Open lacombar opened 7 months ago
You can see in the output: serial: None
. This is because the Security Key series does not have serial numbers.
how can ykman
be used with multiple keys with no serial numbers ?
ERROR: Multiple YubiKeys detected. Use --device SERIAL to specify which one to use.
Also, currently ykman list -s
does not output anything if the key has no serial number, at least, it should emit a message about a given key having no serial number.
~/% ykman list -s
~/%
ykman list
will list all keys, including those without serial number. ykman list -s
does what the --help output states: "output only serial numbers, one per line (devices without serial will be omitted)".
ykman commands that act on a single device use the serial number of the YubiKey to determine which device target, and cannot be used on devices without a serial number, if more than one is present. If you need to perform some action on multiple keys (batch programming, etc) then scripting can be used to iterate over connected devices.
1) Just because something behave as documented does not imply the behavior is providing a very good UX. In this case, it's rather poor to have no output at all.
2) Can serial number be programmed into a key ? [I'd assume not]
3) if not, how can I reasonably expect prior to purchasing whether a key will have a serial number or not ? So far, out of 3 keys, only 1 has a serial number.
4) even if using HID device node is not stable, why not at least provide this method to be able to use ykman
as a backup identification with the key without having to resort to invoke the Python gods ?
- Just because something behave as documented does not imply the behavior is providing a very good UX. In this case, it's rather poor to have no output at all.
It looks like you're trying to use the command for something it was not intended to do, so I fully understand that you find the UX poor for that task.
- Can serial number be programmed into a key ? [I'd assume not]
No, devices which do not have serial numbers cannot have them programmed later.
- if not, how can I reasonably expect prior to purchasing whether a key will have a serial number or not ? So far, out of 3 keys, only 1 has a serial number.
The Security Key series, with the exception of the "Security Key Enterprise Edition" do not have serial numbers. All standard YubiKey models have serial numbers.
- even if using HID device node is not stable, why not at least provide this method to be able to use
ykman
as a backup identification with the key without having to resort to invoke the Python gods ?
It's something we may consider for future releases, if there is sufficient demand. However it would also need equivalent device paths for the OTP and CCID transports in addition to FIDO, as these typically show up as 3 different devices.
master
as of e5a4f22f15b767ca6ae87e99bf5e9e6533b4cf14ykman list -s
does not work.Steps to reproduce
Run:
ykman list -s
Expected result
Serial from the yubikey being displayed. There is no other documented way to list the serial numbers.
Other info
The devices are listed via https://github.com/Yubico/python-fido2. The
HIDIOCGRAWUNIQ
ioctl does not return anything.Here is the diagnostics from the two keys on the system: