louib / challenge-response Goto Github PK

After using the library on Linux to perform an HMAC-SHA1 challenge-response, the yubikey can no longer be used to authenticate to a website until it is unplugged and plugged back it.

Step to reproduce

1. run cargo test from the library and touch the yubikey to complete the challenge-response
2. Go on https://demo.yubico.com/webauthn-technical/registration to try using the yubikey for authentication. The yubikey will not be flashing
3. Unplug the yubikey and plug it back in. The authentication should now be working on the yubico test website.

From what I understand, this is part of the FIDO2 standard, and will eventually replace the current proprietary HMAC-SHA1 extension used by the YubiKeys and others. Here's the link to the spec, and here is the doc from Yubico.

We already support writing the HMAC-SHA1 and OTP configuration, so it shouldn't be too difficult to add support for reading that same configuration. This could be useful for example to detect if a slot was already configured.

This is similar to #11. We currently depend on libusb, which I believe is dynamically linked. I think removing the dependency on libusb would make this library pure Rust.

There are a few WIP PRs to add an async API to rusb (for example here), but none have landed yet. There is also nusb, which is a pure Rust async-first library