nitrokey-pro-firmware icon indicating copy to clipboard operation
nitrokey-pro-firmware copied to clipboard

Published 20 hours ago • verified publisher icon Nitrokey

Support longer PINs

Open jans23 opened this issue 7 years ago • 4 comments

The firmware (and NK App) support max of 20 character long PINs while the OpenPGP Card supports 32 characters. The firmware and App should be changed to support entire 32 characters.

jans23 avatar Mar 21 '17 16:03 jans23

@szszszsz Was this corrected in newer firmware versions? Seems like this is present to firmware 0.9 0.10 and 0.11 and impacts https://github.com/osresearch/heads/issues/1167 which doesn't report any error when setting the PIN, but fails at HOTP sealing with Admin PIN.

I didn't meet this limitation in my tests with "Insurgo Open Technologies" which is 25 chars. But 26 chars+ < 32 fails...

tlaurion avatar Jun 02 '22 15:06 tlaurion

@szszszsz @jans23: the firmware (0.9, 0.10, 0.11) permits longer PINs to be provisioned (up to 64?) But HOTP sealing (Heads) only works when provided with GPG Admin PIN <=25 chars.

https://github.com/osresearch/heads/pull/1168 circumvents this firmware issue under Heads OEM Factory Reset/Re-Ownership security components provisioning (forcing GPG Admin PIN <=25 chars and GPG User PIN <=64 chars) for all USB Security dongles, also limiting custom passphrase (which is propagated to all security components, including GPG Admin PIN) to be <=25 characters as well to circumvent this issue.

Whatever happens with this issue won't make us go back in time for Nitrokey Pro devices which aren't user upgradeable, so fixing this results in some kind of limitation for all USB Security dongles to be provisioned/used under Heads.

As of now, Heads master only limited the minimum size of the PIN to be 8 chars, not enforcing this known limitation (which is not 20 chars, but 25. Why 25, not 20, is another topic).

tlaurion avatar Jun 02 '22 18:06 tlaurion

Hi @tlaurion! Sorry for the delay.

  1. Indeed the protocol used is limited to 20-25 characters for the PIN length, depending on the command. Thank you for adding this check.
  2. This problem is still present in the current Nitrokey Pro firmware unfortunately.
  3. As for the solution we could:
    • fix this problem in the current Nitrokey Pro firmware,
    • add support to the nitrokey-hotp-verification for this change (selecting protocol by the firmware version), and
    • leave the check from the mentioned PR only for the non-upgradable older versions, which are <= 0.10.

szszszsz avatar Jun 10 '22 08:06 szszszsz

@szszszsz So Heads now makes sure that PINs are <= 25 characters

tlaurion avatar Jun 27 '22 16:06 tlaurion