Re: "Waiting for touch" notification
Douglas E Engert <[email protected]>
| Newsgroups | gmane.comp.encryption.opensc.devel |
|---|---|
| Message-ID | <[email protected]> |
This sounds similar to PKCS#11 CKA_ALWAYS_AUTHENTICATE and C_Login ( CKU_CONTEXT_SPECIFIC) which is designed to request the PIN for each crypto operation. NIST 800-73 says a PIV compliant card requires the verification of the PIN just before the use of the 9C key on the card. (The sign key) OpenSC PKCS#11 supports this. But the PKCS#11 application needs to recognize the CKA_ALWAYS_AUTHENTICATE attribute of the key and put up a prompt requesting the PIN. It also sounds like an extension by Yubico of the official PIV specifications. Does the PIN need to be entered in addition or in place of touching? You could try the Yubico PKCS#11 module and see if has the same problem. If the only issue is you can't see it blinking, you could use the Yubikey in a USB hub placed so you can see it :-) On 10/16/2016 11:02 AM, Thomas Habets wrote: > When it's waiting for a touch it just waits with no user notification > outside of the yubikey blinking. Since I have a Yubikey 4 Nano the > blinking is not always in view, which makes me type "ssh"/"git push" > and just stare at the screen. > > Has anyone explored how to surface this "please touch the smartcard" > or something message to the user with opensc? > > I can imagine an ugly solution where if there's an outstanding "sign" > operation for more than epsilon time, then maybe connect to this unix socket > and say something, or shell out to this command. I can then use that > to do something better than, but similar to, running: > xmessage 'touch the yubikey' > > [1] https://blog.habets.se/2016/01/Yubikey-4-for-SSH-with-physical-presence-proof > -- Douglas E. Engert <[email protected]> ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot