Klas Lindfors
38 lines
1.3 KiB
Plaintext
38 lines
1.3 KiB
Plaintext
Using Attestation
|
|
-----------------
|
|
|
|
== Introduction
|
|
This feature is only available in YubiKey 4.3 and newer.
|
|
|
|
A high level description of the thinking and how this can be used can be found
|
|
at https://developers.yubico.com/PIV/Introduction/PIV_attestation.html
|
|
|
|
== Usage
|
|
Attestation works through a special key slot called “f9” this comes
|
|
pre-loaded from factory with a key and cert signed by Yubico, but can be
|
|
overwritten.
|
|
After a key has been generated in a normal slot it can be attested by this
|
|
special key, this can be realised by using the yubico-piv-tool action attest:
|
|
|
|
$ yubico-piv-tool --action=generate --slot=9a
|
|
...
|
|
$ yubico-piv-tool --action=attest --slot=9a
|
|
|
|
The output of this is a PEM encoded certificate, signed by the key in slot f9.
|
|
|
|
== Verifying
|
|
To verify an attestation step 1 is to build the certificate chain. Put the
|
|
attestation root certificate in a file (or if you trust several put all
|
|
of them in said file). The Yubico root certificate can be found at
|
|
https://developers.yubico.com/PIV/Introduction/piv-attestation-ca.pem
|
|
|
|
Then add the keys attestation certificate to that file:
|
|
|
|
$ yubico-piv-tool --action=read-certificate --slot=f9 > certs.pem
|
|
|
|
Now we're ready to verify the attestation:
|
|
|
|
$ yubico-piv-tool --action=attest --slot=f9 > attestation.pem
|
|
$ openssl verify -CAfile certs.pem attestation.pem
|
|
attestation.pem: OK
|