From 8abf9d323ec701e83ba806a9a7c19de487f3d5a8 Mon Sep 17 00:00:00 2001 From: Pol Henarejos Date: Fri, 14 Aug 2026 22:21:57 +0200 Subject: [PATCH] Default generated keys to no touch Signed-off-by: Pol Henarejos --- src/openpgp/piv.c | 5 +++-- tests/piv/test_060_regressions.py | 9 +++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/src/openpgp/piv.c b/src/openpgp/piv.c index b7c78a9..fb57d7c 100644 --- a/src/openpgp/piv.c +++ b/src/openpgp/piv.c @@ -62,6 +62,7 @@ #define TOUCHPOLICY_ALWAYS 2 #define TOUCHPOLICY_CACHED 3 #define TOUCHPOLICY_AUTO 0xFF +#define PIV_DEFAULT_TOUCH_POLICY TOUCHPOLICY_NEVER #define ORIGIN_GENERATED 0x01 #define ORIGIN_IMPORTED 0x02 @@ -1058,7 +1059,7 @@ static int cmd_asym_keygen(void) { return SW_DATA_INVALID(); } uint8_t def_pinpol = piv_default_pin_policy(key_ref); - uint8_t meta[] = {a80.data[0], tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : TOUCHPOLICY_ALWAYS, ORIGIN_GENERATED}; + uint8_t meta[] = {a80.data[0], tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : PIV_DEFAULT_TOUCH_POLICY, ORIGIN_GENERATED}; if (meta_add(key_ref, CONST_BYTE_ARRAY(meta, sizeof(meta))) != PICOKEYS_OK || !flash_commit_sync(PIV_FLASH_COMMIT_TIMEOUT_MS)) { return SW_MEMORY_FAILURE(); } @@ -1536,7 +1537,7 @@ static int cmd_import_asym(void) { return SW_WRONG_DATA(); } uint8_t def_pinpol = piv_default_pin_policy(key_ref); - uint8_t meta[] = { algo, tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : TOUCHPOLICY_ALWAYS, ORIGIN_IMPORTED }; + uint8_t meta[] = { algo, tlv_len(&aaa) ? aaa.data[0] : def_pinpol, tlv_len(&aab) ? aab.data[0] : PIV_DEFAULT_TOUCH_POLICY, ORIGIN_IMPORTED }; if (meta_add(key_ref, CONST_BYTE_ARRAY(meta, sizeof(meta))) != PICOKEYS_OK || !flash_commit_sync(PIV_FLASH_COMMIT_TIMEOUT_MS)) { return SW_MEMORY_FAILURE(); } diff --git a/tests/piv/test_060_regressions.py b/tests/piv/test_060_regressions.py index 15afb9c..18a415f 100644 --- a/tests/piv/test_060_regressions.py +++ b/tests/piv/test_060_regressions.py @@ -133,3 +133,12 @@ def test_piv_card_authentication_key_is_pin_free_by_default(managed_piv): assert response finally: delete_key(managed_piv, slot) + + +def test_piv_generated_key_uses_no_touch_by_default(managed_piv): + slot = SLOT.AUTHENTICATION + try: + managed_piv.generate_key(slot, KEY_TYPE.ECCP256, PIN_POLICY.ONCE, TOUCH_POLICY.DEFAULT) + assert managed_piv.get_slot_metadata(slot).touch_policy == TOUCH_POLICY.NEVER + finally: + delete_key(managed_piv, slot)