search

Yubico / yubikey-manager

Python library and command line tool for configuring any YubiKey over all USB interfaces.
https://developers.yubico.com/yubikey-manager/
BSD 2-Clause "Simplified" License
861 stars 125 forks source link

Error: Unable to export public key from slot AUTHENTICATION #540

Closed kmille closed 1 year ago

kmille commented 1 year ago

Steps to reproduce I really have troubles importing and using an existing rsa-2048-ssh-key (used as PIV):

kmille@linbox:tmp ykman piv reset
WARNING! This will delete all stored PIV data and restore factory settings. Proceed? [y/N]: y
Resetting PIV data...
Success! All PIV data have been cleared from the YubiKey.
Your YubiKey now has the default PIN, PUK and Management Key:
        PIN:    123456
        PUK:    12345678
        Management Key: 010203040506070801020304050607080102030405060708

kmille@linbox:tmp cat test
-----BEGIN RSA PRIVATE KEY-----
MIIEoAIBAAKCAQEA05aJbFQQqkQtUap47lVIzClYsJVWQKRlrnwVupwY9UrFWjKy
y4Ukgv9PD+PXg7U8I70fbLnqnEgpITuiWHwq+YYzpbb7mvnh0i2EPp5axQjKrQnD
r/PP+6HkRd/tuRS/92NhM67I8SOthODhpdlhgBCE1DBenaacFKdhw2GSROkIvj16
++EAgSrRZ4N/96dDjQogyelqE4BUsIZGK9PCjhojD92JBqK1eloNuEcULk9O73BB
MaGKOW0jiVwUSUDkcK9ShAbc2EgU5WxncoK4XmliMfxxnCpGe05GJL9p5+U0srXS
7kusZzRj1ppyyEjjx+S1CNJQYT5xdz4ipaiUNQIDAQABAoH/FZHy1OsmbWxnvuGJ
BBhYU4byl8KXmf9uuJw+E0+aStDC/W8AhOwh6t6AlUFAlB2ui1+UM+rAI0KXXT9m
xfjdi9PNPeVkk9ZtIAAaeziuir0AWt/WJ0wOFRGAENa+PTQXiwe0s+Vy+yJInUhF
pJ2swVJrRzZv7Fco8Zy/Wq44XkFSIzPSd/gSrtxdiVm4/8+pYWjhPNQEz9zYpZnV
HXnPDFhbfPP/Pk87Dnv6MlDow1AiNhi5Em+GI/lmqXclFPp66y8i5QjZNbKkSyV0
GjI6ZRy1rAeR1PI0d8WDQVtzuL6Om+M7sElhlRNBcO+j+cOBG5ZlXCS8mnvsoP6i
mvOBAoGBAOycIMaql1buAxsbB7qbpry0MLn8dGzJTb8U/DPJabyUZx906xr1cmV6
6f7SONAHfqW5drJ1oaCDCPNvYu2it/x6Kd+r26Zxq80113ROAIB0DszwHDu93+Kh
lxGAS/4O1ulkTutcr3jnorXBrB+gpLNSOWVrarJfUr0DW1fFKflhAoGBAOTteNg9
y1604vUkYS/Avjol2oCSxfLHatRPy8PPtu9VFoM4sdq7q1+j/RfMrKz4NIlVLucY
HK/wA4QRFu9GHmpqI5Y7FbCjamHtq28Roiy7Kdt2P71JXRIV9I8peiOGWRJfASsy
TjJ5vu4QvgQzcqqzRynbC+LYhKDhWcJMmydVAoGAZ1li76P/6taXwLUz0Qy/7dj/
F53v9LyRGw+9gZlOeDKSQKk/ME1ZpH3ly4pjimpbpWO3Nwguiv/xXvOeUJIsrzll
JO/aR3+LPV1xOLoBeho3hMi0bFvpeQKADALwLo6ozNUlq6SWeMckySNJXZ87kaAu
teAPgM4mQ609rr7OMMECgYALKRSaHjEa9eCWqOZgCJp9hTjoyb8CvfwUS6uYaTj2
5AQL86igDEQnjnwZO+4zJIqTI2b89yz22tGhD6A5nAaBk5kWitzc1qqqCYcxDAAH
BDzfKR2kYb460n0wuYntz2/qOF17OKGdTlgjjQdmdwehEMpoXPhwX7Pfj/zrPwbV
XQKBgG4pziC34g2NelyMKWt75ASPl8fXgSX6FFRi1aYNrOvi8RVbiOxILy7rCv4X
5xbY11iTcYiWkBcJ1PpVT02V7BmBxLNJ3fE9LXQzn7/2vZDzQXpFnAqsCinKo5qx
gsCCyx9dKOe2CXCx4TsJqp6I1qZxiaWr9Bhq3v+M9iWFue3f
-----END RSA PRIVATE KEY-----

kmille@linbox:tmp ykman piv keys import 9a test      
Enter a management key [blank to use default key]: 
kmille@linbox:tmp ykman piv keys export 9a pubkey.pem
Error: Unable to export public key from slot AUTHENTICATION
kmille@linbox:tmp

I need pubkey.pem for doing ykman piv certificates generate --subject "CN=demo" 9a pubkey.pem

dainnilsson commented 1 year ago

Exporting a public key from the YubiKey itself is only supported on YubiKey 5.3 and later. Since you have the RSA private key in pem format you can probably use that to export the public key: openssl rsa -in privkey.pem -pubout > pubkey.pem

kmille commented 1 year ago

Why can't we tell this to the the user instead of just saying "Unable to export public key"? In addition, exporting a public key from the Yubikey works If I generated the private key on the Yubikey previously:

kmille@linbox:~ ykman piv keys generate 9a pubkey.pem
Enter a management key [blank to use default key]: 
kmille@linbox:~ ykman piv keys export 9a pubkey.pem
kmille@linbox:~ head -n 1 pubkey.pem             
-----BEGIN PUBLIC KEY-----

Sorry to say but the tooling around the Yubikey is really annoying sometimes. Even if an operation works, it would be nice to tell the user.

dainnilsson commented 1 year ago

When generating a private key on the YubiKey the public key is always returned/exported, but you cannot export it from the YubiKey after that, unless you have firmware 5.3 or later. The export command will attempt to use several different mechanisms to export the public key. On >= 5.3 it will simply export the key. Otherwise it can export the certificate and pull the public key from that (requires a certificate with the correct public key to be stored on the corresponding slot of the YubiKey). This is explained in the --help output of the command:


Usage: ykman.exe piv keys export [OPTIONS] SLOT PUBLIC-KEY

  Export a public key corresponding to a stored private key.

  This command uses several different mechanisms for exporting the public key corresponding to a stored private key,
  which may fail. If a certificate is stored in the slot it is assumed to contain the correct public key. If this is
  not the case, the wrong public key will be returned.

  The --verify flag can be used to verify that the public key being returned matches the private key, by using the
  slot to create and verify a signature. This may require the PIN to be provided.

  SLOT        PIV slot of the private key
  PUBLIC-KEY  file to write the public key to (use '-' to use stdout)

Options:
  -F, --format [PEM|DER]  encoding format  [default: PEM]
  -v, --verify            verify that the public key matches the private key in the slot
  -P, --pin TEXT          PIN code (used for --verify)
  -h, --help              show this message and exit```
kmille commented 1 year ago

Finally, it worked with these commands:

kmille@linbox:~ ssh-keygen -f test -b 2048 -P ''
Generating public/private rsa key pair.
Your identification has been saved in test
Your public key has been saved in test.pub
The key fingerprint is:
SHA256:Al3v269+p7kW3JsGO/ZGmKuUDjRQK6H/A9tHRsrvuus kmille@linbox
The key's randomart image is:
+---[RSA 2048]----+
|       ...       |
|     ...o..      |
|    ...o ...     |
|     .. +.o      |
|      .oS=.o .o. |
|       .* =o.+o..|
|       . =.=. =.o|
|          B  *o*.|
|        .E+==+X= |
+----[SHA256]-----+
kmille@linbox:~ ssh-keygen -p -m pem -f test
Key has comment 'kmille@linbox'
Enter new passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved with the new passphrase.
kmille@linbox:~ ykman piv keys import 9a test
Enter a management key [blank to use default key]: 
kmille@linbox:~ openssl rsa -in test -pubout  | tee testpub.pem
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApd42z1KA+tQW8C+CaLeh
YRFRjuZRJ+Wuh5vA0cV7iMyWFWcGzAQXh3nYooSqBoh/hke4V+TaSr60afaxb5Bk
1NXYTVfn1a1XlqIDlB/y4qDVr6qEymW7S5ZF6T8YmF+kdtTjbl8U7W/SnFzZcel5
yTd0ba+IliPA+3OWQZi/gZ7BEdySYxcd+Cv5fHdXnkJrt4BLgM+9MgV1bNfoN2YT
6nyCOvejFBdUkemkD+7IuePZuuEw/cUruQOTCuwEe+dTw736JPjUcCj33xXjvgqK
/gVjDLkVlRcUU3m52DgEvociOrIAEjonBCT1LTXFCkivp2DOY9cN8vP+XO4hCc9I
4QIDAQAB
-----END PUBLIC KEY-----
kmille@linbox:~ ykman piv certificates generate --subject "CN=yubico" 9a testpub.pem
Enter a management key [blank to use default key]: 
Enter PIN: 
kmille@linbox:~