search

Nitrokey / nitrokey-pro-firmware

Firmware for the Nitrokey Pro device
GNU General Public License v3.0
119 stars 22 forks source link

Support longer PINs #32

Open jans23 opened 7 years ago

jans23 commented 7 years ago

The firmware (and NK App) support max of 20 character long PINs while the OpenPGP Card supports 32 characters. The firmware and App should be changed to support entire 32 characters.

tlaurion commented 2 years ago

@szszszsz Was this corrected in newer firmware versions? Seems like this is present to firmware 0.9 0.10 and 0.11 and impacts https://github.com/osresearch/heads/issues/1167 which doesn't report any error when setting the PIN, but fails at HOTP sealing with Admin PIN.

I didn't meet this limitation in my tests with "Insurgo Open Technologies" which is 25 chars. But 26 chars+ < 32 fails...

tlaurion commented 2 years ago

@szszszsz @jans23: the firmware (0.9, 0.10, 0.11) permits longer PINs to be provisioned (up to 64?) But HOTP sealing (Heads) only works when provided with GPG Admin PIN <=25 chars.

https://github.com/osresearch/heads/pull/1168 circumvents this firmware issue under Heads OEM Factory Reset/Re-Ownership security components provisioning (forcing GPG Admin PIN <=25 chars and GPG User PIN <=64 chars) for all USB Security dongles, also limiting custom passphrase (which is propagated to all security components, including GPG Admin PIN) to be <=25 characters as well to circumvent this issue.

Whatever happens with this issue won't make us go back in time for Nitrokey Pro devices which aren't user upgradeable, so fixing this results in some kind of limitation for all USB Security dongles to be provisioned/used under Heads.

As of now, Heads master only limited the minimum size of the PIN to be 8 chars, not enforcing this known limitation (which is not 20 chars, but 25. Why 25, not 20, is another topic).

szszszsz commented 2 years ago

Hi @tlaurion! Sorry for the delay.

  1. Indeed the protocol used is limited to 20-25 characters for the PIN length, depending on the command. Thank you for adding this check.
  2. This problem is still present in the current Nitrokey Pro firmware unfortunately.
  3. As for the solution we could:
    • fix this problem in the current Nitrokey Pro firmware,
    • add support to the nitrokey-hotp-verification for this change (selecting protocol by the firmware version), and
    • leave the check from the mentioned PR only for the non-upgradable older versions, which are <= 0.10.
tlaurion commented 2 years ago

@szszszsz So Heads now makes sure that PINs are <= 25 characters