nitrokey-3-firmware: NK3AM doesn't do make_cred + assert in the same process with opcard firmware (hmac-secret)
UPDATE
This can be produced with only libfido2 (latest) https://github.com/Nitrokey/nitrokey-3-firmware/issues/94#issuecomment-1286819682
ORIGINAL REPORT
enrolling a NK3ANFC works like a charm:
β ~ sudo systemd-cryptenroll --fido2-device=auto /dev/nvme0n1p3
π Please enter current passphrase for disk /dev/nvme0n1p3: ******
Initializing FIDO2 credential on security token.
π (Hint: This might require confirmation of user presence on security token.)
π Please enter security token PIN: ********
Generating secret key on FIDO2 security token.
π In order to allow secret key generation, please confirm presence on security token.
New FIDO2 token enrolled as key slot 1.
But if I wipe the slot, and retry with a NK3AM all I get is being stuck and just hangs (setting systemd debug doesnβt show anything either):
β ~ sudo systemd-cryptenroll --fido2-device=auto --wipe-slot=fido2 /dev/nvme0n1p3
π Please enter current passphrase for disk /dev/nvme0n1p3: ******
Initializing FIDO2 credential on security token.
π (Hint: This might require confirmation of user presence on security token.)
π Please enter security token PIN: **********
Generating secret key on FIDO2 security token.
π In order to allow secret key generation, please confirm presence on security token.
<just hangs here forever w/o any journal or dmesg logs>
Iβve correctly touched the 3AM twice too, and inserted the correct pin too Since cryptenroll is following a standard, I believe there must be a difference (or bug) between the NFC and Mini variants
I donβt know if itβs useful but the 3AM works the very same when used for MFA on Fedora with pamu2fcfg - so it seems at least there, they work the same (they should both be fido2 capable)
Also, while the process hangs above, what happens is that if I just ctrl-c the whole process, the 3AM is just in some state that requires me to unplug and plug it again to make it work (again) - operations like gpg --card-status
just hangs too while the device is busy with cryptenroll
both cards are running firmware 1.2.2 and the 3AM also has the opcard firmware too
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Comments: 19 (19 by maintainers)
Unfortuantely this has not yet been released. Iβll let you know once it is.
On
6e2ce7ccb8bafd5c8a86b251630dbd74e58d60b2
with default features:https://github.com/solokeys/fido-authenticator/blob/0.1.1/src/ctap2.rs#L1385
Returned by: https://github.com/Nitrokey/trussed/blob/v0.1.0-nitrokey-2/src/mechanisms/hmacsha256.rs#L19 because the key is a
P256
key. Introduced by: https://github.com/Nitrokey/trussed/commit/b0212a4c06fd25310ba5abcf6fc479ebb3abf2ceNext steps:
Thanks for the report! Iβll try to reproduce this with my device and get back to you.
So Iβve patched systemd-crytpenroll to spit out libfido2 debug and this is what Iβm getting
Working NK3AN libfido2+systemd debug logs
In this case, the whole process just hangs - the NK3M doesnβt blink anymore (it did blink twice and Iβve correctly touched it, then nothing) and as said already, itβs like itβs shutdown and I have to unplug and replug to make it working again
Non Working NK3M libfido2+systemd debug logs