yubikey-cli v0.3.0 (#241 )

yubikey-piv v0.3.0 (#240 )
Cargo.lock: bump dependencies (#238 )
2021-03-22 10:23:15 -07:00 · 2021-03-22 09:45:19 -07:00 · 2021-03-22 09:27:28 -07:00 · 2021-02-03 06:13:01 -08:00 · 2021-02-01 09:27:04 -08:00 · 2021-01-31 09:54:13 -08:00
12 changed files with 472 additions and 335 deletions
@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## 0.3.0 (2021-03-22)
+### Added
+- Typed structs for PIN-protected and admin metadata ([#223])
+- `MgmKey::set_default`/`MgmKey::set_manual` methods ([#224])
+
+### Changed
+- Have `Transaction::set_mgm_key` take touch requirement as bool ([#224])
+
+### Removed
+- `MgmKey::set` method ([#224])
+
+[#223]: https://github.com/iqlusioninc/yubikey-piv.rs/pull/223
+[#224]: https://github.com/iqlusioninc/yubikey-piv.rs/pull/224
+
 ## 0.2.0 (2021-01-30)
 ### Changed
 - Bump `der-parser` to v5.0 ([#194])
@@ -1,5 +1,7 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "aho-corasick"
 version = "0.7.15"
@@ -52,20 +54,20 @@ checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"

 [[package]]
 name = "bitvec"
-version = "0.18.4"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2838fdd79e8776dbe07a106c784b0f8dda571a21b2750a092cc4cbaa653c8e"
+checksum = "98fcd36dda4e17b7d7abc64cb549bf0201f4ab71e00700c798ca7e62ed3761fa"
 dependencies = [
 "funty",
- "radium 0.4.1",
+ "radium 0.3.0",
 "wyz",
 ]

 [[package]]
 name = "bitvec"
-version = "0.19.4"
+version = "0.19.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7ba35e9565969edb811639dbebfe34edc0368e472c5018474c8eb2543397f81"
+checksum = "8942c8d352ae1838c9dda0b0ca2ab657696ef2232a20147cf1b30ae1a9cb4321"
 dependencies = [
 "funty",
 "radium 0.5.3",
@@ -84,27 +86,21 @@ dependencies = [

 [[package]]
 name = "bumpalo"
-version = "3.6.0"
+version = "3.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "099e596ef14349721d9016f6b80dd3419ea1bf289ab9b44df8e4dfd3a005d5d9"
+checksum = "63396b8a4b9de3f4fdfb320ab6080762242f66a8ef174c49d8e19b674db4cdbe"

 [[package]]
 name = "byteorder"
-version = "1.4.2"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae44d1a3d5a19df61dd0c8beb138458ac2a53a7ac09eba97d55592540004306b"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"

 [[package]]
 name = "cc"
-version = "1.0.66"
+version = "1.0.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c0496836a84f8d0495758516b8621a622beb77c0fed418570e50764093ced48"
-
-[[package]]
-name = "cfg-if"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+checksum = "e3c69b077ad434294d3ce9f1f6143a2a4b89a8a2d54ef813d85003a4fd1137fd"

 [[package]]
 name = "cfg-if"
@@ -136,9 +132,9 @@ dependencies = [

 [[package]]
 name = "const-oid"
-version = "0.4.1"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5d82796b70971fbb603900a5edc797a4d9be0f9ec1257f83a1dba0aa374e3e9"
+checksum = "9f6b64db6932c7e49332728e3a6bd82c6b7e16016607d20923b537c3bc4c0d5f"

 [[package]]
 name = "cookie-factory"
@@ -184,20 +180,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd17d13ecf875e704369fdbde242483ac769fc18f6af21e43d5a692a079732fc"
 dependencies = [
 "nom",
- "num-bigint 0.3.1",
+ "num-bigint 0.3.2",
 "num-traits",
 "proc-macro-hack",
 ]

 [[package]]
 name = "der-parser"
-version = "5.0.0"
+version = "5.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4b1e27396f46037881c39d821660f2ff48797aaa7152a45ded7a93b368a819"
+checksum = "13e6cad1223a7b98b59275a56516ed8c40508d21284a32e404ed3fe2ae9a809a"
 dependencies = [
 "der-oid-macro",
 "nom",
- "num-bigint 0.3.1",
+ "num-bigint 0.3.2",
 "num-traits",
 "proc-macro-hack",
 "rusticata-macros",
@@ -235,12 +231,13 @@ dependencies = [

 [[package]]
 name = "elliptic-curve"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "592b1c857559479c056b73a3053c717108a70e4dce320ad28c79c63f5c2e62ba"
+checksum = "f2db227e61a43a34915680bdda462ec0e212095518020a88a1f91acd16092c39"
 dependencies = [
- "bitvec 0.18.4",
+ "bitvec 0.18.5",
 "ff",
+ "funty",
 "generic-array",
 "group",
 "pkcs8",
@@ -251,9 +248,9 @@ dependencies = [

 [[package]]
 name = "env_logger"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26ecb66b4bdca6c1409b40fb255eefc2bd4f6d135dab3c3124f80ffa2a9661e"
+checksum = "17392a012ea30ef05a610aa97dfb49496e71c9f676b27879922ea5bdf60d9d3f"
 dependencies = [
 "atty",
 "humantime",
@@ -268,7 +265,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01646e077d4ebda82b73f1bca002ea1e91561a77df2431a9e79729bcc31950ef"
 dependencies = [
- "bitvec 0.18.4",
+ "bitvec 0.18.5",
 "rand_core",
 "subtle",
 ]
@@ -295,7 +292,7 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
 "libc",
 "wasi 0.9.0+wasi-snapshot-preview1",
 ]
@@ -358,9 +355,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"

 [[package]]
 name = "js-sys"
-version = "0.3.47"
+version = "0.3.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cfb73131c35423a367daf8cbd24100af0d077668c8c2943f0e7dd775fef0f65"
+checksum = "dc15e39392125075f60c95ba416f5381ff6c3a948ff02ab12464715adf56c821"
 dependencies = [
 "wasm-bindgen",
 ]
@@ -376,22 +373,22 @@ dependencies = [

 [[package]]
 name = "lexical-core"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db65c6da02e61f55dae90a0ae427b2a5f6b3e8db09f58d10efab23af92592616"
+checksum = "21f866863575d0e1d654fbeeabdc927292fdf862873dc3c96c6f753357e13374"
 dependencies = [
 "arrayvec",
 "bitflags",
- "cfg-if 0.1.10",
+ "cfg-if",
 "ryu",
 "static_assertions",
 ]

