Cannot add LUKS key: fgets error 0x00

[schaerfo]

Describe the bug
After generating the keyfile, adding the key to LUKS with khefin-add-luks-key fails.

To Reproduce
Steps to reproduce the behavior:

1. Generate a keyfile with khefin enrol
2. Attempt to add the LUKS key with sudo khefin-add-luks-key /tmp/keyfile /dev/nvme0n1p6
3. Enter passphrase for keyfile
4. The error khefin: Unable to get authenticator PIN for ONLYKEY at /dev/hidraw1 on STDIN: fgets error 0x00 is displayed and khefin exits with status 68

Expected behavior
I am prompted to tap the security key, after that, the LUKS key is added.

Environment:

• Operating system: Manjaro Linux
• Version: 0.6.0
• Authenticator make and model: Onlykey, Solokey Tap A (same behavior with both keys)

[mjec]

Thanks for the report @schaerfo! I'll take a look in the next couple of days, but I think I know what the issue might be.

[mjec]

Quick update here:

• As I suspected, the fix is to prompt for PIN as well as passphrase in the khefin-add-luks-key script
• We also need to do this in the initramfs and mkinitcpio run scripts
• I would like to avoid prompting unless there is at least one authenticator connected which requires a PIN, to avoid prompting for a PIN when it's not necessary; but this involves adding a new subcommand to khefin for this purpose

I'm still in the process of putting this together in a patch, but I'll have that sorted out this week for sure.

[schaerfo]

Thank you for your work so far, no need to hurry

[ZenithalHourlyRate]

Reproduced this bug using Yubikey having FIDO PIN. Meanwhile, with another key (CanoKey) without FIDO PIN, the behavior is expected.

[mjec]

This is fixed in version 0.6.1, now tagged and released.