-
Notifications
You must be signed in to change notification settings - Fork 64
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add new algorithms supported in firmware 5.7.x #157
base: v2
Are you sure you want to change the base?
Conversation
This commit supports the new algorithms supported on YubiKeys with a 5.7.x firmware. It adds support for RSA-3072, RSA-4096, Ed25519, and X25519. Generating or importing X25519 keys is only supported with Go 1.20+, which adds support for the crypto/ecdh package.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks great! A couple of comments, but otherwise lgtm
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://go.dev/doc/devel/release#policy
Versions of Go earlier than 1.20 are no longer supported. Let's not bother with this?
"fmt" | ||
) | ||
|
||
type X25519PrivateKey struct { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add a comment to this exported type similar to ECDSAPrivateKey, explaining that users are expected to type case private keys to this type.
https://pkg.go.dev/github.com/go-piv/piv-go/v2/piv#ECDSAPrivateKey
}) | ||
} | ||
|
||
func (yk *YubiKey) tryX25519PrivateKey(slot Slot, public crypto.PublicKey, auth KeyAuth, pp PINPolicy) (crypto.PrivateKey, error) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Go generally doesn't use "try" in the method name
newX25519PrivateKey()
} | ||
} | ||
|
||
func (yk *YubiKey) tryX22519PrivateKeyInsecure(private crypto.PrivateKey) ([][]byte, byte, int, error) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"setX22519PrivateKeyInsecure"
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ditto: let's remove this and drop support for earlier versions of Go
This commit supports the new algorithms supported on YubiKeys with a 5.7.x firmware. It adds support for RSA-3072, RSA-4096, Ed25519, and X25519.
Generating X25519 keys is only supported with Go 1.20+, which adds support for the
crypto/ecdh
package.Note that this commit removes the support for Ed25519 on SoloKeys if the algorithm identifier is set to 0x22.
Fixes #143