 [[package]]
 name = "libc"
-version = "0.2.84"
+version = "0.2.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cca32fa0182e8c0989459524dc356b8f2b5c10f1b9eb521b7d182c03cf8c5ff"
+checksum = "ba4aede83fc3617411dc6993bc8c70919750c1c257c6ca6a502aed6e0e2394ae"

 [[package]]
 name = "libm"
@@ -405,7 +402,7 @@ version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
 ]

 [[package]]
@@ -416,11 +413,12 @@ checksum = "0ee1c47aaa256ecabcaea351eae4a9b01ef39ed810004e298d2511ed284b1525"

 [[package]]
 name = "nom"
-version = "6.1.0"
+version = "6.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab6f70b46d6325aa300f1c7bb3d470127dfc27806d8ea6bf294ee0ce643ce2b1"
+checksum = "e7413f999671bd4745a7b624bd370a569fb6bc574b23c83a3c5ed2e453f3d5e2"
 dependencies = [
- "bitvec 0.19.4",
+ "bitvec 0.19.5",
+ "funty",
 "lexical-core",
 "memchr",
 "version_check",
@@ -439,9 +437,9 @@ dependencies = [

 [[package]]
 name = "num-bigint"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e9a41747ae4633fce5adffb4d2e81ffc5e89593cb19917f8fb2cc5ff76507bf"
+checksum = "7d0a3d5e207573f948a9e5376662aa743a2ea13f7c50a554d7af443a73fbfeba"
 dependencies = [
 "autocfg 1.0.1",
 "num-integer",
@@ -508,9 +506,9 @@ dependencies = [

 [[package]]
 name = "once_cell"
-version = "1.5.2"
+version = "1.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13bd41f508810a131401606d54ac32a467c97172d74ba7662562ebba5ad07fa0"
+checksum = "af8b08b04175473088b46763e51ee54da5f9a164bc162f615b91bc179dbf15a3"

 [[package]]
 name = "opaque-debug"
@@ -539,9 +537,9 @@ dependencies = [

 [[package]]
 name = "pbkdf2"
-version = "0.7.1"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca5c74683c467276ba17c4bb16e219487dc8fd4465b24d2653386e40de37dab6"
+checksum = "297e1dad0e9de7af53235b833761351bf6bda57d6acb4f263b61a2ddf674f1dc"
 dependencies = [
 "crypto-mac",
 ]
@@ -567,9 +565,9 @@ dependencies = [

 [[package]]
 name = "pem"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c220d01f863d13d96ca82359d1e81e64a7c6bf0637bcde7b2349630addf0c6"
+checksum = "fd56cbd21fea48d0c440b41cd69c589faacade08c992d9a54e471b79d0fd13eb"
 dependencies = [
 "base64",
 "once_cell",
@@ -614,18 +612,18 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "991431c3519a3f36861882da93630ce66b52918dcf1b8e2fd66b397fc96f28df"
+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
 dependencies = [
 "proc-macro2",
 ]

 [[package]]
 name = "radium"
-version = "0.4.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64de9a0c5361e034f1aefc9f71a86871ec870e766fe31a009734a989b329286a"
+checksum = "def50a86306165861203e7f84ecffbbdfdea79f0e51039b33de1e952358c47ac"

 [[package]]
 name = "radium"
@@ -676,27 +674,26 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.4.3"
+version = "1.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9251239e129e16308e70d853559389de218ac275b515068abc96829d05b948a"
+checksum = "957056ecddbeba1b26965114e191d2e8589ce74db242b6ea25fc4062427a5c19"
 dependencies = [
 "aho-corasick",
 "memchr",
 "regex-syntax",
- "thread_local",
 ]

 [[package]]
 name = "regex-syntax"
-version = "0.6.22"
+version = "0.6.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5eb417147ba9860a96cfe72a0b93bf88fee1744b5636ec99ab20c1aa9376581"
+checksum = "24d5f089152e60f62d28b835fbff2cd2e8dc0baf1ac13343bef92ab7eed84548"

 [[package]]
 name = "ring"
-version = "0.16.19"
+version = "0.16.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "024a1e66fea74c66c66624ee5622a7ff0e4b73a13b4f5c326ddb50c708944226"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
 dependencies = [
 "cc",
 "libc",
@@ -761,18 +758,18 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.123"
+version = "1.0.124"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92d5161132722baa40d802cc70b15262b98258453e85e5d1d365c757c73869ae"
+checksum = "bd761ff957cb2a45fbb9ab3da6512de9de55872866160b23c25f1a841e99d29f"

 [[package]]
 name = "sha-1"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce3cdf1b5e620a498ee6f2a171885ac7e22f0e12089ec4b3d22b84921792507c"
+checksum = "dfebf75d25bd900fd1e7d11501efab59bc846dbc76196839663e6637bba9f25f"
 dependencies = [
 "block-buffer",
- "cfg-if 1.0.0",
+ "cfg-if",
 "cpuid-bool",
 "digest",
 "opaque-debug",
@@ -780,12 +777,12 @@ dependencies = [

 [[package]]
 name = "sha2"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e7aab86fe2149bad8c507606bdb3f4ef5e7b2380eb92350f56122cca72a42a8"
+checksum = "fa827a14b29ab7f44778d14a88d3cb76e949c45083f7dbfa507d0cb699dc12de"
 dependencies = [
 "block-buffer",
- "cfg-if 1.0.0",
+ "cfg-if",
 "cpuid-bool",
 "digest",
 "opaque-debug",
@@ -846,9 +843,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "1.0.60"
+version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c700597eca8a5a762beb35753ef6b94df201c81cca676604f547495a0d7f0081"
+checksum = "3fd9d1e9976102a03c542daa2eff1b43f9d72306342f3f8b3ed5fb8908195d6f"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -869,9 +866,9 @@ dependencies = [

 [[package]]
 name = "tap"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36474e732d1affd3a6ed582781b3683df3d0563714c59c39591e8ff707cf078e"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"

 [[package]]
 name = "termcolor"
@@ -884,33 +881,24 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "1.0.23"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76cc616c6abf8c8928e2fdcc0dbfab37175edd8fb49a4641066ad1364fdab146"
+checksum = "e0f4a65597094d4483ddaed134f409b2cb7c1beccf25201a9f73c719254fa98e"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.23"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9be73a2caec27583d0046ef3796c3794f868a5bc813db689eed00c7631275cd1"
+checksum = "7765189610d8241a44529806d6fd1f2e0a08734313a35d5b3a556f92b381f3c0"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn",
 ]

-[[package]]
-name = "thread_local"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8208a331e1cb318dd5bd76951d2b8fc48ca38a69f5f4e4af1b6a9f8c6236915"
-dependencies = [
- "once_cell",
-]
-
 [[package]]
 name = "time"
 version = "0.1.44"
@@ -924,9 +912,9 @@ dependencies = [

 [[package]]
 name = "typenum"
-version = "1.12.0"
+version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
+checksum = "879f6906492a7cd215bfa4cf595b600146ccfac0c79bcbd1f3000162af5e8b06"

 [[package]]
 name = "unicode-xid"
@@ -942,9 +930,9 @@ checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"

 [[package]]
 name = "version_check"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a972e5669d67ba988ce3dc826706fb0a8b01471c088cb0b6110b805cc36aed"
+checksum = "5fecdca9a5291cc2b8dcf7dc02453fee791a280f3743cb0905f8822ae463b3fe"

 [[package]]
 name = "wasi"
@@ -960,19 +948,19 @@ checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.70"
+version = "0.2.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55c0f7123de74f0dab9b7d00fd614e7b19349cd1e2f5252bbe9b1754b59433be"
+checksum = "8fe8f61dba8e5d645a4d8132dc7a0a66861ed5e1045d2c0ed940fab33bac0fbe"
 dependencies = [
- "cfg-if 1.0.0",
+ "cfg-if",
 "wasm-bindgen-macro",
 ]

 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.70"
+version = "0.2.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bc45447f0d4573f3d65720f636bbcc3dd6ce920ed704670118650bcd47764c7"
+checksum = "046ceba58ff062da072c7cb4ba5b22a37f00a302483f7e2a6cdc18fedbdc1fd3"
 dependencies = [
 "bumpalo",
 "lazy_static",
@@ -985,9 +973,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.70"
+version = "0.2.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b8853882eef39593ad4174dd26fc9865a64e84026d223f63bb2c42affcbba2c"
+checksum = "0ef9aa01d36cda046f797c57959ff5f3c615c9cc63997a8d545831ec7976819b"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -995,9 +983,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.70"
+version = "0.2.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4133b5e7f2a531fa413b3a1695e925038a05a71cf67e87dafa295cb645a01385"
+checksum = "96eb45c1b2ee33545a813a92dbb53856418bf7eb54ab34f7f7ff1448a5b3735d"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1008,15 +996,15 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.70"
+version = "0.2.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd4945e4943ae02d15c13962b38a5b1e81eadd4b71214eee75af64a4d6a4fd64"
+checksum = "b7148f4696fb4960a346eaa60bbfb42a1ac4ebba21f750f75fc1375b098d5ffa"

 [[package]]
 name = "web-sys"
-version = "0.3.47"
+version = "0.3.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c40dc691fc48003eba817c38da7113c15698142da971298003cac3ef175680b3"
+checksum = "59fe19d70f5dacc03f6e46777213facae5ac3801575d56ca6cbd4c93dcd12310"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@@ -1071,9 +1059,9 @@ dependencies = [

 [[package]]
 name = "x509-parser"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b22c80f083d860f8e77f44762e9df8c92de7defeb70219ec37f32968cab53e90"
+checksum = "db7999ae290e75ec1d4dc8e9ff9870e48e3542a8f2e9c1e2e07d7ca02b459e10"
 dependencies = [
 "base64",
 "chrono",
@@ -1082,7 +1070,7 @@ dependencies = [
 "der-parser",
 "lazy_static",
 "nom",
- "num-bigint 0.3.1",
+ "num-bigint 0.3.2",
 "oid-registry",
 "rusticata-macros",
 "rustversion",
@@ -1091,7 +1079,7 @@ dependencies = [

 [[package]]
 name = "yubikey-cli"
-version = "0.1.0"
+version = "0.3.0"
 dependencies = [
 "env_logger",
 "gumdrop",
@@ -1106,7 +1094,7 @@ dependencies = [

 [[package]]
 name = "yubikey-piv"
-version = "0.2.0"
+version = "0.3.0"
 dependencies = [
 "chrono",
 "cookie-factory",
@@ -1,6 +1,6 @@
 [package]
 name    = "yubikey-piv"
-version = "0.2.0" # Also update html_root_url in lib.rs when bumping this
+version = "0.3.0" # Also update html_root_url in lib.rs when bumping this
 description = """
 Pure Rust host-side driver for the YubiKey Personal Identity Verification (PIV)
 application providing general-purpose public-key signing and encryption
@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## 0.3.0 (2021-03-22)
+### Changed
+- Bump `yubikey-piv` dependency to v0.3 ([#240])
+
+[#240]: https://github.com/iqlusioninc/yubikey-piv.rs/pull/240
+
+## 0.2.0 (2021-01-30)
+### Changed
+- Bump MSRV to 1.46+ ([#208])
+- Bump `yubikey-piv` dependency to v0.2 ([#220])
+
+[#208]: https://github.com/iqlusioninc/yubikey-piv.rs/pull/208
+[#220]: https://github.com/iqlusioninc/yubikey-piv.rs/pull/220
+
 ## 0.1.0 (2020-10-19)
 ### Added
 - `status` command ([#72], [#74])
@@ -1,6 +1,6 @@
 [package]
 name = "yubikey-cli"
-version = "0.1.0"
+version = "0.3.0"
 description = """
 Command-line interface for performing encryption and signing using RSA/ECC keys
 stored on YubiKey devices.
@@ -22,4 +22,4 @@ sha2 = "0.9"
 subtle-encoding = "0.5"
 termcolor = "1"
 x509-parser = "0.9"
-yubikey-piv = { version = "0.2", path = ".." }
+yubikey-piv = { version = "0.3", path = ".." }
@@ -32,11 +32,11 @@

 use crate::{
    error::Error,
-    metadata,
+    metadata::{AdminData, ProtectedData},
    mgm::{MgmType, ADMIN_FLAGS_1_PROTECTED_MGM},
    yubikey::{YubiKey, ADMIN_FLAGS_1_PUK_BLOCKED},
-    TAG_ADMIN, TAG_ADMIN_FLAGS_1, TAG_ADMIN_SALT, TAG_ADMIN_TIMESTAMP, TAG_PROTECTED,
-    TAG_PROTECTED_FLAGS_1, TAG_PROTECTED_MGM,
+    TAG_ADMIN_FLAGS_1, TAG_ADMIN_SALT, TAG_ADMIN_TIMESTAMP, TAG_PROTECTED_FLAGS_1,
+    TAG_PROTECTED_MGM,
 };
 use log::error;
 use std::{
@@ -79,8 +79,8 @@ impl Config {

        let txn = yubikey.begin_transaction()?;

