Repository navigation
piv: let "Enable Anyway" also send the reads the compatibility table skips - #161
Merged
Merged
Conversation
…skips #128's override relaxes the PIV pane's controls but left the transport's internal reads (GET METADATA, ATTEST) gated by the table. A wrong entry there, e.g. for newer firmware, silently hides information (algorithms, PIN/touch policy) with no way to get it back and no trace of why. - PivSessionState carries a send-unsupported-reads choice, kept across a card change; the GUI sets it from "Enable Anyway" for that key and re-reads status when it is toggled. RESET is never overridden. - Every internal read the table skips, or sends anyway under the override, leaves a --debug / activity-log trace line naming the applet fingerprint, so a wrong entry can be spotted. - "Unlock Anyway" is now "Enable Anyway" (and "…are enabled for this key"); the rest of the wording is #128's. - CLAUDE.md lists keyroost-pivtest and its RustCrypto/dalek dependencies, including the new p521. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Skvxkb6eMzytjPDmL6mPYU
Parity with the GUI's "Enable Anyway": a PIV command run with --force (generate-key, change-management-key, reset, delete-key, move-key) now also sends GET METADATA and ATTEST for the rest of that command when the table lists them unsupported, each with a --debug trace line. Done once in guard_piv_feature, which every forced command calls first. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Skvxkb6eMzytjPDmL6mPYU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #128's PIV override (@episource, FYI — this reintroduces a transport-level piece you deliberately kept out, so I'd value your view).
Why: #128's "Unlock Anyway" relaxes the PIV pane's controls, but the transport still skips GET METADATA and ATTEST whenever the compatibility table lists them unsupported. If that entry is wrong (newer firmware, a misidentified card), keyroost silently hides algorithm and PIN/touch-policy information, and nothing shows why.
Changes
PivSessionState::set_send_unsupported_reads: a per-key choice, kept across a card change (set before the session's first read). The GUI sets it from "Enable Anyway" for that key and re-reads status when toggled. RESET and the reset mechanism choice are never overridden.PivSession::internal_read_allowed: one decision point for GET METADATA and ATTEST. Every read the table skips — or sends anyway under the override — leaves a--debug/ activity-log trace line naming the applet fingerprint. GET SLOT KEY STATUS is untouched: it reads through GET METADATA, and its gate in the import mismatch check only ever refuses on a supported verdict.--forceon a PIV command (generate-key,change-management-key,reset,delete-key,move-key) also sends those reads for the rest of the command (PivSession::set_send_unsupported_reads, set once inguard_piv_feature), with the same trace lines.keyroost-pivtestrow (rsa, p256/p384/p521, ed25519-dalek, x25519-dalek, zeroize), including PIV applet fingerprinting, device specific feature gates #128's newp521.Verified
-D warnings, workspace tests (1312), rustdoc-D warnings, docs audit.🤖 Generated with Claude Code
https://claude.ai/code/session_01Skvxkb6eMzytjPDmL6mPYU