Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiple YubiKeys support #583

Open
wants to merge 35 commits into
base: master
Choose a base branch
from
Open

Multiple YubiKeys support #583

wants to merge 35 commits into from

Conversation

renatav
Copy link
Collaborator

@renatav renatav commented Jan 24, 2025

Description (e.g. "Related to ...", etc.)

This PR includes several major reworks/new features:

  • Key names defined in config files when creating a new repository or adding a new role are added to metadata files. This is possible following the transition to the newest version of TUF and securesystemslib. These names are loaded from metadata files when a repository is initialized and used when asking the user to insert a specific YubiKey.
  • When signing metadata, we now iterate over all inserted YubiKeys. The users will no longer have to remove and insert YubiKeys several times.
  • Add a PinManager class. Instances of this class can be passed into API functions, enabling reuse of already entered pin. Removed all code that stored pins in global dictionaries, as this is less secure.
    This will allow creation of scripts like this one:
pin_manager = PinManager(auto_continue=True)
pin_manager.add_pin(25924217, "123456")
update_metadata_expiration_date("auth1/auth1", pin_manager, roles=["root"], keystore="keystore")
update_metadata_expiration_date("auth1/auth1", pin_manager, roles=["targets"], keystore="keystore")

Of course, a PIN should not be specified in this manner when using production YubiKeys. If the PIN manager is empty, the first time a YubiKey is needed, TAF will prompt the user to enter the PIN. The script could also ensure that all PINs are securely entered before calling any of TAF's API functions

Signing after this rework will look like this:

Scenario 1 - no YubiKeys inserted initially, the user inserts one YubiKey first and then the second one later

Sign targets using YubiKey(s)? [y/N]: y
Please insert targets (userYK1, userYK3, user1) YubiKey(s) (threshold 2) and press ENTER
Enter PIN for userYK1:
Confirm PIN for userYK1:
Please insert targets (userYK3, user1) YubiKey(s) (threshold 2) and press ENTER
Enter PIN for userYK3:
Confirm PIN for userYK3:
Threshold of targets keys reached. Do you want to load more targets keys? [y/N]: n

Scenario 2 - no YubiKeys inserted initially, the users inserts both YubiKeys at the same time:

Sign targets using YubiKey(s)? [y/N]: y
Please insert targets (userYK1, userYK3, user1) YubiKey(s) (threshold 2) and press ENTER 
Enter PIN for userYK1:
Confirm PIN for userYK1:
Enter PIN for userYK3:
Confirm PIN for userYK3:
Threshold of targets keys reached. Do you want to load more targets keys? [y/N]: n

Here are config files used to create repositories and specify addition of a new role:

keys-description.json
keys-description2.json
keys-description3.json
keys-description4.json
role-config.json

Fix #244

Code review checklist (for code reviewer to complete)

  • Pull request represents a single change (i.e. not fixing disparate/unrelated things in a single PR)
  • Title summarizes what is changing
  • Commit messages are meaningful (see this for details)
  • Tests have been included and/or updated, as appropriate
  • Docstrings have been included and/or updated, as appropriate
  • Changelog has been updated, as needed (see CHANGELOG.md)

@renatav renatav changed the title Renatav/multiple yubikeys Multiple YubiKeys support Jan 24, 2025
@renatav renatav force-pushed the renatav/multiple-yubikeys branch from 1737f6d to 87eb87a Compare January 24, 2025 05:37
@renatav renatav force-pushed the renatav/multiple-yubikeys branch 3 times, most recently from d6d310f to de62af3 Compare January 29, 2025 23:47
@renatav renatav force-pushed the renatav/multiple-yubikeys branch from de62af3 to c98b314 Compare January 29, 2025 23:50
@renatav renatav marked this pull request as ready for review January 30, 2025 00:09
@renatav renatav self-assigned this Jan 30, 2025
@renatav renatav requested review from n-dusan and sale3 January 30, 2025 00:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Use multiple YubiKeys at the same time
1 participant