Hello,
first off, no AI is involved in this specific bug report ;-)
I use:
- hardware / board revision : waveshare_rp2350_one
- firmware / commit hash: 7.4.2, USB: 1050:0407 for Yubikey5
I like to store TOTP tokens on the device using protocol from yubikey: https://developers.yubico.com/OATH/YKOATH_Protocol.html
So I store some tokens and read them, all works fine.
Then I like to use the password feature (called "validate" in their docs) so I set a password which succeeds. Then I try to read tokens without validating and I get back the error SW: 69 82, also fine. I can repeat reading forever and it always fails which is fine. But now I disconnect the waveshare and reconnect it, then again I try to access the tokens without validation and would also expect the same error, but surprisingly the password is ignored and I get full access without validation. So this constitutes a security failure as I see it. This is true for all commands which require validation, they all succeed now.
If I use the yubico authenticator GUI then it still requires me to enter the password to access the tokens even after disconnection. So I enter the password and see the tokens properly. So from yubico authenticator point of view all works fine. Maybe because they never try to read in this case without validation.
APDU logs:
# set password
APDU: 00 A4 04 00 07 A0 00 00 05 27 21 01
SW: 79 03 07 04 00 71 08 42 43 31 44 36 30 36 32 74 08 B8 F9 16 E9 4C 6B 25 CE 7B 01 01 90 00
APDU: 00 A3 00 00 20 74 08 83 D6 61 70 86 58 15 93 75 14 2A D8 5B 0A 7E 72 CE 41 3C 9B 81 13 FD 8D AA A4 E1 7A B1 83
SW: 75 14 71 03 4F CD 9E 0A 8C 62 C8 AB FB 38 F1 58 AE 6D 79 A9 4B 95 90 00
APDU: 00 03 00 00 33 73 11 01 18 DD 75 DD 30 F8 FA 34 EE FD 02 8C D5 39 B9 FD 74 08 00 00 00 00 00 00 00 00 75 14 95 76 3C 44 58 B5 89 74 BD 14 5F 11 B2 CB 53 F2 78 5B 52 3D
SW: 90 00
# list tokens
APDU: 00 A4 04 00 07 A0 00 00 05 27 21 01
SW: 79 03 07 04 00 71 08 42 43 31 44 36 30 36 32 74 08 F0 38 45 F1 CC 53 AB 4A 7B 01 01 90 00
APDU: 00 A1 00 00
# error, which is correct
SW: 69 82
-> disconnect waveshare
-> reinsert waveshare
# list tokens
APDU: 00 A4 04 00 07 A0 00 00 05 27 21 01
SW: 79 03 07 04 00 71 08 42 43 31 44 36 30 36 32 74 08 B8 35 C8 FA DF 50 77 49 7B 01 01 90 00
APDU: 00 A1 00 00
# it succeeds (I have 3 example tokens stored), but it should fail!
SW: 72 18 21 45 78 61 6D 70 6C 65 3A 61 6C 69 63 65 40 67 6D 61 69 6C 2E 63 6F 6D 72 0B 21 74 74 74 74 74 65 65 65 65 65 72 05 21 74 65 73 74 90 00
Hello,
first off, no AI is involved in this specific bug report ;-)
I use:
I like to store TOTP tokens on the device using protocol from yubikey: https://developers.yubico.com/OATH/YKOATH_Protocol.html
So I store some tokens and read them, all works fine.
Then I like to use the password feature (called "validate" in their docs) so I set a password which succeeds. Then I try to read tokens without validating and I get back the error SW: 69 82, also fine. I can repeat reading forever and it always fails which is fine. But now I disconnect the waveshare and reconnect it, then again I try to access the tokens without validation and would also expect the same error, but surprisingly the password is ignored and I get full access without validation. So this constitutes a security failure as I see it. This is true for all commands which require validation, they all succeed now.
If I use the yubico authenticator GUI then it still requires me to enter the password to access the tokens even after disconnection. So I enter the password and see the tokens properly. So from yubico authenticator point of view all works fine. Maybe because they never try to read in this case without validation.
APDU logs:
# set password
APDU: 00 A4 04 00 07 A0 00 00 05 27 21 01
SW: 79 03 07 04 00 71 08 42 43 31 44 36 30 36 32 74 08 B8 F9 16 E9 4C 6B 25 CE 7B 01 01 90 00
APDU: 00 A3 00 00 20 74 08 83 D6 61 70 86 58 15 93 75 14 2A D8 5B 0A 7E 72 CE 41 3C 9B 81 13 FD 8D AA A4 E1 7A B1 83
SW: 75 14 71 03 4F CD 9E 0A 8C 62 C8 AB FB 38 F1 58 AE 6D 79 A9 4B 95 90 00
APDU: 00 03 00 00 33 73 11 01 18 DD 75 DD 30 F8 FA 34 EE FD 02 8C D5 39 B9 FD 74 08 00 00 00 00 00 00 00 00 75 14 95 76 3C 44 58 B5 89 74 BD 14 5F 11 B2 CB 53 F2 78 5B 52 3D
SW: 90 00
# list tokens
APDU: 00 A4 04 00 07 A0 00 00 05 27 21 01
SW: 79 03 07 04 00 71 08 42 43 31 44 36 30 36 32 74 08 F0 38 45 F1 CC 53 AB 4A 7B 01 01 90 00
APDU: 00 A1 00 00
# error, which is correct
SW: 69 82
-> disconnect waveshare
-> reinsert waveshare
# list tokens
APDU: 00 A4 04 00 07 A0 00 00 05 27 21 01
SW: 79 03 07 04 00 71 08 42 43 31 44 36 30 36 32 74 08 B8 35 C8 FA DF 50 77 49 7B 01 01 90 00
APDU: 00 A1 00 00
# it succeeds (I have 3 example tokens stored), but it should fail!
SW: 72 18 21 45 78 61 6D 70 6C 65 3A 61 6C 69 63 65 40 67 6D 61 69 6C 2E 63 6F 6D 72 0B 21 74 74 74 74 74 65 65 65 65 65 72 05 21 74 65 73 74 90 00