Update README.md

Fix headings
Upgrade to version 3.0
2024-11-10 19:01:10 +01:00 · 2024-11-10 18:57:19 +01:00 · 2024-11-10 18:56:55 +01:00 · 2024-11-10 18:56:46 +01:00 · 2024-11-10 18:14:24 +01:00 · 2024-11-09 00:38:39 +01:00
33 changed files with 2776 additions and 311 deletions
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,6 +35,7 @@ jobs:
        language: [ 'cpp', 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+        mode: [ 'pico', 'esp32', 'local' ]

    steps:
    - name: Checkout repository
@@ -66,7 +67,7 @@ jobs:

    - run: |
       echo "Run, Build Application using script"
-       ./workflows/autobuild.sh
+       ./workflows/autobuild.sh ${{ matrix.mode }}

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,10 +14,10 @@ name: "Emulation and test"
 on:
  workflow_dispatch:
  push:
-    branches: [ "main" ]
+    branches: [ "main", "piv" ]
  pull_request:
    # The branches below must be a subset of the branches above
-    branches: [ "main" ]
+    branches: [ "main", "piv" ]
  schedule:
    - cron: '23 5 * * 4'

--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,79 +1,98 @@
- #
- # This file is part of the Pico OpenPGP distribution (https://github.com/polhenarejos/pico-openpgp).
- # Copyright (c) 2022 Pol Henarejos.
- #
- # This program is free software: you can redistribute it and/or modify
- # it under the terms of the GNU General Public License as published by
- # the Free Software Foundation, version 3.
- #
- # This program is distributed in the hope that it will be useful, but
- # WITHOUT ANY WARRANTY; without even the implied warranty of
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- # General Public License for more details.
- #
- # You should have received a copy of the GNU General Public License
- # along with this program. If not, see <http://www.gnu.org/licenses/>.
- #
+#
+# This file is part of the Pico OpenPGP distribution (https://github.com/polhenarejos/pico-openpgp).
+# Copyright (c) 2022 Pol Henarejos.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#

 cmake_minimum_required(VERSION 3.13)

-if(ENABLE_EMULATION)
+if(ESP_PLATFORM)
+        set(EXTRA_COMPONENT_DIRS src pico-keys-sdk/src)
+        include($ENV{IDF_PATH}/tools/cmake/project.cmake)
 else()
-include(pico_sdk_import.cmake)
+
+        if(ENABLE_EMULATION)
+        else()
+                include(pico_sdk_import.cmake)
+        endif()
+
+        project(pico_openpgp C CXX ASM)
+
+        set(CMAKE_C_STANDARD 11)
+        set(CMAKE_CXX_STANDARD 17)
+
+        if(ENABLE_EMULATION)
+        else()
+                pico_sdk_init()
+        endif()
+
+        add_executable(pico_openpgp)
 endif()

-project(pico_openpgp C CXX ASM)
-
-set(CMAKE_C_STANDARD 11)
-set(CMAKE_CXX_STANDARD 17)
-
-if(ENABLE_EMULATION)
-else()
-pico_sdk_init()
-endif()
-
-add_executable(pico_openpgp)
-
 set(SOURCES ${SOURCES}
        ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/openpgp.c
        ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/files.c
-        )
+        ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/piv.c
+        ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/management.c
+)
+
+set(USB_ITF_CCID 1)
+set(USB_ITF_WCID 1)
+include(pico-keys-sdk/pico_keys_sdk_import.cmake)
+if(ESP_PLATFORM)
+        project(pico_openpgp)
+endif()

 set(INCLUDES ${INCLUDES}
        ${CMAKE_CURRENT_LIST_DIR}/src/openpgp
-        )
-
-set(USB_ITF_CCID 1)
-include(pico-keys-sdk/pico_keys_sdk_import.cmake)
-
-target_sources(pico_openpgp PUBLIC ${SOURCES})
-target_include_directories(pico_openpgp PUBLIC ${INCLUDES})
-
-target_compile_options(pico_openpgp PUBLIC
-    -Wall
-    -Werror
 )
+if(NOT ESP_PLATFORM)
+        target_sources(pico_openpgp PUBLIC ${SOURCES})
+        target_include_directories(pico_openpgp PUBLIC ${INCLUDES})

-if(ENABLE_EMULATION)
-
-target_compile_options(pico_openpgp PUBLIC
-        -fdata-sections
-        -ffunction-sections
+        target_compile_options(pico_openpgp PUBLIC
+                -Wall
        )
-if(APPLE)
-target_link_options(pico_openpgp PUBLIC
-        -Wl,-dead_strip
-        )
-else()
-target_link_options(pico_openpgp PUBLIC
-        -Wl,--gc-sections
-        )
-endif (APPLE)
-else()
+        if(NOT MSVC)
+                target_compile_options(pico_openpgp PUBLIC
+                        -Werror
+                )
+        endif()

-pico_add_extra_outputs(pico_openpgp)
+        if(ENABLE_EMULATION)
+                if(NOT MSVC)
+                        target_compile_options(pico_openpgp PUBLIC
+                                -fdata-sections
+                                -ffunction-sections
+                        )
+                endif()
+                if(APPLE)
+                        target_link_options(pico_openpgp PUBLIC
+                                -Wl,-dead_strip
+                        )
+                elseif(MSVC)
+                        target_compile_options(pico_openpgp PUBLIC
+                                -WX
+                        )

-#target_compile_definitions(pico_openpgp PRIVATE MBEDTLS_ECDSA_DETERMINISTIC=1)
-
-target_link_libraries(pico_openpgp PRIVATE pico_keys_sdk pico_stdlib tinyusb_device tinyusb_board pico_multicore hardware_flash hardware_sync hardware_adc pico_unique_id hardware_rtc)
+                        target_link_libraries(pico_openpgp PUBLIC wsock32 ws2_32 Bcrypt)
+                else()
+                        target_link_options(pico_openpgp PUBLIC
+                                -Wl,--gc-sections
+                        )
+                endif(APPLE)
+                target_link_libraries(pico_openpgp PRIVATE pthread m)
+        endif()
 endif()
+
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 # Pico OpenPGP
-This project aims at transforming your Raspberry Pico into a Smart Card with an OpenPGP applet integrated. The Pico works as a reader with an embedded OpenPGP card, like a USB card.
+This project aims at transforming your Raspberry Pico or ESP32 microcontroller into a Smart Card with an OpenPGP applet integrated. The Pico works as a reader with an embedded OpenPGP card, like a USB card.

 OpenPGP cards are used to manage PGP keys and do cryptographic operations, such as keypair generation, signing and asymmetric deciphering. Pico OpenPGP follows the [**OpenPGP 3.4.1** specifications](https://gnupg.org/ftp/specs/OpenPGP-smart-card-application-3.4.pdf "**OpenPGP 3.4.1** specifications"), available at [GnuPG](http://gnupg.org "GnuPG").

@@ -29,6 +29,10 @@ Pico OpenPGP has implemented the following features:
 - AES key generation.
 - AES ciphering and deciphering.
 - Cardholder certificates support.
+- Secure Boot and Secure Lock in RP2350 and ESP32-S3 MCUs.
+- One Time Programming to store the master key that encrypts all resident keys and seeds.
+- Rescue interface to allow recovery of the device if it becomes unresponsive or undetectable.
+- LED customization with Pico Commissioner.

 All these features are compliant with the specification. Therefore, if you detect some behaviour that is not expected or it does not follow the rules of specs, please open an issue.

@@ -47,44 +51,71 @@ As a consequence, Pico OpenPGP is designed from zero. Well, not strictly from ze
 Whilst Gnuk is OpenPGP 2.0 with small set of enhancements, Pico OpenPGP aims at being OpenPGP 3.4 compliant, with new features (not present in Gnuk), such as Manage Security Environment (MSE) or UIF.

 ## Security considerations
-All secret keys (asymmetric and symmetric) are stored encrypted in the flash memory of the Raspberry Pico. DEK is used as a 256 bit AES key to protect private and secret keys. Keys are never stored in RAM except for signature and decryption operations and only during the process. All keys (including DEK) are loaded and cleared every time to avoid potential security flaws.
+All secret keys (asymmetric and symmetric) are stored encrypted in the flash memory of the Raspberry Pico using a Device Encyrption Key (DEK). DEK is a 256 bit AES key used to protect private and secret keys. Keys are never stored in RAM except for signature and decryption operations and only during the process. All keys (including DEK) are loaded and cleared every time to avoid potential security flaws.

-At the same time, DEK is encrypted with doubled salted and hashed PIN. Also, the PIN is hashed in memory during the session. Hence, PIN is never stored in plain text neither in flash nor in memory. Note that PIN is conveyed from the host to the Pico in plain text if no secure channel is provided.
+At the same time, DEK is encrypted with doubled salted and hashed PIN. For RP2350 and ESP32-S3 microcontrollers it is masked by a secure device 32 bytes key. Also, the PIN is hashed in memory during the session. Hence, PIN is never stored in plain text neither in flash nor in memory. Note that PIN is conveyed from the host to the Pico in plain text if no secure channel is provided.

 If the Pico is stolen the contents of private and secret keys cannot be read without the PIN, even if the flash memory is dumped.

+### RP2350 and ESP32-S3
+RP2350 and ESP32-S3 microcontrollers are equipped with advanced security features, including Secure Boot and Secure Lock, ensuring that firmware integrity and authenticity are tightly controlled. Both devices support the storage of the Device Encryption Key (DEK) in an OTP (One-Time Programmable) memory region, making it permanently inaccessible for external access or tampering. This secure, non-volatile region guarantees that critical security keys are embedded into the hardware, preventing unauthorized access and supporting robust defenses against code injection or firmware modification. Together, Secure Boot and Secure Lock enforce firmware authentication, while the DEK in OTP memory solidifies the foundation for secure operations.
+
+### Secure Boot
+Secure Boot is a security feature that ensures that only trusted firmware, verified through digital signatures, can be loaded onto the device during the boot process. Once enabled, Secure Boot checks every piece of firmware against a cryptographic signature before execution, rejecting any unauthorized or modified code. This prevents malicious firmware from compromising the device’s operation and integrity. With Secure Boot activated, only firmware versions signed by a trusted authority, such as the device manufacturer, will be accepted, ensuring the device remains protected from unauthorized software modifications. **This is irreversible. Once enabled, it CANNOT be disabled.**
+
+**IMPORTANT:** For users wishing to develop and compile custom firmware, a private-public key pair is essential. Activating Secure Boot requires users to generate and manage their own unique private-public key pair. The public key from this pair must be embedded into the device to validate all firmware. Firmware will not boot without a proper digital signature from this key pair. This means that users must sign all future firmware versions with their private key and embed the public key in the device to ensure compatibility.
+
+### Secure Lock
+Secure Lock builds on Secure Boot by imposing an even stricter security model. Once activated, Secure Lock prevents any further installation of new boot keys, effectively locking the device to only run firmware that is authorized by the device's primary vendor—in this case, Pico Keys. In addition to preventing additional keys, Secure Lock disables debugging interfaces and puts additional safeguards in place to resist tampering and intrusion attempts. This ensures that the device operates exclusively with the original vendor’s firmware and resists unauthorized access, making it highly secure against external threats. **This is irreversible. Once enabled, it CANNOT be disabled.**
+
+**IMPORTANT:** Activating Secure Lock not only enables Secure Boot but also invalidates all keys except the official Pico Key. This means that only firmware signed by Pico Key will be recognized, and custom code will no longer be allowed. Once enabled, the Pico Key device will run solely on the official firmware available on the website, with no option for generating or compiling new code for the device.
+
 ## Download
-Please, go to the [Release page](https://github.com/polhenarejos/pico-openpgp/releases "Release page"))  and download the UF2 file for your board.
+**If you own an ESP32-S3 board, go to [ESP32 Flasher](https://www.picokeys.com/esp32-flasher/) for flashing your Pico OpenPGP.**

-Please, go to the Release page and download the UF2 file for your board.
+If you own a Raspberry Pico (RP2040 or RP2350), go to [Download page](https://www.picokeys.com/getting-started/), select your vendor and model and download the proper firmware; or go to [Release page](https://www.github.com/polhenarejos/pico-openpgp/releases/) and download the UF2 file for your board.

-Note that UF2 files are shiped with a dummy VID/PID to avoid license issues (FEFF:FCFD). If you are planning to use it with OpenSC or similar, you should modify Info.plist of CCID driver to add these VID/PID or use the [Pico Patcher tool](https://www.picokeys.com/pico-patcher/).
-
-Alternatively you can use the legacy VID/PID patcher as follows:
-`./patch_vidpid.sh VID:PID input_hsm_file.uf2 output_hsm_file.uf2`
+Note that UF2 files are shiped with a dummy VID/PID to avoid license issues (FEFF:FCFD). If you plan to use it with OpenSC or similar tools, you should modify Info.plist of CCID driver to add these VID/PID or use the [Pico Commissioner](https://www.picokeys.com/pico-commissioner/ "Pico Commissioner").

 You can use whatever VID/PID (i.e., 234b:0000 from FISJ), but remember that you are not authorized to distribute the binary with a VID/PID that you do not own.

-Note that the pure-browser option [Pico Patcher tool](https://www.picokeys.com/pico-patcher/) is the most recommended. 
+Note that the pure-browser option [Pico Commissioner](https://www.picokeys.com/pico-commissioner/ "Pico Commissioner") is the most recommended.

-## Build
+## Build for Raspberry Pico
 Before building, ensure you have installed the toolchain for the Pico and the Pico SDK is properly located in your drive.
+```
+git clone https://github.com/polhenarejos/pico-openpgp
+git submodule update --init --recursive
+cd pico-openpgp
+mkdir build
+cd build
+PICO_SDK_PATH=/path/to/pico-sdk cmake .. -DPICO_BOARD=board_type -DUSB_VID=0x1234 -DUSB_PID=0x5678
+make
+```
+Note that `PICO_BOARD`, `USB_VID` and `USB_PID` are optional. If not provided, `pico` board and VID/PID `FEFF:FCFD` will be used.

-    git clone https://github.com/polhenarejos/pico-openpgp
-    cd pico-openpgp
-    mkdir build
-    cd build
-    PICO_SDK_PATH=/path/to/pico-sdk cmake .. -DPICO_BOARD=board_type -DUSB_VID=0x1234 -DUSB_PID=0x5678
-    make
+Additionally, you can pass the `VIDPID=value` parameter to build the firmware with a known VID/PID. The supported values are:

-Note that PICO_BOARD, USB_VID and USB_PID are optional. If not provided, pico board and VID/PID FEFF:FCFD will be used.
+- `NitroHSM`
+- `NitroFIDO2`
+- `NitroStart`
+- `NitroPro`
+- `Nitro3`
+- `Yubikey5`
+- `YubikeyNeo`
+- `YubiHSM`
+- `Gnuk`
+- `GnuPG`

-After make ends, the binary file pico_openpgp.uf2 will be generated. Put your pico board into loading mode, by pushing BOOTSEL button while pluging on, and copy the UF2 to the new fresh usb mass storage Pico device. Once copied, the pico mass storage will be disconnected automatically and the pico board will reset with the new firmware. A blinking led will indicate the device is ready to work.
+After running `make`, the binary file `pico_openpgp.uf2` will be generated. To load this onto your Pico board:
+
+1. Put the Pico board into loading mode by holding the `BOOTSEL` button while plugging it in.
+2. Copy the `pico_openpgp.uf2` file to the new USB mass storage device that appears.
+3. Once the file is copied, the Pico mass storage device will automatically disconnect, and the Pico board will reset with the new firmware.
+4. A blinking LED will indicate that the device is ready to work.

 ## Operation time
 ### Keypair generation
-Generating EC keys is almost instant. RSA keypair generation takes some time, specially for 3072 and 4096 bits.
-### Keypair generation
 Generating EC keys is almost instant. RSA keypair generation takes some time, specially for `3072` and `4096` bits.

 | RSA key length (bits) | Average time (seconds) |
@@ -135,7 +166,9 @@ Pico OpenPGP relies on PKCS#15 structure to store and manipulate the internal fi
 The way to communicate is exactly the same as with other cards, such as OpenPGP or similar.

 ### Important
-OpenSC relies on PCSC driver, which reads a list (`Info.plist`) that contains a pair of VID/PID of supported readers. In order to be detectable, you must patch the UF2 binary (if you just downloaded from the [Release section](https://github.com/polhenarejos/pico-openpgp/releases "Release section")) or configure the project with the proper VID/PID with `USB_VID` and `USB_PID` parameters in `CMake` (see [Build section](#build "Build section")). Note that you cannot distribute the patched/compiled binary if you do not own the VID/PID or have an explicit authorization.
+OpenSC relies on PCSC driver, which reads a list (`Info.plist`) that contains a pair of VID/PID of supported readers. In order to be detectable, you have several options:
+- Use the pure-browser online [Pico Commissioner](https://www.picokeys.com/pico-commissioner/ "Pico Commissioner") that commissions the Pico Key on-the-fly without external tools.
+- Build and configure the project with the proper VID/PID with `USB_VID` and `USB_PID` parameters in `CMake` (see [Build section](#build "Build section")). Note that you cannot distribute the patched/compiled binary if you do not own the VID/PID or have an explicit authorization.

 ## Credits
 Pico OpenPGP uses the following libraries or portion of code:
--- a/2
+++ b/2
@@ -1 +1 @@
-Version=1.12
+Version=2.2
--- a/build_pico_openpgp.sh
+++ b/build_pico_openpgp.sh
@@ -1,45 +1,93 @@
 #!/bin/bash

-VERSION_MAJOR="1"
-VERSION_MINOR="12"
+VERSION_MAJOR="3"
+VERSION_MINOR="0"
+SUFFIX="${VERSION_MAJOR}.${VERSION_MINOR}"
+#if ! [[ -z "${GITHUB_SHA}" ]]; then
+#    SUFFIX="${SUFFIX}.${GITHUB_SHA}"
+#fi

 rm -rf release/*
+mkdir -p build_release
+mkdir -p release
 cd build_release

-for board in adafruit_feather_rp2040 \
+for board in 0xcb_helios \
+    adafruit_feather_rp2040_usb_host \
+    adafruit_feather_rp2040 \
    adafruit_itsybitsy_rp2040 \
    adafruit_kb2040 \
    adafruit_macropad_rp2040 \
    adafruit_qtpy_rp2040 \
    adafruit_trinkey_qt2040 \
+    amethyst_fpga \
+    archi \
    arduino_nano_rp2040_connect \
+    cytron_maker_pi_rp2040 \
    datanoisetv_rp2040_dsp \
    eetree_gamekit_rp2040 \
    garatronic_pybstick26_rp2040 \
+    gen4_rp2350_24 \
+    gen4_rp2350_24ct \
+    gen4_rp2350_24t \
+    gen4_rp2350_28 \
+    gen4_rp2350_28ct \
+    gen4_rp2350_28t \
+    gen4_rp2350_32 \
+    gen4_rp2350_32ct \
+    gen4_rp2350_32t \
+    gen4_rp2350_35 \
+    gen4_rp2350_35ct \
+    gen4_rp2350_35t \
+    hellbender_2350A_devboard \
+    ilabs_challenger_rp2350_bconnect \
+    ilabs_challenger_rp2350_wifi_ble \
+    ilabs_opendec02 \
+    melopero_perpetuo_rp2350_lora \
    melopero_shake_rp2040 \
+    metrotech_xerxes_rp2040 \
+    net8086_usb_interposer \
    nullbits_bit_c_pro \
+    phyx_rick_tny_rp2350 \
+    pi-plates_micropi \
    pico \
    pico_w \
+    pico2 \
    pimoroni_badger2040 \
    pimoroni_interstate75 \
    pimoroni_keybow2040 \
    pimoroni_motor2040 \
    pimoroni_pga2040 \
+    pimoroni_pga2350 \
+    pimoroni_pico_plus2_rp2350 \
    pimoroni_picolipo_4mb \
    pimoroni_picolipo_16mb \
    pimoroni_picosystem \
    pimoroni_plasma2040 \
+    pimoroni_plasma2350 \
    pimoroni_servo2040 \
    pimoroni_tiny2040 \
    pimoroni_tiny2040_2mb \
+    pimoroni_tiny2350 \
    pololu_3pi_2040_robot \
+    pololu_zumo_2040_robot \
    seeed_xiao_rp2040 \
+    seeed_xiao_rp2350 \
    solderparty_rp2040_stamp \
    solderparty_rp2040_stamp_carrier \
    solderparty_rp2040_stamp_round_carrier \
+    solderparty_rp2350_stamp_xl \
+    solderparty_rp2350_stamp \
    sparkfun_micromod \
    sparkfun_promicro \
+    sparkfun_promicro_rp2350 \
    sparkfun_thingplus \
+    switchscience_picossci2_conta_base \
+    switchscience_picossci2_dev_board \
+    switchscience_picossci2_micro \
+    switchscience_picossci2_rp2350_breakout \
+    switchscience_picossci2_tiny \
+    tinycircuits_thumby_color_rp2350 \
    vgaboard \
    waveshare_rp2040_lcd_0.96 \
    waveshare_rp2040_lcd_1.28 \
@@ -47,11 +95,14 @@ for board in adafruit_feather_rp2040 \
    waveshare_rp2040_plus_4mb \
    waveshare_rp2040_plus_16mb \
    waveshare_rp2040_zero \
+    weact_studio_rp2040_2mb \
+    weact_studio_rp2040_4mb \
+    weact_studio_rp2040_8mb \
+    weact_studio_rp2040_16mb \
    wiznet_w5100s_evb_pico
 do
    rm -rf *
-    PICO_SDK_PATH=../../pico-sdk cmake .. -DPICO_BOARD=$board
-    make -kj20
-    mv pico_openpgp.uf2 ../release/pico_openpgp_$board-$VERSION_MAJOR.$VERSION_MINOR.uf2
-
+    PICO_SDK_PATH="${PICO_SDK_PATH:-../../pico-sdk}" cmake .. -DPICO_BOARD=$board
+    make -j`nproc`
+    mv pico_openpgp.uf2 ../release/pico_openpgp_$board-$SUFFIX.uf2
 done
--- a/patch_vidpid.sh
+++ b/patch_vidpid.sh
@@ -17,7 +17,7 @@
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #

-VERSION_MAJOR="4" #Version of Pico CCID Core
+VERSION_MAJOR="5" #Version of Pico Keys SDK
 VERSION_MINOR="0"

 echo "----------------------------"
--- a/2
+++ b/2
--- a/pico_sdk_import.cmake
+++ b/pico_sdk_import.cmake
@@ -18,9 +18,20 @@ if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_PATH} AND (NOT PICO_SDK_FETCH_FROM_GIT_P
    message("Using PICO_SDK_FETCH_FROM_GIT_PATH from environment ('${PICO_SDK_FETCH_FROM_GIT_PATH}')")
 endif ()

+if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_TAG} AND (NOT PICO_SDK_FETCH_FROM_GIT_TAG))
+    set(PICO_SDK_FETCH_FROM_GIT_TAG $ENV{PICO_SDK_FETCH_FROM_GIT_TAG})
+    message("Using PICO_SDK_FETCH_FROM_GIT_TAG from environment ('${PICO_SDK_FETCH_FROM_GIT_TAG}')")
+endif ()
+
+if (PICO_SDK_FETCH_FROM_GIT AND NOT PICO_SDK_FETCH_FROM_GIT_TAG)
+  set(PICO_SDK_FETCH_FROM_GIT_TAG "master")
+  message("Using master as default value for PICO_SDK_FETCH_FROM_GIT_TAG")
+endif()
+
 set(PICO_SDK_PATH "${PICO_SDK_PATH}" CACHE PATH "Path to the Raspberry Pi Pico SDK")
 set(PICO_SDK_FETCH_FROM_GIT "${PICO_SDK_FETCH_FROM_GIT}" CACHE BOOL "Set to ON to fetch copy of SDK from git if not otherwise locatable")
 set(PICO_SDK_FETCH_FROM_GIT_PATH "${PICO_SDK_FETCH_FROM_GIT_PATH}" CACHE FILEPATH "location to download SDK")
+set(PICO_SDK_FETCH_FROM_GIT_TAG "${PICO_SDK_FETCH_FROM_GIT_TAG}" CACHE FILEPATH "release tag for SDK")

 if (NOT PICO_SDK_PATH)
    if (PICO_SDK_FETCH_FROM_GIT)
@@ -29,11 +40,22 @@ if (NOT PICO_SDK_PATH)
        if (PICO_SDK_FETCH_FROM_GIT_PATH)
            get_filename_component(FETCHCONTENT_BASE_DIR "${PICO_SDK_FETCH_FROM_GIT_PATH}" REALPATH BASE_DIR "${CMAKE_SOURCE_DIR}")
        endif ()
-        FetchContent_Declare(
-                pico_sdk
-                GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk
-                GIT_TAG master
-        )
+        # GIT_SUBMODULES_RECURSE was added in 3.17
+        if (${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.17.0")
+            FetchContent_Declare(
+                    pico_sdk
+                    GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk
+                    GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG}
+                    GIT_SUBMODULES_RECURSE FALSE
+            )
+        else ()
+            FetchContent_Declare(
+                    pico_sdk
+                    GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk
+                    GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG}
+            )
+        endif ()
+
        if (NOT pico_sdk)
            message("Downloading Raspberry Pi Pico SDK")
            FetchContent_Populate(pico_sdk)
--- a/sdkconfig.defaults
+++ b/sdkconfig.defaults
@@ -0,0 +1,55 @@
+# This file was generated using idf.py save-defconfig. It can be edited manually.
+# Espressif IoT Development Framework (ESP-IDF) Project Minimal Configuration
+#
+IGNORE_UNKNOWN_FILES_FOR_MANAGED_COMPONENTS=1
+
+CONFIG_TINYUSB=y
+
+CONFIG_PARTITION_TABLE_CUSTOM=y
+CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="pico-keys-sdk/config/esp32/partitions.csv"
+CONFIG_PARTITION_TABLE_FILENAME="pico-keys-sdk/config/esp32/partitions.csv"
+CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
+CONFIG_WL_SECTOR_SIZE_512=y
+CONFIG_WL_SECTOR_MODE_PERF=y
+COMPILER_OPTIMIZATION="Performance"
+
+CONFIG_MBEDTLS_CMAC_C=y
+CONFIG_MBEDTLS_CHACHA20_C=y
+CONFIG_MBEDTLS_POLY1305_C=y
+CONFIG_MBEDTLS_CHACHAPOLY_C=y
+CONFIG_MBEDTLS_HKDF_C=y
+CONFIG_MBEDTLS_HARDWARE_ECC=y
+CONFIG_MBEDTLS_HARDWARE_GCM=y
+CONFIG_MBEDTLS_DES_C=y
+# CONFIG_MBEDTLS_HARDWARE_MPI is not set
+CONFIG_MBEDTLS_HARDWARE_SHA=y
+CONFIG_MBEDTLS_HARDWARE_AES=y
+# CONFIG_MBEDTLS_ROM_MD5 is not set
+CONFIG_MBEDTLS_SHA512_C=y
+CONFIG_MBEDTLS_TLS_DISABLED=y
+# CONFIG_MBEDTLS_TLS_ENABLED is not set
+# CONFIG_ESP_TLS_USE_DS_PERIPHERAL is not set
+# CONFIG_ESP_WIFI_ENABLED is not set
+# CONFIG_ESP_WIFI_MBEDTLS_CRYPTO is not set
+# CONFIG_ESP_WIFI_MBEDTLS_TLS_CLIENT is not set
+# CONFIG_WPA_MBEDTLS_CRYPTO is not set
+# CONFIG_MBEDTLS_PSK_MODES is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_RSA is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ELLIPTIC_CURVE is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA is not set
+# CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA is not set
+# CONFIG_MBEDTLS_SSL_RENEGOTIATION is not set
+# CONFIG_MBEDTLS_SSL_PROTO_TLS1_2 is not set
+# CONFIG_MBEDTLS_SSL_PROTO_GMTSSL1_1 is not set
+# CONFIG_MBEDTLS_SSL_PROTO_DTLS is not set
+# CONFIG_MBEDTLS_SSL_ALPN is not set
+# CONFIG_MBEDTLS_CLIENT_SSL_SESSION_TICKETS is not set
+# CONFIG_MBEDTLS_SERVER_SSL_SESSION_TICKETS is not set
+# CONFIG_ESP32_WIFI_ENABLE_WPA3_SAE is not set
+# CONFIG_ESP32_WIFI_ENABLE_WPA3_OWE_STA is not set
+# CONFIG_ESP_WIFI_ENABLE_WPA3_SAE is not set
+# CONFIG_ESP_WIFI_ENABLE_WPA3_OWE_STA is not set
+
+CONFIG_ESP_COREDUMP_ENABLE_TO_UART=y
--- a/src/openpgp/CMakeLists.txt
+++ b/src/openpgp/CMakeLists.txt
@@ -0,0 +1,6 @@
+idf_component_register(
+    SRCS ${SOURCES}
+    INCLUDE_DIRS . ../../pico-keys-sdk/src ../../pico-keys-sdk/src/fs ../../pico-keys-sdk/src/rng ../../pico-keys-sdk/src/usb
+    REQUIRES bootloader_support esp_partition esp_tinyusb zorxx__neopixel mbedtls efuse
+)
+idf_component_set_property(${COMPONENT_NAME} WHOLE_ARCHIVE ON)
--- a/src/openpgp/files.c
+++ b/src/openpgp/files.c
@@ -39,6 +39,7 @@ extern int parse_algoinfo(const file_t *f, int mode);
 extern int parse_app_data(const file_t *f, int mode);
 extern int parse_discrete_do(const file_t *f, int mode);
 extern int parse_pw_status(const file_t *f, int mode);
+extern int piv_parse_discovery(const file_t *f);

 uint8_t historical_bytes[] = {
    10, 0,
@@ -249,10 +250,236 @@ file_t file_entries[] = {
    /* 56 */ { .fid = EF_CH_3, .parent = 0, .name = NULL,
               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_NONE },
+    // ** PIV ** //
+    /* 57 */ { .fid = EF_PIV_ADMIN_DATA, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 58 */ { .fid = EF_PIV_ATTESTATION, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 59 */ { .fid = EF_PIV_MSCMAP, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 60 */ { .fid = EF_PIV_MSROOTS1, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 61 */ { .fid = EF_PIV_MSROOTS2, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 62 */ { .fid = EF_PIV_MSROOTS3, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 63 */ { .fid = EF_PIV_MSROOTS4, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 64 */ { .fid = EF_PIV_MSROOTS5, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 65 */ { .fid = EF_PIV_KEY_AUTHENTICATION, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 66 */ { .fid = EF_PIV_KEY_CARDMGM, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 67 */ { .fid = EF_PIV_KEY_SIGNATURE, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 68 */ { .fid = EF_PIV_KEY_KEYMGM, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 69 */ { .fid = EF_PIV_KEY_CARDAUTH, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 70 */ { .fid = EF_PIV_KEY_RETIRED1, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 71 */ { .fid = EF_PIV_KEY_RETIRED2, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 72 */ { .fid = EF_PIV_KEY_RETIRED3, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 73 */ { .fid = EF_PIV_KEY_RETIRED4, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 74 */ { .fid = EF_PIV_KEY_RETIRED5, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 75 */ { .fid = EF_PIV_KEY_RETIRED6, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 76 */ { .fid = EF_PIV_KEY_RETIRED7, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 77 */ { .fid = EF_PIV_KEY_RETIRED8, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 78 */ { .fid = EF_PIV_KEY_RETIRED9, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 79 */ { .fid = EF_PIV_KEY_RETIRED10, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 80 */ { .fid = EF_PIV_KEY_RETIRED11, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 81 */ { .fid = EF_PIV_KEY_RETIRED12, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 82 */ { .fid = EF_PIV_KEY_RETIRED12, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 83 */ { .fid = EF_PIV_KEY_RETIRED13, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 84 */ { .fid = EF_PIV_KEY_RETIRED14, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 85 */ { .fid = EF_PIV_KEY_RETIRED15, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 86 */ { .fid = EF_PIV_KEY_RETIRED16, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 87 */ { .fid = EF_PIV_KEY_RETIRED17, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 88 */ { .fid = EF_PIV_KEY_RETIRED18, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 89 */ { .fid = EF_PIV_KEY_RETIRED19, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 90 */ { .fid = EF_PIV_KEY_RETIRED20, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 91 */ { .fid = EF_PIV_KEY_ATTESTATION, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 92 */ { .fid = EF_PIV_CAPABILITY, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 93 */ { .fid = EF_PIV_CHUID, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 94 */ { .fid = EF_PIV_AUTHENTICATION, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 95 */ { .fid = EF_PIV_FINGERPRINTS, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 96 */ { .fid = EF_PIV_SECURITY, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 97 */ { .fid = EF_PIV_FACIAL, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 98 */ { .fid = EF_PIV_PRINTED, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 99 */ { .fid = EF_PIV_SIGNATURE, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 100 */ { .fid = EF_PIV_KEY_MANAGEMENT, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 101 */ { .fid = EF_PIV_CARD_AUTH, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 102 */ { .fid = EF_PIV_DISCOVERY, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FUNC, .data = (uint8_t *) piv_parse_discovery,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 103 */ { .fid = EF_PIV_KEY_HISTORY, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 104 */ { .fid = EF_PIV_IRIS, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 105 */ { .fid = EF_PIV_BITGT, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 106 */ { .fid = EF_PIV_SM_SIGNER, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 107 */ { .fid = EF_PIV_PC_REF_DATA, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 108 */ { .fid = EF_PIV_RETIRED1, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 109 */ { .fid = EF_PIV_RETIRED2, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 110 */ { .fid = EF_PIV_RETIRED3, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 111 */ { .fid = EF_PIV_RETIRED4, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 112 */ { .fid = EF_PIV_RETIRED5, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 113 */ { .fid = EF_PIV_RETIRED6, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 114 */ { .fid = EF_PIV_RETIRED7, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 115 */ { .fid = EF_PIV_RETIRED8, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 116 */ { .fid = EF_PIV_RETIRED9, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 117 */ { .fid = EF_PIV_RETIRED10, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 118 */ { .fid = EF_PIV_RETIRED11, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 119 */ { .fid = EF_PIV_RETIRED12, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 120 */ { .fid = EF_PIV_RETIRED13, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 121 */ { .fid = EF_PIV_RETIRED14, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 122 */ { .fid = EF_PIV_RETIRED15, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 123 */ { .fid = EF_PIV_RETIRED16, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 124 */ { .fid = EF_PIV_RETIRED17, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 125 */ { .fid = EF_PIV_RETIRED18, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 126 */ { .fid = EF_PIV_RETIRED19, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 127 */ { .fid = EF_PIV_RETIRED20, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_WORKING_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },
+    /* 128 */ { .fid = EF_PIV_PIN, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 129 */ { .fid = EF_PIV_PUK, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_WP },
+    /* 130 */ { .fid = EF_META, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_NONE },
+    /* 131 */ { .fid = EF_PW_RETRIES, .parent = 0, .name = NULL,
+               .type = FILE_TYPE_INTERNAL_EF | FILE_DATA_FLASH, .data = NULL,
+               .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_R_WP },

-    /* 57 */ { .fid = 0x0000, .parent = 0, .name = openpgp_aid, .type = FILE_TYPE_WORKING_EF,
+    /* 132 */ { .fid = 0x0000, .parent = 0, .name = openpgp_aid, .type = FILE_TYPE_WORKING_EF,
               .data = NULL, .ef_structure = FILE_EF_TRANSPARENT, .acl = ACL_RO },
-    /* 58 */ { .fid = 0x0000, .parent = 0xff, .name = NULL, .type = FILE_TYPE_UNKNOWN, .data = NULL,
+    /* 133 */ { .fid = 0x0000, .parent = 0xff, .name = NULL, .type = FILE_TYPE_NOT_KNOWN, .data = NULL,
               .ef_structure = 0, .acl = ACL_NONE }                                                                                       //end
 };

--- a/src/openpgp/files.h
+++ b/src/openpgp/files.h
@@ -28,6 +28,7 @@
 #define EF_ALGO_PRIV2   0x10c2
 #define EF_ALGO_PRIV3   0x10c3
 #define EF_PW_PRIV      0x10c4
+#define EF_PW_RETRIES   0x10c5
 #define EF_PK_SIG       0x10d1
 #define EF_PK_DEC       0x10d2
 #define EF_PK_AUT       0x10d3
@@ -81,4 +82,85 @@
 #define EF_EXLEN_INFO   0x7f66 //C
 #define EF_GFM          0x7f74 //C

+// PIV
+
+#define EF_PIV_PIN  0x1184
+#define EF_PIV_PUK  0x1185
+
+#define EF_PIV_ADMIN_DATA  0xff00
+#define EF_PIV_ATTESTATION 0xff01
+#define	EF_PIV_MSCMAP      0xff10
+#define	EF_PIV_MSROOTS1    0xff11
+#define EF_PIV_MSROOTS2    0xff12
+#define EF_PIV_MSROOTS3    0xff13
+#define EF_PIV_MSROOTS4    0xff14
+#define EF_PIV_MSROOTS5    0xff15
+
+#define EF_PIV_KEY_AUTHENTICATION   0x009a
+#define EF_PIV_KEY_CARDMGM          0x009b
+#define EF_PIV_KEY_SIGNATURE        0x009c
+#define EF_PIV_KEY_KEYMGM           0x009d
+#define EF_PIV_KEY_CARDAUTH         0x009e
+#define EF_PIV_KEY_RETIRED1         0x0082
+#define EF_PIV_KEY_RETIRED2         0x0083
+#define EF_PIV_KEY_RETIRED3         0x0084
+#define EF_PIV_KEY_RETIRED4         0x0085
+#define EF_PIV_KEY_RETIRED5         0x0086
+#define EF_PIV_KEY_RETIRED6         0x0087
+#define EF_PIV_KEY_RETIRED7         0x0088
+#define EF_PIV_KEY_RETIRED8         0x0089
+#define EF_PIV_KEY_RETIRED9         0x008a
+#define EF_PIV_KEY_RETIRED10        0x008b
+#define EF_PIV_KEY_RETIRED11        0x008c
+#define EF_PIV_KEY_RETIRED12        0x008d
+#define EF_PIV_KEY_RETIRED13        0x008e
+#define EF_PIV_KEY_RETIRED14        0x008f
+#define EF_PIV_KEY_RETIRED15        0x0090
+#define EF_PIV_KEY_RETIRED16        0x0091
+#define EF_PIV_KEY_RETIRED17        0x0092
+#define EF_PIV_KEY_RETIRED18        0x0096 // It's 0x93 but assigned to EF_SIG_COUNT
+#define EF_PIV_KEY_RETIRED19        0x0094
+#define EF_PIV_KEY_RETIRED20        0x0095
+#define EF_PIV_KEY_ATTESTATION      0x00fb // It's 0xf9 but assigned to EF_KDF
+
+#define EF_PIV_CAPABILITY       0xc107
+#define EF_PIV_CHUID            0xc102
+#define EF_PIV_AUTHENTICATION   0xc105 /* cert for 9a key */
+#define EF_PIV_FINGERPRINTS     0xc103
+#define EF_PIV_SECURITY         0xc106
+#define EF_PIV_FACIAL           0xc108
+#define EF_PIV_PRINTED          0xc109
+#define EF_PIV_SIGNATURE        0xc10a /* cert for 9c key */
+#define EF_PIV_KEY_MANAGEMENT   0xc10b /* cert for 9d key */
+#define EF_PIV_CARD_AUTH        0xc101 /* cert for 9e key */
+#define EF_PIV_DISCOVERY        0x007e
+#define EF_PIV_KEY_HISTORY      0xc10c
+#define EF_PIV_IRIS             0xc121
+#define EF_PIV_BITGT            0x7f61
+#define EF_PIV_SM_SIGNER        0xc122
+#define EF_PIV_PC_REF_DATA      0xc123
+
+#define EF_PIV_RETIRED1  0xc10d
+#define EF_PIV_RETIRED2  0xc10e
+#define EF_PIV_RETIRED3  0xc10f
+#define EF_PIV_RETIRED4  0xc110
+#define EF_PIV_RETIRED5  0xc111
+#define EF_PIV_RETIRED6  0xc112
+#define EF_PIV_RETIRED7  0xc113
+#define EF_PIV_RETIRED8  0xc114
+#define EF_PIV_RETIRED9  0xc115
+#define EF_PIV_RETIRED10 0xc116
+#define EF_PIV_RETIRED11 0xc117
+#define EF_PIV_RETIRED12 0xc118
+#define EF_PIV_RETIRED13 0xc119
+#define EF_PIV_RETIRED14 0xc11a
+#define EF_PIV_RETIRED15 0xc11b
+#define EF_PIV_RETIRED16 0xc11c
+#define EF_PIV_RETIRED17 0xc11d
+#define EF_PIV_RETIRED18 0xc11e
+#define EF_PIV_RETIRED19 0xc11f
+#define EF_PIV_RETIRED20 0xc120
+
+#define EF_DEV_CONF     0x1122
+
 #endif
--- a/src/openpgp/management.c
+++ b/src/openpgp/management.c
@@ -0,0 +1,153 @@
+/*
+ * This file is part of the Pico FIDO distribution (https://github.com/polhenarejos/pico-fido).
+ * Copyright (c) 2022 Pol Henarejos.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "pico_keys.h"
+#include "apdu.h"
+#include "version.h"
+#include "files.h"
+#include "asn1.h"
+#include "management.h"
+
+int man_process_apdu();
+int man_unload();
+
+const uint8_t man_aid[] = {
+    8,
+    0xa0, 0x00, 0x00, 0x05, 0x27, 0x47, 0x11, 0x17
+};
+
+extern void init_piv();
+int man_select(app_t *a, uint8_t force) {
+    (void) force;
+    a->process_apdu = man_process_apdu;
+    a->unload = man_unload;
+    sprintf((char *) res_APDU, "%d.%d.0", PIV_VERSION_MAJOR, PIV_VERSION_MINOR);
+    res_APDU_size = strlen((char *) res_APDU);
+    apdu.ne = res_APDU_size;
+    init_piv();
+    return PICOKEY_OK;
+}
+
+INITIALIZER( man_ctor ) {
+    register_app(man_select, man_aid);
+}
+
+int man_unload() {
+    return PICOKEY_OK;
+}
+
+bool cap_supported(uint16_t cap) {
+    file_t *ef = search_dynamic_file(EF_DEV_CONF);
+    if (file_has_data(ef)) {
+        uint16_t tag = 0x0;
+        uint8_t *tag_data = NULL, *p = NULL;
+        uint16_t tag_len = 0;
+        asn1_ctx_t ctxi;
+        asn1_ctx_init(file_get_data(ef), file_get_size(ef), &ctxi);
+        while (walk_tlv(&ctxi, &p, &tag, &tag_len, &tag_data)) {
+            if (tag == TAG_USB_ENABLED) {
+                uint16_t ecaps = tag_data[0];
+                if (tag_len == 2) {
+                    ecaps = (tag_data[0] << 8) | tag_data[1];
+                }
+                return ecaps & cap;
+            }
+        }
+    }
+    return true;
+}
+
+int man_get_config() {
+    file_t *ef = search_dynamic_file(EF_DEV_CONF);
+    res_APDU_size = 0;
+    res_APDU[res_APDU_size++] = 0; // Overall length. Filled later
+    res_APDU[res_APDU_size++] = TAG_USB_SUPPORTED;
+    res_APDU[res_APDU_size++] = 1;
+    res_APDU[res_APDU_size++] = CAP_PIV | CAP_OPENPGP;
+    res_APDU[res_APDU_size++] = TAG_SERIAL;
+    res_APDU[res_APDU_size++] = 4;
+    memcpy(res_APDU + res_APDU_size, pico_serial.id, 4);
+    res_APDU_size += 4;
+    res_APDU[res_APDU_size++] = TAG_FORM_FACTOR;
+    res_APDU[res_APDU_size++] = 1;
+    res_APDU[res_APDU_size++] = 0x01;
+    res_APDU[res_APDU_size++] = TAG_VERSION;
+    res_APDU[res_APDU_size++] = 3;
+    res_APDU[res_APDU_size++] = PIV_VERSION_MAJOR;
+    res_APDU[res_APDU_size++] = PIV_VERSION_MINOR;
+    res_APDU[res_APDU_size++] = 0;
+    res_APDU[res_APDU_size++] = TAG_NFC_SUPPORTED;
+    res_APDU[res_APDU_size++] = 1;
+    res_APDU[res_APDU_size++] = 0x00;
+    if (!file_has_data(ef)) {
+        res_APDU[res_APDU_size++] = TAG_USB_ENABLED;
+        res_APDU[res_APDU_size++] = 1;
+        res_APDU[res_APDU_size++] = CAP_PIV | CAP_OPENPGP;
+        res_APDU[res_APDU_size++] = TAG_DEVICE_FLAGS;
+        res_APDU[res_APDU_size++] = 1;
+        res_APDU[res_APDU_size++] = FLAG_EJECT;
+        res_APDU[res_APDU_size++] = TAG_CONFIG_LOCK;
+        res_APDU[res_APDU_size++] = 1;
+        res_APDU[res_APDU_size++] = 0x00;
+        res_APDU[res_APDU_size++] = TAG_NFC_ENABLED;
+        res_APDU[res_APDU_size++] = 1;
+        res_APDU[res_APDU_size++] = 0x00;
+    }
+    else {
+        memcpy(res_APDU + res_APDU_size, file_get_data(ef), file_get_size(ef));
+        res_APDU_size += file_get_size(ef);
+    }
+    res_APDU[0] = res_APDU_size - 1;
+    return 0;
+}
+
+int cmd_read_config() {
+    man_get_config();
+    return SW_OK();
+}
+
+int cmd_write_config() {
+    if (apdu.data[0] != apdu.nc - 1) {
+        return SW_WRONG_DATA();
+    }
+    file_t *ef = file_new(EF_DEV_CONF);
+    file_put_data(ef, apdu.data + 1, apdu.nc - 1);
+    low_flash_available();
+    return SW_OK();
+}
+
+#define INS_READ_CONFIG             0x1D
+#define INS_WRITE_CONFIG            0x1C
+
+static const cmd_t cmds[] = {
+    { INS_READ_CONFIG, cmd_read_config },
+    { INS_WRITE_CONFIG, cmd_write_config },
+    { 0x00, 0x0 }
+};
+
+int man_process_apdu() {
+    if (CLA(apdu) != 0x00) {
+        return SW_CLA_NOT_SUPPORTED();
+    }
+    for (const cmd_t *cmd = cmds; cmd->ins != 0x00; cmd++) {
+        if (cmd->ins == INS(apdu)) {
+            int r = cmd->cmd_handler();
+            return r;
+        }
+    }
+    return SW_INS_NOT_SUPPORTED();
+}
--- a/src/openpgp/management.h
+++ b/src/openpgp/management.h
@@ -0,0 +1,55 @@
+/*
+ * This file is part of the Pico FIDO distribution (https://github.com/polhenarejos/pico-fido).
+ * Copyright (c) 2022 Pol Henarejos.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _MANAGEMENT_H_
+#define _MANAGEMENT_H_
+
+#include <stdlib.h>
+#if !defined(ENABLE_EMULATION) && !defined(ESP_PLATFORM)
+#include "pico/stdlib.h"
+#endif
+
+#define TAG_USB_SUPPORTED 0x01
+#define TAG_SERIAL 0x02
+#define TAG_USB_ENABLED 0x03
+#define TAG_FORM_FACTOR 0x04
+#define TAG_VERSION 0x05
+#define TAG_AUTO_EJECT_TIMEOUT 0x06
+#define TAG_CHALRESP_TIMEOUT 0x07
+#define TAG_DEVICE_FLAGS 0x08
+#define TAG_APP_VERSIONS 0x09
+#define TAG_CONFIG_LOCK 0x0A
+#define TAG_UNLOCK 0x0B
+#define TAG_REBOOT 0x0C
+#define TAG_NFC_SUPPORTED 0x0D
+#define TAG_NFC_ENABLED 0x0E
+
+#define CAP_OTP 0x01
+#define CAP_U2F 0x02
+#define CAP_FIDO2 0x200
+#define CAP_OATH 0x20
+#define CAP_PIV 0x10
+#define CAP_OPENPGP 0x08
+#define CAP_HSMAUTH 0x100
+
+#define FLAG_REMOTE_WAKEUP 0x40
+#define FLAG_EJECT 0x80
+
+extern bool cap_supported(uint16_t cap);
+extern int man_get_config();
+
+#endif //_MANAGEMENT_H
--- a/src/openpgp/openpgp.c
+++ b/src/openpgp/openpgp.c
@@ -15,20 +15,26 @@
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

+#ifdef ESP_PLATFORM
+#include "esp_compat.h"
+#define MBEDTLS_ALLOW_PRIVATE_ACCESS
+#else
 #include "common.h"
+#endif
 #include "openpgp.h"
 #include "version.h"
 #include "files.h"
 #include "random.h"
 #include "eac.h"
 #include "crypto_utils.h"
-#include "mbedtls/rsa.h"
-#include "mbedtls/ecdsa.h"
 #include "mbedtls/ecdh.h"
 #include "mbedtls/asn1.h"
 #include "asn1.h"
 #include "usb.h"
 #include "ccid/ccid.h"
+#include "otp.h"
+
+uint8_t PICO_PRODUCT = 3;

 bool has_pw1 = false;
 bool has_pw2 = false;
@@ -60,7 +66,6 @@ char atr_openpgp[] = {

 int openpgp_process_apdu();

-
 extern uint32_t board_button_read(void);

 static bool wait_button_pressed(uint16_t fid) {
@@ -168,58 +173,9 @@ void scan_files() {
    file_t *ef;
    if ((ef = search_by_fid(EF_FULL_AID, NULL, SPECIFY_ANY))) {
        ef->data = openpgp_aid_full;
-#ifndef ENABLE_EMULATION
-        pico_get_unique_board_id_string((char *) ef->data + 12, 4);
-#else
-        memset((char *) ef->data + 12, 0, 4);
-#endif
-    }
-    if ((ef = search_by_fid(EF_PW1, NULL, SPECIFY_ANY))) {
-        if (!ef->data) {
-            printf("PW1 is empty. Initializing with default password\r\n");
-            const uint8_t def[6] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
-            uint8_t dhash[33];
-            dhash[0] = sizeof(def);
-            double_hash_pin(def, sizeof(def), dhash + 1);
-            flash_write_data_to_file(ef, dhash, sizeof(dhash));
-        }
-    }
-    if ((ef = search_by_fid(EF_RC, NULL, SPECIFY_ANY))) {
-        if (!ef->data) {
-            printf("RC is empty. Initializing with default password\r\n");
-
-            const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
-            uint8_t dhash[33];
-            dhash[0] = sizeof(def);
-            double_hash_pin(def, sizeof(def), dhash + 1);
-            flash_write_data_to_file(ef, dhash, sizeof(dhash));
-        }
-    }
-    if ((ef = search_by_fid(EF_PW3, NULL, SPECIFY_ANY))) {
-        if (!ef->data) {
-            printf("PW3 is empty. Initializing with default password\r\n");
-
-            const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
-            uint8_t dhash[33];
-            dhash[0] = sizeof(def);
-            double_hash_pin(def, sizeof(def), dhash + 1);
-            flash_write_data_to_file(ef, dhash, sizeof(dhash));
-        }
-    }
-    if ((ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY))) {
-        if (!ef->data) {
-            printf("SigCount is empty. Initializing to zero\r\n");
-            const uint8_t def[3] = { 0 };
-            flash_write_data_to_file(ef, def, sizeof(def));
-        }
-    }
-    if ((ef = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY))) {
-        if (!ef->data) {
-            printf("PW status is empty. Initializing to default\r\n");
-            const uint8_t def[] = { 0x1, 127, 127, 127, 3, 3, 3 };
-            flash_write_data_to_file(ef, def, sizeof(def));
-        }
+        memcpy(ef->data + 12, pico_serial.id, 4);
    }
+    bool reset_dek = false;
    if ((ef = search_by_fid(EF_DEK, NULL, SPECIFY_ANY))) {
        if (!ef->data) {
            printf("DEK is empty\r\n");
@@ -239,57 +195,112 @@ void scan_files() {
            aes_encrypt_cfb_256(session_pw3, def, def + IV_SIZE + 32, 32);
            aes_encrypt_cfb_256(session_pw3, def, def + IV_SIZE + 32 + 32, 32);
            memset(session_pw3, 0, sizeof(session_pw3));
-            flash_write_data_to_file(ef, def, sizeof(def));
+            file_put_data(ef, def, sizeof(def));
+            reset_dek = true;
+        }
+    }
+    if ((ef = search_by_fid(EF_PW1, NULL, SPECIFY_ANY))) {
+        if (!ef->data || reset_dek) {
+            printf("PW1 is empty. Initializing with default password\r\n");
+            const uint8_t def[6] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
+            uint8_t dhash[33];
+            dhash[0] = sizeof(def);
+            double_hash_pin(def, sizeof(def), dhash + 1);
+            file_put_data(ef, dhash, sizeof(dhash));
+        }
+    }
+    if ((ef = search_by_fid(EF_RC, NULL, SPECIFY_ANY))) {
+        if (!ef->data || reset_dek) {
+            printf("RC is empty. Initializing with default password\r\n");
+
+            const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
+            uint8_t dhash[33];
+            dhash[0] = sizeof(def);
+            double_hash_pin(def, sizeof(def), dhash + 1);
+            file_put_data(ef, dhash, sizeof(dhash));
+        }
+    }
+    if ((ef = search_by_fid(EF_PW3, NULL, SPECIFY_ANY))) {
+        if (!ef->data || reset_dek) {
+            printf("PW3 is empty. Initializing with default password\r\n");
+
+            const uint8_t def[8] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 };
+            uint8_t dhash[33];
+            dhash[0] = sizeof(def);
+            double_hash_pin(def, sizeof(def), dhash + 1);
+            file_put_data(ef, dhash, sizeof(dhash));
+        }
+    }
+    if ((ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY))) {
+        if (!ef->data) {
+            printf("SigCount is empty. Initializing to zero\r\n");
+            const uint8_t def[3] = { 0 };
+            file_put_data(ef, def, sizeof(def));
+        }
+    }
+    if ((ef = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_ANY))) {
+        if (!ef->data) {
+            printf("PW status is empty. Initializing to default\r\n");
+            const uint8_t def[] = { 0x1, 127, 127, 127, 3, 3, 3 };
+            file_put_data(ef, def, sizeof(def));
        }
    }
    if ((ef = search_by_fid(EF_UIF_SIG, NULL, SPECIFY_ANY))) {
        if (!ef->data) {
            printf("UIF SIG is empty. Initializing to default\r\n");
            const uint8_t def[] = { 0x0, 0x20 };
-            flash_write_data_to_file(ef, def, sizeof(def));
+            file_put_data(ef, def, sizeof(def));
        }
    }
    if ((ef = search_by_fid(EF_UIF_DEC, NULL, SPECIFY_ANY))) {
        if (!ef->data) {
            printf("UIF DEC is empty. Initializing to default\r\n");
            const uint8_t def[] = { 0x0, 0x20 };
-            flash_write_data_to_file(ef, def, sizeof(def));
+            file_put_data(ef, def, sizeof(def));
        }
    }
    if ((ef = search_by_fid(EF_UIF_AUT, NULL, SPECIFY_ANY))) {
        if (!ef->data) {
            printf("UIF AUT is empty. Initializing to default\r\n");
            const uint8_t def[] = { 0x0, 0x20 };
-            flash_write_data_to_file(ef, def, sizeof(def));
+            file_put_data(ef, def, sizeof(def));
        }
    }
    if ((ef = search_by_fid(EF_KDF, NULL, SPECIFY_ANY))) {
        if (!ef->data) {
            printf("KDF is empty. Initializing to default\r\n");
            const uint8_t def[] = { 0x81, 0x1, 0x0 };
-            flash_write_data_to_file(ef, def, sizeof(def));
+            file_put_data(ef, def, sizeof(def));
        }
    }
-
    if ((ef = search_by_fid(EF_SEX, NULL, SPECIFY_ANY))) {
        if (!ef->data) {
            printf("Sex is empty. Initializing to default\r\n");
            const uint8_t def[] = { 0x30 };
-            flash_write_data_to_file(ef, def, sizeof(def));
+            file_put_data(ef, def, sizeof(def));
+        }
+    }
+    if ((ef = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_ANY))) {
+        if (!ef->data) {
+            printf("PW retries is empty. Initializing to default\r\n");
+            const uint8_t def[] = { 0x1, 3, 3, 3 };
+            file_put_data(ef, def, sizeof(def));
        }
    }
    low_flash_available();
 }

+extern bool has_pwpiv;
+extern uint8_t session_pwpiv[32];
 int load_dek() {
-    if (!has_pw1 && !has_pw2 && !has_pw3) {
-        return CCID_NO_LOGIN;
+    if (!has_pw1 && !has_pw2 && !has_pw3 && !has_pwpiv) {
+        return PICOKEY_NO_LOGIN;
    }
    file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF);
    if (!tf) {
-        return CCID_ERR_FILE_NOT_FOUND;
+        return PICOKEY_ERR_FILE_NOT_FOUND;
    }
-    int r = CCID_OK;
+    int r = PICOKEY_OK;
    if (has_pw1 || has_pw2) {
        memcpy(dek, file_get_data(tf), IV_SIZE + 32);
        r = aes_decrypt_cfb_256(session_pw1, dek, dek + IV_SIZE, 32);
@@ -299,10 +310,20 @@ int load_dek() {
        memcpy(dek + IV_SIZE, file_get_data(tf) + IV_SIZE + 32 + 32, 32);
        r = aes_decrypt_cfb_256(session_pw3, dek, dek + IV_SIZE, 32);
    }
-    if (r != 0) {
-        return CCID_EXEC_ERROR;
+    else if (has_pwpiv) {
+        memcpy(dek, file_get_data(tf), IV_SIZE);
+        memcpy(dek + IV_SIZE, file_get_data(tf) + IV_SIZE + 32 + 32 + 32, 32);
+        r = aes_decrypt_cfb_256(session_pwpiv, dek, dek + IV_SIZE, 32);
    }
-    return CCID_OK;
+    if (r != 0) {
+        return PICOKEY_EXEC_ERROR;
+    }
+    if (otp_key_1) {
+        for (int i = 0; i < 32; i++) {
+            dek[IV_SIZE + i] ^= otp_key_1[i];
+        }
+    }
+    return PICOKEY_OK;
 }

 void release_dek() {
@@ -311,7 +332,7 @@ void release_dek() {

 int dek_encrypt(uint8_t *data, size_t len) {
    int r;
-    if ((r = load_dek()) != CCID_OK) {
+    if ((r = load_dek()) != PICOKEY_OK) {
        return r;
    }
    r = aes_encrypt_cfb_256(dek + IV_SIZE, dek, data, len);
@@ -321,7 +342,7 @@ int dek_encrypt(uint8_t *data, size_t len) {

 int dek_decrypt(uint8_t *data, size_t len) {
    int r;
-    if ((r = load_dek()) != CCID_OK) {
+    if ((r = load_dek()) != PICOKEY_OK) {
        return r;
    }
    r = aes_decrypt_cfb_256(dek + IV_SIZE, dek, data, len);
@@ -347,12 +368,12 @@ int openpgp_unload() {
    algo_aut = EF_ALGO_PRIV3;
    pk_dec = EF_PK_DEC;
    pk_aut = EF_PK_AUT;
-    return CCID_OK;
+    return PICOKEY_OK;
 }

 extern char __StackLimit;
 int heapLeft() {
-#ifndef ENABLE_EMULATION
+#if !defined(ENABLE_EMULATION) && !defined(ESP_PLATFORM)
    char *p = malloc(256);   // try to avoid undue fragmentation
    int left = &__StackLimit - p;
    free(p);
@@ -362,7 +383,8 @@ int heapLeft() {
    return left;
 }

-int openpgp_select_aid(app_t *a) {
+int openpgp_select_aid(app_t *a, uint8_t force) {
+    (void) force;
    a->process_apdu = openpgp_process_apdu;
    a->unload = openpgp_unload;
    init_openpgp();
@@ -376,10 +398,10 @@ int openpgp_select_aid(app_t *a) {
    res_APDU[res_APDU_size++] = ((heap_left >> 0) & 0xff);
    res_APDU[1] += 8;
    apdu.ne = res_APDU_size;
-    return CCID_OK;
+    return PICOKEY_OK;
 }

-void __attribute__((constructor)) openpgp_ctor() {
+INITIALIZER( openpgp_ctor ) {
    ccid_atr = (uint8_t *) atr_openpgp;
    register_app(openpgp_select_aid, openpgp_aid);
 }
@@ -460,37 +482,37 @@ int inc_sig_count() {
    if (!(pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF)) || !pw_status->data) {
        return SW_REFERENCE_NOT_FOUND();
    }
-    if (file_get_data(pw_status)[0] == 1) {
+    if (file_get_data(pw_status)[0] == 0) {
        has_pw1 = false;
    }
    file_t *ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY);
    if (!ef || !ef->data) {
-        return CCID_ERR_FILE_NOT_FOUND;
+        return PICOKEY_ERR_FILE_NOT_FOUND;
    }
    uint8_t *p = file_get_data(ef);
    uint32_t counter = (p[0] << 16) | (p[1] << 8) | p[2];
    counter++;
    uint8_t q[3] = { (counter >> 16) & 0xff, (counter >> 8) & 0xff, counter & 0xff };
-    int r = flash_write_data_to_file(ef, q, sizeof(q));
-    if (r != CCID_OK) {
-        return CCID_EXEC_ERROR;
+    int r = file_put_data(ef, q, sizeof(q));
+    if (r != PICOKEY_OK) {
+        return PICOKEY_EXEC_ERROR;
    }
    low_flash_available();
-    return CCID_OK;
+    return PICOKEY_OK;
 }

 int reset_sig_count() {
    file_t *ef = search_by_fid(EF_SIG_COUNT, NULL, SPECIFY_ANY);
    if (!ef || !ef->data) {
-        return CCID_ERR_FILE_NOT_FOUND;
+        return PICOKEY_ERR_FILE_NOT_FOUND;
    }
    uint8_t q[3] = { 0 };
-    int r = flash_write_data_to_file(ef, q, sizeof(q));
-    if (r != CCID_OK) {
-        return CCID_EXEC_ERROR;
+    int r = file_put_data(ef, q, sizeof(q));
+    if (r != PICOKEY_OK) {
+        return PICOKEY_EXEC_ERROR;
    }
    low_flash_available();
-    return CCID_OK;
+    return PICOKEY_OK;
 }

 int parse_sec_tpl(const file_t *f, int mode) {
@@ -578,14 +600,6 @@ int parse_pw_status(const file_t *f, int mode) {
    return res_APDU_size - init_len;
 }

-#define ALGO_RSA        0x01
-#define ALGO_ECDH       0x12
-#define ALGO_ECDSA      0x13
-#define ALGO_AES        0x70
-#define ALGO_AES_128    0x71
-#define ALGO_AES_192    0x72
-#define ALGO_AES_256    0x74
-
 #define ALGO_RSA_1K     0
 #define ALGO_RSA_2k     1
 #define ALGO_RSA_3K     2
@@ -820,8 +834,10 @@ static int cmd_get_data() {
        uint16_t data_len = parse_do(fids, 1);
        uint8_t *p = NULL;
        uint16_t tg = 0;
-        size_t tg_len = 0;
-        if (walk_tlv(res_APDU, data_len, &p, &tg, &tg_len, NULL)) {
+        uint16_t tg_len = 0;
+        asn1_ctx_t ctxi;
+        asn1_ctx_init(res_APDU, data_len, &ctxi);
+        if (walk_tlv(&ctxi, &p, &tg, &tg_len, NULL)) {
            uint8_t dec = 2;
            if ((tg & 0x1f) == 0x1f) {
                dec++;
@@ -843,47 +859,52 @@ static int cmd_get_data() {

 int pin_reset_retries(const file_t *pin, bool force) {
    if (!pin) {
-        return CCID_ERR_NULL_PARAM;
+        return PICOKEY_ERR_NULL_PARAM;
    }
    file_t *pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF);
-    if (!pw_status) {
-        return CCID_ERR_FILE_NOT_FOUND;
+    file_t *pw_retries = search_by_fid(EF_PW_RETRIES, NULL, SPECIFY_EF);
+    if (!pw_status || !pw_retries) {
+        return PICOKEY_ERR_FILE_NOT_FOUND;
    }
-    uint8_t p[7];
-    memcpy(p, file_get_data(pw_status), 7);
-    uint8_t retries = p[3 + (pin->fid & 0x3)];
+    if (3 + (pin->fid & 0xf) >= file_get_size(pw_status) || (pin->fid & 0xf) >= file_get_size(pw_retries)) {
+        return PICOKEY_ERR_MEMORY_FATAL;
+    }
+    uint8_t p[64];
+    memcpy(p, file_get_data(pw_status), file_get_size(pw_status));
+    uint8_t retries = p[3 + (pin->fid & 0xf)];
    if (retries == 0 && force == false) { //blocked
-        return CCID_ERR_BLOCKED;
+        return PICOKEY_ERR_BLOCKED;
    }
-    p[3 + (pin->fid & 0x3)] = 3;
-    int r = flash_write_data_to_file(pw_status, p, file_get_size(pw_status));
+    uint8_t max_retries = file_get_data(pw_retries)[(pin->fid & 0xf)];
+    p[3 + (pin->fid & 0xf)] = max_retries;
+    int r = file_put_data(pw_status, p, file_get_size(pw_status));
    low_flash_available();
    return r;
 }

 int pin_wrong_retry(const file_t *pin) {
    if (!pin) {
-        return CCID_ERR_NULL_PARAM;
+        return PICOKEY_ERR_NULL_PARAM;
    }
    file_t *pw_status = search_by_fid(EF_PW_PRIV, NULL, SPECIFY_EF);
    if (!pw_status) {
-        return CCID_ERR_FILE_NOT_FOUND;
+        return PICOKEY_ERR_FILE_NOT_FOUND;
    }
-    uint8_t p[7];
-    memcpy(p, file_get_data(pw_status), 7);
-    if (p[3 + (pin->fid & 0x3)] > 0) {
-        p[3 + (pin->fid & 0x3)] -= 1;
-        int r = flash_write_data_to_file(pw_status, p, file_get_size(pw_status));
-        if (r != CCID_OK) {
+    uint8_t p[64];
+    memcpy(p, file_get_data(pw_status), file_get_size(pw_status));
+    if (p[3 + (pin->fid & 0xf)] > 0) {
+        p[3 + (pin->fid & 0xf)] -= 1;
+        int r = file_put_data(pw_status, p, file_get_size(pw_status));
+        if (r != PICOKEY_OK) {
            return r;
        }
        low_flash_available();
-        if (p[3 + (pin->fid & 0x3)] == 0) {
-            return CCID_ERR_BLOCKED;
+        if (p[3 + (pin->fid & 0xf)] == 0) {
+            return PICOKEY_ERR_BLOCKED;
        }
-        return p[3 + (pin->fid & 0x3)];
+        return p[3 + (pin->fid & 0xf)];
    }
-    return CCID_ERR_BLOCKED;
+    return PICOKEY_ERR_BLOCKED;
 }

 int check_pin(const file_t *pin, const uint8_t *data, size_t len) {
@@ -903,17 +924,17 @@ int check_pin(const file_t *pin, const uint8_t *data, size_t len) {
    }
    if (memcmp(file_get_data(pin) + 1, dhash, sizeof(dhash)) != 0) {
        int retries;
-        if ((retries = pin_wrong_retry(pin)) < CCID_OK) {
+        if ((retries = pin_wrong_retry(pin)) < PICOKEY_OK) {
            return SW_PIN_BLOCKED();
        }
        return set_res_sw(0x63, 0xc0 | retries);
    }

    int r = pin_reset_retries(pin, false);
-    if (r == CCID_ERR_BLOCKED) {
+    if (r == PICOKEY_ERR_BLOCKED) {
        return SW_PIN_BLOCKED();
    }
-    if (r != CCID_OK) {
+    if (r != PICOKEY_OK) {
        return SW_MEMORY_FAILURE();
    }
    isUserAuthenticated = true;
@@ -972,7 +993,7 @@ static int cmd_verify() {
    if (apdu.nc > 0) {
        return check_pin(pw, apdu.data, apdu.nc);
    }
-    uint8_t retries = *(file_get_data(pw_status) + 3 + (fid & 0x3));
+    uint8_t retries = *(file_get_data(pw_status) + 3 + (fid & 0xf));
    if (retries == 0) {
        return SW_PIN_BLOCKED();
    }
@@ -1008,29 +1029,29 @@ static int cmd_put_data() {
        int r = 0;
        if (fid == EF_RC) {
            has_rc = false;
-            if ((r = load_dek()) != CCID_OK) {
+            if ((r = load_dek()) != PICOKEY_OK) {
                return SW_EXEC_ERROR();
            }
            uint8_t dhash[33];
            dhash[0] = apdu.nc;
            double_hash_pin(apdu.data, apdu.nc, dhash + 1);
-            r = flash_write_data_to_file(ef, dhash, sizeof(dhash));
+            r = file_put_data(ef, dhash, sizeof(dhash));

            file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF);
            if (!tf) {
                return SW_REFERENCE_NOT_FOUND();
            }
-            uint8_t def[IV_SIZE + 32 + 32 + 32];
+            uint8_t def[IV_SIZE + 32 + 32 + 32 + 32];
            memcpy(def, file_get_data(tf), file_get_size(tf));
            hash_multi(apdu.data, apdu.nc, session_rc);
            memcpy(def + IV_SIZE + 32, dek + IV_SIZE, 32);
            aes_encrypt_cfb_256(session_rc, def, def + IV_SIZE + 32, 32);
-            r = flash_write_data_to_file(tf, def, sizeof(def));
+            r = file_put_data(tf, def, sizeof(def));
        }
        else {
-            r = flash_write_data_to_file(ef, apdu.data, apdu.nc);
+            r = file_put_data(ef, apdu.data, apdu.nc);
        }
-        if (r != CCID_OK) {
+        if (r != PICOKEY_OK) {
            return SW_MEMORY_FAILURE();
        }
        low_flash_available();
@@ -1049,7 +1070,7 @@ static int cmd_change_pin() {
    }
    uint8_t pin_len = file_get_data(pw)[0];
    uint16_t r = 0;
-    if ((r = load_dek()) != CCID_OK) {
+    if ((r = load_dek()) != PICOKEY_OK) {
        return SW_EXEC_ERROR();
    }
    r = check_pin(pw, apdu.data, pin_len);
@@ -1059,13 +1080,13 @@ static int cmd_change_pin() {
    uint8_t dhash[33];
    dhash[0] = apdu.nc - pin_len;
    double_hash_pin(apdu.data + pin_len, apdu.nc - pin_len, dhash + 1);
-    flash_write_data_to_file(pw, dhash, sizeof(dhash));
+    file_put_data(pw, dhash, sizeof(dhash));

    file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF);
    if (!tf) {
        return SW_REFERENCE_NOT_FOUND();
    }
-    uint8_t def[IV_SIZE + 32 + 32 + 32];
+    uint8_t def[IV_SIZE + 32 + 32 + 32 + 32] = {0};
    memcpy(def, file_get_data(tf), file_get_size(tf));
    if (P2(apdu) == 0x81) {
        hash_multi(apdu.data + pin_len, apdu.nc - pin_len, session_pw1);
@@ -1077,7 +1098,7 @@ static int cmd_change_pin() {
        memcpy(def + IV_SIZE + 32 + 32, dek + IV_SIZE, 32);
        aes_encrypt_cfb_256(session_pw3, def, def + IV_SIZE + 32 + 32, 32);
    }
-    flash_write_data_to_file(tf, def, sizeof(def));
+    file_put_data(tf, def, sizeof(def));
    low_flash_available();
    return SW_OK();
 }
@@ -1117,25 +1138,25 @@ static int cmd_reset_retry() {
            newpin_len = apdu.nc;
        }
        int r = 0;
-        if ((r = load_dek()) != CCID_OK) {
+        if ((r = load_dek()) != PICOKEY_OK) {
            return SW_EXEC_ERROR();
        }
        file_t *tf = search_by_fid(EF_DEK, NULL, SPECIFY_EF);
        if (!tf) {
            return SW_REFERENCE_NOT_FOUND();
        }
-        uint8_t def[IV_SIZE + 32 + 32 + 32];
+        uint8_t def[IV_SIZE + 32 + 32 + 32 + 32];
        memcpy(def, file_get_data(tf), file_get_size(tf));
        hash_multi(apdu.data + (apdu.nc - newpin_len), newpin_len, session_pw1);
        memcpy(def + IV_SIZE, dek + IV_SIZE, 32);
        aes_encrypt_cfb_256(session_pw1, def, def + IV_SIZE, 32);
-        r = flash_write_data_to_file(tf, def, sizeof(def));
+        r = file_put_data(tf, def, sizeof(def));

        uint8_t dhash[33];
        dhash[0] = newpin_len;
        double_hash_pin(apdu.data + (apdu.nc - newpin_len), newpin_len, dhash + 1);
-        flash_write_data_to_file(pw, dhash, sizeof(dhash));
-        if (pin_reset_retries(pw, true) != CCID_OK) {
+        file_put_data(pw, dhash, sizeof(dhash));
+        if (pin_reset_retries(pw, true) != PICOKEY_OK) {
            return SW_MEMORY_FAILURE();
        }
        low_flash_available();
@@ -1144,18 +1165,18 @@ static int cmd_reset_retry() {
    return SW_INCORRECT_P1P2();
 }

-int store_keys(void *key_ctx, int type, uint16_t key_id) {
+int store_keys(void *key_ctx, int type, uint16_t key_id, bool use_kek) {
    int r, key_size = 0;
    uint8_t kdata[4096 / 8]; //worst

    //if (!has_pw3)
-    //    return CCID_NO_LOGIN;
+    //    return PICOKEY_NO_LOGIN;
    //file_t *pw3 = search_by_fid(EF_PW3, NULL, SPECIFY_EF);
    //if (!pw3)
-    //    return CCID_ERR_FILE_NOT_FOUND;
+    //    return PICOKEY_ERR_FILE_NOT_FOUND;
    file_t *ef = search_by_fid(key_id, NULL, SPECIFY_EF);
    if (!ef) {
-        return CCID_ERR_FILE_NOT_FOUND;
+        return PICOKEY_ERR_FILE_NOT_FOUND;
    }
    if (type == ALGO_RSA) {
        mbedtls_rsa_context *rsa = (mbedtls_rsa_context *) key_ctx;
@@ -1165,10 +1186,10 @@ int store_keys(void *key_ctx, int type, uint16_t key_id) {
    }
    else if (type == ALGO_ECDSA || type == ALGO_ECDH) {
        mbedtls_ecdsa_context *ecdsa = (mbedtls_ecdsa_context *) key_ctx;
-        key_size = mbedtls_mpi_size(&ecdsa->d);
+        size_t olen = 0;
        kdata[0] = ecdsa->grp.id & 0xff;
-        mbedtls_ecp_write_key(ecdsa, kdata + 1, key_size);
-        key_size++;
+        mbedtls_ecp_write_key_ext(ecdsa, &olen, kdata + 1, sizeof(kdata) - 1);
+        key_size = olen + 1;
    }
    else if (type & ALGO_AES) {
        if (type == ALGO_AES_128) {
@@ -1182,78 +1203,86 @@ int store_keys(void *key_ctx, int type, uint16_t key_id) {
        }
        memcpy(kdata, key_ctx, key_size);
    }
-    r = dek_encrypt(kdata, key_size);
-    if (r != CCID_OK) {
-        return r;
+    if (use_kek) {
+        r = dek_encrypt(kdata, key_size);
+        if (r != PICOKEY_OK) {
+            return r;
+        }
    }
    //r = aes_encrypt_cfb_256(file_read(pw3->data+2), session_pw3, kdata, key_size);
-    //if (r != CCID_OK)
+    //if (r != PICOKEY_OK)
    //    return r;
-    r = flash_write_data_to_file(ef, kdata, key_size);
-    if (r != CCID_OK) {
+    r = file_put_data(ef, kdata, key_size);
+    if (r != PICOKEY_OK) {
        return r;
    }
    low_flash_available();
-    return CCID_OK;
+    return PICOKEY_OK;
 }

-int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey) {
+int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey, bool use_dek) {
    int key_size = file_get_size(fkey);
    uint8_t kdata[4096 / 8];
    memcpy(kdata, file_get_data(fkey), key_size);
-    if (dek_decrypt(kdata, key_size) != 0) {
-        return CCID_EXEC_ERROR;
+    if (use_dek && dek_decrypt(kdata, key_size) != 0) {
+        return PICOKEY_EXEC_ERROR;
    }
    if (mbedtls_mpi_read_binary(&ctx->P, kdata, key_size / 2) != 0) {
        mbedtls_rsa_free(ctx);
-        return CCID_WRONG_DATA;
+        return PICOKEY_WRONG_DATA;
    }
    if (mbedtls_mpi_read_binary(&ctx->Q, kdata + key_size / 2, key_size / 2) != 0) {
        mbedtls_rsa_free(ctx);
-        return CCID_WRONG_DATA;
+        return PICOKEY_WRONG_DATA;
    }
    if (mbedtls_mpi_lset(&ctx->E, 0x10001) != 0) {
        mbedtls_rsa_free(ctx);
-        return CCID_EXEC_ERROR;
+        return PICOKEY_EXEC_ERROR;
    }
    if (mbedtls_rsa_import(ctx, NULL, &ctx->P, &ctx->Q, NULL, &ctx->E) != 0) {
        mbedtls_rsa_free(ctx);
-        return CCID_WRONG_DATA;
+        return PICOKEY_WRONG_DATA;
    }
    if (mbedtls_rsa_complete(ctx) != 0) {
        mbedtls_rsa_free(ctx);
-        return CCID_WRONG_DATA;
+        return PICOKEY_WRONG_DATA;
    }
    if (mbedtls_rsa_check_privkey(ctx) != 0) {
        mbedtls_rsa_free(ctx);
-        return CCID_WRONG_DATA;
+        return PICOKEY_WRONG_DATA;
    }
-    return CCID_OK;
+    return PICOKEY_OK;
 }

-int load_private_key_ecdsa(mbedtls_ecdsa_context *ctx, file_t *fkey) {
+int load_private_key_ecdsa(mbedtls_ecdsa_context *ctx, file_t *fkey, bool use_dek) {
    int key_size = file_get_size(fkey);
    uint8_t kdata[67]; //Worst case, 521 bit + 1byte
    memcpy(kdata, file_get_data(fkey), key_size);
-    if (dek_decrypt(kdata, key_size) != 0) {
-        return CCID_EXEC_ERROR;
+    if (use_dek && dek_decrypt(kdata, key_size) != 0) {
+        return PICOKEY_EXEC_ERROR;
    }
    mbedtls_ecp_group_id gid = kdata[0];
    int r = mbedtls_ecp_read_key(gid, ctx, kdata + 1, key_size - 1);
    if (r != 0) {
        mbedtls_ecdsa_free(ctx);
-        return CCID_EXEC_ERROR;
+        return PICOKEY_EXEC_ERROR;
    }
-    return CCID_OK;
+    mbedtls_platform_zeroize(kdata, sizeof(kdata));
+    r = mbedtls_ecp_mul(&ctx->grp, &ctx->Q, &ctx->d, &ctx->grp.G, random_gen, NULL);
+    if (r != 0) {
+        mbedtls_ecdsa_free(ctx);
+        return PICOKEY_EXEC_ERROR;
+    }
+    return PICOKEY_OK;
 }

 int load_aes_key(uint8_t *aes_key, file_t *fkey) {
    int key_size = file_get_size(fkey);
    memcpy(aes_key, file_get_data(fkey), key_size);
    if (dek_decrypt(aes_key, key_size) != 0) {
-        return CCID_EXEC_ERROR;
+        return PICOKEY_EXEC_ERROR;
    }
-    return CCID_OK;
+    return PICOKEY_OK;
 }

 mbedtls_ecp_group_id get_ec_group_id_from_attr(const uint8_t *algo, size_t algo_len) {
@@ -1338,7 +1367,7 @@ static int cmd_keypair_gen() {
    }

    uint16_t fid = 0x0;
-    int r = CCID_OK;
+    int r = PICOKEY_OK;
    if (apdu.data[0] == 0xB6) {
        fid = EF_PK_SIG;
    }
@@ -1376,10 +1405,10 @@ static int cmd_keypair_gen() {
                mbedtls_rsa_free(&rsa);
                return SW_EXEC_ERROR();
            }
-            r = store_keys(&rsa, ALGO_RSA, fid);
+            r = store_keys(&rsa, ALGO_RSA, fid, true);
            make_rsa_response(&rsa);
            mbedtls_rsa_free(&rsa);
-            if (r != CCID_OK) {
+            if (r != PICOKEY_OK) {
                return SW_EXEC_ERROR();
            }
        }
@@ -1397,10 +1426,10 @@ static int cmd_keypair_gen() {
                mbedtls_ecdsa_free(&ecdsa);
                return SW_EXEC_ERROR();
            }
-            r = store_keys(&ecdsa, algo[0], fid);
+            r = store_keys(&ecdsa, algo[0], fid, true);
            make_ecdsa_response(&ecdsa);
            mbedtls_ecdsa_free(&ecdsa);
-            if (r != CCID_OK) {
+            if (r != PICOKEY_OK) {
                return SW_EXEC_ERROR();
            }
        }
@@ -1411,8 +1440,8 @@ static int cmd_keypair_gen() {
        if (!pbef) {
            return SW_REFERENCE_NOT_FOUND();
        }
-        r = flash_write_data_to_file(pbef, res_APDU, res_APDU_size);
-        if (r != CCID_OK) {
+        r = file_put_data(pbef, res_APDU, res_APDU_size);
+        if (r != PICOKEY_OK) {
            return SW_EXEC_ERROR();
        }
        if (fid == EF_PK_SIG) {
@@ -1424,9 +1453,9 @@ static int cmd_keypair_gen() {
            uint8_t aes_key[32]; //maximum AES key size
            uint8_t key_size = 32;
            memcpy(aes_key, random_bytes_get(key_size), key_size);
-            r = store_keys(aes_key, ALGO_AES_256, EF_AES_KEY);
+            r = store_keys(aes_key, ALGO_AES_256, EF_AES_KEY, true);
            /* if storing the key fails, we silently continue */
-            //if (r != CCID_OK)
+            //if (r != PICOKEY_OK)
            //    return SW_EXEC_ERROR();
        }
        low_flash_available();
@@ -1452,7 +1481,7 @@ int rsa_sign(mbedtls_rsa_context *ctx,
    uint8_t *d = (uint8_t *) data, *end = d + data_len, *hsh = NULL;
    size_t seq_len = 0, hash_len = 0;
    int key_size = ctx->len, r = 0;
-    mbedtls_md_type_t md = MBEDTLS_MD_SHA256;
+    mbedtls_md_type_t md = MBEDTLS_MD_NONE;
    if (mbedtls_asn1_get_tag(&d, end, &seq_len,
                             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) == 0) {
        mbedtls_asn1_buf mdb;
@@ -1575,19 +1604,19 @@ static int cmd_pso() {
    if (wait_button_pressed(pk_fid == EF_PK_SIG ? EF_UIF_SIG : EF_UIF_DEC) == true) {
        return SW_SECURE_MESSAGE_EXEC_ERROR();
    }
-    int r = CCID_OK;
+    int r = PICOKEY_OK;
    int key_size = file_get_size(ef);
    if (is_aes) {
        uint8_t aes_key[32];
        r = load_aes_key(aes_key, ef);
-        if (r != CCID_OK) {
+        if (r != PICOKEY_OK) {
            memset(aes_key, 0, sizeof(aes_key));
            return SW_EXEC_ERROR();
        }
        if (P1(apdu) == 0x80 && P2(apdu) == 0x86) { //decipher
            r = aes_decrypt(aes_key, NULL, key_size, PICO_KEYS_AES_MODE_CBC, apdu.data + 1, apdu.nc - 1);
            memset(aes_key, 0, sizeof(aes_key));
-            if (r != CCID_OK) {
+            if (r != PICOKEY_OK) {
                return SW_EXEC_ERROR();
            }
            memcpy(res_APDU, apdu.data + 1, apdu.nc - 1);
@@ -1596,7 +1625,7 @@ static int cmd_pso() {
        else if (P1(apdu) == 0x86 && P2(apdu) == 0x80) { //encipher
            r = aes_encrypt(aes_key, NULL, key_size, PICO_KEYS_AES_MODE_CBC, apdu.data, apdu.nc);
            memset(aes_key, 0, sizeof(aes_key));
-            if (r != CCID_OK) {
+            if (r != PICOKEY_OK) {
                return SW_EXEC_ERROR();
            }
            res_APDU[0] = 0x2;
@@ -1608,8 +1637,8 @@ static int cmd_pso() {
    if (algo[0] == ALGO_RSA) {
        mbedtls_rsa_context ctx;
        mbedtls_rsa_init(&ctx);
-        r = load_private_key_rsa(&ctx, ef);
-        if (r != CCID_OK) {
+        r = load_private_key_rsa(&ctx, ef, true);
+        if (r != PICOKEY_OK) {
            mbedtls_rsa_free(&ctx);
            return SW_EXEC_ERROR();
        }
@@ -1647,8 +1676,8 @@ static int cmd_pso() {
        if (P1(apdu) == 0x9E && P2(apdu) == 0x9A) {
            mbedtls_ecdsa_context ctx;
            mbedtls_ecdsa_init(&ctx);
-            r = load_private_key_ecdsa(&ctx, ef);
-            if (r != CCID_OK) {
+            r = load_private_key_ecdsa(&ctx, ef, true);
+            if (r != PICOKEY_OK) {
                mbedtls_ecdsa_free(&ctx);
                return SW_EXEC_ERROR();
            }
@@ -1773,12 +1802,12 @@ static int cmd_internal_aut() {
    if (wait_button_pressed(EF_UIF_AUT) == true) {
        return SW_SECURE_MESSAGE_EXEC_ERROR();
    }
-    int r = CCID_OK;
+    int r = PICOKEY_OK;
    if (algo[0] == ALGO_RSA) {
        mbedtls_rsa_context ctx;
        mbedtls_rsa_init(&ctx);
-        r = load_private_key_rsa(&ctx, ef);
-        if (r != CCID_OK) {
+        r = load_private_key_rsa(&ctx, ef, true);
+        if (r != PICOKEY_OK) {
            mbedtls_rsa_free(&ctx);
            return SW_EXEC_ERROR();
        }
@@ -1793,8 +1822,8 @@ static int cmd_internal_aut() {
    else if (algo[0] == ALGO_ECDH || algo[0] == ALGO_ECDSA) {
        mbedtls_ecdsa_context ctx;
        mbedtls_ecdsa_init(&ctx);
-        r = load_private_key_ecdsa(&ctx, ef);
-        if (r != CCID_OK) {
+        r = load_private_key_ecdsa(&ctx, ef, true);
+        if (r != PICOKEY_OK) {
            mbedtls_ecdsa_free(&ctx);
            return SW_EXEC_ERROR();
        }
@@ -1840,7 +1869,7 @@ static int cmd_mse() {
    return SW_OK();
 }

-size_t tag_len(uint8_t **data) {
+uint16_t tag_len(uint8_t **data) {
    size_t len = *(*data)++;
    if (len == 0x82) {
        len = *(*data)++ << 8;
@@ -1865,7 +1894,7 @@ static int cmd_import_data() {
    if (*start++ != 0x4D) {
        return SW_WRONG_DATA();
    }
-    size_t tgl = tag_len(&start);
+    uint16_t tgl = tag_len(&start);
    if (*start != 0xB6 && *start != 0xB8 && *start != 0xA4) {
        return SW_WRONG_DATA();
    }
@@ -1893,7 +1922,8 @@ static int cmd_import_data() {
        return SW_WRONG_DATA();
    }
    tgl = tag_len(&start);
-    uint8_t *end = start + tgl, len[9] = { 0 }, *p[9] = { 0 };
+    uint8_t *end = start + tgl, *p[9] = { 0 };
+    uint16_t len[9] = { 0 };
    while (start < end) {
        uint8_t tag = *start++;
        if ((tag >= 0x91 && tag <= 0x97) || tag == 0x99) {
@@ -1963,10 +1993,10 @@ static int cmd_import_data() {
            mbedtls_rsa_free(&rsa);
            return SW_EXEC_ERROR();
        }
-        r = store_keys(&rsa, ALGO_RSA, fid);
+        r = store_keys(&rsa, ALGO_RSA, fid, true);
        make_rsa_response(&rsa);
        mbedtls_rsa_free(&rsa);
-        if (r != CCID_OK) {
+        if (r != PICOKEY_OK) {
            return SW_EXEC_ERROR();
        }
    }
@@ -1996,13 +2026,16 @@ static int cmd_import_data() {
            mbedtls_ecdsa_free(&ecdsa);
            return SW_EXEC_ERROR();
        }
-        r = store_keys(&ecdsa, ALGO_ECDSA, fid);
+        r = store_keys(&ecdsa, ALGO_ECDSA, fid, true);
        make_ecdsa_response(&ecdsa);
        mbedtls_ecdsa_free(&ecdsa);
-        if (r != CCID_OK) {
+        if (r != PICOKEY_OK) {
            return SW_EXEC_ERROR();
        }
    }
+    else {
+        return SW_FUNC_NOT_SUPPORTED();
+    }
    if (fid == EF_PK_SIG) {
        reset_sig_count();
    }
@@ -2010,8 +2043,8 @@ static int cmd_import_data() {
    if (!pbef) {
        return SW_REFERENCE_NOT_FOUND();
    }
-    r = flash_write_data_to_file(pbef, res_APDU, res_APDU_size);
-    if (r != CCID_OK) {
+    r = file_put_data(pbef, res_APDU, res_APDU_size);
+    if (r != PICOKEY_OK) {
        return SW_EXEC_ERROR();
    }
    res_APDU_size = 0; //make_*_response sets a response. we need to overwrite
--- a/src/openpgp/openpgp.h
+++ b/src/openpgp/openpgp.h
@@ -19,14 +19,41 @@
 #define __OPENPGP_H_

 #include "stdlib.h"
-#ifndef ENABLE_EMULATION
+#if !defined(ENABLE_EMULATION) && !defined(ESP_PLATFORM)
 #include <pico/stdlib.h>
 #endif

 #include "pico_keys.h"
 #include "apdu.h"
+#include "mbedtls/rsa.h"
+#include "mbedtls/ecdsa.h"

 extern bool has_pw1;
 extern bool has_pw3;

+extern int store_keys(void *key_ctx, int type, uint16_t key_id, bool use_kek);
+extern void make_rsa_response(mbedtls_rsa_context *rsa);
+extern void make_ecdsa_response(mbedtls_ecdsa_context *ecdsa);
+extern int ecdsa_sign(mbedtls_ecdsa_context *ctx,
+                      const uint8_t *data,
+                      size_t data_len,
+                      uint8_t *out,
+                      size_t *out_len);
+extern int rsa_sign(mbedtls_rsa_context *ctx,
+                    const uint8_t *data,
+                    size_t data_len,
+                    uint8_t *out,
+                    size_t *out_len);
+extern int load_private_key_rsa(mbedtls_rsa_context *ctx, file_t *fkey, bool use_dek);
+extern int load_private_key_ecdsa(mbedtls_ecdsa_context *ctx, file_t *fkey, bool use_dek);
+extern int pin_reset_retries(const file_t *pin, bool force);
+
+#define ALGO_RSA        0x01
+#define ALGO_ECDH       0x12
+#define ALGO_ECDSA      0x13
+#define ALGO_AES        0x70
+#define ALGO_AES_128    0x71
+#define ALGO_AES_192    0x72
+#define ALGO_AES_256    0x74
+
 #endif
--- a/src/openpgp/piv.c
+++ b/src/openpgp/piv.c
--- a/src/openpgp/version.h
+++ b/src/openpgp/version.h
@@ -24,9 +24,14 @@
 #define OPGP_VERSION_MINOR (OPGP_VERSION & 0xff)


-#define PIPGP_VERSION 0x010C
+#define PIPGP_VERSION 0x0300

 #define PIPGP_VERSION_MAJOR ((PIPGP_VERSION >> 8) & 0xff)
 #define PIPGP_VERSION_MINOR (PIPGP_VERSION & 0xff)

+#define PIV_VERSION 0x0507
+
+#define PIV_VERSION_MAJOR ((PIV_VERSION >> 8) & 0xff)
+#define PIV_VERSION_MINOR (PIV_VERSION & 0xff)
+
 #endif
--- a/tests/docker/bullseye/Dockerfile
+++ b/tests/docker/bullseye/Dockerfile
@@ -0,0 +1,43 @@
+FROM debian:bullseye
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt update && apt upgrade -y
+RUN apt install -y apt-utils
+RUN apt autoremove -y
+RUN rm -rf /var/cache/apt/archives/*
+RUN apt install -y libccid \
+    libpcsclite-dev \
+    git \
+    autoconf \
+    pkg-config \
+    libtool \
+    help2man \
+    automake \
+    gcc \
+    make \
+    build-essential \
+    opensc \
+    python3 \
+    python3-pip \
+    swig \
+    cmake \
+    vsmartcard-vpcd \
+    libgcrypt-dev \
+    libssl-dev \
+    check \
+    gengetopt \
+    && rm -rf /var/lib/apt/lists/*
+RUN pip3 install pytest pycvc cryptography pyscard
+RUN git clone https://github.com/Yubico/yubico-piv-tool
+WORKDIR /yubico-piv-tool
+RUN git checkout tags/yubico-piv-tool-2.5.1
+ADD tests/docker/jammy/yubico-piv-tool.patch /yubico-piv-tool/yubico-piv-tool.patch
+RUN git apply yubico-piv-tool.patch
+RUN mkdir build
+WORKDIR /yubico-piv-tool/build
+RUN cmake .. -DENABLE_HARDWARE_TESTS=1
+RUN make -j`nproc`
+RUN make install
+WORKDIR /
+RUN ldconfig
--- a/tests/docker/jammy/Dockerfile
+++ b/tests/docker/jammy/Dockerfile
@@ -22,6 +22,20 @@ RUN apt install -y libccid \
    cmake \
    vsmartcard-vpcd \
    libgcrypt-dev \
+    libssl-dev \
+    check \
+    gengetopt \
    && rm -rf /var/lib/apt/lists/*
 RUN pip3 install pytest pycvc cryptography pyscard
+RUN git clone https://github.com/Yubico/yubico-piv-tool
+WORKDIR /yubico-piv-tool
+RUN git checkout tags/yubico-piv-tool-2.5.1
+ADD tests/docker/jammy/yubico-piv-tool.patch /yubico-piv-tool/yubico-piv-tool.patch
+RUN git apply yubico-piv-tool.patch
+RUN mkdir build
+WORKDIR /yubico-piv-tool/build
+RUN cmake .. -DENABLE_HARDWARE_TESTS=1
+RUN make -j`nproc`
+RUN make install
 WORKDIR /
+RUN ldconfig
--- a/tests/docker/jammy/yubico-piv-tool.patch
+++ b/tests/docker/jammy/yubico-piv-tool.patch
@@ -0,0 +1,68 @@
+diff --git a/lib/tests/api.c b/lib/tests/api.c
+index fb7c1a8..b569ec3 100644
+--- a/lib/tests/api.c
+++ b/lib/tests/api.c
+@@ -515,7 +515,7 @@ START_TEST(test_pin_policy_always) {
+     unsigned char rand[128] = {0};
+ 
+     size_t sig_len = sizeof(signature);
+-    size_t padlen = 256;
+    size_t padlen = 512;
+     unsigned int enc_len;
+     unsigned int data_len;
+ 
+@@ -1009,8 +1009,8 @@ END_TEST
+ START_TEST(test_pin_cache) {
+   ykpiv_rc res;
+   ykpiv_state *local_state;
+-  unsigned char data[256] = {0};
+-  unsigned char data_in[256] = {0};
+  unsigned char data[512] = {0};
+  unsigned char data_in[512] = {0};
+   int len = sizeof(data);
+   size_t len2 = sizeof(data);
+ 
+@@ -1028,17 +1028,17 @@ START_TEST(test_pin_cache) {
+   ck_assert_int_eq(res, YKPIV_OK);
+ 
+   // Verify decryption does not work without auth
+-  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
+  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
+   ck_assert_int_eq(res, YKPIV_AUTHENTICATION_ERROR);
+ 
+   // Verify decryption does work when authed
+   res = ykpiv_verify_select(g_state, "123456", 6, NULL, true);
+   ck_assert_int_eq(res, YKPIV_OK);
+-  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
+  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
+   ck_assert_int_eq(res, YKPIV_OK);
+ 
+   // Verify PIN policy allows continuing to decrypt without re-verifying
+-  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
+  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
+   ck_assert_int_eq(res, YKPIV_OK);
+ 
+   // Create a new ykpiv state, connect, and close it.
+@@ -1059,7 +1059,7 @@ START_TEST(test_pin_cache) {
+   //
+   // Note that you can verify that this fails by rebuilding with
+   // DISABLE_PIN_CACHE set to 1.
+-  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
+  res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
+   ck_assert_int_eq(res, YKPIV_OK);
+ }
+ END_TEST
+diff --git a/tools/confirm.sh b/tools/confirm.sh
+index 81c10ac..4ab15c5 100755
+--- a/tools/confirm.sh
+++ b/tools/confirm.sh
+@@ -20,7 +20,8 @@ echo "WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WA
+ echo "******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* *******" >&0
+ echo >&0
+ echo -n "Are you SURE you wish to proceed?  If so, type 'CONFIRM': " >&0
+-
+echo "0"
+exit 0
+ read CONFIRM
+ if [[ "x$CONFIRM" != "xCONFIRM" ]]; then
+     echo "1"
--- a/tests/docker_env.sh
+++ b/tests/docker_env.sh
@@ -46,10 +46,10 @@


 # default values, can be overridden by the environment
-: ${MBEDTLS_DOCKER_GUEST:=jammy}
+: ${MBEDTLS_DOCKER_GUEST:=bullseye}


-DOCKER_IMAGE_TAG="pico-hsm-test:${MBEDTLS_DOCKER_GUEST}"
+DOCKER_IMAGE_TAG="pico-openpgp-test:${MBEDTLS_DOCKER_GUEST}"

 # Make sure docker is available
 if ! which docker > /dev/null; then
@@ -79,7 +79,7 @@ ${DOCKER} image build \
    --cache-from=${DOCKER_IMAGE_TAG} \
    --network host \
    --build-arg MAKEFLAGS_PARALLEL="-j ${NUM_PROC}" \
-    tests/docker/${MBEDTLS_DOCKER_GUEST}
+    -f tests/docker/${MBEDTLS_DOCKER_GUEST}/Dockerfile .

 run_in_docker()
 {
--- a/tests/scripts/attestation.sh
+++ b/tests/scripts/attestation.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+
+echo -n "  Fetch attestation certificate... "
+piv read-cert -sf9 -o sf9.pem
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+algs=("RSA1024" "RSA2048" "ECCP256" "ECCP384")
+slots=("9a" "9c" "9d" "9e" "82" "83" "84" "85" "86" "87" "88" "89" "8a" "8b" "8c" "8d" "8e" "8f" "90" "91" "92" "93" "94" "95")
+for alg in ${algs[*]}; do
+    for slot in ${slots[*]}; do
+        echo "  Test attestation with ${alg} in slot ${slot}"
+        echo -n "    Keygen... "
+        gen_and_check $alg $slot && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    Fetch attesting certificate... "
+        piv attest -s$slot -o attestation.pem
+        test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    OpenSSL verify attestation... "
+        e=$(openssl verify -CAfile sf9.pem attestation.pem 2>&1)
+        test $? -eq 0 && echo -n "." || exit $?
+        grep -q ": OK" <<< $e && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    Key deletion... "
+        delete_key $alg $slot && echo -e ".\t${OK}" || exit $?
+
+    done
+done
+
+rm -rf cert.pem
+rm -rf sf9.pem
--- a/tests/scripts/cli-test.sh
+++ b/tests/scripts/cli-test.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+chmod a+x tests/scripts/*.sh
+
+echo "======== CLI Test suite ========"
+./tests/scripts/yubico-piv-tool.sh
--- a/tests/scripts/func.sh
+++ b/tests/scripts/func.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+OK="\033[32mok\033[0m"
+FAIL="\033[31mfail\033[0m"
+
+READER="u"
+
+piv() {
+    yubico-piv-tool -r${READER} -a$@
+}
+
+gen_and_check() {
+    e=$(piv generate -s$2 -A$1 -opublic.pem 2>&1)
+    test $? -eq 0 && echo -n "." || exit $?
+    grep -q "Successfully generated a new private key" <<< $e && echo -n "." || exit $?
+    e=$(piv status 2>&1)
+    e=${e//$'\t'/}
+    e=${e//$'\n'/}
+    test $? -eq 0 && echo -n "." || exit $?
+    grep -q "Slot $2:Algorithm:$1" <<< $e && echo -n "." || exit $?
+}
+delete_key() {
+    piv delete-key -s$2 > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    piv delete-cert -s$2 > /dev/null 2>&1
+    test $? -eq 0 && echo -n "." || exit $?
+    e=$(piv status 2>&1)
+    test $? -eq 0 && echo -n "." || exit $?
+    q=$(grep -q "Slot $2: Algorithm: $1" <<< $e)
+    test $? -eq 1 && echo -n "." || exit $?
+    rm -rf public.pem
+}
+gen_and_delete() {
+    gen_and_check $1 $2
+    test $? -eq 0 && echo -n "." || exit $?
+    delete_key $1 $2
+    test $? -eq 0 && echo -n "." || exit $?
+}
--- a/tests/scripts/keygen.sh
+++ b/tests/scripts/keygen.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+
+algs=("RSA1024" "RSA2048" "ECCP256" "ECCP384")
+slots=("9a" "9c" "9d" "9e" "82" "83" "84" "85" "86" "87" "88" "89" "8a" "8b" "8c" "8d" "8e" "8f" "90" "91" "92" "93" "94" "95")
+for alg in ${algs[*]}; do
+    for slot in ${slots[*]}; do
+        echo -n "  Test ${alg} in slot ${slot}... "
+        gen_and_delete ${alg} $slot && echo -e ".\t${OK}" || exit $?
+    done
+done
--- a/tests/scripts/signatures.sh
+++ b/tests/scripts/signatures.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+
+algs=("RSA1024" "RSA2048" "ECCP256" "ECCP384")
+slots=("9a" "9c" "9d" "9e" "82" "83" "84" "85" "86" "87" "88" "89" "8a" "8b" "8c" "8d" "8e" "8f" "90" "91" "92" "93" "94" "95")
+for alg in ${algs[*]}; do
+    for slot in ${slots[*]}; do
+        echo "  Test signature with ${alg} in slot ${slot}"
+        echo -n "    Keygen... "
+        gen_and_check $alg $slot && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    Test request certificate... "
+        e=$(piv verify -arequest -P123456 -s$slot -S'/CN=bar/OU=test/O=example.com/' -ipublic.pem -ocert.pem 2>&1)
+        test $? -eq 0 && echo -n "." || exit $?
+        grep -q "Successfully verified PIN" <<< $e && echo -n "." || exit $?
+        grep -q "Successfully generated a certificate request" <<< $e && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    OpenSSL verify request... "
+        e=$(openssl req -verify -in cert.pem 2>&1)
+        test $? -eq 0 && echo -n "." || exit $?
+        grep -q " OK" <<< $e && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    Test self-signed certificate... "
+        e=$(piv verify -aselfsign -P123456 -s$slot -S'/CN=bar/OU=test/O=example.com/' -ipublic.pem -ocert.pem 2>&1)
+        test $? -eq 0 && echo -n "." || exit $?
+        grep -q "Successfully verified PIN" <<< $e && echo -n "." || exit $?
+        grep -q "Successfully generated a new self signed certificate" <<< $e && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    Test signature... "
+        e=$(piv verify-pin -atest-signature -s$slot -P123456 -icert.pem 2>&1)
+        test $? -eq 0 && echo -n "." || exit $?
+        grep -q "Successful" <<< $e && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    OpenSSL verify cert... "
+        e=$(openssl verify -CAfile cert.pem cert.pem 2>&1)
+        test $? -eq 0 && echo -n "." || exit $?
+        grep -q ": OK" <<< $e && echo -e ".\t${OK}" || exit $?
+
+        echo -n "    Key deletion... "
+        delete_key $alg $slot && echo -e ".\t${OK}" || exit $?
+
+    done
+done
+
+rm -rf cert.pem
--- a/tests/scripts/version.sh
+++ b/tests/scripts/version.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+
+# Get version
+echo -n "  Test version... "
+e=$(piv version 2>&1)
+test $? -eq 0 && echo -n "." || exit $?
+grep -q "Application version" <<< $e && echo -n "." || exit $?
+grep -q " found" <<< $e && echo -e ".\t${OK}" || exit $?
--- a/tests/scripts/yubico-piv-test.sh
+++ b/tests/scripts/yubico-piv-test.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+reset
+test $? -eq 0 || exit $?
+
+echo -n "  Test PKCS11 tool..."
+gen_and_check rsa:2048
+test $? -eq 0 && echo -n "." || exit $?
+e=$(pkcs11-tool --test -l --pin 648219 2>&1)
+test $? -eq 0 && echo -n "." || exit $?
+grep -q "No errors" <<< $e && echo -n "." || exit $?
+pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
+test $? -eq 0 && echo -e ".\t${OK}" || exit $?
+#e=$(pkcs11-tool --test-ec -l --pin 648219 --id 1 --key-type ec:secp256r1 2>&1)
+#test $? -eq 0 && echo -n "." || exit $?
+#grep -q "==> OK" <<< $e && echo -e ".\t${OK}" || exit $?
--- a/tests/scripts/yubico-piv-tool.sh
+++ b/tests/scripts/yubico-piv-tool.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+source ./tests/scripts/func.sh
+echo "==== Test version ===="
+./tests/scripts/version.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test asymmetric keygen ===="
+./tests/scripts/keygen.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test self-signed certificates ===="
+./tests/scripts/signatures.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
+
+echo "==== Test attestation ===="
+./tests/scripts/attestation.sh
+test $? -eq 0 || {
+    echo -e "\t${FAIL}"
+    exit 1
+}
--- a/tests/start-up-and-test.sh
+++ b/tests/start-up-and-test.sh
@@ -1,7 +1,30 @@
-#!/bin/bash -eu
+#!/bin/bash

+OK="\t\033[32mok\033[0m"
+FAIL="\t\033[31mfail\033[0m"
+
+fail() {
+    echo -e "${FAIL}"
+    exit 1
+}
+
+echo -n "Start PCSC..."
 /usr/sbin/pcscd &
-sleep 2
-rm -rf memory.flash
-./build_in_docker/pico_openpgp > /dev/null &
+test $? -eq 0 && echo -e "${OK}" || {
+    echo -e "${FAIL}"
+    exit 1
+}
+sleep 1
+rm -f memory.flash
+echo -n "Start Pico OpenPGP..."
+./build_in_docker/pico_openpgp > /dev/null 2>&1 &
+test $? -eq 0 && echo -n "." || fail
+sleep 1
+ATR="3b:da:18:ff:81:b1:fe:75:1f:03:00:31:f5:73:c0:01:60:00:90:00:1c"
+e=$(opensc-tool -an 2>&1)
+grep -q "${ATR}" <<< $e && echo -n "." || fail
+test $? -eq 0 && echo -e "${OK}" || fail
+
 pytest tests -W ignore::DeprecationWarning
+
+./tests/scripts/cli-test.sh
--- a/workflows/autobuild.sh
+++ b/workflows/autobuild.sh
@@ -2,12 +2,38 @@

 git submodule update --init --recursive
 sudo apt update
+
+if [[ $1 == "pico" ]]; then
 sudo apt install -y cmake gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib
 git clone https://github.com/raspberrypi/pico-sdk
 cd pico-sdk
 git submodule update --init
 cd ..
+git clone https://github.com/raspberrypi/picotool
+cd picotool
+git submodule update --init
 mkdir build
 cd build
+cmake -DPICO_SDK_PATH=../../pico-sdk ..
+make -j`nproc`
+sudo make install
+cd ../..
+mkdir build_pico
+cd build_pico
 cmake -DPICO_SDK_PATH=../pico-sdk ..
 make
+elif [[ $1 == "esp32" ]]; then
+sudo apt install -y git wget flex bison gperf python3 python3-pip python3-venv cmake ninja-build ccache libffi-dev libssl-dev dfu-util libusb-1.0-0
+git clone --recursive https://github.com/espressif/esp-idf.git
+cd esp-idf
+./install.sh esp32s3
+. ./export.sh
+cd ..
+idf.py set-target esp32s3
+idf.py all
+else
+mkdir build
+cd build
+cmake -DENABLE_EMULATION=1 ..
+make
+fi
Author	SHA1	Message	Date
Pol Henarejos	4971a22a32	Update README.md Fix headings	2024-11-10 19:01:10 +01:00
Pol Henarejos	3ed463cc97	Upgrade to version 3.0 Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-11-10 18:57:19 +01:00
Pol Henarejos	4e6a9eaa4c	Update README Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-11-10 18:56:55 +01:00
Pol Henarejos	79c69a6617	OTP key is used to mask the DEK. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-11-10 18:56:46 +01:00
Pol Henarejos	21a9a731aa	Upgrade Pico Keys SDK Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-11-10 18:14:24 +01:00
Pol Henarejos	9b2b2e822a	Add compiler options for optimized build.s Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-11-09 00:38:39 +01:00
Pol Henarejos	4ba5e04080	Add PICO_PRODUCT. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-11-09 00:37:19 +01:00
Pol Henarejos	2747083672	Upgrade pico keys sdk. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-11-09 00:36:21 +01:00
Pol Henarejos	442caa2716	Fix macos alignment. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-10-01 13:29:25 +02:00
Pol Henarejos	e9f0b1b58c	Update autobuild for local and esp32. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-10-01 09:33:22 +02:00
Pol Henarejos	f1f6800b60	Fix ESP32 support. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-09-30 19:42:52 +02:00
Pol Henarejos	20b5084eee	Fix build Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-09-30 19:42:44 +02:00
Pol Henarejos	57e8d689fc	Add sdkdefaults for esp32 Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-09-30 19:26:26 +02:00
Pol Henarejos	e0779a49e7	Add error if a non-supported key is attempted to be imported. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-09-30 17:04:34 +02:00
Pol Henarejos	57e7fc38fb	Update pico_sdk_import Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-09-24 00:45:53 +02:00
Pol Henarejos	f301601bcd	Upgrade Pico Keys SDK to add support for OTP. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-09-16 19:41:15 +02:00
Pol Henarejos	3edf9bbf75	Add support for RP2350. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-30 13:33:56 +02:00
Pol Henarejos	cde8968068	Update to latest Pico Keys SDK. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-30 13:25:01 +02:00
Pol Henarejos	c0b23a7cb3	Fix write offset. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-26 00:51:40 +02:00
Pol Henarejos	0322967865	Free x509 cert on finish. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-25 21:17:15 +02:00
Pol Henarejos	e8c62e5867	Use bullseye for tests. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-25 20:58:26 +02:00
Pol Henarejos	57a6458051	Fix unitialized var. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-25 20:58:14 +02:00
Pol Henarejos	6780eb3935	Fix select aid to new callback. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-25 20:57:56 +02:00
Pol Henarejos	ac33f5a026	Add bullseye dockerfile. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-25 20:46:09 +02:00
Pol Henarejos	1051690b79	Add support to ESP32. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-20 00:23:22 +02:00
Pol Henarejos	8a5c734c41	Fix TLV when returning the public key in get metadata. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-13 17:16:57 +02:00
Pol Henarejos	c09f96e956	Fix return error when missing metadata. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-13 17:06:58 +02:00
Pol Henarejos	c28852d0ea	Fix return metadata for PIN/PUK. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-13 17:05:35 +02:00
Pol Henarejos	209cd389e5	Fix returning error code when no object is found on GET DATA. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-13 16:49:39 +02:00
Pol Henarejos	10c3389c51	Fix GET METADATA when ref is CARDMGM. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-13 16:48:14 +02:00
Pol Henarejos	197bf3c056	Add management support for YKMAN. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-08-13 16:34:10 +02:00
Pol Henarejos	3a4ca80970	Update VERSION to 2.2	2024-07-16 00:31:34 +02:00
Pol Henarejos	6a10405357	Upgrade to version 2.2 Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-07-15 15:16:36 +02:00
Pol Henarejos	1434ef2bd2	Fix for mbedtls 3.6 Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-07-15 15:16:36 +02:00
Pol Henarejos	11cb855f81	Fix idVendor and idProduct placeholders for Pico Patcher. Fixes #14 and #15 Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-07-15 15:16:31 +02:00
Pol Henarejos	5aba16692d	Merge pull request #17 from imkuang/fix_pw1-life-status Fix conditional error resetting has_pw1 variable	2024-07-15 15:12:26 +02:00
Ming Kuang	886bee5ddc	Fix conditional error resetting has_pw1 variable According to OpenPGP 3.4.1 specifications subsection 4.4.1: PW status Bytes 1st byte: 00 = PW1 (no. 81) only valid for one PSO:CDS command 01 = PW1 valid for several PSO:CDS commands Therefore has_pw1 should be reset to false when the first byte of the PW status is 0 instead of 1.	2024-07-06 22:09:37 +08:00
Pol Henarejos	20e7c93707	Upgrade patch_vidpid for new Pico Keys SDK. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-05-30 19:16:50 +02:00
Pol Henarejos	a2c00863f6	Upgrade to version 2.0. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-05-23 19:22:59 +02:00
Pol Henarejos	b61af665b8	Change size of tag_len() for uint16. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-05-23 18:44:57 +02:00
Pol Henarejos	20387c955e	Use latest version of Pico Keys SDK. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-05-23 18:40:24 +02:00
Pol Henarejos	0198386734	Merge branch 'piv'	2024-05-23 18:32:26 +02:00
Pol Henarejos	ce6eb6e8e6	Fix overflow when importing data. Fixes #12. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-05-23 18:32:15 +02:00
Pol Henarejos	e0daea80af	Add PIV tests. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-28 01:20:48 +01:00
Pol Henarejos	a9797ae1ba	Added x509 extensions to attesting certificates. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-27 19:12:14 +01:00
Pol Henarejos	877e5c0a5c	Fix attestation verification. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-27 18:50:55 +01:00
Pol Henarejos	f4c3a75d66	Compute public point on load key. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-27 18:45:23 +01:00
Pol Henarejos	b1e09b7047	Fix fetching some certs. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-27 18:10:04 +01:00
Pol Henarejos	e8ad4baa70	Fix operation with slot 93. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-27 15:24:11 +01:00
Pol Henarejos	42f9402f8b	Fix key deletion. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-27 15:18:01 +01:00
Pol Henarejos	c609050b3c	Fix keygen in slot 93. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-27 15:11:29 +01:00
Pol Henarejos	1e22908de1	Fix PIN POLICY Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-26 20:58:38 +01:00
Pol Henarejos	f8974ff183	Add PIN policy check on AUTHENTICATE. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-26 19:52:47 +01:00
Pol Henarejos	a49aab43d7	Added support for RSA 3072 and RSA 4096 import and fixed RSA signature/decryption. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-26 19:41:06 +01:00
Pol Henarejos	f20449fee3	Fix RSA signature. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-26 19:38:17 +01:00
Pol Henarejos	85b6c90d39	Added support for key import. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-26 13:00:42 +01:00
Pol Henarejos	9fe59a551a	Added support for ATTESTATION. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-26 12:13:51 +01:00
Pol Henarejos	ad5e98ce89	Fix PUK change. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-25 13:32:57 +01:00
Pol Henarejos	a5bb1cd721	Add 3DES support. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-25 13:25:40 +01:00
Pol Henarejos	e2bbe927af	Only mark MGM if challenge is the same. Otherwise, send OK silently. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-25 12:43:16 +01:00
Pol Henarejos	c35beb5b0e	Reset PIN status on select. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-25 11:43:10 +01:00
Pol Henarejos	beabcdd8a6	Add RESET command. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-25 11:42:24 +01:00
Pol Henarejos	d45a0bfc20	Fix verify on change pin. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-24 02:19:55 +01:00
Pol Henarejos	61261aa1d6	Add meta data when generatin keypair and returning public key on get metadata. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-24 02:19:39 +01:00
Pol Henarejos	6f1af52510	Add missing EF_PW_RETRIES file. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-24 01:23:58 +01:00
Pol Henarejos	1c10b0186e	Added support for SET RETRIES. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-22 20:38:01 +01:00
Pol Henarejos	e0e1b3758e	Added support for dynamic number of maximum retries. 3 by default Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-22 20:37:47 +01:00
Pol Henarejos	e3112d5cdf	Added support for RESET RETRY. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-22 20:14:03 +01:00
Pol Henarejos	13f848dafb	Added CHANGE PIN command. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-22 20:07:59 +01:00
Pol Henarejos	36420ef098	Added support for move-key. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-21 23:12:58 +01:00
Pol Henarejos	9de33f8969	Fix RETIRED18 comment. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-21 23:12:45 +01:00
Pol Henarejos	ba941d6cad	Fixed chained response in other interfaces. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-21 22:02:13 +01:00
Pol Henarejos	17d476a9e2	Fix crash on PIN change. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-21 22:01:41 +01:00
Pol Henarejos	2e70af60db	Add support for SET_MGM_KEY. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-21 22:01:09 +01:00
Pol Henarejos	2db451f858	Update test.yml Add piv branch.	2024-03-21 16:43:21 +01:00
Pol Henarejos	62743bbb3c	Fix ECDSA signature encoding. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-20 10:12:16 +01:00
Pol Henarejos	1197389e02	Fix response length encoding. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-20 10:11:03 +01:00
Pol Henarejos	9bcb6c1d7e	Fixed chained response. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-20 00:07:14 +01:00
Pol Henarejos	ec08c06196	Added support for PUT DATA. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-20 00:06:42 +01:00
Pol Henarejos	de43604db6	Added support for APDU chaining. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-19 18:55:21 +01:00
Pol Henarejos	2f24c3d9a8	Added support for PIV signature. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-19 17:56:36 +01:00
Pol Henarejos	0b7c8da592	KEK use is optional. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-19 17:56:00 +01:00
Pol Henarejos	d96bbb9b4b	Use new asn1 structs. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-14 23:22:19 +01:00
Pol Henarejos	ebec1b1022	Add PIV asymmetric keygen. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-14 23:22:01 +01:00
Pol Henarejos	4cfa2a16bf	Added AUTHENTICATE support. Note that CARD MGM key is NOT encrypted with DEK, since it has to be accessed even without PIN. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-12 22:04:19 +01:00
Pol Henarejos	817d8b39ec	Added first commit of Pico OpenPGP with PIV support. It shares the PIN of OpenPGP. Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>	2024-03-06 18:54:30 +01:00