-
Notifications
You must be signed in to change notification settings - Fork 42
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
OTP calculateHmacSha1 requiring touch doesn't work after requesting device info #98
Comments
Hi Jeff, I am going to check this. Please let me know which version of yubikit-android you use. |
Using version 2.2.0 |
Hi, I tried to simulate/reproduce what you described, but without success. Could you try the attached snippet in the demo app (2.2.0) and let me know if you see the same issue? Just replace the activityViewModel.yubiKey.observer(viewLifecycleOwner) block with the attached snippet, start the DemoApp, and connect the YubiKey over USB - it should be blinking, waiting for touch, after which the hmacSha1 calculation should be successful. For the test, Slot 1 should be setup with challenge-response and touch required. I also attached my logcat output. One thing I realised with YubiKey Neo is that when using it with an Android phone, I need to hold the phone in my hand for the touch to be registered. I use different types of USB-C - USB-A adaptors to connect the key to the phone and the touches would not be registered if the phone is just laying on the table when touching the YubiKey sensor. (Newer YubiKey’s like YubiKey 5 do not have such issue). snippet
logcat
|
I'm seeing the same issue with the demo change. I tried the demo app at version 2.2.0 as well as mainline. The device info reported by the app is a 'YubiKey NEO' device, version 3.2.0, device form factor UNKNOWN, challenge response timeout: null. My phone is a Google Pixel XL running Android 10. Using the demo app without the changes, I can get the issue to occur as well. From the initial screen, I'll insert the Yubikey and grant permission. The app shows the device info. If I then navigate to the YubiOTP screen and the challenge-response tab and then set the programmed slot (two) and click 'Calculate response', it'll give the No Data error popup. On that screen, if I remove the key and reinsert, the click on 'Calculate repsonse' succeeds. logcat16:15:03.366 yubikit D UsbDevice attached: /dev/bus/usb/001/002
16:15:03.380 yubikit D request permission
16:15:03.471 yubikit D Requesting permission for UsbDevice: /dev/bus/usb/001/002
16:15:05.471 yubikit D Permission result for /dev/bus/usb/001/002, permitted: true
16:15:05.471 yubikit D permission result true
16:15:05.471 yubikit D USB device attached com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice@2664d1a, current: null
16:15:05.472 yubikit D YubiKey connected
16:15:05.480 yubikit D Creating new CachedOtpConnection
16:15:05.485 yubikit D USB connection opened: com.yubico.yubikit.android.transport.usb.connection.UsbSmartCardConnection@a0c20e6
16:15:05.486 yubikit D 10 bytes sent over ccid: 62 00 00 00 00 00 00 00 00 00
16:15:05.494 yubikit D 30 bytes received: 80 14 00 00 00 00 00 00 00 00 3b fa 13 00 00 81 31 fe 15 59 75 62 69 6b 65 79 4e 45 4f a6
16:15:05.496 yubikit D 23 bytes sent over ccid: 6f 0d 00 00 00 00 01 00 00 00 00 a4 04 00 08 a0 00 00 05 27 47 11 17
16:15:05.500 yubikit D 42 bytes received: 80 20 00 00 00 00 01 00 00 00 44 46 55 20 65 6e 61 62 6c 65 64 20 2d 20 46 57 20 76 65 72 73 69 6f 6e 20 33 2e 32 2e 30 90 00
16:15:05.502 yubikit D 14 bytes sent over ccid: 6f 04 00 00 00 00 02 00 00 00 a4 04 00 08
16:15:05.513 yubikit D 12 bytes received: 80 02 00 00 00 00 02 00 00 00 6e 00
16:15:05.515 yubikit D 23 bytes sent over ccid: 6f 0d 00 00 00 00 03 00 00 00 00 a4 04 00 08 a0 00 00 05 27 20 01 01
16:15:05.527 yubikit D 22 bytes received: 80 0c 00 00 00 00 03 00 00 00 03 02 00 03 87 07 02 00 00 00 90 00
16:15:05.529 yubikit D 23 bytes sent over ccid: 6f 0d 00 00 00 00 04 00 00 00 00 a4 04 00 08 a0 00 00 05 27 20 01 01
16:15:05.539 yubikit D 22 bytes received: 80 0c 00 00 00 00 04 00 00 00 03 02 00 03 87 07 02 00 00 00 90 00
16:15:05.541 yubikit D 15 bytes sent over ccid: 6f 05 00 00 00 00 05 00 00 00 00 01 10 00 00
16:15:05.549 yubikit D 16 bytes received: 80 06 00 00 00 00 05 00 00 00 00 27 fb ac 90 00
16:15:05.549 yubikit D Scan for available ccid applications
16:15:05.550 yubikit D 21 bytes sent over ccid: 6f 0b 00 00 00 00 06 00 00 00 00 a4 04 00 06 d2 76 00 01 24 01
16:15:05.557 yubikit D 12 bytes received: 80 02 00 00 00 00 06 00 00 00 90 00
16:15:05.558 yubikit D 23 bytes sent over ccid: 6f 0d 00 00 00 00 07 00 00 00 00 a4 04 00 08 a0 00 00 05 27 21 01 01
16:15:05.584 yubikit D 37 bytes received: 80 1b 00 00 00 00 07 00 00 00 79 03 00 02 01 71 08 46 e2 48 94 f3 d2 d7 a4 74 08 91 0a 4f 62 15 1e 79 6e 90 00
16:15:05.585 yubikit D 20 bytes sent over ccid: 6f 0a 00 00 00 00 08 00 00 00 00 a4 04 00 05 a0 00 00 03 08
16:15:05.594 yubikit D 31 bytes received: 80 15 00 00 00 00 08 00 00 00 61 11 4f 06 00 00 10 00 01 00 79 07 4f 05 a0 00 00 03 08 90 00
16:15:05.596 yubikit D 23 bytes sent over ccid: 6f 0d 00 00 00 00 09 00 00 00 00 a4 04 00 08 a0 00 00 06 47 2f 00 01
16:15:05.601 yubikit D 12 bytes received: 80 02 00 00 00 00 09 00 00 00 6d 00
16:15:05.602 yubikit D Missing applet FIDO, capability U2F
16:15:05.603 yubikit D 22 bytes sent over ccid: 6f 0c 00 00 00 00 0a 00 00 00 00 a4 04 00 07 a0 00 00 05 27 10 02
16:15:05.608 yubikit D 12 bytes received: 80 02 00 00 00 00 0a 00 00 00 6d 00
16:15:05.609 yubikit D Missing applet AID_U2F_YUBICO, capability U2F
16:15:05.609 yubikit D Read info com.yubico.yubikit.management.DeviceInfo@1144627
16:15:05.609 yubikit D Read device info successfully: 3.2.0
16:15:05.609 yubikit D USB connection closed: com.yubico.yubikit.android.transport.usb.connection.UsbSmartCardConnection@a0c20e6
16:15:05.617 yubikit D USB connection opened: com.yubico.yubikit.android.transport.usb.connection.UsbOtpConnection@a0e527d
16:15:05.618 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.622 yubikit D Sending payload over HID to slot 0x12: 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 00 00 00 00 00 00 00 00 00 00 00 00 00
16:15:05.622 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.623 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.624 yubikit D WRITE FEATURE REPORT: 63 63 63 63 63 63 63 80
16:15:05.625 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.626 yubikit D WRITE FEATURE REPORT: 63 63 63 63 63 63 63 81
16:15:05.628 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.629 yubikit D WRITE FEATURE REPORT: 63 63 63 63 63 63 63 82
16:15:05.632 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.634 yubikit D WRITE FEATURE REPORT: 63 63 63 63 63 63 63 83
16:15:05.636 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.636 yubikit D WRITE FEATURE REPORT: 63 63 63 63 63 63 63 84
16:15:05.638 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.639 yubikit D WRITE FEATURE REPORT: 63 63 63 63 63 63 63 85
16:15:05.640 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.641 yubikit D WRITE FEATURE REPORT: 63 63 63 63 63 63 63 86
16:15:05.643 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.643 yubikit D WRITE FEATURE REPORT: 63 63 00 00 00 00 00 87
16:15:05.645 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.645 yubikit D WRITE FEATURE REPORT: 00 12 b5 d6 00 00 00 89
16:15:05.647 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.648 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.648 yubikit D Calculating hmacSha1
16:15:05.650 yubikit D Sending payload over HID to slot 0x30: 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01
16:15:05.662 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.663 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.668 yubikit D WRITE FEATURE REPORT: 00 01 01 01 01 01 01 80
16:15:05.670 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.670 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 81
16:15:05.672 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.672 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 82
16:15:05.695 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.696 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 83
16:15:05.702 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.702 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 84
16:15:05.706 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.706 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 85
16:15:05.711 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.712 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 86
16:15:05.714 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.714 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 87
16:15:05.721 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.721 yubikit D WRITE FEATURE REPORT: 01 01 01 01 01 01 01 88
16:15:05.731 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.733 yubikit D WRITE FEATURE REPORT: 01 30 f8 7e 00 00 00 89
16:15:05.741 yubikit D READ FEATURE REPORT: 00 03 02 00 03 07 05 00
16:15:05.742 yubikit E OtpConnection callback threw an exception
com.yubico.yubikit.core.otp.CommandRejectedException: No data
at com.yubico.yubikit.core.otp.OtpProtocol.readFrame(OtpProtocol.java:223)
at com.yubico.yubikit.core.otp.OtpProtocol.sendAndReceive(OtpProtocol.java:103)
at com.yubico.yubikit.yubiotp.YubiOtpSession$2.sendAndReceive(YubiOtpSession.java:212)
at com.yubico.yubikit.yubiotp.YubiOtpSession.calculateHmacSha1(YubiOtpSession.java:378)
at com.yubico.yubikit.android.app.ui.YubiKeyFragment$onViewCreated$2.invoke$lambda$2$lambda$1(YubiKeyFragment.kt:75)
at com.yubico.yubikit.android.app.ui.YubiKeyFragment$onViewCreated$2.$r8$lambda$FgDHvRPjd9JarXN2MtHTzKW5kgU(Unknown Source:0)
at com.yubico.yubikit.android.app.ui.YubiKeyFragment$onViewCreated$2$$ExternalSyntheticLambda1.invoke(Unknown Source:2)
at com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice.lambda$requestConnection$0(UsbYubiKeyDevice.java:118)
at com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice$$ExternalSyntheticLambda0.invoke(Unknown Source:4)
at com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice$CachedOtpConnection.lambda$new$0$com-yubico-yubikit-android-transport-usb-UsbYubiKeyDevice$CachedOtpConnection(UsbYubiKeyDevice.java:179)
at com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice$CachedOtpConnection$$ExternalSyntheticLambda0.run(Unknown Source:4)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
at java.lang.Thread.run(Thread.java:919)
16:15:17.831 yubikit D UsbDevice detached: /dev/bus/usb/001/002
16:15:17.831 yubikit D Closing YubiKey device
16:15:17.831 yubikit D Closing CachedOtpConnection
16:15:17.832 yubikit D USB connection closed: com.yubico.yubikit.android.transport.usb.connection.UsbOtpConnection@a0e527d
16:15:17.832 yubikit D Device removed com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice@2664d1a
|
I found a different YubiKey which seems to be working both in the demo app and my own. It is a YubiKey 5 NFC, form factor USB_A_KEYCHAIN, firmware 5.2.4, and challenge response timeout 15. |
Upon insertion of a USB Yubikey, I am attempting to read device info such as serial number and then compute an HMAC-SHA1. The device info reads successfully, but the YubiOtpSession.calculateHmacSha1 doesn't seem to notice that the key needs a touch. The call fails with a CommandRejectedException with messsage "No data". If I do not read the device info, the calculateHmacSha1 call properly waits for the key touch. If I use NFC, I can both read the device info and calculate the HMAC-SHA1 with a single press of the key (YubiKey NEO).
To retrieve the device info, I am following the code from the Android demo app in the com.yubico.yubikit.android.app.ui.management.ManagementViewModel.readDeviceInfo method. It checks for various connection types and uses the DeviceUtil.readInfo method to read the data.
Logging for the failed calculateHmacSha1 call. The feature report never returns a tailing 89 value indicating the need for a touch.
Logging for the successful calculateHmacSha1 call without the debug info. The read report with the trailing 89 value is present indicating (I believe) touch is required.
The text was updated successfully, but these errors were encountered: