Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support nitrokey 3 #595

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Conversation

999eagle
Copy link

@999eagle 999eagle commented Jan 22, 2025

not sure whether this is in the scope of this library, but with the nitrokey 3 firmware 1.8.0 it now supports a piv applet as well and it'd be nice to reuse this library for the nitrokey 3 as well.

supporting the key required two (probably minor) changes:

  • the piv applet's aid uses the full aid as specified in nist sp 800-73pt1-5 section 2.2 instead of just the nist prefix. yubikeys seem to support both the prefix (which is technically against the spec) and the full aid (tested with a yubikey 5c nfc), while the nitrokey 3 requires the full aid.
  • the nitrokey 3, for some strange reason, does not return any data on the select application apdu, instead returning a bytes remaining response and requiring a separate get response call to return the actual data.

the nitrokey 3 also currently uses a static version (6.6.6) and serial (0x0052f743, 5437251), but supports the same commands as the yubikey 5.

according to nist sp 800-73-4, section 2.2 the aid of the piv applet is A0 00 00 03 08 00 00 10 00 01 00
where A0 00 00 03 08 is the nist rid, 00 00 10 00 indicates the piv application, and 01 00 is the piv version

tested with a yubikey 5c nfc which still works with this change, and with a nitrokey 3c which only responds
to the full aid instead of just the prefix
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant