl<'tx> Transaction<'tx> {
            out_data.extend_from_slice(&response.data()[..response.data().len()]);
        }

-        Ok(Response::new(sw.into(), out_data))
+        Ok(Response::new(sw, out_data))
    }

    /// Fetch an object.
@@ -42,10 +42,9 @@ use crate::{
    transaction::Transaction,
 };
 use log::{error, info};
-use pcsc::Card;
+use pcsc::{Card, Disposition};
 use rand_core::{OsRng, RngCore};
 use std::{
-    convert::{TryFrom, TryInto},
    fmt::{self, Display},
    str::FromStr,
 };
@@ -56,6 +55,7 @@ use {
        apdu::StatusWords,
        consts::{TAG_ADMIN_FLAGS_1, TAG_ADMIN_TIMESTAMP},
        metadata::AdminData,
+        mgm,
        transaction::ChangeRefAction,
        Buffer, ObjectId,
    },
@@ -72,12 +72,6 @@ pub(crate) const ALGO_3DES: u8 = 0x03;
 /// Card management key
 pub(crate) const KEY_CARDMGM: u8 = 0x9b;

-/// MGMT Applet ID.
-///
-/// <https://developers.yubico.com/PIV/Introduction/Admin_access.html>
-#[cfg(feature = "untested")]
-const MGMT_AID: [u8; 8] = [0xa0, 0x00, 0x00, 0x05, 0x27, 0x47, 0x11, 0x17];
-
 const TAG_DYN_AUTH: u8 = 0x7c;

 /// Cached YubiKey PIN.
@@ -99,6 +93,20 @@ impl From<Serial> for u32 {
    }
 }

+impl TryFrom<&[u8]> for Serial {
+    type Error = Error;
+
+    fn try_from(bytes: &[u8]) -> Result<Self> {
+        if bytes.len() > 4 {
+            return Err(Error::SizeError);
+        }
+
+        let mut arr = [0u8; 4];
+        arr[(4 - bytes.len())..].copy_from_slice(bytes);
+        Ok(Self(u32::from_be_bytes(arr)))
+    }
+}
+
 impl FromStr for Serial {
    type Err = Error;

@@ -157,6 +165,16 @@ pub struct YubiKey {
    pub(crate) serial: Serial,
 }

+impl fmt::Debug for YubiKey {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("YubiKey")
+            .field("name", &self.name)
+            .field("version", &self.version)
+            .field("serial", &self.serial)
+            .finish_non_exhaustive()
+    }
+}
+
 impl YubiKey {
    /// Open a connection to a YubiKey.
    ///
@@ -167,12 +185,7 @@ impl YubiKey {
    /// [`yubikey::reader::Context`][`Context`] to select from the available
    /// PC/SC readers.
    pub fn open() -> Result<Self> {
-        let mut readers = Context::open().map_err(|e| match e {
-            Error::PcscError {
-                inner: Some(pcsc::Error::NoReadersAvailable),
-            } => Error::NotFound,
-            other => other,
-        })?;
+        let mut readers = Context::open()?;
        let mut reader_iter = readers.iter()?;

        if let Some(reader) = reader_iter.next() {
@@ -190,26 +203,42 @@ impl YubiKey {

    /// Open a YubiKey with a specific serial number.
    pub fn open_by_serial(serial: Serial) -> Result<Self> {
-        let mut readers = Context::open().map_err(|e| match e {
-            Error::PcscError {
-                inner: Some(pcsc::Error::NoReadersAvailable),
-            } => Error::NotFound,
-            other => other,
-        })?;
+        let mut readers = Context::open()?;
+
+        let mut open_error = None;

        for reader in readers.iter()? {
            let yubikey = match reader.open() {
                Ok(yk) => yk,
-                Err(_) => continue,
+                Err(e) => {
+                    // Save the first error we see that indicates we might have been able
+                    // to find a matching YubiKey.
+                    if open_error.is_none() {
+                        if let Error::PcscError {
+                            inner: Some(pcsc::Error::SharingViolation),
+                        } = e
+                        {
+                            open_error = Some(e);
+                        }
+                    }
+                    continue;
+                }
            };

            if serial == yubikey.serial() {
                return Ok(yubikey);
+            } else {
+                // We didn't want this YubiKey; don't reset it.
+                let _ = yubikey.disconnect(pcsc::Disposition::LeaveCard);
            }
        }

+        Err(if let Some(e) = open_error {
+            e
+        } else {
            error!("no YubiKey detected with serial: {}", serial);
-        Err(Error::NotFound)
+            Error::NotFound
+        })
    }

    /// Reconnect to a YubiKey.
@@ -239,6 +268,38 @@ impl YubiKey {
        Ok(())
    }

+    /// Disconnect from the YubiKey.
+    ///
+    /// In case of error, ownership of the YubiKey is returned to the caller.
+    ///
+    /// # Note
+    ///
+    /// `YubiKey` implements `Drop` which automatically disconnects the card using
+    /// `Disposition::ResetCard`; you only need to call this function if you want to
+    /// handle errors or use a different disposition method.
+    pub fn disconnect(self, disposition: Disposition) -> core::result::Result<(), (Self, Error)> {
+        let Self {
+            card,
+            name,
+            pin,
+            version,
+            serial,
+        } = self;
+
+        card.disconnect(disposition).map_err(|(card, e)| {
+            (
+                Self {
+                    card,
+                    name,
+                    pin,
+                    version,
+                    serial,
+                },
+                e.into(),
+            )
+        })
+    }
+
    /// Begin a transaction.
    pub(crate) fn begin_transaction(&mut self) -> Result<Transaction<'_>> {
        // TODO(tarcieri): reconnect support
@@ -286,7 +347,7 @@ impl YubiKey {
        // get a challenge from the card
        let challenge = Apdu::new(Ins::Authenticate)
            .params(ALGO_3DES, KEY_CARDMGM)
-            .data(&[TAG_DYN_AUTH, 0x02, 0x80, 0x00])
+            .data([TAG_DYN_AUTH, 0x02, 0x80, 0x00])
            .transmit(&txn, 261)?;

        if !challenge.is_success() || challenge.data().len() < 12 {
@@ -311,7 +372,7 @@ impl YubiKey {

        let authentication = Apdu::new(Ins::Authenticate)
            .params(ALGO_3DES, KEY_CARDMGM)
-            .data(&data)
+            .data(data)
            .transmit(&txn, 261)?;

        if !authentication.is_success() {
@@ -342,7 +403,7 @@ impl YubiKey {

        let status_words = Apdu::new(Ins::SelectApplication)
            .p1(0x04)
-            .data(MGMT_AID)
+            .data(mgm::APPLET_ID)
            .transmit(&txn, 255)?
            .status_words();

@@ -351,7 +412,12 @@ impl YubiKey {
                "Failed selecting mgmt application: {:04x}",
                status_words.code()
            );
-            return Err(Error::GenericError);
+            return Err(match status_words {
+                StatusWords::NotFoundError => Error::AppletNotFound {
+                    applet_name: mgm::APPLET_NAME,
+                },
+                _ => Error::GenericError,
+            });
        }

        Ok(())
@@ -569,7 +635,7 @@ impl YubiKey {

        let response = Apdu::new(Ins::Authenticate)
            .params(ALGO_3DES, KEY_CARDMGM)
-            .data(&[0x7c, 0x02, 0x81, 0x00])
+            .data([0x7c, 0x02, 0x81, 0x00])
            .transmit(&txn, 261)?;

        if !response.is_success() {
@@ -595,7 +661,7 @@ impl YubiKey {
        // send the response to the card and a challenge of our own.
        let status_words = Apdu::new(Ins::Authenticate)
            .params(ALGO_3DES, KEY_CARDMGM)
-            .data(&data)
+            .data(data)
            .transmit(&txn, 261)?
            .status_words();

@@ -637,15 +703,30 @@ impl<'a> TryFrom<&'a Reader<'_>> for YubiKey {

        info!("connected to reader: {}", reader.name());

-        let (version, serial) = {
+        let mut app_version_serial = || -> Result<(Version, Serial)> {
            let txn = Transaction::new(&mut card)?;
            txn.select_application()?;

            let v = txn.get_version()?;
            let s = txn.get_serial(v)?;
-            (v, s)
+            Ok((v, s))
        };

+        match app_version_serial() {
+            Err(e) => {
+                error!("Could not use reader: {}", e);
+
+                // We were unable to use the card, so we've effectively only connected as
+                // a side-effect of determining this. Avoid disrupting its internal state
+                // any further (e.g. preserve the PIN cache of whatever applet is selected
+                // currently).
+                if let Err((_, e)) = card.disconnect(pcsc::Disposition::LeaveCard) {
+                    error!("Failed to disconnect gracefully from card: {}", e);
+                }
+
+                Err(e)
+            }
+            Ok((version, serial)) => {
                let yubikey = YubiKey {
                    card,
                    name: String::from(reader.name()),
@@ -656,4 +737,6 @@ impl<'a> TryFrom<&'a Reader<'_>> for YubiKey {