-        if let Ok(data) = metadata::read(&txn, TAG_ADMIN) {
-            if let Ok(item) = metadata::get_item(&data, TAG_ADMIN_FLAGS_1) {
+        if let Ok(admin_data) = AdminData::read(&txn) {
+            if let Ok(item) = admin_data.get_item(TAG_ADMIN_FLAGS_1) {
                if item.is_empty() {
                    error!("empty response for admin flags metadata item! ignoring");
                } else {
@@ -94,7 +94,7 @@ impl Config {
                }
            }

-            if metadata::get_item(&data, TAG_ADMIN_SALT).is_ok() {
+            if admin_data.get_item(TAG_ADMIN_SALT).is_ok() {
                if config.mgm_type != MgmType::Manual {
                    error!("conflicting types of MGM key administration configured");
                } else {
@@ -102,7 +102,7 @@ impl Config {
                }
            }

-            if let Ok(item) = metadata::get_item(&data, TAG_ADMIN_TIMESTAMP) {
+            if let Ok(item) = admin_data.get_item(TAG_ADMIN_TIMESTAMP) {
                if item.len() != CB_ADMIN_TIMESTAMP {
                    error!("pin timestamp in admin metadata is an invalid size");
                } else {
@@ -117,10 +117,10 @@ impl Config {
            }
        }

-        if let Ok(data) = metadata::read(&txn, TAG_PROTECTED) {
+        if let Ok(protected_data) = ProtectedData::read(&txn) {
            config.protected_data_available = true;

-            if let Ok(item) = metadata::get_item(&data, TAG_PROTECTED_FLAGS_1) {
+            if let Ok(item) = protected_data.get_item(TAG_PROTECTED_FLAGS_1) {
                if item.is_empty() {
                    error!("empty response for protected flags metadata item! ignoring");
                } else if item[0] & PROTECTED_FLAGS_1_PUK_NOBLOCK != 0 {
@@ -128,7 +128,7 @@ impl Config {
                }
            }

-            if metadata::get_item(&data, TAG_PROTECTED_MGM).is_ok() {
+            if protected_data.get_item(TAG_PROTECTED_MGM).is_ok() {
                if config.mgm_type != MgmType::Protected {
                    error!(
                        "conflicting types of mgm key administration configured: protected MGM exists"
@@ -123,7 +123,7 @@

 #![doc(
    html_logo_url = "https://raw.githubusercontent.com/iqlusioninc/yubikey-piv.rs/main/img/logo.png",
-    html_root_url = "https://docs.rs/yubikey-piv/0.1.0"
+    html_root_url = "https://docs.rs/yubikey-piv/0.3.0"
 )]
 #![forbid(unsafe_code)]
 #![warn(
@@ -178,11 +178,9 @@ pub(crate) const CB_OBJ_TAG_MIN: usize = 2; // 1 byte tag + 1 byte len
 #[cfg(feature = "untested")]
 pub(crate) const CB_OBJ_TAG_MAX: usize = CB_OBJ_TAG_MIN + 2; // 1 byte tag + 3 bytes len

-pub(crate) const TAG_ADMIN: u8 = 0x80;
 pub(crate) const TAG_ADMIN_FLAGS_1: u8 = 0x81;
 pub(crate) const TAG_ADMIN_SALT: u8 = 0x82;
 pub(crate) const TAG_ADMIN_TIMESTAMP: u8 = 0x83;
-pub(crate) const TAG_PROTECTED: u8 = 0x88;
 pub(crate) const TAG_PROTECTED_FLAGS_1: u8 = 0x81;
 pub(crate) const TAG_PROTECTED_MGM: u8 = 0x89;

@@ -30,153 +30,187 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-use crate::{
-    error::Error, serialization::*, transaction::Transaction, Buffer, TAG_ADMIN, TAG_PROTECTED,
-};
+use std::marker::PhantomData;
+use zeroize::Zeroizing;
+
+use crate::{error::Error, serialization::*, transaction::Transaction, Buffer};

 #[cfg(feature = "untested")]
 use crate::{CB_OBJ_MAX, CB_OBJ_TAG_MAX};

 #[cfg(feature = "untested")]
-use zeroize::Zeroizing;
+use std::iter;

+const TAG_ADMIN: u8 = 0x80;
+const TAG_PROTECTED: u8 = 0x88;
 pub const OBJ_ADMIN_DATA: u32 = 0x005f_ff00;
 pub const OBJ_PRINTED: u32 = 0x005f_c109;

-/// Get metadata item
-pub(crate) fn get_item(mut data: &[u8], tag: u8) -> Result<&[u8], Error> {
-    while !data.is_empty() {
-        let (remaining, tlv) = Tlv::parse(data)?;
-        data = remaining;
+pub(crate) trait MetadataType: private::Sealed {}

-        if tlv.tag == tag {
-            // found tag
-            return Ok(tlv.value);
-        }
-    }
+/// A type variable corresponding to PIN-protected metadata.
+pub(crate) enum Protected {}
+impl MetadataType for Protected {}

-    Err(Error::GenericError)
+/// A type variable corresponding to administrative metadata.
+pub(crate) enum Admin {}
+impl MetadataType for Admin {}
+
+/// Metadata stored in a YubiKey.
+pub(crate) struct Metadata<T: MetadataType> {
+    inner: Buffer,
+    _marker: PhantomData<T>,
 }

-/// Set metadata item
-#[cfg(feature = "untested")]
-pub(crate) fn set_item(
-    data: &mut [u8],
-    pcb_data: &mut usize,
-    cb_data_max: usize,
-    tag: u8,
-    p_item: &[u8],
-) -> Result<(), Error> {
-    let mut cb_temp: usize = 0;
-    let mut tag_temp: u8 = 0;
-    let mut cb_len: usize = 0;
-    let cb_item = p_item.len();
+/// PIN-protected metadata stored in a YubiKey.
+pub(crate) type ProtectedData = Metadata<Protected>;
+/// Administrative metadata stored in a YubiKey.
+pub(crate) type AdminData = Metadata<Admin>;

-    let mut offset = 0;
-
-    while offset < *pcb_data {
-        tag_temp = data[offset];
-        offset += 1;
-
-        cb_len = get_length(&data[offset..], &mut cb_temp);
-        offset += cb_len;
-
-        if tag_temp == tag {
-            break;
+impl<T: MetadataType> Default for Metadata<T> {
+    fn default() -> Self {
+        Metadata {
+            inner: Zeroizing::new(vec![]),
+            _marker: PhantomData::default(),
        }
+    }
+}

-        offset += cb_temp;
+impl<T: MetadataType> Metadata<T> {
+    /// Read metadata
+    pub(crate) fn read(txn: &Transaction<'_>) -> Result<Self, Error> {
+        let data = txn.fetch_object(T::obj_id())?;
+        Ok(Metadata {
+            inner: Tlv::parse_single(data, T::tag())?,
+            _marker: PhantomData::default(),
+        })
    }

-    if tag_temp != tag {
-        if cb_item == 0 {
-            // We've been asked to delete an existing item that isn't in the blob
+    /// Write metadata
+    #[cfg(feature = "untested")]
+    pub(crate) fn write(&self, txn: &Transaction<'_>) -> Result<(), Error> {
+        if self.inner.len() > CB_OBJ_MAX - CB_OBJ_TAG_MAX {
+            return Err(Error::GenericError);
+        }
+
+        if self.inner.is_empty() {
+            return Self::delete(txn);
+        }
+
+        let mut buf = Zeroizing::new(vec![0u8; CB_OBJ_MAX]);
+        let len = Tlv::write(&mut buf, T::tag(), &self.inner)?;
+
+        txn.save_object(T::obj_id(), &buf[..len])
+    }
+
+    /// Delete metadata
+    #[cfg(feature = "untested")]
+    pub(crate) fn delete(txn: &Transaction<'_>) -> Result<(), Error> {
+        txn.save_object(T::obj_id(), &[])
+    }
+
+    /// Get metadata item
+    pub(crate) fn get_item(&self, tag: u8) -> Result<&[u8], Error> {
+        let mut data = &self.inner[..];
+
+        while !data.is_empty() {
+            let (remaining, tlv) = Tlv::parse(data)?;
+            data = remaining;
+
+            if tlv.tag == tag {
+                // found tag
+                return Ok(tlv.value);
+            }
+        }
+
+        Err(Error::GenericError)
+    }
+
+    /// Set metadata item
+    #[cfg(feature = "untested")]
+    pub(crate) fn set_item(&mut self, tag: u8, item: &[u8]) -> Result<(), Error> {
+        let mut cb_temp: usize = 0;
+        let mut tag_temp: u8 = 0;
+        let mut cb_len: usize = 0;
+
+        let mut offset = 0;
+
+        while offset < self.inner.len() {
+            tag_temp = self.inner[offset];
+            offset += 1;
+
+            cb_len = get_length(&self.inner[offset..], &mut cb_temp);
+            offset += cb_len;
+
+            if tag_temp == tag {
+                break;
+            }
+
+            offset += cb_temp;
+        }
+
+        if tag_temp != tag {
+            if item.is_empty() {
+                // We've been asked to delete an existing item that isn't in the blob
+                return Ok(());
+            }
+
+            // We did not find an existing tag, append
+            assert_eq!(offset, self.inner.len());
+            self.inner
+                .extend(iter::repeat(0).take(1 + get_length_size(item.len()) + item.len()));
+            Tlv::write(&mut self.inner[offset..], tag, item)?;
+
            return Ok(());
        }

-        // We did not find an existing tag, append
-        *pcb_data += Tlv::write(&mut data[*pcb_data..], tag, p_item)?;
+        // Found tag

-        return Ok(());
-    }
-
-    // Found tag
-
-    // Check length, if it matches, overwrite
-    if cb_temp == cb_item {
-        data[offset..offset + cb_item].copy_from_slice(p_item);
-        return Ok(());
-    }
-
-    // Length doesn't match, expand/shrink to fit
-    let next_offset = offset + cb_temp;
-    // Must be signed to have negative offsets
-    let cb_moved: isize = (cb_item as isize - cb_temp as isize)
-        + if cb_item != 0 {
-            get_length_size(cb_item) as isize
-        } else {
-            // For tag, if deleting
-            -1
+        // Check length, if it matches, overwrite
+        if cb_temp == item.len() {
+            self.inner[offset..offset + item.len()].copy_from_slice(item);
+            return Ok(());
        }
-        // Accounts for different length encoding
-        - cb_len as isize;

-    // If length would cause buffer overflow, return error
-    if (*pcb_data as isize + cb_moved) as usize > cb_data_max {
-        return Err(Error::GenericError);
+        // Length doesn't match, expand/shrink to fit
+        let next_offset = offset + cb_temp;
+        // Must be signed to have negative offsets
+        let cb_moved: isize = (item.len() as isize - cb_temp as isize)
+            + if item.is_empty() {
+                // For tag, if deleting
+                -1
+            } else {
+                get_length_size(item.len()) as isize
+            }
+            // Accounts for different length encoding
+            - cb_len as isize;
+
+        // If length would cause buffer overflow, return error
+        if (self.inner.len() as isize + cb_moved) as usize > CB_OBJ_MAX {
+            return Err(Error::GenericError);
+        }
+
+        // Move remaining data
+        let orig_len = self.inner.len();
+        if cb_moved > 0 {
+            self.inner.extend(iter::repeat(0).take(cb_moved as usize));
+        }
+        self.inner.copy_within(
+            next_offset..orig_len,
+            (next_offset as isize + cb_moved) as usize,
+        );
+        self.inner
+            .resize((orig_len as isize + cb_moved) as usize, 0);
+
+        // Re-encode item and insert
+        if !item.is_empty() {
+            offset -= cb_len;
+            offset += set_length(&mut self.inner[offset..], item.len())?;
+            self.inner[offset..offset + item.len()].copy_from_slice(item);
+        }
+
+        Ok(())
    }
-
-    // Move remaining data
-    data.copy_within(
-        next_offset..*pcb_data,
-        (next_offset as isize + cb_moved) as usize,
-    );
-    *pcb_data = (*pcb_data as isize + cb_moved) as usize;
-
-    // Re-encode item and insert
-    if cb_item != 0 {
-        offset -= cb_len;
-        offset += set_length(&mut data[offset..], cb_item)?;
-        data[offset..offset + cb_item].copy_from_slice(p_item);
-    }
-
-    Ok(())
-}
-
-/// Read metadata
-pub(crate) fn read(txn: &Transaction<'_>, tag: u8) -> Result<Buffer, Error> {
-    let obj_id = match tag {
-        TAG_ADMIN => OBJ_ADMIN_DATA,
-        TAG_PROTECTED => OBJ_PRINTED,
-        _ => return Err(Error::InvalidObject),
-    };
-
-    let data = txn.fetch_object(obj_id)?;
-    Tlv::parse_single(data, tag)
-}
-
-/// Write metadata
-#[cfg(feature = "untested")]
-pub(crate) fn write(txn: &Transaction<'_>, tag: u8, data: &[u8]) -> Result<(), Error> {
-    if data.len() > CB_OBJ_MAX - CB_OBJ_TAG_MAX {
-        return Err(Error::GenericError);
-    }
-
-    let obj_id = match tag {
-        TAG_ADMIN => OBJ_ADMIN_DATA,
-        TAG_PROTECTED => OBJ_PRINTED,
-        _ => return Err(Error::InvalidObject),
-    };
-
-    if data.is_empty() {
-        // Deleting metadata
-        return txn.save_object(obj_id, &[]);
-    }
-
-    let mut buf = Zeroizing::new(vec![0u8; CB_OBJ_MAX]);
-    let len = Tlv::write(&mut buf, tag, data)?;
-
-    txn.save_object(obj_id, &buf[..len])
 }

 /// Get the size of a length tag for the given length
@@ -190,3 +224,27 @@ fn get_length_size(length: usize) -> usize {
        3
    }
 }
+
+mod private {
+    use super::*;
+    pub trait Sealed {
+        fn tag() -> u8;
+        fn obj_id() -> u32;
+    }
+    impl Sealed for Protected {
+        fn tag() -> u8 {
+            TAG_PROTECTED
+        }
+        fn obj_id() -> u32 {
+            OBJ_PRINTED
+        }
+    }
+    impl Sealed for Admin {
+        fn tag() -> u8 {
+            TAG_ADMIN
+        }
+        fn obj_id() -> u32 {
+            OBJ_ADMIN_DATA
+        }
+    }
+}
@@ -38,8 +38,9 @@ use zeroize::{Zeroize, Zeroizing};

 #[cfg(feature = "untested")]
 use crate::{
-    metadata, yubikey::YubiKey, CB_BUF_MAX, CB_OBJ_MAX, TAG_ADMIN, TAG_ADMIN_FLAGS_1,
-    TAG_ADMIN_SALT, TAG_PROTECTED, TAG_PROTECTED_MGM,
+    metadata::{AdminData, ProtectedData},
+    yubikey::YubiKey,
+    TAG_ADMIN_FLAGS_1, TAG_ADMIN_SALT, TAG_PROTECTED_MGM,
 };
 use des::{
    cipher::{generic_array::GenericArray, BlockCipher, NewBlockCipher},
@@ -135,8 +136,8 @@ impl MgmKey {
        let txn = yubikey.begin_transaction()?;

        // recover management key
-        let data = metadata::read(&txn, TAG_ADMIN)?;
-        let salt = metadata::get_item(&data, TAG_ADMIN_SALT)?;
+        let admin_data = AdminData::read(&txn)?;
+        let salt = admin_data.get_item(TAG_ADMIN_SALT)?;

        if salt.len() != CB_ADMIN_SALT {
            error!(
@@ -159,12 +160,12 @@ impl MgmKey {
    pub fn get_protected(yubikey: &mut YubiKey) -> Result<Self, Error> {
        let txn = yubikey.begin_transaction()?;

-        let data = metadata::read(&txn, TAG_PROTECTED).map_err(|e| {
+        let protected_data = ProtectedData::read(&txn).map_err(|e| {
            error!("could not read protected data (err: {:?})", e);
            e
        })?;

-        let item = metadata::get_item(&data, TAG_PROTECTED_MGM).map_err(|e| {
+        let item = protected_data.get_item(TAG_PROTECTED_MGM).map_err(|e| {
            error!("could not read protected MGM from metadata (err: {:?})", e);
            e
        })?;
@@ -182,21 +183,84 @@ impl MgmKey {
        MgmKey::from_bytes(item)
    }

-    /// Set the management key (MGM)
+    /// Resets the management key for the given YubiKey to the default value.
+    ///
+    /// This will wipe any metadata related to derived and PIN-protected management keys.
    #[cfg(feature = "untested")]
-    pub fn set(&self, yubikey: &mut YubiKey, touch: Option<u8>) -> Result<(), Error> {
-        let txn = yubikey.begin_transaction()?;
-        txn.set_mgm_key(&self, touch)
+    pub fn set_default(yubikey: &mut YubiKey) -> Result<(), Error> {
+        MgmKey::default().set_manual(yubikey, false)
    }

-    /// Set protected management key (MGM)
+    /// Configures the given YubiKey to use this management key.
+    ///
+    /// The management key must be stored by the user, and provided when performing key
+    /// management operations.
+    ///
+    /// This will wipe any metadata related to derived and PIN-protected management keys.
    #[cfg(feature = "untested")]
-    pub fn set_protected(&self, yubikey: &mut YubiKey) -> Result<(), Error> {
-        let mut data = Zeroizing::new(vec![0u8; CB_BUF_MAX]);
-
+    pub fn set_manual(&self, yubikey: &mut YubiKey, require_touch: bool) -> Result<(), Error> {
        let txn = yubikey.begin_transaction()?;

-        txn.set_mgm_key(self, None).map_err(|e| {
+        txn.set_mgm_key(&self, require_touch).map_err(|e| {
+            // Log a warning, since the device mgm key is corrupt or we're in a state
+            // where we can't set the mgm key.
+            error!("could not set new derived mgm key, err = {}", e);
+            e
+        })?;
+
+        // After this point, we've set the mgm key, so the function should succeed,
+        // regardless of being able to set the metadata.
+
+        if let Ok(mut admin_data) = AdminData::read(&txn) {
+            // Clear the protected mgm key bit.
+            if let Ok(item) = admin_data.get_item(TAG_ADMIN_FLAGS_1) {
+                let mut flags_1 = [0u8; 1];
+                if item.len() == flags_1.len() {
+                    flags_1.copy_from_slice(item);
+                    flags_1[0] &= !ADMIN_FLAGS_1_PROTECTED_MGM;
+
+                    if let Err(e) = admin_data.set_item(TAG_ADMIN_FLAGS_1, &flags_1) {
+                        error!("could not set admin flags item, err = {}", e);
+                    }
+                } else {
+                    error!(
+                        "admin data flags are an incorrect size: {} (expected {})",
+                        item.len(),
+                        flags_1.len()
+                    );
+                }
+            }
+
+            // Remove any existing salt for a derived mgm key.
+            if let Err(e) = admin_data.set_item(TAG_ADMIN_SALT, &[]) {
+                error!("could not unset derived mgm salt (err = {})", e)
+            }
+
+            if let Err(e) = admin_data.write(&txn) {
+                error!("could not write admin data, err = {}", e);
+            }
+        }
+
+        // Clear any prior mgm key from protected data.
+        if let Ok(mut protected_data) = ProtectedData::read(&txn) {
+            if let Err(e) = protected_data.set_item(TAG_PROTECTED_MGM, &[]) {
+                error!("could not clear protected mgm item, err = {:?}", e);
+            } else if let Err(e) = protected_data.write(&txn) {
+                error!("could not write protected data, err = {:?}", e);
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Configures the given YubiKey to use this as a PIN-protected management key.
+    ///
+    /// This enables key management operations to be performed with access to the PIN.
+    #[cfg(feature = "untested")]
+    pub fn set_protected(&self, yubikey: &mut YubiKey) -> Result<(), Error> {
+        let txn = yubikey.begin_transaction()?;
+
+        txn.set_mgm_key(self, false).map_err(|e| {
            // log a warning, since the device mgm key is corrupt or we're in
            // a state where we can't set the mgm key
            error!("could not set new derived mgm key, err = {}", e);
@@ -206,39 +270,25 @@ impl MgmKey {
        // after this point, we've set the mgm key, so the function should
        // succeed, regardless of being able to set the metadata

-        // set the new mgm key in protected data
-        let buffer = match metadata::read(&txn, TAG_PROTECTED) {
-            Ok(b) => b,
-            Err(_) => {
-                // set current metadata blob size to zero, we'll add to the blank blob
-                Zeroizing::new(vec![])
-            }
-        };
-        let mut cb_data = buffer.len();
-        data[..cb_data].copy_from_slice(&buffer);
+        // Fetch the current protected data, or start a blank metadata blob.
+        let mut protected_data = ProtectedData::read(&txn).unwrap_or_default();

-        if let Err(e) = metadata::set_item(
-            data.as_mut_slice(),
-            &mut cb_data,
-            CB_OBJ_MAX,
-            TAG_PROTECTED_MGM,
-            self.as_ref(),
-        ) {
+        // Set the new mgm key in protected data.
+        if let Err(e) = protected_data.set_item(TAG_PROTECTED_MGM, self.as_ref()) {
            error!("could not set protected mgm item, err = {:?}", e);
        } else {
-            metadata::write(&txn, TAG_PROTECTED, &data).map_err(|e| {
+            protected_data.write(&txn).map_err(|e| {
                error!("could not write protected data, err = {:?}", e);
                e
            })?;
        }

        // set the protected mgm flag in admin data
-        cb_data = data.len();

        let mut flags_1 = [0u8; 1];

-        if let Ok(buffer) = metadata::read(&txn, TAG_ADMIN) {
-            if let Ok(item) = metadata::get_item(&buffer, TAG_ADMIN_FLAGS_1) {
+        let mut admin_data = if let Ok(mut admin_data) = AdminData::read(&txn) {
+            if let Ok(item) = admin_data.get_item(TAG_ADMIN_FLAGS_1) {
                if item.len() == flags_1.len() {
                    flags_1.copy_from_slice(item);
                } else {
@@ -254,26 +304,20 @@ impl MgmKey {
            }

            // remove any existing salt
-            if let Err(e) =
-                metadata::set_item(&mut data, &mut cb_data, CB_OBJ_MAX, TAG_ADMIN_SALT, &[])
-            {
+            if let Err(e) = admin_data.set_item(TAG_ADMIN_SALT, &[]) {
                error!("could not unset derived mgm salt (err = {})", e)
            }
+
+            admin_data
        } else {
-            cb_data = 0;
-        }
+            AdminData::default()
+        };

        flags_1[0] |= ADMIN_FLAGS_1_PROTECTED_MGM;

-        if let Err(e) = metadata::set_item(
-            data.as_mut_slice(),
-            &mut cb_data,
-            CB_OBJ_MAX,
-            TAG_ADMIN_FLAGS_1,
-            &flags_1,
-        ) {
+        if let Err(e) = admin_data.set_item(TAG_ADMIN_FLAGS_1, &flags_1) {
            error!("could not set admin flags item, err = {}", e);
-        } else if let Err(e) = metadata::write(&txn, TAG_ADMIN, &data[..cb_data]) {
+        } else if let Err(e) = admin_data.write(&txn) {
            error!("could not write admin data, err = {}", e);
        }

@@ -229,14 +229,8 @@ impl<'tx> Transaction<'tx> {

    /// Set the management key (MGM).
    #[cfg(feature = "untested")]
-    pub fn set_mgm_key(&self, new_key: &MgmKey, touch: Option<u8>) -> Result<(), Error> {
-        let p2 = match touch.unwrap_or_default() {
-            0 => 0xff,
-            1 => 0xfe,
-            _ => {
-                return Err(Error::GenericError);
-            }
-        };
+    pub fn set_mgm_key(&self, new_key: &MgmKey, require_touch: bool) -> Result<(), Error> {
+        let p2 = if require_touch { 0xfe } else { 0xff };

        let mut data = [0u8; DES_LEN_3DES + 3];
        data[0] = ALGO_3DES;
@@ -50,8 +50,8 @@ use std::{

 #[cfg(feature = "untested")]
 use crate::{
-    apdu::StatusWords, metadata, transaction::ChangeRefAction, Buffer, ObjectId, CB_BUF_MAX,
-    CB_OBJ_MAX, MGMT_AID, TAG_ADMIN, TAG_ADMIN_FLAGS_1, TAG_ADMIN_TIMESTAMP,
+    apdu::StatusWords, metadata::AdminData, transaction::ChangeRefAction, Buffer, ObjectId,
+    MGMT_AID, TAG_ADMIN_FLAGS_1, TAG_ADMIN_TIMESTAMP,
 };
 use getrandom::getrandom;
 #[cfg(feature = "untested")]
@@ -417,12 +417,9 @@ impl YubiKey {
    /// Set PIN last changed
    #[cfg(feature = "untested")]
    pub fn set_pin_last_changed(yubikey: &mut YubiKey) -> Result<(), Error> {
-        let mut data = [0u8; CB_BUF_MAX];
        let txn = yubikey.begin_transaction()?;

