Struct openpgp_card::OpenPgpTransaction
source · [−]pub struct OpenPgpTransaction<'a> { /* private fields */ }
Expand description
Low-level access to OpenPGP card functionality.
On backends that support transactions, operations are grouped together in transaction, while an object of this type lives.
An OpenPgpTransaction on typical underlying card subsystems must be short lived. Typically, smart cards can’t be kept open for longer than a few seconds, before they are automatically closed.
Implementations
sourceimpl<'a> OpenPgpTransaction<'a>
impl<'a> OpenPgpTransaction<'a>
sourcepub fn feature_pinpad_verify(&self) -> bool
pub fn feature_pinpad_verify(&self) -> bool
Does the reader support FEATURE_VERIFY_PIN_DIRECT?
sourcepub fn feature_pinpad_modify(&self) -> bool
pub fn feature_pinpad_modify(&self) -> bool
Does the reader support FEATURE_MODIFY_PIN_DIRECT?
Get the “application related data” from the card.
(This data should probably be cached in a higher layer. Some parts of it are needed regularly, and it does not usually change during normal use of a card.)
Get cardholder related data (65)
sourcepub fn security_support_template(
&mut self
) -> Result<SecuritySupportTemplate, Error>
pub fn security_support_template(
&mut self
) -> Result<SecuritySupportTemplate, Error>
Get security support template (7a)
sourcepub fn cardholder_certificate(&mut self) -> Result<Vec<u8>, Error>
pub fn cardholder_certificate(&mut self) -> Result<Vec<u8>, Error>
Get cardholder certificate (each for AUT, DEC and SIG).
Call select_data() before calling this fn to select a particular certificate (if the card supports multiple certificates).
sourcepub fn next_cardholder_certificate(&mut self) -> Result<Vec<u8>, Error>
pub fn next_cardholder_certificate(&mut self) -> Result<Vec<u8>, Error>
Call “GET NEXT DATA” for the DO cardholder certificate.
Cardholder certificate data for multiple slots can be read from the card by first calling cardholder_certificate(), followed by up to two calls to next_cardholder_certificate().
sourcepub fn algorithm_information(&mut self) -> Result<Option<AlgoInfo>, Error>
pub fn algorithm_information(&mut self) -> Result<Option<AlgoInfo>, Error>
Get “Algorithm Information”
sourcepub fn attestation_certificate(&mut self) -> Result<Vec<u8>, Error>
pub fn attestation_certificate(&mut self) -> Result<Vec<u8>, Error>
Get “Attestation Certificate (Yubico)”
sourcepub fn firmware_version(&mut self) -> Result<Vec<u8>, Error>
pub fn firmware_version(&mut self) -> Result<Vec<u8>, Error>
Firmware Version (YubiKey specific (?))
sourcepub fn set_identity(&mut self, id: u8) -> Result<Vec<u8>, Error>
pub fn set_identity(&mut self, id: u8) -> Result<Vec<u8>, Error>
Set identity (Nitrokey Start specific (?)). [see: https://docs.nitrokey.com/start/linux/multiple-identities.html https://github.com/Nitrokey/nitrokey-start-firmware/pull/33/]
sourcepub fn select_data(
&mut self,
num: u8,
tag: &[u8],
yk_workaround: bool
) -> Result<(), Error>
pub fn select_data(
&mut self,
num: u8,
tag: &[u8],
yk_workaround: bool
) -> Result<(), Error>
SELECT DATA (“select a DO in the current template”).
This command currently only applies to
cardholder_certificate
and
set_cardholder_certificate
in OpenPGP card.
yk_workaround
: Yubikey 5 up to (and including) firmware version 5.4.3 need a workaround
for this command. Set to true
to apply this workaround.
(When sending the SELECT DATA command as defined in the card spec, without enabling the
workaround, bad Yubikey firmware versions (<= 5.4.3) return
IncorrectParametersCommandDataField
)
(This library leaves it up to consumers to decide on a strategy for dealing with this issue. Possible strategies include:
- asking the card for its
firmware_version
and using the workaround if version <=5.4.3 - trying this command first without the workaround, then with workaround if the card
returns
IncorrectParametersCommandDataField
- for read operations: using
next_cardholder_certificate
instead of SELECT DATA)
sourcepub fn private_use_do(&mut self, num: u8) -> Result<Vec<u8>, Error>
pub fn private_use_do(&mut self, num: u8) -> Result<Vec<u8>, Error>
Get data from “private use” DO.
num
must be between 1 and 4.
sourcepub fn factory_reset(&mut self) -> Result<(), Error>
pub fn factory_reset(&mut self) -> Result<(), Error>
Reset all state on this OpenPGP card.
Note: the “factory reset” operation is not directly offered by the card spec. It is implemented as a series of OpenPGP card commands:
- send 4 bad requests to verify pw1,
- send 4 bad requests to verify pw3,
- terminate_df,
- activate_file.
With most cards, this sequence of operations causes the card to revert to a “blank” state.
(However, e.g. vanilla Gnuk doesn’t support this functionality.
Gnuk needs to be built with the --enable-factory-reset
option to the configure
script to enable this functionality).
sourcepub fn verify_pw1_sign(&mut self, pin: &[u8]) -> Result<(), Error>
pub fn verify_pw1_sign(&mut self, pin: &[u8]) -> Result<(), Error>
Verify pw1 (user) for signing operation (mode 81).
Depending on the PW1 status byte (see Extended Capabilities) this access condition is only valid for one PSO:CDS command or remains valid for several attempts.
sourcepub fn verify_pw1_sign_pinpad(&mut self) -> Result<(), Error>
pub fn verify_pw1_sign_pinpad(&mut self) -> Result<(), Error>
Verify pw1 (user) for signing operation (mode 81) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.
Depending on the PW1 status byte (see Extended Capabilities) this access condition is only valid for one PSO:CDS command or remains valid for several attempts.
sourcepub fn check_pw1_sign(&mut self) -> Result<(), Error>
pub fn check_pw1_sign(&mut self) -> Result<(), Error>
Check the current access of PW1 for signing (mode 81).
If verification is not required, an empty Ok Response is returned.
(Note:
- some cards don’t correctly implement this feature, e.g. YubiKey 5
- some cards that don’t support this instruction may decrease the pin’s error count, eventually requiring the user to reset the pin)
sourcepub fn verify_pw1_user(&mut self, pin: &[u8]) -> Result<(), Error>
pub fn verify_pw1_user(&mut self, pin: &[u8]) -> Result<(), Error>
Verify PW1 (user). (For operations except signing, mode 82).
sourcepub fn verify_pw1_user_pinpad(&mut self) -> Result<(), Error>
pub fn verify_pw1_user_pinpad(&mut self) -> Result<(), Error>
Verify PW1 (user) for operations except signing (mode 82), using a pinpad on the card reader. If no usable pinpad is found, an error is returned.
sourcepub fn check_pw1_user(&mut self) -> Result<(), Error>
pub fn check_pw1_user(&mut self) -> Result<(), Error>
Check the current access of PW1. (For operations except signing, mode 82).
If verification is not required, an empty Ok Response is returned.
(Note:
- some cards don’t correctly implement this feature, e.g. YubiKey 5
- some cards that don’t support this instruction may decrease the pin’s error count, eventually requiring the user to reset the pin)
sourcepub fn verify_pw3_pinpad(&mut self) -> Result<(), Error>
pub fn verify_pw3_pinpad(&mut self) -> Result<(), Error>
Verify PW3 (admin) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.
sourcepub fn check_pw3(&mut self) -> Result<(), Error>
pub fn check_pw3(&mut self) -> Result<(), Error>
Check the current access of PW3 (admin).
If verification is not required, an empty Ok Response is returned.
(Note:
- some cards don’t correctly implement this feature, e.g. YubiKey 5
- some cards that don’t support this instruction may decrease the pin’s error count, eventually requiring the user to reset the pin)
sourcepub fn change_pw1(&mut self, old: &[u8], new: &[u8]) -> Result<(), Error>
pub fn change_pw1(&mut self, old: &[u8], new: &[u8]) -> Result<(), Error>
Change the value of PW1 (user password).
The current value of PW1 must be presented in old
for authorization.
sourcepub fn change_pw1_pinpad(&mut self) -> Result<(), Error>
pub fn change_pw1_pinpad(&mut self) -> Result<(), Error>
Change the value of PW1 (0x81) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.
sourcepub fn change_pw3(&mut self, old: &[u8], new: &[u8]) -> Result<(), Error>
pub fn change_pw3(&mut self, old: &[u8], new: &[u8]) -> Result<(), Error>
Change the value of PW3 (admin password).
The current value of PW3 must be presented in old
for authorization.
sourcepub fn change_pw3_pinpad(&mut self) -> Result<(), Error>
pub fn change_pw3_pinpad(&mut self) -> Result<(), Error>
Change the value of PW3 (admin password) using a pinpad on the card reader. If no usable pinpad is found, an error is returned.
sourcepub fn reset_retry_counter_pw1(
&mut self,
new_pw1: &[u8],
resetting_code: Option<&[u8]>
) -> Result<(), Error>
pub fn reset_retry_counter_pw1(
&mut self,
new_pw1: &[u8],
resetting_code: Option<&[u8]>
) -> Result<(), Error>
Reset the error counter for PW1 (user password) and set a new value for PW1.
For authorization, either:
- PW3 must have been verified previously,
- secure messaging must be currently used,
- the resetting_code must be presented.
sourcepub fn decipher(&mut self, dm: Cryptogram<'_>) -> Result<Vec<u8>, Error>
pub fn decipher(&mut self, dm: Cryptogram<'_>) -> Result<Vec<u8>, Error>
Decrypt the ciphertext in dm
, on the card.
(This is a wrapper around the low-level pso_decipher
operation, it builds the required data
field from dm
)
sourcepub fn pso_decipher(&mut self, data: Vec<u8>) -> Result<Vec<u8>, Error>
pub fn pso_decipher(&mut self, data: Vec<u8>) -> Result<Vec<u8>, Error>
Run decryption operation on the smartcard (low level operation) (7.2.11 PSO: DECIPHER)
(consider using the decipher()
method if you don’t want to create
the data field manually)
sourcepub fn signature_for_hash(&mut self, hash: Hash<'_>) -> Result<Vec<u8>, Error>
pub fn signature_for_hash(&mut self, hash: Hash<'_>) -> Result<Vec<u8>, Error>
Sign hash
, on the card.
This is a wrapper around the low-level
pso_compute_digital_signature operation.
It builds the required data
field from hash
.
For RSA, this means a “DigestInfo” data structure is generated. (see 7.2.10.2 DigestInfo for RSA).
With ECC the hash data is processed as is, using pso_compute_digital_signature.
sourcepub fn pso_compute_digital_signature(
&mut self,
data: Vec<u8>
) -> Result<Vec<u8>, Error>
pub fn pso_compute_digital_signature(
&mut self,
data: Vec<u8>
) -> Result<Vec<u8>, Error>
Run signing operation on the smartcard (low level operation) (7.2.10 PSO: COMPUTE DIGITAL SIGNATURE)
(consider using the signature_for_hash()
method if you don’t
want to create the data field manually)
sourcepub fn authenticate_for_hash(
&mut self,
hash: Hash<'_>
) -> Result<Vec<u8>, Error>
pub fn authenticate_for_hash(
&mut self,
hash: Hash<'_>
) -> Result<Vec<u8>, Error>
Auth-sign hash
, on the card.
This is a wrapper around the low-level
internal_authenticate operation.
It builds the required data
field from hash
.
For RSA, this means a “DigestInfo” data structure is generated. (see 7.2.10.2 DigestInfo for RSA).
With ECC the hash data is processed as is.
sourcepub fn internal_authenticate(&mut self, data: Vec<u8>) -> Result<Vec<u8>, Error>
pub fn internal_authenticate(&mut self, data: Vec<u8>) -> Result<Vec<u8>, Error>
Run signing operation on the smartcard (low level operation) (7.2.13 INTERNAL AUTHENTICATE)
(consider using the authenticate_for_hash()
method if you don’t
want to create the data field manually)
sourcepub fn set_private_use_do(
&mut self,
num: u8,
data: Vec<u8>
) -> Result<Vec<u8>, Error>
pub fn set_private_use_do(
&mut self,
num: u8,
data: Vec<u8>
) -> Result<Vec<u8>, Error>
Set data of “private use” DO.
num
must be between 1 and 4.
Access condition:
- 1/3 need PW1 (82)
- 2/4 need PW3
pub fn set_name(&mut self, name: &[u8]) -> Result<(), Error>
pub fn set_lang(&mut self, lang: &[Lang]) -> Result<(), Error>
pub fn set_sex(&mut self, sex: Sex) -> Result<(), Error>
pub fn set_url(&mut self, url: &[u8]) -> Result<(), Error>
sourcepub fn set_cardholder_certificate(&mut self, data: Vec<u8>) -> Result<(), Error>
pub fn set_cardholder_certificate(&mut self, data: Vec<u8>) -> Result<(), Error>
Set cardholder certificate (for AUT, DEC or SIG).
Call select_data() before calling this fn to select a particular certificate (if the card supports multiple certificates).
sourcepub fn set_algorithm_attributes(
&mut self,
key_type: KeyType,
algo: &Algo
) -> Result<(), Error>
pub fn set_algorithm_attributes(
&mut self,
key_type: KeyType,
algo: &Algo
) -> Result<(), Error>
Set algorithm attributes (4.4.3.9 Algorithm Attributes)
sourcepub fn set_pw_status_bytes(
&mut self,
pw_status: &PWStatusBytes,
long: bool
) -> Result<(), Error>
pub fn set_pw_status_bytes(
&mut self,
pw_status: &PWStatusBytes,
long: bool
) -> Result<(), Error>
Set PW Status Bytes.
If long
is false, send 1 byte to the card, otherwise 4.
