Feature: Security Domain and SCP11a/b/c features #164

DennisDyallo · 2024-11-27T18:06:40Z

Description

This PR implements comprehensive support for SCP11a/b/c secure channels and enhances Security Domain functionality. It also enables OATH, OTP, and YubiHsm applications to operate over SCP connections.

Key Changes

Introduced new ../Scp/ namespace for improved secure channel management
Added support for SCP11a/b/c secure channels
Enabled OATH, OTP, and YubiHsm applications over SCP connections
Implemented new Security Domain application through SecurityDomainSession

New Components

SecurityDomainSession: Application that manages the Security Domain
Scp03KeyParameters: SCP03 key configuration
Scp11KeyParameters: SCP11 key configuration
KeyReference: Refers to keys on the Yubikey Security Domain
Scp03State: SCP03 state management
Scp11State: SCP11 state management

Deprecation and misc changes

Deprecated all classes in ../Scp03/ namespace
Replaced with new implementations in ../Scp11/ namespace
Modified some class names and functionality to align with Android SDK (yubikit-android) and Python SDK (yubikey-manager)

Migration Notes

The new architecture favors using SecurityDomainSession for Security Domain operations rather than individual command classes. Update existing implementations accordingly.

Type of change

Refactor (non-breaking change which improves code quality or performance)
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

How has this been tested?

Tested using a 5.7.2 key and 5.7.4 FIPS key.

Test configuration:

OS version: Win 11
Firmware version: 5.4.3, 5.7.2 Non FIPS, 5.7.4 Non FIPS
Yubikey model¹: 5 MPE, FIPS

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have run dotnet format to format my code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

See Yubikey models (Multi-protocol, Security Key, FIPS, Bio, YubiHSM, YubiHSM FIPS) ↩

feat(scp11): Generate EC Key feat(sd): Reset Security Domain misc: Changed static analysis mode misc: SampleCode projects won't build nuget packages

Store identifiers in dictionary Utilize current and next TLV values Improve method functionality Enhance code readability

update auth-decrypt.md update auth-sign.md updated RSA key sizes in user manual files updated RSA key info in API docs updated docs and minor adjustments and new tests

support OATH and SCP support OTP and SCP support YubiHSM and SCP

…fier

added YubiHsm SCP 11b tests

throws exception on invalid KeyParameters add docs

AdamVe

This looks good to me. Thanks for addressing the issues from my comments and fixing the FIPS tests.

clarified docs (ScpKeyParameters) removed optional constructor (Scp11KeyParameters) added test for invalid constructor parameters (Scp11KeyParameters) fixed test for non fips hexadecimal notation for key ids in docstring increased sleep delay for integration test

Yubico.YubiKey/docs/users-manual/sdk-programming-guide/secure-channel-protocol.md

dainnilsson · 2024-12-16T13:55:48Z

Yubico.YubiKey/docs/users-manual/sdk-programming-guide/secure-channel-protocol.md

+SCP11[^1] uses asymmetric cryptography based on elliptic curves (NIST P-256) for authentication and key agreement. Compared to SCP03, it uses certificates instead of pre-shared keys, providing greater flexibility in cases where the two entities setting up the secure channel are not deployed in strict pairs. The secure channel can be embedded into complex use cases, such as:
+- Installation of payment credentials on wearables
+- Production systems
+- Remote provisioning of cell phone subscriptions


Not sure these bullets are really relevant in a YubiKey-centric context.

I took them from the GPC SCP11 $2 and thought it may be of value as it describes some of the use cases. The existing document also legitimized the use of SCP by explaining some of the use cases. But since I'm already referencing GPC, perhaps thats enough?

Yubico.YubiKey/docs/users-manual/sdk-programming-guide/secure-channel-protocol.md

add validation and tests on keyId and keyVersionNumber (KeyReference) made replaceKvn into an optional parameter

misc: factory method for creating KeyReferences

fixed header style, typos

Changes to be committed: modified: ../docs/index.md

fixed xref in whats-new.md removed unused docs

github-actions · 2024-12-17T13:45:51Z

Package	Line Rate	Branch Rate	Complexity	Health
Yubico.Core	44%	32%	4311	➖
Yubico.YubiKey	49%	46%	19680	➖
Summary	48% (32942 / 68517)	43% (8245 / 18990)	23991	➖

Minimum allowed line rate is 40%

DennisDyallo added the enhancement New feature or request label Nov 27, 2024

DennisDyallo self-assigned this Nov 27, 2024

DennisDyallo force-pushed the feature/scp11 branch 2 times, most recently from cfa5db9 to 69d6525 Compare November 27, 2024 19:07

