Page MenuHome GnuPG

Display prompt to user when YubiKey is waiting for touch confirmation
Open, Needs TriagePublic

Description

YubiKeys can be configured with a touch policy that requires the user to physically touch the device before it responds to a request. There is very little feedback to the user while it's waiting, other than a small and easily overlooked blinking LED on the YubiKey.

Would like to add a prompt to GPG while waiting for the YubiKey, using the existing pinentry tools, in order to make it more obvious that the user needs to take action.

A little more info/background can be found on my blog post: https://blog.unit410.com/security/2021/11/18/improving-yubikey-and-gnupg-usability.html

I've added a diff implementing this feature here: https://dev.gnupg.org/D542
(You can also find my patch on GitHub: https://github.com/joelnordell/gnupg/commit/1512c7b7fad6a9bee3ad9ca946c3b78988ceebb8)

What is the process for submitting this patch? Should I send it to the gnupg-devel@gnupg.org mailing list?

Event Timeline

Just a quick comment regarding GitHub: This mirror of the gpg repo hasn't been updated since many months. Please get the sources of gpg directly from the original source: git://git.gnupg.org/gnupg.git. See https://gnupg.org/download/git.html

Thanks @ikloecker - I'll rebase to the original repo and send it to the email list.

When the device-side feature was proposed, I had suggested to extend the protocol so that host side can know device side requires user interaction and prompt a user. But... the result was "it can be done with device side only".

Alas, it was not correct (for all cases). I don't know how we can move on from here.