search

mit-ll / LL-Smartcard

A Python module for interacting with smart cards.
Other
50 stars 18 forks source link

Pin question #1

Open achapkowski opened 6 years ago

achapkowski commented 6 years ago

If I have a user pass their pin like 1234, will this package convert it to it's bytes format? The example is unclear.

cspensky commented 6 years ago

Programmatically you would do the following:

PIN = [0x31, 0x32, 0x33, 0x34, 0x00, 0x00, 0x00, 0x00] # 1234
data, sw1, sw2 = card.apdu_verify_pin(PIN, 0x00)

Honestly it's been a while since I looked at the spec, but I believe you just append 0's to ensure that you always send an 8 digit PIN. Let me know if this isn't working for you.

dplaniel commented 1 year ago

So is the expectation that the user hard-codes their PIN in plaintext into the script? Isn't that insane?

dplaniel commented 1 year ago

examples/cac_crypto.py allows the user to pass the pin as a command line argument, but having your PIN in plaintext in your bash history is scarcely better, right?

cspensky commented 1 year ago

This library is for exploring smartcard functionality, not for production use. We assume the users of the library know what they are doing. You are free to augment the library anyway you see fit to protect your own PIN.