Struct nitrokey::Storage

pub struct Storage {}

A Nitrokey Storage device without user or admin authentication.

Use the global function connect to obtain an instance wrapper or the method connect to directly obtain an instance. If you want to execute a command that requires user or admin authentication, use authenticate_admin or authenticate_user.

Examples

Authentication with error handling:

use nitrokey::{Authenticate, User, Storage};

fn perform_user_task(device: &User<Storage>) {}
fn perform_other_task(device: &Storage) {}

let device = nitrokey::Storage::connect()?;
let device = match device.authenticate_user("123456") {
    Ok(user) => {
        perform_user_task(&user);
        user.device()
    },
    Err((device, err)) => {
        println!("Could not authenticate as user: {}", err);
        device
    },
};
perform_other_task(&device);

Methods

impl Storage

pub fn connect() -> Result<Storage, CommandError>

Connects to a Nitrokey Storage.

Errors

• Undefined if no Nitrokey device of the given model is connected

Example

use nitrokey::Storage;

fn use_storage(device: Storage) {}

match nitrokey::Storage::connect() {
    Ok(device) => use_storage(device),
    Err(err) => println!("Could not connect to the Nitrokey Storage: {}", err),
}

pub fn change_update_pin(
    &self,
    current: &str,
    new: &str
) -> Result<(), CommandError>

Changes the update PIN.

The update PIN is used to enable firmware updates. Unlike the user and the admin PIN, the update PIN is not managed by the OpenPGP smart card but by the Nitrokey firmware. There is no retry counter as with the other PIN types.

Errors

• InvalidString if one of the provided passwords contains a null byte
• WrongPassword if the current update password is wrong

Example

let device = nitrokey::Storage::connect()?;
match device.change_update_pin("12345678", "87654321") {
    Ok(()) => println!("Updated update PIN."),
    Err(err) => println!("Failed to update update PIN: {}", err),
};

pub fn enable_firmware_update(
    &self,
    update_pin: &str
) -> Result<(), CommandError>

Enables the firmware update mode.

During firmware update mode, the Nitrokey can no longer be accessed using HID commands. To resume normal operation, run dfu-programmer at32uc3a3256s launch. In order to enter the firmware update mode, you need the update password that can be changed using the [change_update_pin][] method.

Errors

• InvalidString if one of the provided passwords contains a null byte
• WrongPassword if the current update password is wrong

Example

let device = nitrokey::Storage::connect()?;
match device.enable_firmware_update("12345678") {
    Ok(()) => println!("Nitrokey entered update mode."),
    Err(err) => println!("Could not enter update mode: {}", err),
};

pub fn enable_encrypted_volume(
    &self,
    user_pin: &str
) -> Result<(), CommandError>

Enables the encrypted storage volume.

Once the encrypted volume is enabled, it is presented to the operating system as a block device. The API does not provide any information on the name or path of this block device.

Errors

• InvalidString if the provided password contains a null byte
• WrongPassword if the provided user password is wrong

Example

let device = nitrokey::Storage::connect()?;
match device.enable_encrypted_volume("123456") {
    Ok(()) => println!("Enabled the encrypted volume."),
    Err(err) => println!("Could not enable the encrypted volume: {}", err),
};

pub fn disable_encrypted_volume(&self) -> Result<(), CommandError>

Disables the encrypted storage volume.

Once the volume is disabled, it can be no longer accessed as a block device. If the encrypted volume has not been enabled, this method still returns a success.

Example

fn use_volume() {}

let device = nitrokey::Storage::connect()?;
match device.enable_encrypted_volume("123456") {
    Ok(()) => {
        println!("Enabled the encrypted volume.");
        use_volume();
        match device.disable_encrypted_volume() {
            Ok(()) => println!("Disabled the encrypted volume."),
            Err(err) => {
                println!("Could not disable the encrypted volume: {}", err);
            },
        };
    },
    Err(err) => println!("Could not enable the encrypted volume: {}", err),
};

pub fn enable_hidden_volume(
    &self,
    volume_password: &str
) -> Result<(), CommandError>

Enables a hidden storage volume.

This function will only succeed if the encrypted storage (enable_encrypted_volume) or another hidden volume has been enabled previously. Once the hidden volume is enabled, it is presented to the operating system as a block device and any previously opened encrypted or hidden volumes are closed. The API does not provide any information on the name or path of this block device.

Note that the encrypted and the hidden volumes operate on the same storage area, so using both at the same time might lead to data loss.

The hidden volume to unlock is selected based on the provided password.

Errors

• AesDecryptionFailed if the encrypted storage has not been opened before calling this method or the AES key has not been built
• InvalidString if the provided password contains a null byte

Example

let device = nitrokey::Storage::connect()?;
device.enable_encrypted_volume("123445")?;
match device.enable_hidden_volume("hidden-pw") {
    Ok(()) => println!("Enabled a hidden volume."),
    Err(err) => println!("Could not enable the hidden volume: {}", err),
};

pub fn disable_hidden_volume(&self) -> Result<(), CommandError>

Disables a hidden storage volume.

Once the volume is disabled, it can be no longer accessed as a block device. If no hidden volume has been enabled, this method still returns a success.

Example

fn use_volume() {}

let device = nitrokey::Storage::connect()?;
device.enable_encrypted_volume("123445")?;
match device.enable_hidden_volume("hidden-pw") {
    Ok(()) => {
        println!("Enabled the hidden volume.");
        use_volume();
        match device.disable_hidden_volume() {
            Ok(()) => println!("Disabled the hidden volume."),
            Err(err) => {
                println!("Could not disable the hidden volume: {}", err);
            },
        };
    },
    Err(err) => println!("Could not enable the hidden volume: {}", err),
};

pub fn create_hidden_volume(
    &self,
    slot: u8,
    start: u8,
    end: u8,
    password: &str
) -> Result<(), CommandError>

Creates a hidden volume.

The volume is crated in the given slot and in the given range of the available memory, where start is the start position as a percentage of the available memory, and end is the end position as a percentage of the available memory. The volume will be protected by the given password.

Note that the encrypted and the hidden volumes operate on the same storage area, so using both at the same time might lead to data loss.

According to the libnitrokey documentation, this function only works if the encrypted storage has been opened.

Errors

• AesDecryptionFailed if the encrypted storage has not been opened before calling this method or the AES key has not been built
• InvalidString if the provided password contains a null byte

Example

let device = nitrokey::Storage::connect()?;
device.enable_encrypted_volume("123445")?;
device.create_hidden_volume(0, 0, 100, "hidden-pw")?;

pub fn set_unencrypted_volume_mode(
    &self,
    admin_pin: &str,
    mode: VolumeMode
) -> Result<(), CommandError>

Sets the access mode of the unencrypted volume.

This command will reconnect the unencrypted volume so buffers should be flushed before calling it. Since firmware version v0.51, this command requires the admin PIN. Older firmware versions are not supported.

Errors

• InvalidString if the provided password contains a null byte
• WrongPassword if the provided admin password is wrong

Example

use nitrokey::VolumeMode;

let device = nitrokey::Storage::connect()?;
match device.set_unencrypted_volume_mode("123456", VolumeMode::ReadWrite) {
    Ok(()) => println!("Set the unencrypted volume to read-write mode."),
    Err(err) => println!("Could not set the unencrypted volume to read-write mode: {}", err),
};

pub fn get_status(&self) -> Result<StorageStatus, CommandError>

Returns the status of the connected storage device.

Example

fn use_volume() {}

let device = nitrokey::Storage::connect()?;
match device.get_status() {
    Ok(status) => {
        println!("SD card ID: {:#x}", status.serial_number_sd_card);
    },
    Err(err) => println!("Could not get Storage status: {}", err),
};

pub fn get_production_info(&self) -> Result<StorageProductionInfo, CommandError>

Returns the production information for the connected storage device.

Example

fn use_volume() {}

let device = nitrokey::Storage::connect()?;
match device.get_production_info() {
    Ok(data) => {
        println!("SD card ID:   {:#x}", data.sd_card.serial_number);
        println!("SD card size: {} GB", data.sd_card.size);
    },
    Err(err) => println!("Could not get Storage production info: {}", err),
};

pub fn clear_new_sd_card_warning(
    &self,
    admin_pin: &str
) -> Result<(), CommandError>

Clears the warning for a new SD card.

The Storage status contains a field for a new SD card warning. After a factory reset, the field is set to true. After filling the SD card with random data, it is set to false. This method can be used to set it to false without filling the SD card with random data.

