def otp(ctx, access_code):
"""
Manage OTP Application.
The YubiKey provides two keyboard-based slots which can each be configured
with a credential. Several credential types are supported.
A slot configuration may be write-protected with an access code. This
prevents the configuration to be overwritten without the access code
provided. Mode switching the YubiKey is not possible when a slot is
configured with an access code.
Examples:
\b
Swap the configurations between the two slots:
$ ykman otp swap
\b
Program a random challenge-response credential to slot 2:
$ ykman otp chalresp --generate 2
\b
Program a Yubico OTP credential to slot 1, using the serial as public id:
$ ykman otp yubiotp 1 --serial-public-id
\b
Program a random 38 characters long static password to slot 2:
$ ykman otp static --generate 2 --length 38
"""
ctx.obj["session"] = YubiOtpSession(ctx.obj["conn"])
if access_code is not None:
if access_code == "":
access_code = click_prompt("Enter access code", show_default=False)
try:
access_code = parse_access_code_hex(access_code)
except Exception as e:
ctx.fail("Failed to parse access code: " + str(e))
ctx.obj["access_code"] = access_code
def get_overall_fips_status(pid, info):
statuses = {}
usb_enabled = info.config.enabled_capabilities[TRANSPORT.USB]
statuses["OTP"] = False
if usb_enabled & CAPABILITY.OTP:
with connect_to_device(info.serial, [OtpConnection])[0] as conn:
otp_app = YubiOtpSession(conn)
statuses["OTP"] = otp_in_fips_mode(otp_app)
statuses["OATH"] = False
if usb_enabled & CAPABILITY.OATH:
with connect_to_device(info.serial, [SmartCardConnection])[0] as conn:
oath_app = OathSession(conn)
statuses["OATH"] = oath_in_fips_mode(oath_app)
statuses["FIDO U2F"] = False
if usb_enabled & CAPABILITY.U2F:
with connect_to_device(info.serial, [FidoConnection])[0] as conn:
statuses["FIDO U2F"] = ctap_in_fips_mode(conn)
return statuses
def serial_modhex(self):
with self._open_device([OtpConnection]) as conn:
session = YubiOtpSession(conn)
return modhex_encode(b'\xff\x00' + struct.pack(b'>I', session.get_serial()))
def __enter__(self):
return YubiOtpSession(self._conn)