Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

reset device only works if PIN is blocked #157

Open
colemickens opened this issue Aug 8, 2020 · 2 comments
Open

reset device only works if PIN is blocked #157

colemickens opened this issue Aug 8, 2020 · 2 comments

Comments

@colemickens
Copy link

Per Yubico docs on the RESET command: https://developers.yubico.com/PIV/Introduction/Yubico_extensions.html

Do you want to have a force_reset_device that does something like this?

    let mut rng = rand::thread_rng();
    loop {
        let b: [u8; 8] = rand::Rng::gen(&mut rng);
        let v = yk.verify_pin(&b);
        if v.is_err() {
            if yk.get_pin_retries().unwrap() <= 0 {
                break;
            }
        }
    }
    ykpiv::yubikey::YubiKey::block_puk(&mut yk).unwrap();
    yk.reset_device().unwrap();
@tarcieri
Copy link
Collaborator

Some precedent for this in block_puk:

https://github.com/iqlusioninc/yubikey-piv.rs/blob/aaaf3b142e5556bbac7950d5f96befbe27efa132/src/yubikey.rs#L469

It sounds like a good feature, although I'd prefer a deterministic counter-based method like the one used in block_puk to one based on an RNG.

@colemickens
Copy link
Author

Oh yeah, I had added that when I was making a different mistake and thought the PIN needed to change for it to count against retries, but that's obviously not the case. I can send a simpler version like you describe.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants