ykman otp calculate should allow providing the challenge on standard input

[scy]

• YubiKey Manager (ykman) version: 2.1.0
• How was it installed?: Debian package
• Operating system and version: Raspberry Pi OS Buster 2020-05-27
• YubiKey model and version: YubiKey 5 NFC
• Bug description summary: ykman otp calculate should allow providing the challenge on standard input

Steps to reproduce

ykman otp calculate --help

Expected result

There should be an option like -s, --stdin: Read CHALLENGE from stdin, not as a parameter

Actual results and logs

ykman otp calculate has no such option.

Other info

While waiting for the YubiKey to respond to the challenge (which can be quite a long time if --touch is required on the slot), the challenge can be seen in the output of ps faux and other tools, because it is provided on the command line (e.g. ykman otp calculate 2 1a2b3c4d5e6f). Even if ykman is run as root, normal users can still see the challenge.

My use case is semi-automatic unlocking of an encrypted hard drive. One part of the drive passphrase is stored in a file that can be accessed only by root (generated by something like openssl rand 16 -hex > /root/.unlock-secret), the other part is the response of the YubiKey when you send it the contents of /root/.unlock-secret as a challenge.

While the machine is waiting for me to push the YubiKey’s button, every unprivileged user on the system can see the secret only root should know.

Let me know if you’d be interested in a pull request.

This issue is somewhat related to #335; maybe all operations that currently accept a secret or challenge on the command line should get a (standardized) option to read from stdin.

[scy]

I’ve just noticed that ykchalresp from the personalization suite of tools has the -i- option which will do exactly what I’m looking for.

[dagheyman]

Thanks, and agreed that this should be added in some way (and to similar commands like you mentioned).

[dainnilsson]

This should now with ykman 4.0 work "as expected". If challenge isn't given as an argument, it will instead be read from stdin.