Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for imported keys on yubikey kms #655

Closed
maraino opened this issue Dec 18, 2024 · 0 comments · Fixed by #656
Closed

Add support for imported keys on yubikey kms #655

maraino opened this issue Dec 18, 2024 · 0 comments · Fixed by #656
Labels
enhancement New feature or request needs triage

Comments

@maraino
Copy link
Contributor

maraino commented Dec 18, 2024

Description

step-ca or step-kms-plugin fails to sign with a key imported into the yubikey. The cause of this is because we attest the slot to get the public key. We also support the workaround of getting the certificate in the same slot. But we can easily support imported keys without the workaround if we use KeyInfo to get the public key, it would be something something like this:

func (k *YubiKey) getPublicKey(slot piv.Slot) (crypto.PublicKey, error) {
	ki, err := k.yk.KeyInfo(slot)
	if err != nil {
		return nil, err
	}
	// not use if this can be nil
	if ki.PublicKey == nil {
		 return nil, errors.New("error retrieving public key")
	}
	return ki.PublicKey, nil
}

KeyInfo is only supported on YubiKeys with a version >= 5.3.0, so we might need to fallback to Attest and Certificate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request needs triage
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant