Changes in Version 2.1 & pynitrokey

Nitrokey / nitrokey-fido2-firmware

FIDO2 USB token optimized for security, extensibility, and style. A fork of Solo key.

https://www.nitrokey.com/

Other

53 stars 6 forks source link

Closed daringer closed 4 years ago

daringer commented 4 years ago

The 2.1. firmware version leads to some changes:

fido2 challenge-response & fido2 make-credential require the pin to be provided, so added them as options or asking the user to provide it during execution.
fido2 reboot fails with: fido2.ctap.CtapError: CTAP error: 0x01 - INVALID_COMMAND
fido2 reset fails with: fido2.ctap.CtapError: CTAP error: 0x30 - NOT_ALLOWED

but apart from this, don't see other problems

szszszsz commented 4 years ago

Hi!

Sorry, the documentation for the changes is in progress, but you have found the biggest differences already I believe.

Reboot command AFAIR was removed from the production firmware, hence the INVALID_COMMAND.
FIDO2 reset does work only in the first 10 seconds of the device's power cycle - otherwise the NOT_ALLOWED error is shown. This error has to be handled properly in the client.

jans23 commented 4 years ago

Why was the reboot command removed?

szszszsz commented 4 years ago

Why was the reboot command removed?

I have just checked, and the reboot command works after user confirmation by a touch button. Sorry for confusion.

daringer commented 4 years ago

Good outcome I would say:

fido2 reboot needs a confirmation by the touch button, will add this as a hint to the user on command execution
fido2 reset also works fine the first 10secs after plugging the key in, will guide the user here, too

will be part of the upcoming 0.4.1 release

daringer commented 4 years ago

release done, issue(s) fixed, closing...