                Ok(yubikey)
            }
+        }
+    }
 }
@@ -0,0 +1,85 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            d4:29:8f:df:8a:af:7b:c0:d7:bf:19:9d:90:d5:ef:ca
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Ferdinand Linnenberg CA
+        Validity
+            Not Before: Feb 10 12:25:37 2022 GMT
+            Not After : May 15 12:25:37 2024 GMT
+        Subject: CN=Bob
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d5:27:9b:99:1b:3a:36:64:36:c8:e5:78:64:b6:
+                    9d:70:9d:29:6c:0e:85:91:4b:78:3b:dc:16:c3:09:
+                    8c:d3:74:20:8c:6f:ed:c3:90:c9:1b:4d:80:d5:46:
+                    da:52:7f:d2:2f:bc:b2:f7:40:8d:ad:dd:24:b9:5c:
+                    dc:a2:21:2f:48:ec:06:93:8b:89:f0:cd:63:ff:a1:
+                    fd:ce:36:d5:07:7a:1e:0e:cf:68:a8:c1:b3:7f:62:
+                    84:b7:e1:cf:25:7b:3f:a8:3c:ac:07:1a:fd:c2:e1:
+                    e0:9e:26:24:c1:0d:6d:9d:c6:57:6a:b4:39:28:3d:
+                    88:3e:c9:6a:89:90:72:4a:7b:75:c5:5e:1b:5e:5c:
+                    32:54:a3:ff:eb:01:68:7f:89:b4:4c:01:3f:08:8e:
+                    6c:61:49:60:26:0b:26:58:81:d7:1a:57:ee:52:5c:
+                    05:47:de:da:eb:b5:92:9d:5b:ce:26:18:44:59:3e:
+                    27:d0:61:86:e2:f4:c6:d9:c7:2b:1f:cb:ea:78:f0:
+                    a1:a9:57:d7:98:4c:c1:2f:ae:6a:38:b4:34:53:2e:
+                    5a:9e:f8:58:c7:51:e7:fd:b8:27:cd:87:72:26:c1:
+                    7d:14:c7:cd:fb:f2:04:8a:c4:8f:61:cf:a8:78:bd:
+                    21:be:28:cb:e8:a8:65:29:28:82:46:2f:18:e6:ff:
+                    6f:53
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                B5:A5:F0:37:25:97:AD:BE:F1:43:52:45:4D:8B:A0:5E:E9:78:21:B8
+            X509v3 Authority Key Identifier: 
+                keyid:26:4E:EB:B0:A5:1B:08:A8:90:2A:85:04:73:84:B5:A5:2C:61:D6:91
+                DirName:/CN=Ferdinand Linnenberg CA
+                serial:8C:E0:40:D9:D8:60:E5:77
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+         19:f3:eb:c1:95:e6:d5:a9:33:d7:2e:02:d8:3a:91:84:81:14:
+         93:fc:03:4d:b1:4b:9d:0b:9b:94:93:9f:1a:0d:87:31:a1:fa:
+         a6:c7:3a:6b:18:24:12:ab:28:fb:c8:e3:09:a2:5d:50:49:00:
+         d9:18:e6:4a:09:18:e0:1c:da:d3:19:96:3d:74:72:fe:e0:8f:
+         ee:59:54:66:2e:57:72:b8:91:55:06:13:e5:9e:89:a2:3a:13:
+         3b:45:30:d3:cd:15:0e:81:eb:4f:b0:6a:a4:6d:00:7d:5b:c0:
+         4a:7f:97:d0:27:27:31:ae:3e:72:f1:74:fe:86:8e:29:a9:42:
+         23:26:22:db:08:8b:df:e9:d3:83:8d:81:10:36:d7:33:68:5e:
+         cb:93:cb:1e:12:c8:cb:be:5e:5c:8e:58:b0:1d:06:5e:c9:98:
+         b7:f1:49:fe:c4:03:de:b4:2b:da:9d:2c:7d:98:37:1c:6c:a8:
+         95:21:6f:23:e3:2e:09:bc:6c:e5:ed:e2:50:d8:f7:da:45:39:
+         d8:34:8a:57:0c:4f:d0:0d:80:06:d6:34:63:72:27:d1:50:d1:
+         d2:21:2c:97:57:17:98:02:95:3a:96:ed:75:9f:cc:f3:b8:f1:
+         3a:85:f9:58:08:9b:a0:75:fd:9b:fd:31:dd:08:dc:14:3d:f4:
+         68:aa:d4:30
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgIRANQpj9+Kr3vA178ZnZDV78owDQYJKoZIhvcNAQELBQAw
+IjEgMB4GA1UEAwwXRmVyZGluYW5kIExpbm5lbmJlcmcgQ0EwHhcNMjIwMjEwMTIy
+NTM3WhcNMjQwNTE1MTIyNTM3WjAOMQwwCgYDVQQDDANCb2IwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDVJ5uZGzo2ZDbI5Xhktp1wnSlsDoWRS3g73BbD
+CYzTdCCMb+3DkMkbTYDVRtpSf9IvvLL3QI2t3SS5XNyiIS9I7AaTi4nwzWP/of3O
+NtUHeh4Oz2iowbN/YoS34c8lez+oPKwHGv3C4eCeJiTBDW2dxldqtDkoPYg+yWqJ
+kHJKe3XFXhteXDJUo//rAWh/ibRMAT8IjmxhSWAmCyZYgdcaV+5SXAVH3trrtZKd
+W84mGERZPifQYYbi9MbZxysfy+p48KGpV9eYTMEvrmo4tDRTLlqe+FjHUef9uCfN
+h3ImwX0Ux8378gSKxI9hz6h4vSG+KMvoqGUpKIJGLxjm/29TAgMBAAGjgaMwgaAw
+CQYDVR0TBAIwADAdBgNVHQ4EFgQUtaXwNyWXrb7xQ1JFTYugXul4IbgwUgYDVR0j
+BEswSYAUJk7rsKUbCKiQKoUEc4S1pSxh1pGhJqQkMCIxIDAeBgNVBAMMF0ZlcmRp
+bmFuZCBMaW5uZW5iZXJnIENBggkAjOBA2dhg5XcwEwYDVR0lBAwwCgYIKwYBBQUH
+AwIwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IBAQAZ8+vBlebVqTPXLgLY
+OpGEgRST/ANNsUudC5uUk58aDYcxofqmxzprGCQSqyj7yOMJol1QSQDZGOZKCRjg
+HNrTGZY9dHL+4I/uWVRmLldyuJFVBhPlnomiOhM7RTDTzRUOgetPsGqkbQB9W8BK
+f5fQJycxrj5y8XT+ho4pqUIjJiLbCIvf6dODjYEQNtczaF7Lk8seEsjLvl5cjliw
+HQZeyZi38Un+xAPetCvanSx9mDccbKiVIW8j4y4JvGzl7eJQ2PfaRTnYNIpXDE/Q
+DYAG1jRjcifRUNHSISyXVxeYApU6lu11n8zzuPE6hflYCJugdf2b/THdCNwUPfRo
+qtQw
+-----END CERTIFICATE-----
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIi6DixMpf5PQCAggA
+MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECLgvCsIAjjXRBIIEyDAss0V4NrI5
+W7KXPRgRJ1tqvQrWZQTIFu4Crzs9Inb4TtSv5mATI9ZU2RMFF6MYXlhIxJng861P
+5IWcU6VeOjRFej8wcB3uTvD2z7NB2cyA5BZSojrZfX5OIEKL9sBzn0vinqmm5N1z
+oXhLMgf0FZssA3+zjIf04vtvmk5pxTCE6dq6vlsEIJyQ0xGc39bStIwk2a4E9wvi
+XayKNJnRFSrTahuI3DvQJPd9TdmM6sBKnrcJrDa6LvH51SrGzW8bBEjDAmC7yJdi
+mBckFTjZ6rGrSxOI6HdnF9RP+y9OiLE4ou5OJ9MbBtngq9OrTImAMZ5ftWowaqX/
+Do1UTqixi4ecWrr5fr1+A2Vch0I1drds2e/mmLR+5GEQXQXZPZKjtPMwxM/AYnTZ
+w/M3T9KtwSj0s5G6Saz4WpzaUL7wATb/UNqMr8Ifl8mHEVoFZhvoRpMWA7Yj1oPb
+cHz8lsfoSrTnK+zLR8ZK3HRu4MtpdCNVwQIJ67T6Feb8YLwYSccTNHBSqUmWRD95
+wOOqY33xcfplaQ2Y+/8+mHScGSEPNmC4f7EggDeUnG3ow0f4n95DENO+aYqGLjSF
+XdCjhD+NTNdlV0z50B6P2XWUoBZOOnPfgFf4nAgn7xQbkZZOk5bQDKo2Zu9jW9/
+uJyTHqI58tcopI3cjd5iQXOJUrM4OWpPIu3p+VWaIAA8JzJIfDN6fyQ3qsMr305L
+30JcjrH6if/6J+2g+DpMAK928JY2hfE8VNWH7096ZnArp42/hLYsNuYnSrL1eS+g
+F/4mvyZyLLTFyB0Frnic4I1QTuNkNmwSrm/B5wIWLqkS7XAyyDDXAcaTHdZCN6nM
+O2OuF7DfBsFcNMM4VagG5adPS9CYkvz0EEh6ho5XiP2yL3tZfsHyuB4njAsV3aFi
+D0Yq7QiCf5iA2d4KsYO6yr1wPfVhlsmPi3++mrHulBwwCQWHTlPgRZnjj1xgmPcQ
+00KsUVh+CMWlf20O5sKhzjvkzbwUj1K+ZfMDuuq1RbzFRSx+Gx8vIaThFg9kVyoP
+zuvzsT6qc3BGNHmaGZ3d5Re25AuGRTF4cTpDfjW0UL7Wnvnis7iMrUasDhyF7CFn
+/KG7eKzxqS08o6D4AM5S/fzZEtszoEgAga6DS2R75FVskDweWuEIsar9UGg3UlmW
+q3+rRPRf1CzrLtyYenkkLg/ajr8JOnFGqZVaLmMnegZQH6rF3aEzlQLNgbNepcuA
+ObSmAO6MR3MlQgdsH/lNzOPdj1gKcE25hOjGfmwgbOXSJv9Cz0bcBLFEyLZSNpRk
+HhNejj6BEz/Cmqg1wm7SOBHsXJGcOTnLO1Y3FBt0I7heWvWmj9rOLG9tvvx9dtrP
+pQyDbIcWonuXLrXYSPyOjmeWoQSzdH3NsCswBV4G+iOiLCJDkElR+mrwKbhtS88T
+3YeZnsCTsmH+jZpxGgPTObjIG91U4UE4Pnkwc2df355VuOKrf0rB/NK0A9hZGqsV
+nxtodjn92P6UFzmfEdt95pMcmurK9wkm1kRkP7cIyAs2lCOIdbgGsszz6Mk16Xqy
+49RdhLxJrJ4gkYZIAbY+KNGVc7uPhm/T9xGrIstbEsoUM7jy7nHMOCCDgdbwX/4X
+caMeSMZcZ+RvraDDBEbSbg==
+-----END ENCRYPTED PRIVATE KEY-----
@@ -3,37 +3,39 @@
 #![forbid(unsafe_code)]
 #![warn(missing_docs, rust_2018_idioms, trivial_casts, unused_qualifications)]

-use lazy_static::lazy_static;
 use log::trace;
+use once_cell::sync::Lazy;
 use rand_core::{OsRng, RngCore};
-use rsa::{hash::Hash::SHA2_256, PaddingScheme, PublicKey};
+use rsa::pkcs1v15;
 use sha2::{Digest, Sha256};
-use std::{convert::TryInto, env, sync::Mutex};
+use signature::hazmat::PrehashVerifier;
+use std::{env, str::FromStr, sync::Mutex};
 use x509::RelativeDistinguishedName;
 use yubikey::{
+    certificate,
    certificate::{Certificate, PublicKeyInfo},
-    piv::{self, AlgorithmId, Key, RetiredSlotId, SlotId},
-    Error, MgmKey, PinPolicy, TouchPolicy, YubiKey,
+    piv::{self, AlgorithmId, Key, ManagementSlotId, RetiredSlotId, SlotId},
+    Error, MgmKey, PinPolicy, Serial, TouchPolicy, YubiKey,
 };

-lazy_static! {
-    /// Provide thread-safe access to a YubiKey
-    static ref YUBIKEY: Mutex<YubiKey> = init_yubikey();
-}
-
-/// One-time test initialization and setup
-fn init_yubikey() -> Mutex<YubiKey> {
+static YUBIKEY: Lazy<Mutex<YubiKey>> = Lazy::new(|| {
    // Only show logs if `RUST_LOG` is set
    if env::var("RUST_LOG").is_ok() {
        env_logger::builder().format_timestamp(None).init();
    }

-    let yubikey = YubiKey::open().unwrap();
+    let yubikey = if let Ok(serial) = env::var("YUBIKEY_SERIAL") {
+        let serial = Serial::from_str(&serial).unwrap();
+        YubiKey::open_by_serial(serial).unwrap()
+    } else {
+        YubiKey::open().unwrap()
+    };
+
    trace!("serial: {}", yubikey.serial());
    trace!("version: {}", yubikey.version());

    Mutex::new(yubikey)
-}
+});

 //
 // CCCID support
@@ -194,26 +196,17 @@ fn generate_self_signed_rsa_cert() {
    //

    let pubkey = match cert.subject_pki() {
-        PublicKeyInfo::Rsa { pubkey, .. } => pubkey,
+        PublicKeyInfo::Rsa { pubkey, .. } => pkcs1v15::VerifyingKey::<Sha256>::from(pubkey.clone()),
        _ => unreachable!(),
    };

    let data = cert.as_ref();
    let tbs_cert_len = u16::from_be_bytes(data[6..8].try_into().unwrap()) as usize;
    let msg = &data[4..8 + tbs_cert_len];
-    let sig = &data[data.len() - 128..];
-
+    let sig = pkcs1v15::Signature::try_from(&data[data.len() - 128..]).unwrap();
    let hash = Sha256::digest(msg);

-    assert!(pubkey
-        .verify(
-            PaddingScheme::PKCS1v15Sign {
-                hash: Some(SHA2_256)
-            },
-            &hash,
-            sig
-        )
-        .is_ok());
+    assert!(pubkey.verify_prehash(&hash, &sig).is_ok());
 }

