Struct nitrokey::Storage

pub struct Storage<'a> { /* fields omitted */ }

A Nitrokey Storage device without user or admin authentication.

Use the connect method to obtain an instance wrapper or the connect_storage method to directly obtain an instance. If you want to execute a command that requires user or admin authentication, use authenticate_admin or authenticate_user.

Examples

Authentication with error handling:

use nitrokey::{Authenticate, User, Storage};

fn perform_user_task<'a>(device: &User<'a, Storage<'a>>) {}
fn perform_other_task(device: &Storage) {}

let mut manager = nitrokey::take()?;
let device = manager.connect_storage()?;
let device = match device.authenticate_user("123456") {
    Ok(user) => {
        perform_user_task(&user);
        user.device()
    },
    Err((device, err)) => {
        eprintln!("Could not authenticate as user: {}", err);
        device
    },
};
perform_other_task(&device);

Methods

impl<'a> Storage<'a>

pub fn change_update_pin(
    &mut self,
    current: &str,
    new: &str
) -> Result<(), Error>

Changes the update PIN.

The update PIN is used to enable firmware updates. Unlike the user and the admin PIN, the update PIN is not managed by the OpenPGP smart card but by the Nitrokey firmware. There is no retry counter as with the other PIN types.

Errors

• InvalidString if one of the provided passwords contains a null byte
• WrongPassword if the current update password is wrong

Example

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
match device.change_update_pin("12345678", "87654321") {
    Ok(()) => println!("Updated update PIN."),
    Err(err) => eprintln!("Failed to update update PIN: {}", err),
};

pub fn enable_firmware_update(&mut self, update_pin: &str) -> Result<(), Error>

Enables the firmware update mode.

During firmware update mode, the Nitrokey can no longer be accessed using HID commands. To resume normal operation, run dfu-programmer at32uc3a3256s launch. In order to enter the firmware update mode, you need the update password that can be changed using the [change_update_pin][] method.

Errors

• InvalidString if one of the provided passwords contains a null byte
• WrongPassword if the current update password is wrong

Example

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
match device.enable_firmware_update("12345678") {
    Ok(()) => println!("Nitrokey entered update mode."),
    Err(err) => eprintln!("Could not enter update mode: {}", err),
};

pub fn enable_encrypted_volume(&mut self, user_pin: &str) -> Result<(), Error>

Enables the encrypted storage volume.

Once the encrypted volume is enabled, it is presented to the operating system as a block device. The API does not provide any information on the name or path of this block device.

Errors

• InvalidString if the provided password contains a null byte
• WrongPassword if the provided user password is wrong

Example

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
match device.enable_encrypted_volume("123456") {
    Ok(()) => println!("Enabled the encrypted volume."),
    Err(err) => eprintln!("Could not enable the encrypted volume: {}", err),
};

pub fn disable_encrypted_volume(&mut self) -> Result<(), Error>

Disables the encrypted storage volume.

Once the volume is disabled, it can be no longer accessed as a block device. If the encrypted volume has not been enabled, this method still returns a success.

Example

fn use_volume() {}

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
match device.enable_encrypted_volume("123456") {
    Ok(()) => {
        println!("Enabled the encrypted volume.");
        use_volume();
        match device.disable_encrypted_volume() {
            Ok(()) => println!("Disabled the encrypted volume."),
            Err(err) => {
                eprintln!("Could not disable the encrypted volume: {}", err);
            },
        };
    },
    Err(err) => eprintln!("Could not enable the encrypted volume: {}", err),
};

pub fn enable_hidden_volume(
    &mut self,
    volume_password: &str
) -> Result<(), Error>

Enables a hidden storage volume.

This function will only succeed if the encrypted storage (enable_encrypted_volume) or another hidden volume has been enabled previously. Once the hidden volume is enabled, it is presented to the operating system as a block device and any previously opened encrypted or hidden volumes are closed. The API does not provide any information on the name or path of this block device.

Note that the encrypted and the hidden volumes operate on the same storage area, so using both at the same time might lead to data loss.

The hidden volume to unlock is selected based on the provided password.

Errors

• AesDecryptionFailed if the encrypted storage has not been opened before calling this method or the AES key has not been built
• InvalidString if the provided password contains a null byte

Example

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
device.enable_encrypted_volume("123445")?;
match device.enable_hidden_volume("hidden-pw") {
    Ok(()) => println!("Enabled a hidden volume."),
    Err(err) => eprintln!("Could not enable the hidden volume: {}", err),
};

pub fn disable_hidden_volume(&mut self) -> Result<(), Error>

Disables a hidden storage volume.

Once the volume is disabled, it can be no longer accessed as a block device. If no hidden volume has been enabled, this method still returns a success.

Example

fn use_volume() {}

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
device.enable_encrypted_volume("123445")?;
match device.enable_hidden_volume("hidden-pw") {
    Ok(()) => {
        println!("Enabled the hidden volume.");
        use_volume();
        match device.disable_hidden_volume() {
            Ok(()) => println!("Disabled the hidden volume."),
            Err(err) => {
                eprintln!("Could not disable the hidden volume: {}", err);
            },
        };
    },
    Err(err) => eprintln!("Could not enable the hidden volume: {}", err),
};

pub fn create_hidden_volume(
    &mut self,
    slot: u8,
    start: u8,
    end: u8,
    password: &str
) -> Result<(), Error>

Creates a hidden volume.

The volume is crated in the given slot and in the given range of the available memory, where start is the start position as a percentage of the available memory, and end is the end position as a percentage of the available memory. The volume will be protected by the given password.

Note that the encrypted and the hidden volumes operate on the same storage area, so using both at the same time might lead to data loss.

According to the libnitrokey documentation, this function only works if the encrypted storage has been opened.

Errors

• AesDecryptionFailed if the encrypted storage has not been opened before calling this method or the AES key has not been built
• InvalidString if the provided password contains a null byte

Example

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
device.enable_encrypted_volume("123445")?;
device.create_hidden_volume(0, 0, 100, "hidden-pw")?;

pub fn set_unencrypted_volume_mode(
    &mut self,
    admin_pin: &str,
    mode: VolumeMode
) -> Result<(), Error>

Sets the access mode of the unencrypted volume.

This command will reconnect the unencrypted volume so buffers should be flushed before calling it. Since firmware version v0.51, this command requires the admin PIN. Older firmware versions are not supported.

Errors

• InvalidString if the provided password contains a null byte
• WrongPassword if the provided admin password is wrong

Example

use nitrokey::VolumeMode;

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
match device.set_unencrypted_volume_mode("12345678", VolumeMode::ReadWrite) {
    Ok(()) => println!("Set the unencrypted volume to read-write mode."),
    Err(err) => eprintln!("Could not set the unencrypted volume to read-write mode: {}", err),
};

pub fn set_encrypted_volume_mode(
    &mut self,
    admin_pin: &str,
    mode: VolumeMode
) -> Result<(), Error>

Sets the access mode of the encrypted volume.

This command will reconnect the encrypted volume so buffers should be flushed before calling it. It is only available in firmware version 0.49.

Errors

• InvalidString if the provided password contains a null byte
• WrongPassword if the provided admin password is wrong

Example

use nitrokey::VolumeMode;

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
match device.set_encrypted_volume_mode("12345678", VolumeMode::ReadWrite) {
    Ok(()) => println!("Set the encrypted volume to read-write mode."),
    Err(err) => eprintln!("Could not set the encrypted volume to read-write mode: {}", err),
};

pub fn get_storage_status(&self) -> Result<StorageStatus, Error>

Returns the status of the connected storage device.

Example

fn use_volume() {}

let mut manager = nitrokey::take()?;
let device = manager.connect_storage()?;
match device.get_storage_status() {
    Ok(status) => {
        println!("SD card ID: {:#x}", status.serial_number_sd_card);
    },
    Err(err) => eprintln!("Could not get Storage status: {}", err),
};

pub fn get_production_info(&self) -> Result<StorageProductionInfo, Error>

Returns the production information for the connected storage device.

Example

fn use_volume() {}

let mut manager = nitrokey::take()?;
let device = manager.connect_storage()?;
match device.get_production_info() {
    Ok(data) => {
        println!("SD card ID:   {:#x}", data.sd_card.serial_number);
        println!("SD card size: {} GB", data.sd_card.size);
    },
    Err(err) => eprintln!("Could not get Storage production info: {}", err),
};

pub fn clear_new_sd_card_warning(
    &mut self,
    admin_pin: &str
) -> Result<(), Error>

Clears the warning for a new SD card.

The Storage status contains a field for a new SD card warning. After a factory reset, the field is set to true. After filling the SD card with random data, it is set to false. This method can be used to set it to false without filling the SD card with random data.

Errors

• InvalidString if the provided password contains a null byte
• WrongPassword if the provided admin password is wrong

Example

let mut manager = nitrokey::take()?;
let mut device = manager.connect_storage()?;
match device.clear_new_sd_card_warning("12345678") {
    Ok(()) => println!("Cleared the new SD card warning."),
    Err(err) => eprintln!("Could not set the clear the new SD card warning: {}", err),
};

pub fn get_sd_card_usage(&self) -> Result<Range<u8>, Error>

Returns a range of the SD card that has not been used to during this power cycle.

The Nitrokey Storage tracks read and write access to the SD card during a power cycle. This method returns a range of the SD card that has not been accessed during this power cycle. The range is relative to the total size of the SD card, so both values are less than or equal to 100. This can be used as a guideline when creating a hidden volume.

Example

let mut manager = nitrokey::take()?;
let storage = manager.connect_storage()?;
let usage = storage.get_sd_card_usage()?;
println!("SD card usage: {}..{}", usage.start, usage.end);

pub fn wink(&mut self) -> Result<(), Error>

Blinks the red and green LED alternatively and infinitely until the device is reconnected.

pub fn get_operation_status(&self) -> Result<OperationStatus, Error>

Returns the status of an ongoing background operation on the Nitrokey Storage.

Some commands may start a background operation during which no other commands can be executed. This method can be used to check whether such an operation is ongoing.

Currently, this is only used by the fill_sd_card method.

pub fn fill_sd_card(&mut self, admin_pin: &str) -> Result<(), Error>

Overwrites the SD card with random data.

Ths method starts a background operation that overwrites the SD card with random data. While this operation is ongoing, no other commands can be executed. Use the get_operation_status function to check the progress of the operation.

Errors

• InvalidString if one of the provided passwords contains a null byte
• WrongPassword if the admin password is wrong

Example

use nitrokey::OperationStatus;

let mut manager = nitrokey::take()?;
let mut storage = manager.connect_storage()?;
storage.fill_sd_card("12345678")?;
loop {
    match storage.get_operation_status()? {
        OperationStatus::Ongoing(progress) => println!("{}/100", progress),
        OperationStatus::Idle => {
            println!("Done!");
            break;
        }
    }
}

pub fn export_firmware(&mut self, admin_pin: &str) -> Result<(), Error>

Exports the firmware to the unencrypted volume.

This command requires the admin PIN. The unencrypted volume must be in read-write mode when this command is executed. Otherwise, it will still return Ok but not write the firmware.

This command unmounts the unencrypted volume if it has been mounted, so all buffers should be flushed. The firmware is written to the firmware.bin file on the unencrypted volume.

Errors

• InvalidString if one of the provided passwords contains a null byte
• WrongPassword if the admin password is wrong

Trait Implementations

impl<'a> Authenticate<'a> for Storage<'a>

fn authenticate_user(
    self,
    password: &str
) -> Result<User<'a, Self>, (Self, Error)>

Performs user authentication. This method consumes the device. If successful, an authenticated device is returned. Otherwise, the current unauthenticated device and the error are returned.

fn authenticate_admin(
    self,
    password: &str
) -> Result<Admin<'a, Self>, (Self, Error)>

Performs admin authentication. This method consumes the device. If successful, an authenticated device is returned. Otherwise, the current unauthenticated device and the error are returned.

impl<'a> Debug for Storage<'a>

fn fmt(&self, f: &mut Formatter) -> Result

Formats the value using the given formatter.

impl<'a> Device<'a> for Storage<'a>

fn into_manager(self) -> &'a mut Manager

Returns the [Manager][] instance that has been used to connect to this device.

fn get_model(&self) -> Model

Returns the model of the connected Nitrokey device.

fn get_status(&self) -> Result<Status, Error>

Returns the status of the Nitrokey device.

fn get_serial_number(&self) -> Result<SerialNumber, Error>

Returns the serial number of the Nitrokey device.

fn get_user_retry_count(&self) -> Result<u8, Error>

Returns the number of remaining authentication attempts for the user. The total number of available attempts is three.

fn get_admin_retry_count(&self) -> Result<u8, Error>

Returns the number of remaining authentication attempts for the admin. The total number of available attempts is three.

fn get_firmware_version(&self) -> Result<FirmwareVersion, Error>

Returns the firmware version.

fn get_config(&self) -> Result<Config, Error>

Returns the current configuration of the Nitrokey device.

fn change_admin_pin(&mut self, current: &str, new: &str) -> Result<(), Error>

Changes the administrator PIN.

fn change_user_pin(&mut self, current: &str, new: &str) -> Result<(), Error>

Changes the user PIN.

fn unlock_user_pin(
    &mut self,
    admin_pin: &str,
    user_pin: &str
) -> Result<(), Error>

Unlocks the user PIN after three failed login attempts and sets it to the given value.

fn lock(&mut self) -> Result<(), Error>

Locks the Nitrokey device.

fn factory_reset(&mut self, admin_pin: &str) -> Result<(), Error>

Performs a factory reset on the Nitrokey device.

fn build_aes_key(&mut self, admin_pin: &str) -> Result<(), Error>

Builds a new AES key on the Nitrokey.

impl<'a> Drop for Storage<'a>

fn drop(&mut self)

Executes the destructor for this type.

impl<'a> From<Storage<'a>> for DeviceWrapper<'a>

fn from(device: Storage<'a>) -> Self

Performs the conversion.

impl<'a> GenerateOtp for Storage<'a>

fn set_time(&mut self, time: u64, force: bool) -> Result<(), Error>

Sets the time on the Nitrokey.

fn get_hotp_slot_name(&self, slot: u8) -> Result<String, Error>

Returns the name of the given HOTP slot.

fn get_totp_slot_name(&self, slot: u8) -> Result<String, Error>

Returns the name of the given TOTP slot.

fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error>

Generates an HOTP code on the given slot. This operation may require user authorization, depending on the device configuration (see [get_config][]).

fn get_totp_code(&self, slot: u8) -> Result<String, Error>

Generates a TOTP code on the given slot. This operation may require user authorization, depending on the device configuration (see [get_config][]).

impl<'a> GetPasswordSafe<'a> for Storage<'a>

fn get_password_safe(
    &mut self,
    user_pin: &str
) -> Result<PasswordSafe<'_, 'a>, Error>

Enables and returns the password safe.