yubikeycommands.hpp

Go to the documentation of this file.

 
#ifndef LOGICALACCESS_YUBIKEYCOMMANDS_HPP
#define LOGICALACCESS_YUBIKEYCOMMANDS_HPP
 
#include <logicalaccess/plugins/cards/iso7816/iso7816commands.hpp>
#include <logicalaccess/plugins/cards/yubikey/lla_cards_yubikey_api.hpp>
#include <logicalaccess/tlv.hpp>
#include <vector>
 
namespace logicalaccess
{
#define CMD_YUBIKEY "Yubikey"
 
typedef enum
{
    HMAC_UNKNOWN = 0x00,
    HMAC_SHA1    = 0x01,
    HMAC_SHA256  = 0x02,
    HMAC_SHA512  = 0x03,
    HMAC_TYPE_HOTP    = 0x10,
    HMAC_TYPE_TOTP    = 0x20
} YubikeyHMAC;
 
typedef enum
{
    PROP_NONE             = 0x00,
    PROP_ONLY_INCREASE    = 0x01, /* Enforces that a challenge is always higher than the previous */
    PROP_REQUIRE_TOUCH    = 0x02 /* Require button press to generate OATH codes */
} YubikeyProperty;
 
typedef enum
{
    SLOT_DUMMY                   = 0x00,
    SLOT_CONFIG_1                = 0x01,
    SLOT_NAV                     = 0x02,
    SLOT_CONFIG_2                = 0x03,
    SLOT_UPDATE_1                = 0x04,
    SLOT_UPDATE_2                = 0x05,
    SLOT_SWAP                    = 0x06,
    SLOT_NDEF_1                  = 0x08,
    SLOT_NDEF_2                  = 0x09,
    SLOT_DEVICE_SERIAL           = 0x10,
    SLOT_DEVICE_CONFIGURATION    = 0x11,
    SLOT_SCAN_MAP                = 0x12,
    SLOT_YUBIKEY_4_CAPABILITIES  = 0x13,
    SLOT_CHALLENGE_OTP_1         = 0x20,
    SLOT_CHALLENGE_OTP_2         = 0x28,
    SLOT_CHALLENGE_HMAC_1        = 0x30,
    SLOT_CHALLENGE_HMAC_2        = 0x38
} YubikeySlot;
 
typedef struct s_YubikeySelectResponse
{
    ByteVector version;
    ByteVector name;
    YubikeyHMAC algorithm = HMAC_UNKNOWN;
    ByteVector challenge;
} YubikeySelectResponse;
 
typedef struct s_YubikeyCalculateResponse
{
    ByteVector name;
    uint8_t digits = 0;
    ByteVector response;
} YubikeyCalculateResponse;
 
typedef struct s_YubikeyListItem
{
    YubikeyHMAC algorithm = HMAC_UNKNOWN;
    ByteVector name;
} YubikeyListItem;
 
#define YUBIKEY_TLV_DEVINFO_AVAILABLE_CAPABILITIES_USB  0x01 /* USB Applications and capabilities that are available for use on this YubiKey. */
#define YUBIKEY_TLV_DEVINFO_SERIAL_NUMBER               0x02 /* Returns the serial number of the YubiKey (if present and visible). */
#define YUBIKEY_TLV_DEVINFO_ENABLED_CAPABILITIES_USB    0x03 /* Applications that are currently enabled over USB on this YubiKey. */
#define YUBIKEY_TLV_DEVINFO_FORM_FACTOR                 0x04 /* Specifies the form factor of the YubiKey (USB-A, USB-C, Nano, etc.) */
#define YUBIKEY_TLV_DEVINFO_FIRMWARE_VERSION            0x05 /* The Major.Minor.Patch version number of the firmware running on the YubiKey. */
#define YUBIKEY_TLV_DEVINFO_AUTOEJECT_TIMEOUT           0x06 /* Timeout in (ms?) before the YubiKey automatically "ejects" itself. */
#define YUBIKEY_TLV_DEVINFO_CHALLENGE_RESPONSE_TIMEOUT  0x07 /* The period of time (in seconds) after which the OTP challenge-response command should timeout. */
#define YUBIKEY_TLV_DEVINFO_DEVICE_FLAGS                0x08 /* Device flags that can control device-global behavior. */
#define YUBIKEY_TLV_DEVINFO_CONFIGURATION_LOCK          0x0A /* Indicates whether or not the YubiKey's configuration has been locked by the user. */
#define YUBIKEY_TLV_DEVINFO_AVAILABLE_CAPABILITIES_NFC  0x0D /* NFC Applications and capabilities that are available for use on this YubiKey. */
#define YUBIKEY_TLV_DEVINFO_ENABLED_CAPABILITIES_NFC    0x0E /* Applications that are currently enabled over USB on this YubiKey. */
 
#define YUBIKEY_TLV_NAME 0x71
#define YUBIKEY_TLV_NAME_LIST 0x72
#define YUBIKEY_TLV_KEY 0x73
#define YUBIKEY_TLV_CHALLENGE 0x74
#define YUBIKEY_TLV_FULL_RESPONSE 0x75
#define YUBIKEY_TLV_TRUNCATED_RESPONSE 0x76
#define YUBIKEY_TLV_HOTP_RESPONSE 0x77
#define YUBIKEY_TLV_PROPERTY 0x78
#define YUBIKEY_TLV_VERSION 0x79
#define YUBIKEY_TLV_IMF 0x7a
#define YUBIKEY_TLV_ALGORITHM 0x7b
#define YUBIKEY_TLV_TOUCH_RESPONSE 0x7c
 
class LLA_CARDS_YUBIKEY_API YubikeyCommands : public Commands
{
  public:
  
    YubikeyCommands()
        : Commands(CMD_YUBIKEY)
    {
    }
 
    explicit YubikeyCommands(std::string cmdtype)
        : Commands(cmdtype)
    {
    }
  
    virtual YubikeySelectResponse selectYubikeyOATH() = 0;
    
    virtual ByteVector selectYubikeyOTP() = 0;
    
    /******************************************************
     *                                                    *
     *                   === OTP ===                      *
     *                                                    *
     * All OTP management commands are skipped for now as *
     * Yubikey Manager app can be used for initial setup. *
     *                                                    *
     ******************************************************/
    
    virtual ByteVector otp_getResponse(YubikeySlot slot, const ByteVector& challenge) = 0;
    
    virtual ByteVector otp_getSerialNumber() = 0;
    
    virtual std::vector<TLVPtr> otp_getDeviceInfo() = 0;
    
    virtual bool otp_queryFIPSMode() = 0;
    
    /******************************************************
     *                                                    *
     *                   === OAUTH ==                     *
     *                                                    *
     ******************************************************/
 
    virtual void oath_put(const ByteVector& name, YubikeyHMAC algorithm, uint8_t digits, const ByteVector& key, YubikeyProperty property = PROP_NONE, const ByteVector& imf = ByteVector()) = 0;
 
    virtual void oath_delete(const ByteVector& name) = 0;
 
    virtual void oath_setCode(YubikeyHMAC algorithm, const ByteVector& key, const ByteVector& challenge) = 0;
    
    virtual std::vector<YubikeyListItem> oath_list() = 0;
    
    virtual void oath_reset() = 0;
    
    virtual YubikeyCalculateResponse oath_calculate(const ByteVector& name, const ByteVector& challenge, bool truncate = false) = 0;
    
    virtual ByteVector oath_validate(const ByteVector& challenge, const ByteVector& response) = 0;
    
    virtual std::vector<YubikeyCalculateResponse> oath_calculateAll(const ByteVector& challenge, bool truncate = false) = 0;
    
    virtual ByteVector oath_sendRemainingInstruction() = 0;
    
    virtual std::shared_ptr<ISO7816Commands> getISO7816Commands() const = 0;
};
}
 
#endif