DennisDyallo added 20 commits November 27, 2024 23:44

initial Security Domain implementation

6e537c7

feat(scp11): Generate EC Key feat(sd): Reset Security Domain misc: Changed static analysis mode misc: SampleCode projects won't build nuget packages

feat(scp11b): Import Key

2bd752f

feat(scp): Import Static Keys

366aa8b

feat(scp11ab): Initialize SCP Connection

5e9ec88

feat(scp): remaining SCP Commands implemented

d2d1cf5

Store identifiers in dictionary Utilize current and next TLV values Improve method functionality Enhance code readability

docs: updated docstrings and manual

4017ae4

update auth-decrypt.md update auth-sign.md updated RSA key sizes in user manual files updated RSA key info in API docs updated docs and minor adjustments and new tests

tests, misc: added and fixed tests, misc updates

093f919

feat(scp): supports apps over SCP

81799ca

support OATH and SCP support OTP and SCP support YubiHSM and SCP

docs: add comments to TlvObject

01b6ab2

docs: fix incorrect values in docs for RSA key sizes and their identi…

c41fff1

…fier

docs: add docs to ApplicationSession.cs

00cdeae

logs: change log level in ConnectionFactory

f90fbee

misc: return ReadOnlyMemory<byte> in ECPublicKeyParameters.cs

f5fbbbf

misc: OtpSession cleanup

a786bef

misc: ScpApduTransform.cs edits

7bd0b36

misc: PivSession.cs edits

23af160

misc: ExternalAuthenticateResponse.cs edits

cd13afd

misc: InitializeUpdateCommand.cs edits

d9cc85f

docs: added docs to PutKeyCommand

660095d

docs: adding comments and docs

6f8b74e

DennisDyallo force-pushed the feature/scp11 branch from 69d6525 to 7a5053b Compare November 27, 2024 22:45

DennisDyallo added 2 commits November 27, 2024 23:49

misc: misc edits

de43147

tests: test edits

ff36d90

added YubiHsm SCP 11b tests

DennisDyallo force-pushed the feature/scp11 branch from 7a5053b to ff36d90 Compare November 27, 2024 22:49

docs, misc: edits in ScpApduTransform

d77bc6a

throws exception on invalid KeyParameters add docs

DennisDyallo force-pushed the feature/scp11 branch from f2d9555 to b6b97ad Compare November 27, 2024 23:38

misc: fixed error output for TestDeviceSelection

76fb610

DennisDyallo force-pushed the feature/scp11 branch from 1f6bff9 to 76fb610 Compare December 12, 2024 18:22

misc: minor work on SCP related classes

1726cb0

AdamVe approved these changes Dec 13, 2024

View reviewed changes

dainnilsson approved these changes Dec 13, 2024

View reviewed changes

DennisDyallo added 3 commits December 15, 2024 20:05

docs: rewrote secure-channel-protocol.md to account for scp11

8b71556

misc: renamed some vars and classes to fit GPC specification

129e383

dainnilsson requested changes Dec 16, 2024

View reviewed changes

DennisDyallo added 2 commits December 16, 2024 18:52

misc: minor SCP work

ead1811

add validation and tests on keyId and keyVersionNumber (KeyReference) made replaceKvn into an optional parameter

docs: added documentation for security domain application

485b626

misc: factory method for creating KeyReferences

DennisDyallo force-pushed the feature/scp11 branch from d650a80 to 485b626 Compare December 16, 2024 18:14

DennisDyallo and others added 4 commits December 16, 2024 20:07

docs: adjusted security domain docs

c3fd1e8

fixed header style, typos

068560a

fixed typos

12021c8

Merge pull request #166 from Yubico/docs/scp-edits

5923b40

fixed header style, typos

DennisDyallo requested a review from dainnilsson December 17, 2024 08:15

dainnilsson approved these changes Dec 17, 2024

View reviewed changes

docs: added Security Domain

f80eca7

Changes to be committed: modified: ../docs/index.md

DennisDyallo force-pushed the feature/scp11 branch 3 times, most recently from 0a4b319 to f80eca7 Compare December 17, 2024 12:01

DennisDyallo added 2 commits December 17, 2024 13:46

Merge branch 'develop' into feature/scp11

b814659

docs:

cf4b0ed

fixed xref in whats-new.md removed unused docs

DennisDyallo force-pushed the feature/scp11 branch from 51a17ce to cf4b0ed Compare December 17, 2024 13:42

DennisDyallo merged commit baa3db0 into develop Dec 17, 2024
12 checks passed

DennisDyallo deleted the feature/scp11 branch December 17, 2024 13:58

This was referenced Dec 17, 2024

Release 1.12 #173

Closed

Release 1.12.0 #168

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: Security Domain and SCP11a/b/c features #164

Feature: Security Domain and SCP11a/b/c features #164

DennisDyallo commented Nov 27, 2024 •

edited

Loading

AdamVe left a comment

dainnilsson Dec 16, 2024

DennisDyallo Dec 16, 2024 •

edited

Loading

github-actions bot commented Dec 17, 2024

Feature: Security Domain and SCP11a/b/c features #164

Feature: Security Domain and SCP11a/b/c features #164

Conversation

DennisDyallo commented Nov 27, 2024 • edited Loading

Description

Key Changes

New Components

Deprecation and misc changes

Migration Notes

Type of change

How has this been tested?

Checklist:

Footnotes

AdamVe left a comment

Choose a reason for hiding this comment

dainnilsson Dec 16, 2024

Choose a reason for hiding this comment

DennisDyallo Dec 16, 2024 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Dec 17, 2024

DennisDyallo commented Nov 27, 2024 •

edited

Loading

DennisDyallo Dec 16, 2024 •

edited

Loading