Yubikey: PIV.9C restriction in scdaemon
Open, Needs TriagePublic

Assigned To
None
Authored By
gniibe
Tue, Sep 8, 4:00 AM

Description

In gnupg/scd/app-piv.c, we have a comment:

/* According to table 4b of SP800-73-4 the signing key always
 * requires a verify.  */

and set force_verify = 1 for 0x9c.

We received a report from a user (gnupg-devel xmpp channel), questioned if this restriction by scdaemon is relevant or not.
Yubikey itself has a feature to control the behavior (pin auth ONCE, touch is required, etc.).
It seems for me that we don't need to restrict this due to the NIST standards. In my opinion, it is up to users to control the behavior of the device.

So, I propose the removal of the restriction for PIV.9C..

BTW, the standard has been updated, and it's now SP800-73-5 (part1, Table 5).
https://csrc.nist.gov/pubs/sp/800/73/pt1/5/final

Event Timeline

We could read the Yubikey configuration to decide what to do. But I have no problems if you lift this force.