search

Yubico / yubikit-android

Yubico Mobile Android SDK - YubiKit
Apache License 2.0
102 stars 38 forks source link

Use Extended length APDUs only on compatible adapters and devices #64

Closed AdamVe closed 1 year ago

AdamVe commented 1 year ago

This PR fixes a bug where the SDK used Extended length APDUs on incompatible NFC adapters.

[Android documentation](https://developer.android.com/reference/android/nfc/tech/IsoDep#isExtendedLengthApduSupported()) says following about Extended length APDUs:

Standard APDUs have a 1-byte length field, allowing a maximum of 255 payload bytes, which results in a maximum APDU length of 261 bytes.

Extended length APDUs have a 3-byte length field, allowing 65535 payload bytes.

Some NFC adapters, like the one used in the Nexus S and the Galaxy Nexus do not support extended length APDUs. They are expected to be well-supported in the future though. Use this method to check for extended length APDU support.

The issue is easily reproduced on a "compatible" device (without Extended APDUs support) by generating an EC key with the AndroidDemo app. During the key generation, an APDU with size greater than the max Standard length APDU size is sent over the connection and following exception is thrown by the Android framework:

E/yubikit: Error:
    java.io.IOException: Transceive length exceeds supported maximum
        at android.nfc.TransceiveResult.getResponseOrThrow(TransceiveResult.java:50)
        at android.nfc.tech.BasicTagTechnology.transceive(BasicTagTechnology.java:151)
        at android.nfc.tech.IsoDep.transceive(IsoDep.java:172)

To avoid sending Extended length APDUs over incompatible connections, the code uses [IsoDep.isExtendedLengthApduSupported](https://developer.android.com/reference/android/nfc/tech/IsoDep#isExtendedLengthApduSupported()) to get the proper capability of the NFC adapter.

Note: We always mark USB connections to YubiKey as capable of Extended Length APDUs - the SmartCardProtocol checks the firmware version of connected YubiKey to decide the support - only FW >= 4.0.0 will use Extended length APDUs.