Add initial support for SCP #145

dainnilsson · 2024-07-02T13:00:40Z

Implements support for Security Domain session.

Key management allows clients to import, replace and delete SCP03 and SCP11 keys and certificates.
Application sessions (PIV, OpenPGP, OATH, Ctap2, YubiOTP) have new constructors with SCP parameters to initialize secure communication over smart-card connection.
Updated device tests verify functionality of the management features as well test YubiKey applications over a secure SCP11b connection.

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java

oath/src/main/java/com/yubico/yubikit/oath/OathSession.java

management/src/main/java/com/yubico/yubikit/management/ManagementSession.java

openpgp/src/main/java/com/yubico/yubikit/openpgp/OpenPgpSession.java

core/src/main/java/com/yubico/yubikit/core/smartcard/AppId.java

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/Scp03KeyParams.java

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/Scp11KeyParams.java

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/SecurityDomainSession.java

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/StaticKeys.java

piv/src/main/java/com/yubico/yubikit/piv/PivSession.java

Deprecate individual configuration methods on SmartCardProtocol in favor of a single .configure() method. Make ApduProcessor Closable. Add SCP support to YubiOtpSession.

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java

testing/src/main/java/com/yubico/yubikit/testing/TestState.java

It's not supported by the JVM in general, so no use implementing it now.

testing/src/main/java/com/yubico/yubikit/testing/openpgp/OpenPgpDeviceTests.java

testing/src/main/java/com/yubico/yubikit/testing/oath/OathDeviceTests.java

testing/src/main/java/com/yubico/yubikit/testing/oath/OathTestUtils.java

testing/src/main/java/com/yubico/yubikit/testing/fido/BasicWebAuthnClientTests.java

testing/src/main/java/com/yubico/yubikit/testing/sd/Scp11TestData.java

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java

testing/src/main/java/com/yubico/yubikit/testing/piv/PivTestState.java

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/Scp11KeyParams.java

piv/src/main/java/com/yubico/yubikit/piv/PivSession.java

AdamVe

LGTM!

github-advanced-security bot found potential problems Jul 2, 2024

View reviewed changes

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java Dismissed Show dismissed Hide dismissed

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Jul 2, 2024

View reviewed changes

oath/src/main/java/com/yubico/yubikit/oath/OathSession.java Fixed Show fixed Hide fixed

management/src/main/java/com/yubico/yubikit/management/ManagementSession.java Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Jul 2, 2024

View reviewed changes

piv/src/main/java/com/yubico/yubikit/piv/PivSession.java Fixed Show fixed Hide fixed

dainnilsson added 2 commits July 3, 2024 08:53

Add initial support for SCP

49b96f5

Ensure version is set prior to requirement check

31844e0

dainnilsson force-pushed the dain/scp branch from 855a388 to 31844e0 Compare July 3, 2024 07:19

dainnilsson added 3 commits July 3, 2024 09:46

Return ApduResponse instead of byte[]

3bedfa7

Implement SecurityDomain.reset()

9ff4ed0

Refactor SCP

aa06438

Deprecate individual configuration methods on SmartCardProtocol in favor of a single .configure() method. Make ApduProcessor Closable. Add SCP support to YubiOtpSession.

dainnilsson force-pushed the dain/scp branch from a49b5cc to aa06438 Compare July 5, 2024 11:12

Implement Security Domain PUT KEY

671420c

github-advanced-security bot found potential problems Jul 5, 2024

View reviewed changes

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java Dismissed Show dismissed Hide dismissed

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java Dismissed Show dismissed Hide dismissed

github-advanced-security bot found potential problems Jul 5, 2024

View reviewed changes

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java Dismissed Show dismissed Hide dismissed

AdamVe added 5 commits July 8, 2024 13:07

initial integration tests of FIPS approved PIV

5fa5447

improve PIV device tests based on HW type

234edbf

add FIPS PIV JCA provider tests

53c1374

refactor FIPS PIV integration tests

40a2f5e

Merge branch 'adamve/test/fips_piv' into dain/scp

32b98a3

github-advanced-security bot found potential problems Jul 8, 2024

View reviewed changes

testing/src/main/java/com/yubico/yubikit/testing/TestState.java Fixed Show fixed Hide fixed

dainnilsson and others added 6 commits July 10, 2024 12:24

Remove Destroyable interface

e013959

It's not supported by the JVM in general, so no use implementing it now.

Don't include Le in MAC calculation

c7a782b

add OpenPgp FIPS integration tests

ac73b3d

Fix NFC timeout for tests, add test suites

94af86c

change state variable names

abaa35d

Merge branch 'adamve/test/fips_openpgp' into dain/scp

9fb0522

github-advanced-security bot found potential problems Jul 10, 2024

View reviewed changes

add FIPS OATH device tests

94fbcd6

github-advanced-security bot found potential problems Jul 11, 2024

View reviewed changes

testing/src/main/java/com/yubico/yubikit/testing/oath/OathDeviceTests.java Dismissed Show dismissed Hide dismissed

testing/src/main/java/com/yubico/yubikit/testing/oath/OathTestUtils.java Fixed Show fixed Hide fixed

refactor test framework

167e0b9

AdamVe added 8 commits July 23, 2024 13:23

inject state into tests

18856b2

self review

69eaa07

rebase fixes

3997845

fix enterprise attestation tests

85362e9

self review

5cae0f7

self review

0a954a1

self review

48fd760

Merge PR #146

274e2f6

github-advanced-security bot found potential problems Jul 23, 2024

View reviewed changes

testing/src/main/java/com/yubico/yubikit/testing/fido/BasicWebAuthnClientTests.java Dismissed Show dismissed Hide dismissed

AdamVe added 8 commits July 24, 2024 15:16

add first test for SCP03

e9a6058

SCP03 tests

5bc0266

add SCP11a import key tests

07fa73e

add additional tests

117cc29

refactor

e866021

refactor and update style

41efd9b

make log message consistent

76d893d

Merge PR #148

c125463

github-advanced-security bot found potential problems Aug 6, 2024

View reviewed changes

testing/src/main/java/com/yubico/yubikit/testing/sd/Scp11TestData.java Dismissed Show dismissed Hide dismissed

AdamVe added 3 commits August 8, 2024 16:02

remove unchecked calls in test code

1fefaa2

self review

65ff8e7

Merge branch 'main' into dain/scp

dcb4f1e

github-advanced-security bot found potential problems Aug 8, 2024

View reviewed changes

core/src/main/java/com/yubico/yubikit/core/smartcard/scp/ScpState.java Dismissed Show dismissed Hide dismissed

AdamVe marked this pull request as ready for review August 9, 2024 06:32

dainnilsson commented Aug 9, 2024

View reviewed changes

AdamVe added 3 commits August 9, 2024 11:32

remove 'default' from PIV test state var names

400cc85

remove unnecessary public methods, update tests

fa702d5

simplify storeAllowlist test

f6e7c17

AdamVe approved these changes Aug 9, 2024

View reviewed changes

AdamVe merged commit 5527bef into main Aug 9, 2024
16 checks passed

AdamVe deleted the dain/scp branch August 9, 2024 12:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add initial support for SCP #145

Add initial support for SCP #145

dainnilsson commented Jul 2, 2024 •

edited by AdamVe

Loading

AdamVe left a comment

Add initial support for SCP #145

Add initial support for SCP #145

Conversation

dainnilsson commented Jul 2, 2024 • edited by AdamVe Loading

AdamVe left a comment

Choose a reason for hiding this comment

dainnilsson commented Jul 2, 2024 •

edited by AdamVe

Loading