 #[test]
@@ -241,3 +234,143 @@ fn generate_self_signed_ec_cert() {
    use p256::ecdsa::signature::Verifier;
    assert!(vk.verify(msg, &sig).is_ok());
 }
+
+#[test]
+#[ignore]
+fn test_slot_id_display() {
+    assert_eq!(format!("{}", SlotId::Authentication), "Authentication");
+    assert_eq!(format!("{}", SlotId::Signature), "Signature");
+    assert_eq!(format!("{}", SlotId::KeyManagement), "KeyManagement");
+    assert_eq!(
+        format!("{}", SlotId::CardAuthentication),
+        "CardAuthentication"
+    );
+    assert_eq!(format!("{}", SlotId::Attestation), "Attestation");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R1)), "R1");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R2)), "R2");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R3)), "R3");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R4)), "R4");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R5)), "R5");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R6)), "R6");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R7)), "R7");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R8)), "R8");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R9)), "R9");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R10)), "R10");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R11)), "R11");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R12)), "R12");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R13)), "R13");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R14)), "R14");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R15)), "R15");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R16)), "R16");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R17)), "R17");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R18)), "R18");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R19)), "R19");
+    assert_eq!(format!("{}", SlotId::Retired(RetiredSlotId::R20)), "R20");
+
+    assert_eq!(
+        format!("{}", SlotId::Management(ManagementSlotId::Pin)),
+        "PIN"
+    );
+    assert_eq!(
+        format!("{}", SlotId::Management(ManagementSlotId::Puk)),
+        "PUK"
+    );
+    assert_eq!(
+        format!("{}", SlotId::Management(ManagementSlotId::Management)),
+        "Management"
+    );
+}
+
+//
+// Metadata
+//
+
+#[test]
+#[ignore]
+fn test_read_metadata() {
+    let mut yubikey = YUBIKEY.lock().unwrap();
+
+    assert!(yubikey.verify_pin(b"123456").is_ok());
+    assert!(yubikey.authenticate(MgmKey::default()).is_ok());
+
+    let slot = SlotId::Retired(RetiredSlotId::R1);
+
+    // Generate a new key in the selected slot.
+    let generated = piv::generate(
+        &mut yubikey,
+        slot,
+        AlgorithmId::EccP256,
+        PinPolicy::Default,
+        TouchPolicy::Default,
+    )
+    .unwrap();
+
+    let metadata = piv::metadata(&mut yubikey, slot).unwrap();
+
+    assert_eq!(metadata.public, Some(generated));
+}
+
+#[test]
+#[ignore]
+fn test_serial_string_conversions() {
+    //2^152+1
+    let serial: [u8; 20] = [
+        0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x01,
+    ];
+
+    let s = certificate::Serial::from(serial);
+    assert_eq!(
+        s.as_x509_int(),
+        "5708990770823839524233143877797980545530986497"
+    );
+    assert_eq!(
+        s.as_x509_hex(),
+        "01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:01"
+    );
+
+    let serial2: [u8; 20] = [
+        0xA1, 0xF3, 0x02, 0x30, 0x76, 0x01, 0x32, 0x48, 0x09, 0x9C, 0x10, 0xAA, 0x3F, 0xA0, 0x54,
+        0x0D, 0xC0, 0xB7, 0x65, 0x01,
+    ];
+
+    let s2 = certificate::Serial::from(serial2);
+    assert_eq!(
+        s2.as_x509_int(),
+        "924566785900861696177829411010986812227211191553"
+    );
+    assert_eq!(
+        s2.as_x509_hex(),
+        "a1:f3:02:30:76:01:32:48:09:9c:10:aa:3f:a0:54:0d:c0:b7:65:01"
+    );
+
+    let serial3: [u8; 20] = [
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xAA, 0x3F, 0xA0, 0x54,
+        0x0D, 0xC0, 0xB7, 0x65, 0x01,
+    ];
+
+    let s3 = certificate::Serial::from(serial3);
+    assert_eq!(s3.as_x509_int(), "3140531249369331492097");
+    assert_eq!(s3.as_x509_hex(), "aa:3f:a0:54:0d:c0:b7:65:01");
+}
+
+#[test]
+#[ignore]
+fn test_parse_cert_from_der() {
+    let bob_der = std::fs::read("tests/assets/Bob.der").expect(".der file not found");
+    let cert =
+        certificate::Certificate::from_bytes(bob_der).expect("Failed to parse valid certificate");
+    assert_eq!(
+        cert.subject(),
+        "CN=Bob",
+        "Subject is {} should be CN=Bob",
+        cert.subject()
+    );
+    assert_eq!(
+        cert.issuer(),
+        "CN=Ferdinand Linnenberg CA",
+        "Issuer is {} should be {}",
+        cert.issuer(),
+        "CN=Ferdinand Linnenberg CA"
+    );
+}
Author	SHA1	Message	Date
Tony Arcieri (iqlusion)	cafb0b2c18	v0.8.0-pre.0 (#491 )	2023-03-14 17:17:07 -06:00
Tony Arcieri (iqlusion)	0c7441a81e	Bump asymmetric crypto dependencies; MSRV 1.65 (#490 ) Bumps the following dependencies to the latest versions: - `elliptic-curve` v0.13 - `k256` v0.13 - `p256` v0.13 - `p384` v0.13 - `pbkdf2` v0.12 - `rsa` v0.9.0-pre.0 - `signature` v2	2023-03-14 11:53:00 -06:00
str4d	a50addc15b	Fix `StatusWords::code` output for `StatusWords::VerifyFailError` (#479 ) * Fix `StatusWords::code` output for `StatusWords::VerifyFailError` Closes iqlusioninc/yubikey.rs#473. * Refactor `Transaction::transfer_data` to match on `StatusWords` This makes the code more reliable, such that it would have avoided the bug in iqlusioninc/yubikey.rs#473.	2023-02-12 12:02:22 -07:00
str4d	0809f300b7	Return errors from `YubiKey::open_by_serial` that indicate a key may exist (#477 ) * Return errors from `YubiKey::open_by_serial` that indicate a key may exist The only such error at the moment is `pcsc::Error::SharingViolation`, which indicates a transient failure to access a specific reader that could have been the one we needed (and so a future retry might succeed). Closes iqlusioninc/yubikey.rs#458. * Avoid resetting unused devices in YubiKey::open_by_serial We only connect to readers so that we can determine their serial. We now try to ensure that the order in which we connect to them doesn't have an effect on their state after we are done.	2023-02-12 10:22:05 -07:00
str4d	d55079f9a6	Enable library users to detect if a smart card doesn't support PIV (#476 ) * Enable library users to detect if a smart card doesn't support PIV Closes iqlusioninc/yubikey.rs#456. * Avoid resetting the card if we fail to select PIV or fetch version/serial	2023-02-12 10:20:34 -07:00
str4d	10241230b3	Raise minimum `pcsc` version to remove workaround (#478 ) In iqlusioninc/yubikey.rs#88 we added a workaround for what turned out to be a bug in `pcsc`, where an error was returned if no readers were available, instead of returning an empty iterator. `pcsc 2.3.1` was published in 2019, so we can safely rely on it.	2023-02-12 10:18:55 -07:00
dependabot[bot]	1e02f135f0	Bump env_logger from 0.9.3 to 0.10.0 (#452 ) Bumps [env_logger](https://github.com/rust-cli/env_logger) from 0.9.3 to 0.10.0. - [Release notes](https://github.com/rust-cli/env_logger/releases) - [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-cli/env_logger/compare/v0.9.3...v0.10.0) --- updated-dependencies: - dependency-name: env_logger dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-01-08 15:24:30 -07:00
Tony Arcieri (iqlusion)	0c2633ab31	transaction: comment cleanup in `get_serial` (#467 ) Moves comments about each YubiKey version number above the arms of the `match` expression	2023-01-07 13:35:52 -08:00
Tony Arcieri (iqlusion)	f49c617a9d	Improve parsing of serial numbers (#466 ) Checks the length of the data returned when querying the serial number, returning an error if it's longer than 4 bytes, and left-padding with zeroes if it's too short. This fixes some potential panics due to incorrect slice lengths as were experienced in #465	2023-01-07 08:35:37 -08:00
Tony Arcieri (iqlusion)	1d33ea1747	Cargo.lock: bump dependencies (#463 )	2023-01-02 10:22:07 -08:00
str4d	18eb4bf4f4	Add `YubiKey::disconnect` (#462 ) This exposes `pcsc::Card::disconnect` to allow alternate disposition methods.	2023-01-02 10:15:31 -08:00
str4d	10941bfb5b	Add partial `Debug` impls for `Context` and `YubiKey` (#457 ) This enables `yubikey::Result<T>` to be debug-formatted, for example when wrapping the output of an API method in `dbg!()`.	2023-01-01 11:16:10 -07:00
Tony Arcieri (iqlusion)	002491193e	Cargo.lock: bump dependencies + audit config (#451 ) This should get the security audit passing again	2022-11-28 10:19:39 -08:00
Tony Arcieri (iqlusion)	2e5139b237	yubikey-cli v0.7.0 (#446 )	2022-11-14 17:17:02 -08:00
Tony Arcieri (iqlusion)	d880faaefa	yubikey v0.7.0 (#444 )	2022-11-14 15:53:00 -08:00
Tony Arcieri (iqlusion)	cc00a10c2f	img: add logo-sq.png (#445 ) Square logo for use with rustdoc	2022-11-14 15:15:19 -08:00
Tony Arcieri (iqlusion)	0a2e798894	Switch from `subtle-encoding` to `base16ct` (#443 )	2022-11-14 14:26:07 -08:00
Tony Arcieri (iqlusion)	5c4259023f	Switch from `lazy_static` to `once_cell` (#442 ) The latter will hopefully eventually be upstreamed into `std`.	2022-11-14 12:52:27 -08:00
Tony Arcieri (iqlusion)	57bb088c7d	yubikey-cli: bump `x509-parser` to v0.14 (#441 )	2022-11-14 12:30:55 -08:00
Tony Arcieri (iqlusion)	ccf19a3668	Bump `rsa` to v0.7.1 (#440 )	2022-11-14 11:08:05 -08:00
dependabot[bot]	db13fce53b	Bump clap from 3.2.23 to 4.0.23 (#438 ) Bumps [clap](https://github.com/clap-rs/clap) from 3.2.23 to 4.0.23. - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/v3.2.23...v4.0.23) --- updated-dependencies: - dependency-name: clap dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-11-14 10:44:39 -08:00
Ferdinand Linnenberg	0071566097	feat: fixed incorrect issuer for certificates & added x509 prints (#437 )	2022-11-14 10:42:07 -08:00
Tony Arcieri (iqlusion)	d8653bc6f0	Use `chrono` v0.4.23 or newer (#436 ) Addresses RUSTSEC-2020-0159	2022-11-12 15:42:34 -08:00
Tony Arcieri (iqlusion)	603b102932	Followups from #371 (#435 ) Implements the changes I suggested in that PR, which are related to naming conventions and documentation.	2022-11-12 15:41:58 -08:00
Tony Arcieri (iqlusion)	7470b1613a	Cargo.lock: bump dependencies (#434 )	2022-11-12 13:27:08 -08:00
Tony Arcieri (iqlusion)	4310cc0f9a	Fix build and clippy warnings (#433 )	2022-11-12 13:15:42 -08:00
Arthur Gautier	87ed7b2338	Adds support for metadata command (#371 ) On firmware 5.4.3, yubikey introduced a metadata command. This returns the policy attached to as slot as well as the public key of the pair in the slot. https://docs.yubico.com/yesdk/users-manual/application-piv/apdu/metadata.html	2022-11-12 11:12:10 -08:00
Shella Stephens	7866d8d53e	MSRV 1.60.0 (#423 )	2022-11-07 08:58:45 -07:00
Shella Stephens	744238fd77	Cargo.lock: update dependencies & fix audit	2022-11-07 07:56:25 -07:00
william light	bbb186f95e	Display inner PC/SC errors (#420 )	2022-10-31 15:00:21 -07:00
dependabot[bot]	c89cc5acd0	Bump sha2 from 0.10.2 to 0.10.5 (#407 ) Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.10.2 to 0.10.5. - [Release notes](https://github.com/RustCrypto/hashes/releases) - [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.10.2...sha2-v0.10.5) --- updated-dependencies: - dependency-name: sha2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-10-18 14:29:21 -07:00
dependabot[bot]	2294c1cc3a	Bump chrono from 0.4.21 to 0.4.22 (#405 ) Bumps [chrono](https://github.com/chronotope/chrono) from 0.4.21 to 0.4.22. - [Release notes](https://github.com/chronotope/chrono/releases) - [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md) - [Commits](https://github.com/chronotope/chrono/compare/v0.4.21...v0.4.22) --- updated-dependencies: - dependency-name: chrono dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-10-18 14:29:08 -07:00
dependabot[bot]	65e201db0f	Bump uuid from 1.1.2 to 1.2.1 (#415 ) Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.1.2 to 1.2.1. - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/1.1.2...1.2.1) --- updated-dependencies: - dependency-name: uuid dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-10-18 14:28:56 -07:00
Tony Arcieri (iqlusion)	b571f81007	yubikey-cli v0.6.0 (#404 )	2022-08-10 17:23:41 -07:00
Tony Arcieri (iqlusion)	0a36a37ae3	yubikey v0.6.0 (#403 )	2022-08-10 16:41:26 -07:00
Tony Arcieri (iqlusion)	3463d109b2	Bump `der-parser` to v8; `x509-parser` to v0.14 (#402 )	2022-08-10 15:19:21 -07:00
dependabot[bot]	014b7ee6fd	Bump p384 from 0.10.0 to 0.11.2 (#401 ) Bumps [p384](https://github.com/RustCrypto/elliptic-curves) from 0.10.0 to 0.11.2. - [Release notes](https://github.com/RustCrypto/elliptic-curves/releases) - [Commits](https://github.com/RustCrypto/elliptic-curves/compare/p384/v0.10.0...p384/v0.11.2) --- updated-dependencies: - dependency-name: p384 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-08-10 14:57:39 -07:00
vdods	498de4c10d	Adding some common traits for certain enum types to support maps. (#372 )	2022-08-10 14:34:58 -07:00
Tony Arcieri (iqlusion)	98b038c873	Cargo.lock: bump dependencies (#400 )	2022-08-10 14:26:33 -07:00
Tony Arcieri (iqlusion)	fab9d25b0a	cli: migrate from `gumdrop` to `clap` v3 (#379 ) `gumdrop` was originally chosen for its minimalist set of dependencies, but `clap` v3 has a slimmed down set of dependencies and better UX.	2022-05-24 21:45:26 -06:00
dependabot[bot]	bb80551324	Bump uuid from 0.8.2 to 1.0.0 (#376 ) Bumps [uuid](https://github.com/uuid-rs/uuid) from 0.8.2 to 1.0.0. - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/0.8.2...1.0.0) --- updated-dependencies: - dependency-name: uuid dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-05-23 20:18:58 -07:00
Tony Arcieri (iqlusion)	9e20ecfe55	RustCrypto crate upgrades; MSRV 1.57 (#378 ) Updates all of the RustCrypto dependencies to the latest versions: - `des` v0.8 - `elliptic-curve` v0.12 - `hmac` v0.12 - `num-bigint-dig` v0.8 - `pbkdf2` v0.11 - `p256` v0.11 - `p384` v0.10 - `rsa` v0.6 - `sha1` v0.10 (replacing `sha-1`) - `sha2` v0.10	2022-05-23 20:04:12 -07:00
Tony Arcieri (iqlusion)	fac83c60fb	Cargo.lock: bump dependencies (#375 )	2022-05-23 17:52:53 -07:00
Shella Stephens	914f9bee0d	Cargo.lock: update dependencies & fix cargo audit (#365 )	2022-03-07 16:29:35 -07:00
Ferdinand Linnenberg	83de59983f	Add Display formatter to SlotId (#353 )	2022-02-11 13:10:53 -08:00
Shella Stephens	e21395c934	Cargo.lock: update dependencies (#347 )	2022-01-31 08:00:16 -07:00
Tony Arcieri (iqlusion)	935fea0868	Bump `p256` => v0.10; `p384` => v0.9 (#344 )	2022-01-17 15:08:48 -08:00
Tony Arcieri (iqlusion)	dd4b1c60a4	2021 edition upgrade; MSRV 1.56 (#343 ) Changes the `edition` to 2021 in both the `yubikey` and `yubikey-cli` crates. Removes `TryFrom`/`TryInto` imports, now that they're in the prelude.	2022-01-17 14:54:01 -08:00
Shella Stephens	74a50f0f0c	Bump dependencies & fix security audit (#340 ) * Bump dependencies & fix security audit * allow dead code for issuer field #[allow(dead_code)] in Certificates struct	2022-01-10 08:40:58 -07:00