-        let buffer = metadata::read(&txn, TAG_ADMIN)?;
-        let mut cb_data = buffer.len();
-        data[..cb_data].copy_from_slice(&buffer);
+        let mut admin_data = AdminData::read(&txn)?;

        // TODO(tarcieri): double check this is little endian
        let tnow = SystemTime::now()
@@ -431,19 +428,14 @@ impl YubiKey {
            .as_secs()
            .to_le_bytes();

-        metadata::set_item(
-            &mut data,
-            &mut cb_data,
-            CB_OBJ_MAX,
-            TAG_ADMIN_TIMESTAMP,
-            &tnow,
-        )
-        .map_err(|e| {
-            error!("could not set pin timestamp, err = {}", e);
-            e
-        })?;
+        admin_data
+            .set_item(TAG_ADMIN_TIMESTAMP, &tnow)
+            .map_err(|e| {
+                error!("could not set pin timestamp, err = {}", e);
+                e
+            })?;

-        metadata::write(&txn, TAG_ADMIN, &data).map_err(|e| {
+        admin_data.write(&txn).map_err(|e| {
            error!("could not write admin data, err = {}", e);
            e
        })?;
@@ -494,8 +486,10 @@ impl YubiKey {
            }
        }

-        if let Ok(data) = metadata::read(&txn, TAG_ADMIN) {
-            if let Ok(item) = metadata::get_item(&data, TAG_ADMIN_FLAGS_1) {
+        // Attempt to set the "PUK blocked" flag in admin data.
+
+        let mut admin_data = if let Ok(admin_data) = AdminData::read(&txn) {
+            if let Ok(item) = admin_data.get_item(TAG_ADMIN_FLAGS_1) {
                if item.len() == flags.len() {
                    flags.copy_from_slice(item)
                } else {
@@ -506,22 +500,16 @@ impl YubiKey {
                    );
                }
            }
-        }
+
+            admin_data
+        } else {
+            AdminData::default()
+        };

        flags[0] |= ADMIN_FLAGS_1_PUK_BLOCKED;
-        let mut data = [0u8; CB_BUF_MAX];
-        let mut cb_data: usize = data.len();

-        if metadata::set_item(
-            &mut data,
-            &mut cb_data,
-            CB_OBJ_MAX,
-            TAG_ADMIN_FLAGS_1,
-            &flags,
-        )
-        .is_ok()
-        {
-            if metadata::write(&txn, TAG_ADMIN, &data[..cb_data]).is_err() {
+        if admin_data.set_item(TAG_ADMIN_FLAGS_1, &flags).is_ok() {
+            if admin_data.write(&txn).is_err() {
                error!("could not write admin metadata");
            }
        } else {
@@ -107,6 +107,45 @@ fn test_verify_pin() {
    assert!(yubikey.verify_pin(b"123456").is_ok());
 }

+//
+// Management key support
+//
+
+#[cfg(feature = "untested")]
+#[test]
+#[ignore]
+fn test_set_mgmkey() {
+    let mut yubikey = YUBIKEY.lock().unwrap();
+
+    assert!(yubikey.verify_pin(b"123456").is_ok());
+    assert!(MgmKey::get_protected(&mut yubikey).is_err());
+    assert!(yubikey.authenticate(MgmKey::default()).is_ok());
+
+    // Set a protected management key.
+    assert!(MgmKey::generate()
+        .unwrap()
+        .set_protected(&mut yubikey)
+        .is_ok());
+    let protected = MgmKey::get_protected(&mut yubikey).unwrap();
+    assert!(yubikey.authenticate(MgmKey::default()).is_err());
+    assert!(yubikey.authenticate(protected.clone()).is_ok());
+
+    // Set a manual management key.
+    let manual = MgmKey::generate().unwrap();
+    assert!(manual.set_manual(&mut yubikey, false).is_ok());
+    assert!(MgmKey::get_protected(&mut yubikey).is_err());
+    assert!(yubikey.authenticate(MgmKey::default()).is_err());
+    assert!(yubikey.authenticate(protected.clone()).is_err());
+    assert!(yubikey.authenticate(manual.clone()).is_ok());
+
+    // Set back to the default management key.
+    assert!(MgmKey::set_default(&mut yubikey).is_ok());
+    assert!(MgmKey::get_protected(&mut yubikey).is_err());
+    assert!(yubikey.authenticate(protected).is_err());
+    assert!(yubikey.authenticate(manual).is_err());
+    assert!(yubikey.authenticate(MgmKey::default()).is_ok());
+}
+
 //
 // Certificate support
 //
Author	SHA1	Message	Date
Tony Arcieri (iqlusion)	e61682be43	yubikey-cli v0.3.0 (#241 )	2021-03-22 10:23:15 -07:00
Tony Arcieri (iqlusion)	43dfc06875	yubikey-piv v0.3.0 (#240 )	2021-03-22 09:45:19 -07:00
Tony Arcieri (iqlusion)	e230390e7e	Cargo.lock: bump dependencies (#238 )	2021-03-22 09:27:28 -07:00
Tony Arcieri (iqlusion)	ef3df46ed2	Cargo.lock: bump deps (#227 )	2021-02-03 06:13:01 -08:00
str4d	18e3636161	Replace MgmKey::set with MgmKey::{set_default, set_manual} (#224 ) * Add MgmKey::set_default method This wipes any metadata related to derived and PIN-protected management keys, returning the management key to its default state. * Transaction::set_mgm_key: Take touch requirement as bool The Option<u8> was inherited from the original C code's usage of an unsigned char. We don't need that flexibility, because only two cases are supported. * Replace MgmKey::set with MgmKey::set_manual MgmKey::set_default is now implemented as a wrapper around MgmKey::set_manual, as they both require clearing metadata related to derived and PIN-protected management keys.	2021-02-01 09:27:04 -08:00
str4d	9d1da84233	Create typed structs for PIN-protected and admin metadata (#223 ) MgmKey::set_protected and YubiKey::set_pin_last_changed both contained bugs resulting from the conversion of C pointer logic (incorrect buffer management). The new Metadata struct holds its own buffer, avoiding the problem. Also adds a protected management key integration test.	2021-01-31 09:54:13 -08:00
Tony Arcieri (iqlusion)	37088bba56	yubikey-cli v0.2.0 (#222 )	2021-01-30 12:23:09 -08:00