From 89d7bde70f161fee7126ab74b1bf50e326a16d16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sosth=C3=A8ne=20Gu=C3=A9don?= Date: Wed, 24 Apr 2024 17:56:13 +0200 Subject: [PATCH] Require PIN for registering an hotp credential Motivation: https://github.com/Nitrokey/nitrokey-hotp-verification/issues/30 --- src/authenticator.rs | 7 +++++++ src/credential.rs | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/src/authenticator.rs b/src/authenticator.rs index 032664fa..3ef48ade 100644 --- a/src/authenticator.rs +++ b/src/authenticator.rs @@ -20,6 +20,7 @@ use crate::command::CredentialData::HmacData; use crate::command::{Credential, EncryptionKeyType, ListCredentials, VerifyCode, YkGetHmac}; use crate::credential::CredentialFlat; +use crate::oath::Kind; use crate::{ command, ensure, oath, state::{CommandState, State}, @@ -626,6 +627,12 @@ where // 2. Generate a filename for the credential let filename = self.filename_for_label(&credential.label); + // 2.5 Require PIN to have been verified before creating an ReverseHOTP credential + if credential.kind == Kind::HotpReverse && !self.state.runtime.client_authorized { + warn_now!("Attempt to create ReverseHOTP credential without authentication"); + return Err(Status::SecurityStatusNotSatisfied); + } + // 3. Serialize the credential (implicitly) and store it let write_res = self.state.try_write_file( &mut self.trussed, diff --git a/src/credential.rs b/src/credential.rs index 1c0bad0a..7d4b4deb 100644 --- a/src/credential.rs +++ b/src/credential.rs @@ -213,6 +213,12 @@ impl CredentialFlat { /// Update credential fields with new values, and save pub fn update_from(&mut self, update_req: UpdateCredential) -> Result<(), Status> { + // Updating ReverseHOTP is disabled + if matches!(self.kind, Kind::HotpReverse) { + warn_now!("Attempt to update ReverseHOTP credential"); + return Err(Status::ConditionsOfUseNotSatisfied); + } + if let Some(new_label) = update_req.new_label { self.label = ShortData::from_slice(new_label).map_err(|_| Status::NotEnoughMemory)?; }