Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 2:49 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 4 posts ] 
Author Message
PostPosted: Wed Jun 03, 2015 7:22 pm 
Offline

Joined: Wed Jun 03, 2015 7:00 pm
Posts: 4
I am using ppa:yubico/stable on Ubuntu 14.04 LTS

After running
Code:
      sleep 0.1
      ykpersonalize -1 -ofixed="$pubID" -ouid="$privID" -a"$aesKey
      sleep 0.2

The yubikey device will not respond to any of the yk* command line tools. For example:
Code:
    [A]bobg@Avature-TP1407E:~$ ykinfo -a
    Yubikey core error: timeout

This device is successfully programmed with the new OTP crendentials and pressing the button types the OTP via the keyboard.

Also, the device is recognized by the ykpersonalize-gui app and if I reprogram the same OTP credentials via the gui, then the device is fixed and once again responds to the command line tools.

Any ideas?

--BobG


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Thu Jun 04, 2015 1:48 am 
Offline

Joined: Wed Jun 03, 2015 7:00 pm
Posts: 4
I have compiled from source and debugged and discovered that actually, its only the serial number that can not be read. All the other attributes that ykinfo can retrieve work fine. -a does not work because the serial is the first thing it tries to read.

When it tries to retrieve the serial number, it sends SLOT_DEVICE_SERIAL (0x10) and times out waiting for the device to set the RESP_PENDING_FLAG (0x40).

With a 'good' yubikey, the yk_wait_for_key_status reads the status as 0x89 a few times and then reads 0xc0 which matches the 0x40 mask.

On a 'bad' yubikey the status starts out as 0x89 also, but instead of changing to 0xc0, it changes to 0x00.

I am trying to look up in the HID standard what those status bits mean to see if there is meaning in it transitioning to 0 instead of 0xc0.


--BobG


Top
 Profile  
Reply with quote  
PostPosted: Mon Jun 22, 2015 8:47 pm 
Offline

Joined: Wed Jun 03, 2015 7:00 pm
Posts: 4
I would still like an answer to this. I have a hundred yubikeys to provision and I am afraid to do it from the command line because after using ykpersonalize from the command line, not only is the serial number not readable, but the ccid USB interface does not work either. From NEO manager UI, no apps are shown after I write a new OTP with ykpersonalize command line tool. Initially we are only using the OTP but I got NEOs so that we could use some sort of Public/Private key app in the future and I don't know if this is permanently ruining the CCID USB interface on the devices.

I spent a lot of time going through the code and trying to figure this out on my own, and I could really use some help now.

--BobG


Top
 Profile  
Reply with quote  
PostPosted: Tue Sep 22, 2015 1:48 pm 
Offline
Site Admin
Site Admin

Joined: Mon Mar 02, 2009 9:51 pm
Posts: 83
There's a flag you need to set when programming the slot to make the serial visible, this is done by adding -oserial-api-visible to the programming command.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 4 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group