According to the spec, length information should not be changed.
So, effectively, with ‘long == false’ the setting pw1_cds_multi
can be changed.
With ‘long == true’, the settings pw1_pin_block
and pw3_pin_block
can also be changed.
(See OpenPGP card spec, pg. 28)
pub fn set_fingerprint(
&mut self,
fp: Fingerprint,
key_type: KeyType
) -> Result<(), Error>
pub fn set_ca_fingerprint_1(&mut self, fp: Fingerprint) -> Result<(), Error>
pub fn set_ca_fingerprint_2(&mut self, fp: Fingerprint) -> Result<(), Error>
pub fn set_ca_fingerprint_3(&mut self, fp: Fingerprint) -> Result<(), Error>
pub fn set_creation_time(
&mut self,
time: KeyGenerationTime,
key_type: KeyType
) -> Result<(), Error>
sourcepub fn set_resetting_code(&mut self, resetting_code: &[u8]) -> Result<(), Error>
pub fn set_resetting_code(&mut self, resetting_code: &[u8]) -> Result<(), Error>
Set resetting code (4.3.4 Resetting Code)
sourcepub fn generate_attestation(&mut self, key_type: KeyType) -> Result<(), Error>
pub fn generate_attestation(&mut self, key_type: KeyType) -> Result<(), Error>
Generate Attestation (Yubico)
sourcepub fn key_import(
&mut self,
key: Box<dyn CardUploadableKey>,
key_type: KeyType
) -> Result<(), Error>
pub fn key_import(
&mut self,
key: Box<dyn CardUploadableKey>,
key_type: KeyType
) -> Result<(), Error>
Import an existing private key to the card. (This implicitly sets the algorithm info, fingerprint and timestamp)
sourcepub fn generate_key(
&mut self,
fp_from_pub: fn(_: &PublicKeyMaterial, _: KeyGenerationTime, _: KeyType) -> Result<Fingerprint, Error>,
key_type: KeyType,
algo: Option<&Algo>
) -> Result<(PublicKeyMaterial, KeyGenerationTime), Error>
pub fn generate_key(
&mut self,
fp_from_pub: fn(_: &PublicKeyMaterial, _: KeyGenerationTime, _: KeyType) -> Result<Fingerprint, Error>,
key_type: KeyType,
algo: Option<&Algo>
) -> Result<(PublicKeyMaterial, KeyGenerationTime), Error>
Generate a key on the card. (7.2.14 GENERATE ASYMMETRIC KEY PAIR)
If the algo
parameter is Some, then this algorithm will be set on
the card for “key_type”.
Note: algo
needs to precisely specify the RSA bitsize of e (if
applicable), and import format, with values that the current card
supports.
sourcepub fn generate_key_simple(
&mut self,
fp_from_pub: fn(_: &PublicKeyMaterial, _: KeyGenerationTime, _: KeyType) -> Result<Fingerprint, Error>,
key_type: KeyType,
simple: AlgoSimple
) -> Result<(PublicKeyMaterial, KeyGenerationTime), Error>
pub fn generate_key_simple(
&mut self,
fp_from_pub: fn(_: &PublicKeyMaterial, _: KeyGenerationTime, _: KeyType) -> Result<Fingerprint, Error>,
key_type: KeyType,
simple: AlgoSimple
) -> Result<(PublicKeyMaterial, KeyGenerationTime), Error>
Generate a key on the card. (7.2.14 GENERATE ASYMMETRIC KEY PAIR)
This is a wrapper around generate_key() which allows
using the simplified AlgoSimple
algorithm selector enum.
Note: AlgoSimple doesn’t specify card specific details (such as bitsize of e for RSA, and import format). This function determines these values based on information from the card.
sourcepub fn public_key(
&mut self,
key_type: KeyType
) -> Result<PublicKeyMaterial, Error>
pub fn public_key(
&mut self,
key_type: KeyType
) -> Result<PublicKeyMaterial, Error>
Get public key material from the card.
Note: this fn returns a set of raw public key data (not an OpenPGP data structure).
Note also that the information from the card is insufficient to reconstruct a pre-existing OpenPGP public key that corresponds to the private key on the card.
Auto Trait Implementations
impl<'a> !RefUnwindSafe for OpenPgpTransaction<'a>
impl<'a> Send for OpenPgpTransaction<'a>
impl<'a> Sync for OpenPgpTransaction<'a>
impl<'a> Unpin for OpenPgpTransaction<'a>
impl<'a> !UnwindSafe for OpenPgpTransaction<'a>
Blanket Implementations
sourceimpl<T> BorrowMut<T> for T where
T: ?Sized,
impl<T> BorrowMut<T> for T where
T: ?Sized,
const: unstable · sourcefn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more