yubikey.rs
yubikey.rs copied to clipboard
reset device only works if PIN is blocked
Per Yubico docs on the RESET command: https://developers.yubico.com/PIV/Introduction/Yubico_extensions.html
Do you want to have a force_reset_device
that does something like this?
let mut rng = rand::thread_rng();
loop {
let b: [u8; 8] = rand::Rng::gen(&mut rng);
let v = yk.verify_pin(&b);
if v.is_err() {
if yk.get_pin_retries().unwrap() <= 0 {
break;
}
}
}
ykpiv::yubikey::YubiKey::block_puk(&mut yk).unwrap();
yk.reset_device().unwrap();
Some precedent for this in block_puk
:
https://github.com/iqlusioninc/yubikey-piv.rs/blob/aaaf3b142e5556bbac7950d5f96befbe27efa132/src/yubikey.rs#L469
It sounds like a good feature, although I'd prefer a deterministic counter-based method like the one used in block_puk
to one based on an RNG.
Oh yeah, I had added that when I was making a different mistake and thought the PIN needed to change for it to count against retries, but that's obviously not the case. I can send a simpler version like you describe.