Errors

• InvalidString if the provided password contains a null byte
• WrongPassword if the provided admin password is wrong

Example

let device = nitrokey::Storage::connect()?;
match device.clear_new_sd_card_warning("12345678") {
    Ok(()) => println!("Cleared the new SD card warning."),
    Err(err) => println!("Could not set the clear the new SD card warning: {}", err),
};

pub fn wink(&self) -> Result<(), CommandError>

Blinks the red and green LED alternatively and infinitely until the device is reconnected.

pub fn export_firmware(&self, admin_pin: &str) -> Result<(), CommandError>

Exports the firmware to the unencrypted volume.

This command requires the admin PIN. The unencrypted volume must be in read-write mode when this command is executed. Otherwise, it will still return Ok but not write the firmware.

This command unmounts the unencrypted volume if it has been mounted, so all buffers should be flushed. The firmware is written to the firmware.bin file on the unencrypted volume.

Errors

• InvalidString if one of the provided passwords contains a null byte
• WrongPassword if the admin password is wrong

Trait Implementations

impl Authenticate for Storage

fn authenticate_user(
    self,
    password: &str
) -> Result<User<Self>, (Self, CommandError)>

Performs user authentication. This method consumes the device. If successful, an authenticated device is returned. Otherwise, the current unauthenticated device and the error are returned.

fn authenticate_admin(
    self,
    password: &str
) -> Result<Admin<Self>, (Self, CommandError)>

Performs admin authentication. This method consumes the device. If successful, an authenticated device is returned. Otherwise, the current unauthenticated device and the error are returned.

impl Debug for Storage

fn fmt(&self, f: &mut Formatter) -> Result

Formats the value using the given formatter.

impl Device for Storage

fn get_model(&self) -> Model

Returns the model of the connected Nitrokey device.

fn get_serial_number(&self) -> Result<String, CommandError>

Returns the serial number of the Nitrokey device. The serial number is the string representation of a hex number.

fn get_user_retry_count(&self) -> u8

Returns the number of remaining authentication attempts for the user. The total number of available attempts is three.

fn get_admin_retry_count(&self) -> u8

Returns the number of remaining authentication attempts for the admin. The total number of available attempts is three.

fn get_major_firmware_version(&self) -> i32

Returns the major part of the firmware version (should be zero).

fn get_minor_firmware_version(&self) -> i32

Returns the minor part of the firmware version (for example 8 for version 0.8).

fn get_config(&self) -> Result<Config, CommandError>

Returns the current configuration of the Nitrokey device.

fn change_admin_pin(&self, current: &str, new: &str) -> Result<(), CommandError>

Changes the administrator PIN.

fn change_user_pin(&self, current: &str, new: &str) -> Result<(), CommandError>

Changes the user PIN.

fn unlock_user_pin(
    &self,
    admin_pin: &str,
    user_pin: &str
) -> Result<(), CommandError>

Unlocks the user PIN after three failed login attempts and sets it to the given value.

fn lock(&self) -> Result<(), CommandError>

Locks the Nitrokey device.

fn factory_reset(&self, admin_pin: &str) -> Result<(), CommandError>

Performs a factory reset on the Nitrokey device.

fn build_aes_key(&self, admin_pin: &str) -> Result<(), CommandError>

Builds a new AES key on the Nitrokey.

impl Drop for Storage

fn drop(&mut self)

Executes the destructor for this type.

impl GenerateOtp for Storage

fn set_time(&self, time: u64, force: bool) -> Result<(), CommandError>

Sets the time on the Nitrokey.

fn get_hotp_slot_name(&self, slot: u8) -> Result<String, CommandError>

Returns the name of the given HOTP slot.

fn get_totp_slot_name(&self, slot: u8) -> Result<String, CommandError>

Returns the name of the given TOTP slot.

fn get_hotp_code(&self, slot: u8) -> Result<String, CommandError>

Generates an HOTP code on the given slot. This operation may require user authorization, depending on the device configuration (see [get_config][]).

fn get_totp_code(&self, slot: u8) -> Result<String, CommandError>

Generates a TOTP code on the given slot. This operation may require user authorization, depending on the device configuration (see [get_config][]).

impl GetPasswordSafe for Storage

fn get_password_safe(
    &self,
    user_pin: &str
) -> Result<PasswordSafe, CommandError>

Enables and returns the password safe.