Closed vuori closed 2 years ago
Yeah, that's consistent with the lack of a key history object. I've considered whether we should add an option to pivy-tool
that tells it to enumerate all retired key slots even if the key history object is missing or incomplete, but haven't done it yet. Turning this bug into a feature request for that might not be a bad idea. It might also be useful to make a pivy-tool
command which enumerates all the slots and then "repairs" the key history object.
If you want to fix it up for your particular key this once, you can write a key history object by hand -- for yours you will want 2 on-card certs, so something like echo c10102c20100 | yubico-piv-tool -a write-object --id=0x5FC10C
should work.
Thanks, I'll give that incantation a try after I finish setting up my new laptop.
Since the deficient Yubico tools are likely to be in wide use and many people probably need to deal with alt-certs for SSH purposes, a repair and/or force-scan mode sounds like a good idea.
The write-object trick seems to be working. For Google-posterity: the third byte (02 in the example) is the number of retired slots in use.
In the 0.7.0 release now there's a pivy-tool update-keyhist
command which will scan all the retired slots and re-write the Key History object for you. There's also a -X
option to scan all retired key slots for list/sign/etc.
Tested on a YK5. Works fine and updating the key history doesn't cause problems with the Windows minidriver either (some OpenSC users apparently had problems with this in the past).
The issue can be closed if you don't have anything else in mind.
Tested on a YK5 nfc. first i exec echo -n C10114C20100FE00 | yubico-piv-tool -k -a write-object --id 0x5FC10C -i - then exec "C:\Program Files\Yubico\YubiKey Manager\ykman.exe" piv certificates import 82 i:/MySmimeCert.pfx
reinsert key ,i see my cert in windows certificate manager "certmgr.msc", but it can't be used actually. i test outlook ,it can show the windows smartcard pin input dialog but with right password it still can't decode encrypted email i also test word to sign a docx file also show pin input but finally show error
finally i delete slot 82 and test to use gui manager import my cert to 9a,9c,9d,9e slot
result:
slot: 9a 9d 9e can be used in outlook to decode encrypted email and in word to sign docx
slot 9c can't be used in outlook to decode encrypted email
slot 9c can be used in word to sign docx
someone can help me??
I have a Yubikey 5 with ECC keys/certs in the first two retired key slots in addition to 9a and 9d. pivy doesn't see them for some reason, but they work fine with Yubico tools (ykman/yubico-piv-tool/ykcs11/Windows minidriver). Any suggestions on how I could debug this?
Update: after some debugging, it looks like
piv_read_keyhist
getsSW_FILE_NOT_FOUND
from the card. Trying to fetch the key history object (id 0x5fc10c) with yubico-piv-tool also fails. From https://github.com/OpenSC/OpenSC/issues/847 it sounds like the key history object should be written when certs/keys are imported and the Yubico tools don't bother to do this? (I imported my keys/certs with either ykman or yubico-piv-tool originally.)Output from pivy-tool list:
Output from ykman piv info: