Skip to content

Instantly share code, notes, and snippets.

@Smurph82 Smurph82/yubitouch.sh forked from a-dma/yubitouch.sh
Created Nov 26, 2017

Embed
What would you like to do?
Bash script for setting or clearing touch requirements for cryptographic operations in the OpenPGP application on a YubiKey 4.
#!/bin/bash
# Bash script for setting or clearing touch requirements for
# cryptographic operations the OpenPGP application on a YubiKey 4.
#
# Author: Alessio Di Mauro <alessio@yubico.com>
GCA=$(which gpg-connect-agent)
DO=0
UIF=0
PE=$(which pinentry)
PE_PROMPT="SETPROMPT Admin PIN\nGETPIN\nBYE"
if [ -z "$GCA" ]
then
echo "Can not find gpg-connect-agent. Aborting...";
exit 1;
fi
if [ $# -lt 2 ] || [ $# -gt 3 ]
then
echo "Wrong parameters"
echo "usage: yubitouch {sig|aut|dec} {off|on|fix} [admin_pin]";
exit 1;
fi
if [ "$1" == "sig" ]
then
DO="D6"
elif [ "$1" == "dec" ]
then
DO="D7"
elif [ "$1" == "aut" ]
then
DO="D8"
else
echo "Invalid value $1 (must be sig, aut, dec). Aborting..."
exit 1
fi
if [ "$2" == "off" ]
then
UIF="00";
elif [ "$2" == "on" ]
then
UIF="01"
elif [ "$2" == "fix" ]
then
UIF="02";
else
echo "Invalid value $2 (must be off, on, fix). Aborting..."
exit 1
fi
if [ $# -eq 3 ]
then
PIN="$3"
elif [ -z "$PE" ]
then
echo -e "Pinentry not present\nFalling back to regular stdin.\nBe careful!"
echo "Enter your admin PIN: "
read PIN
else
PIN="$(echo -e $PE_PROMPT | $PE | sed -n '/^D .*/s/^D //p')"
fi
if [ -z "$PIN" ]
then
echo "Empty PIN. Aborting..."
exit 1
fi
PIN_LEN=${#PIN}
PIN_LEN=$(printf %02x $PIN_LEN)
PIN=$(echo -n "$PIN" | xxd -ps | sed 's/[[:xdigit:]]\{2\}/& /g')
$GCA --hex "scd reset" /bye > /dev/null
VERIFY=$($GCA --hex "scd apdu 00 20 00 83 $PIN_LEN $PIN" /bye)
if ! echo $VERIFY | grep -q "90 00"
then
echo "Verification failed, wrong pin?"
exit 1
fi
PUT=$($GCA --hex "scd apdu 00 da 00 $DO 02 $UIF 20" /bye)
if ! echo $PUT | grep -q "90 00"
then
echo "Unable to change mode. Set to fix?"
exit 1
fi
echo "All done!"
exit 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.