search

go-piv / piv-go

Keys and certificates for YubiKeys, written in Go
Apache License 2.0
366 stars 65 forks source link

Fix attestation manufacture bug in old yubikeys #91

Closed oreparaz closed 3 years ago

oreparaz commented 3 years ago

This changeset works around a manufacture bug in some 4C Nano yubikeys from the 853#### range. The PIV attestation on these yubikeys doesn't work as expected because the PIV device certificate was certified using the U2F root CA (instead of the PIV root CA). Yubico has acknowledged this issue recently in [0]. Thanks to Chris Halos from Yubico for helping root cause this.

This changeset adds the U2F root CA as an additional CA to work around this. After this PR, go-piv attestation works with both yubikeys from the lucky batch and more recent yubikeys that don't exhibit the bug.

Since testing this without a Yubikey from this series is difficult, I've added new positive and negative tests for both attestation chains.

[0] https://github.com/Yubico/developers.yubico.com/pull/392/commits/a58f1003f003e04fc9baf09cad9f64f0c284fd47

This is a snippet of a device cert. Notice the root U2F CA certifying a PIV attestation cert

    Data:
        Version: 3 (0x2)
        Serial Number: 13542434377556493093 (0xbbf06450c44b0325)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Yubico U2F Root CA Serial 457200631
        Validity
            Not Before: Aug  1 00:00:00 2014 GMT
            Not After : Sep  4 00:00:00 2050 GMT
        Subject: CN=Yubico PIV Attestation
oreparaz commented 3 years ago

Address your comments and squashed. Thanks for the detailed review!