fido2-rs 0.6.0

Rust bindings to Yubico fido2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

//! Example: reset a FIDO2 device and verify the old PIN no longer works.
//!
//! **WARNING: This example DESTROYS all FIDO2 data on the device — credentials,
//! PIN, and largeBlob entries. Other applets (PIV, OpenPGP) are not affected.**
//!
//! The CTAP2 spec requires the device to have been powered on within ~10
//! seconds for a reset to succeed. If the device has been connected longer,
//! unplug and reinsert it before running.
//!
//! Usage: cargo run --example device_reset

use fido2_rs::device::DeviceList;
use fido2_rs::error::Error;

const PIN: &str = "1234";

fn main() -> anyhow::Result<()> {
    let mut devices = DeviceList::list_devices(8)?;
    let dev_info = devices.next().expect("No FIDO2 device found");
    let dev = dev_info.open()?;

    println!("Factory reset (touch device)...");
    dev.reset()?;
    println!("  Reset OK");

    println!("Setting initial PIN to \"{PIN}\"...");
    dev.set_pin(PIN, None)?;
    println!("  PIN set");

    assert!(dev.has_pin(), "has_pin() should be true after set_pin");
    println!("  has_pin() = true");

    println!("Factory reset again (touch device)...");
    dev.reset()?;
    println!("  Reset OK — PIN and all credentials wiped");

    assert!(!dev.has_pin(), "has_pin() should be false after reset");
    println!("  has_pin() = false");

    println!("Trying to change PIN using the old PIN (should fail)...");
    match dev.set_pin("5678", Some(PIN)) {
        Err(Error::Fido(e)) => println!("  Failed as expected: {e}"),
        Ok(()) => panic!("set_pin with old PIN should have failed after reset"),
        Err(e) => panic!("Unexpected error type: {e:?}"),
    }

    println!("\nAll checks passed — old PIN is invalid after reset.");
    Ok(())
}