 Pol Henarejos
|
5945f39781
|
Do not allow key import if algorithm is not supported.
Fixes #55
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
nightly-main
|
2026-08-21 00:24:05 +02:00 |
|
|
Pol Henarejos
|
6c6187106f
|
Make 7F74 DO as Constructed DO
Fixes #56
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-20 23:49:33 +02:00 |
|
|
Pol Henarejos
|
db21bf74e5
|
Pico Keys SDK 9
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-20 23:48:58 +02:00 |
|
|
Pol Henarejos
|
7fe9ab39b6
|
Ensure PIV certificate serials are canonical
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-15 01:36:07 +02:00 |
|
|
Pol HenarejosandGitHub
|
0ff8272720
|
Merge pull request #54 from polhenarejos/copilot/fix-code-scanning-alert-229
Resolve CodeQL type-width comparison in password status normalization
|
2026-08-15 00:26:03 +02:00 |
|
|
|
c18ff0862f
|
Fix CodeQL alert #229 loop counter type width
Co-authored-by: polhenarejos <55573252+polhenarejos@users.noreply.github.com>
|
2026-08-14 22:22:53 +00:00 |
|
|
copilot-swe-agent[bot]andGitHub
|
96443389f0
|
Initial plan
|
2026-08-14 22:21:04 +00:00 |
|
|
Pol Henarejos
|
7b904aa609
|
Preserve PIV challenge-binding status for algorithm mismatch
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-15 00:16:54 +02:00 |
|
|
Pol Henarejos
|
2aa24637f3
|
Harden PIV key provenance updates
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-15 00:01:50 +02:00 |
|
|
Pol Henarejos
|
41704e54c1
|
Expire management challenges on unrelated commands
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 23:51:54 +02:00 |
|
|
Pol Henarejos
|
4b5de68912
|
Share spend-before-compare PIN verification
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 23:47:48 +02:00 |
|
|
Pol Henarejos
|
69edb21d71
|
Reject explicit default policy bytes
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 23:38:37 +02:00 |
|
|
Pol Henarejos
|
d626852c13
|
Reject malformed VERIFY bodies without retry loss
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 23:36:00 +02:00 |
|
|
Pol Henarejos
|
b686df8684
|
Require fixed-size reference change bodies
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 23:34:32 +02:00 |
|
|
Pol Henarejos
|
d6362c6083
|
Fix error return code
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 23:32:53 +02:00 |
|
|
Pol Henarejos
|
cbe4a93846
|
Report object deletion failures
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:23:54 +02:00 |
|
|
Pol Henarejos
|
8abf9d323e
|
Default generated keys to no touch
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:21:57 +02:00 |
|
|
Pol Henarejos
|
0fb3a0d7d2
|
Make card-authentication keys pin-free by default
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:19:50 +02:00 |
|
|
Pol Henarejos
|
ef19c3e208
|
Require exact EC scalar lengths on import
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:18:23 +02:00 |
|
|
Pol Henarejos
|
b48ae519cf
|
Accept RSA family algorithm aliases
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:17:37 +02:00 |
|
|
Pol Henarejos
|
144260a633
|
Add regression tests
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:15:00 +02:00 |
|
|
Pol Henarejos
|
81acc66d98
|
Report no PIN policy for management slot
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:14:53 +02:00 |
|
|
Pol Henarejos
|
8cc73cfd55
|
Bind pending authentication responses to issued algorithm
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:08:02 +02:00 |
|
|
Pol Henarejos
|
53241c74de
|
Fix test error workflow report
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 22:07:45 +02:00 |
|
|
Pol Henarejos
|
0c9a414c3e
|
Allow retired key moves and expose F9 metadata
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 21:46:04 +02:00 |
|
|
Pol Henarejos
|
e2265401a9
|
Dispatch authentication by first operation tag
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 21:42:47 +02:00 |
|
|
Pol Henarejos
|
1b396be439
|
Report undefined references as not found
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 21:34:55 +02:00 |
|
|
Pol Henarejos
|
e674ab1028
|
Normalize VERIFY framing and reset handling
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 21:34:10 +02:00 |
|
|
Pol Henarejos
|
24a87113fe
|
Require complete object identifiers
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 21:29:32 +02:00 |
|
|
Pol Henarejos
|
1bb11e5f4a
|
Move openpgp tests to tests/openpgp
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 21:29:22 +02:00 |
|
|
Pol Henarejos
|
27b57364c9
|
Include touch policy in default management-key flag
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 20:39:15 +02:00 |
|
|
Pol Henarejos
|
2ec36b3b23
|
Include algorithm tag in PIN metadata
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 20:38:20 +02:00 |
|
|
Pol Henarejos
|
aee2435e9e
|
Normalize framing and authorization order
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 20:37:14 +02:00 |
|
|
Pol Henarejos
|
83c886aad9
|
Move openpgp tests
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 20:37:02 +02:00 |
|
|
Pol Henarejos
|
351aa46e5d
|
Add pytest tests for PIV
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 20:28:48 +02:00 |
|
|
Pol Henarejos
|
3469f61bb9
|
Fix APDU chained commands
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 20:27:13 +02:00 |
|
|
Pol Henarejos
|
39aad040ef
|
Fix PIV get metadata for slot retired 18
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 20:26:59 +02:00 |
|
|
Pol Henarejos
|
2aab5cf5cd
|
Harden blocked PIN and terminate handling
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:54:10 +02:00 |
|
|
Pol Henarejos
|
241f5d82b2
|
Enforce forcesig for PSO signatures
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:51:53 +02:00 |
|
|
Pol Henarejos
|
999d7180b2
|
Validate algorithm attributes before key creation
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:50:21 +02:00 |
|
|
Pol Henarejos
|
14b39a8f9f
|
Clamp PW status retry slices
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:47:22 +02:00 |
|
|
Pol Henarejos
|
881d670b54
|
Reject truncated data object responses
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:45:23 +02:00 |
|
|
Pol Henarejos
|
090335b939
|
Make PIN DEK updates power-loss recoverable
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:35:12 +02:00 |
|
|
Pol Henarejos
|
86cc28d131
|
Reject undefined security-status reset references
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:14:36 +02:00 |
|
|
Pol Henarejos
|
e8d066284a
|
Clear standing authentication after failure
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:13:54 +02:00 |
|
|
Pol Henarejos
|
81ee0735a4
|
Correct MSE template mapping
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:10:58 +02:00 |
|
|
Pol Henarejos
|
3ffd5efb40
|
Walk cardholder certificate occurrences
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 19:05:14 +02:00 |
|
|
Pol Henarejos
|
dfae5e9098
|
Enforce fixed fingerprint and timestamp lengths
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 18:59:06 +02:00 |
|
|
Pol Henarejos
|
aba80f964c
|
Protect PW status limits from PUT DATA
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 18:44:38 +02:00 |
|
|
Pol Henarejos
|
f82c97e604
|
Enforce GET CHALLENGE limits and parameters
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
|
2026-08-14 18:40:43 +02:00 |
|