Rp2040 commissioned as Yubikey 5A not recognized in KeePassXC #97
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
wwwwwwwwwwHello!
In Yubikey Manager (win32), the key is not recognized upon launch, and when replugged, I get the following error:
In Yubico Authenticator, on Windows, it appears as such:
Yubico Authenticator on NixOS does not give me these issues - it appears as a Yubikey 5A, and all functions work wonderfully. I'm assuming this is because of the reason discussed in #19, where Windows relies purely off of HID descriptors.
Regardless, on both platforms, KeepassXC does not recognize the key under the challenge response field. I get the same grey dropdown as in #19.
Update: I tried launching keypass with the key connected, as documented in #81. That worked well, but isn't a very desirable solution IMO. Good enough for my prototype-y needs, since I'm making a custom pcb for this, but isn't a workaround I recommend considering that, when I replugged the key, it was no longer detected, unlike in 81.
Also worth noting - I'm on my last unit that I use personally, and really dislike testing on. I have 2 RP2040s that appear to load the firmware, and then are not recognized by the OS, and I'm still prompted to plug in a key when they're connected.
Update to this: I ended up using flash_nuke.u2f, and that brought the boards back to life! Probably an issue with commissioning. Commissioning happens pretty early on in a pico-fido key's lifespan, so it's what I recommend if you encounter this issue - just nuke it and start over.
I’m not sure follow this issue.
Can you put step by step to reproduce it?
I have the same issue. Upgrade should use flash_nuke.u2f to remove the old data.
Yes.
For one, flash an RP2040 with flash_nuke and then it's associated pico-fido image.
Commission it as a yubikey - any model.
Open yubico authenticator, and the issue or 2 keys present, both being inaccessible, presents itself.
If you open keepaasxc with the key disconnected, it won't recognize the key when it's plugged in. If you open it when the key is plugged in, it'll recognize the key.
return to v5.8! 6.0 and 6.2 useless waste of time windows YubiKey Personalization Tool, Yubico Authenticator users can't see it! Developer is killing windows environment!
Hello,
It looks like I have the same problem, I've tried using
flash_nukeand then reflashing with pico-fido 6.2 from releases and my own custom build, however the Yubikey Manager fails to connect to the device and KeePassXC does not detect the device.Though it looks like you're on NixOS and I'm on Windows, I wonder if there's anything else I'm missing here? WebAuthn (with Discord, Google, and Authentik) seems to work just fine
faul ubuntu 22.04 5.8 is unstable, lots of features are broken, see tons of complaints, user disputes are quickly closed!
video
https://drive.google.com/file/d/1G1CqVt1e0PlxTdu5dr03okD0DOP2tri5/view?usp=drive_link
Try executing Yubikey Authenticator tool with administration permissions.
@polhenarejos Hello, yes it turns out it needed administrator permissions (I ended up using the
ykmanprogram directly), however 2 issues present itself:WARNING: Failed opening deviceIt is listed as enabled in
ykman infohowever:Edit: otp also doesn't work:
I also still can't register the device in KeePassXC for challenge-response auth, it does not detect the device even with administrator permissions
No change in admin mode either! Linux and Windows OS!
What
ykman -l TRAFFIC otp inforeturns?`
host@host-virtual-machine:~$ ykman -l TRAFFIC otp info
INFO 17:00:11.961 [ykman.logging.set_log_level:60] Logging at level: TRAFFIC
WARNING 17:00:11.961 [ykman.logging.set_log_level:62]
###################################################################################
WARNING: All data sent to/from the YubiKey will be logged!
This data may contain sensitive values, such as secret keys, PINs or passwords!
###################################################################################
INFO 17:00:11.961 [ykman._cli.main.cli:355] System info:
ykman: 5.5.1
Python: 3.10.12 (main, Jul 29 2024, 16:56:48) [GCC 11.4.0]
Platform: linux
Arch: x86_64
System date: 2025-01-29
Running as admin: False
DEBUG 17:00:12.972 [ykman.hid.linux.list_devices:123] Couldn't read HID descriptor for /dev/hidraw0
Traceback (most recent call last):
File "/opt/venvs/yubikey-manager/lib/python3.10/site-packages/ykman/hid/linux.py", line 115, in list_devices
with open(hidraw, "rb") as f:
PermissionError: [Errno 13] Permission denied: '/dev/hidraw0'
DEBUG 17:00:13.28 [fido2.hid.linux.list_descriptors:103] Failed opening device /dev/hidraw0
Traceback (most recent call last):
File "/opt/venvs/yubikey-manager/lib/python3.10/site-packages/fido2/hid/linux.py", line 98, in list_descriptors
devices.append(get_descriptor(hidraw))
File "/opt/venvs/yubikey-manager/lib/python3.10/site-packages/fido2/hid/linux.py", line 55, in get_descriptor
with open(path, "rb") as f:
PermissionError: [Errno 13] Permission denied: '/dev/hidraw0'
DEBUG 17:00:13.137 [ykman.device.add:165] Add device for <class 'yubikit.core.otp.OtpConnection'>: OtpYubiKeyDevice(pid=0407, fingerprint='/dev/hidraw2')
DEBUG 17:00:13.137 [yubikit.support.read_info:264] Attempting to read device info, using HidrawConnection
TRAFFIC 17:00:13.140 [ykman.hid.linux.receive:65] RECV: 00060200010e0000
DEBUG 17:00:13.140 [yubikit.management.init:558] Management session initialized for connection=HidrawConnection, version=6.2.0
DEBUG 17:00:13.140 [yubikit.management.read_device_info:586] Reading DeviceInfo page: 0
TRAFFIC 17:00:13.141 [yubikit.core.otp.send_and_receive:168] SEND: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000136b5b000000
TRAFFIC 17:00:13.150 [ykman.hid.linux.receive:65] RECV: 00060200010e0000
TRAFFIC 17:00:13.162 [ykman.hid.linux.receive:65] RECV: 00060200010e0000
TRAFFIC 17:00:13.162 [ykman.hid.linux.send:69] SEND: 0000000000000080
TRAFFIC 17:00:13.185 [ykman.hid.linux.receive:65] RECV: 00060200010e0000
TRAFFIC 17:00:13.185 [ykman.hid.linux.send:69] SEND: 00136b5b00000089
TRAFFIC 17:00:13.226 [ykman.hid.linux.receive:65] RECV: 1c01020223020440
TRAFFIC 17:00:13.241 [ykman.hid.linux.receive:65] RECV: e4b375bd04010141
TRAFFIC 17:00:13.256 [ykman.hid.linux.receive:65] RECV: 0503060200030242
TRAFFIC 17:00:13.271 [ykman.hid.linux.receive:65] RECV: 02230801800a0143
TRAFFIC 17:00:13.285 [ykman.hid.linux.receive:65] RECV: 00d0800000000044
TRAFFIC 17:00:13.300 [ykman.hid.linux.receive:65] RECV: 0000000000000040
TRAFFIC 17:00:13.300 [ykman.hid.linux.send:69] SEND: 00000000000000ff
TRAFFIC 17:00:13.304 [yubikit.core.otp.send_and_receive:172] RECV: 1c010202230204e4b375bd0401010503060200030202230801800a0100d08000000000
DEBUG 17:00:13.304 [yubikit.support.read_info:292] Read info: DeviceInfo(config=DeviceConfig(enabled_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, auto_eject_timeout=0, challenge_response_timeout=0, device_flags=<DEVICE_FLAG.EJECT: 128>, nfc_restricted=False), serial=3836966333, version=Version(major=6, minor=2, patch=0), form_factor=<FORM_FACTOR.USB_A_KEYCHAIN: 1>, supported_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, is_locked=False, is_fips=False, is_sky=False, part_number=None, fips_capable=<CAPABILITY.0: 0>, fips_approved=<CAPABILITY.0: 0>, pin_complexity=False, reset_blocked=<CAPABILITY.0: 0>, fps_version=None, stm_version=None)
DEBUG 17:00:13.305 [yubikit.support.read_info:351] Device info, after tweaks: DeviceInfo(config=DeviceConfig(enabled_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, auto_eject_timeout=0, challenge_response_timeout=0, device_flags=<DEVICE_FLAG.EJECT: 128>, nfc_restricted=False), serial=3836966333, version=Version(major=6, minor=2, patch=0), form_factor=<FORM_FACTOR.USB_A_KEYCHAIN: 1>, supported_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, is_locked=False, is_fips=False, is_sky=False, part_number=None, fips_capable=<CAPABILITY.0: 0>, fips_approved=<CAPABILITY.0: 0>, pin_complexity=False, reset_blocked=<CAPABILITY.0: 0>, fps_version=None, stm_version=None)
DEBUG 17:00:13.306 [ykman.device.add:176] Resolved device 3836966333
DEBUG 17:00:13.306 [ykman.device.add:165] Add device for <class 'yubikit.core.smartcard.SmartCardConnection'>: ScardYubiKeyDevice(pid=0407, fingerprint='Yubico YubiKey OTP+FIDO+CCID [Pico Key CCID OTP FIDO Interfac] (E4B375BDF5F00000) 00 00')
DEBUG 17:00:13.307 [ykman.device.add:165] Add device for <class 'yubikit.core.smartcard.SmartCardConnection'>: ScardYubiKeyDevice(pid=0407, fingerprint='Yubico YubiKey OTP+FIDO+CCID (E4B375BDF5F00000) 01 00')
DEBUG 17:00:13.309 [yubikit.support.read_info:264] Attempting to read device info, using ScardSmartCardConnection
DEBUG 17:00:13.310 [yubikit.core.smartcard.select:417] Selecting AID: a000000527471117
TRAFFIC 17:00:13.310 [ykman.pcsc.send_and_receive:121] SEND: 00a4040008a000000527471117
TRAFFIC 17:00:13.372 [ykman.pcsc.send_and_receive:123] RECV: 362e322e30 SW=9000
DEBUG 17:00:13.372 [yubikit.management.init:558] Management session initialized for connection=ScardSmartCardConnection, version=6.2.0
DEBUG 17:00:13.373 [yubikit.management.read_device_info:586] Reading DeviceInfo page: 0
TRAFFIC 17:00:13.373 [ykman.pcsc.send_and_receive:121] SEND: 001d0000000000
TRAFFIC 17:00:13.415 [ykman.pcsc.send_and_receive:123] RECV: 1c010202230204e4b375bd0401010503060200030202230801800a0100 SW=9000
DEBUG 17:00:13.415 [yubikit.support.read_info:292] Read info: DeviceInfo(config=DeviceConfig(enabled_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, auto_eject_timeout=0, challenge_response_timeout=0, device_flags=<DEVICE_FLAG.EJECT: 128>, nfc_restricted=False), serial=3836966333, version=Version(major=6, minor=2, patch=0), form_factor=<FORM_FACTOR.USB_A_KEYCHAIN: 1>, supported_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, is_locked=False, is_fips=False, is_sky=False, part_number=None, fips_capable=<CAPABILITY.0: 0>, fips_approved=<CAPABILITY.0: 0>, pin_complexity=False, reset_blocked=<CAPABILITY.0: 0>, fps_version=None, stm_version=None)
DEBUG 17:00:13.416 [yubikit.support.read_info:351] Device info, after tweaks: DeviceInfo(config=DeviceConfig(enabled_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, auto_eject_timeout=0, challenge_response_timeout=0, device_flags=<DEVICE_FLAG.EJECT: 128>, nfc_restricted=False), serial=3836966333, version=Version(major=6, minor=2, patch=0), form_factor=<FORM_FACTOR.USB_A_KEYCHAIN: 1>, supported_capabilities={<TRANSPORT.USB: 'usb'>: <CAPABILITY.FIDO2|OATH|U2F|OTP: 547>}, is_locked=False, is_fips=False, is_sky=False, part_number=None, fips_capable=<CAPABILITY.0: 0>, fips_approved=<CAPABILITY.0: 0>, pin_complexity=False, reset_blocked=<CAPABILITY.0: 0>, fps_version=None, stm_version=None)
DEBUG 17:00:13.440 [ykman.device.add:176] Resolved device 3836966333
TRAFFIC 17:00:13.449 [ykman.hid.linux.receive:65] RECV: 00060200010e0000
TRAFFIC 17:00:13.460 [ykman.hid.linux.receive:65] RECV: 00060200010e0000
DEBUG 17:00:13.461 [yubikit.yubiotp.init:752] YubiOTP session initialized for connection=HidrawConnection, version=6.2.0, state=ConfigState(configured: (False, True), touch_triggered: (True, True), led_inverted: False)
Slot 1: empty
Slot 2: programmed
`
There was a problem with the USB descriptor of keyboard interface in Windows that is fixed. I tested it with Windows 11, with Yubikey Authenticator and KeypassXC.
In Yubikey Authenticator, Accounts sections only works if previously you commission the device with
yubico yubikeyas product name.I can confirm that everything works correctly, thanks!
Notably however, KeePassXC still does not display the device (even with administrator perms) as a compatible challenge-response device however, but that's the remaining issue.
ykmanseems to display correctly and I've confirmed WebAuthn works so far