RS-Key v0.4.10

[0.4.10] - 2026-08-14

The conformance release: every applet swept against a real YubiKey 5.7.4, three
runs per cell, with each difference measured before it was called a bug — which
retired several of the findings that had started the sweep. Four of what survived
could damage a key, and two defaults change in ways you will notice. The rest is
status words, at-rest ordering, and the instruments that were supposed to catch
this class already: proofs that ran against nothing, fuzz targets that never
reached their applet, and gate rows nobody had watched go red.

TL;DR

A conformance release, measured rather than argued: where an entry below names a
reference, it is a YubiKey 5.7.4, three runs per cell. If you read nothing else:

• Four ways to damage a key are closed. A PIV VERIFY whose body was not the
  8-byte wire form spent a PIN retry, so three malformed commands blocked the PIN.
  A short unpadded new reference was stored verbatim, and with the PUK shortened
  too the only exit was INS FB RESET — which destroys every PIV key. A signature
  at a PIN-always slot locked the card. And generating an OpenPGP keypair
  destroyed an AES key the host had installed.
• Two defaults changed and you will see it. PIV slot 9e defaults to PIN
  NEVER, which is what SP 800-73-4 makes the card-authentication key for, and a
  key generated without --touch-policy no longer demands a touch on every
  operation — that one used to hang scripted use with no diagnostic.
• One thing to know when upgrading. The OpenPGP sex DO 5F35 narrows to the
  codes the reference accepts; a device provisioned before this release is
  migrated on its next boot, once, and needs nothing from you.
• The debug counter read is gone from shipping images. Vendor INS 12
  reported the prime-search statistics on every build; it is behind a feature now,
  like its two neighbours.

Everything else is status words, at-rest ordering, and the instruments — grouped
below in the usual four sections, security last.

Shortened to fit GitHub's release-body limit.
Every entry is in CHANGELOG.md at this tag.

---

Verify a download: https://github.com/TheMaxMur/RS-Key/blob/v0.4.10/docs/supply-chain.md