"Yubikey core error: Timeout" with HMAC challenge-response #89
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Hi! This is kind of two issues, but both cause the same problem.
When I try to add a HMAC challenge-response slot using ykpersonalize, although it says "successful", there is still nothing programmed to the slot. If I take
-oserial-api-visibleout of the command, it fails withYubikey core error: write error.ykpersonalize -v -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible -ochal-btn-trigfails to actually change the otp slots:Using
yubikey-personalization-guiresults in the same thing, although it reads successful write. My udev rules are all updated correctly. It may be worth noting that trying to write with this used to fail:However this wasn't a massive issue, as I could still write it with
ykman otp chalresp -t -g 2, which would work fine, and can be interacted with throughykman otp calculate:But using it as a HMAC key gives
Yubikey core error: Timeout. I think this may be to do with not having the correct configuration through ykman, because I think that the-oserial-api-visibleis needed for it to work with this:@qcoral 👀
Maybe related that
ykman otp deleteseems to always act as if it fails, although it still deleted the slot:Please provide:
(Offtopic: may I ask you the software console/terminal? It looks nice)
yubikey-managerandyubikey-personalizationare latest versions1:5.5.1-31.20.0-43.1.25-36.2, from last wednesdayI also now have the error
Yubikey core error: write errorafter reinstalling on the pico to double check it was fully updated, although I was also getting this error yesterday after updating then. I no longer remember what I did to fix it, might have just restarted:The terminal is foot, with fish running on Hyprland. I didn't do much, it's from these dotfiles. Definitely very pretty :)
I fixed the deletion problem but I do not see the problem with chalresp.
First, personalization tools are no longer maintained, so I'll not give support for them since they are discontinued.
If you do:
doesn't work?
ykman otp calculateworks fine, it's only when used withykchalresp, although I don't know if that is part ofykmanoryuibkey-personalize:I've adjusted the code I was using it for to use ykman, but it isn't a drop in replacment; it has a much larger file size when packaged as an ELF binary (due to being in python), meaning my initramfs is larger than prefered. It does work properly with ykman however, so I'll close this issue and maybe support for ykchalresp could be added in the future at some point?
This is an awesome project btw, really interesting to go through!