Package com.yubico.yubikit.openpgp

Class OpenPgpSession

java.lang.Object

com.yubico.yubikit.core.application.ApplicationSession<OpenPgpSession>

com.yubico.yubikit.openpgp.OpenPgpSession

All Implemented Interfaces:

Closeable, AutoCloseable

public class OpenPgpSession
extends com.yubico.yubikit.core.application.ApplicationSession<OpenPgpSession>

OpenPGP card application as specified on gnupg.org.

Enables you to manage keys and data, as well as perform signing, decryption, and authentication operations.

Field Summary

Fields

Modifier and Type	Field	Description
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_ATTESTATION	Support for public key attestation.
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_CACHED	Support for the "cached" UIF settings.
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_EC_KEYS	Support for private keys using Elliptic Curve cryptography.
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_PIN_ATTEMPTS	Support for changing the number of PIN attempts allowed before becoming blocked.
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_RESET	Support for factory reset.
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_RSA_GENERATION	Support for generating RSA keys.
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_RSA4096_KEYS	Support for 4096 (and 3072) bit RSA keys, in addition to 2048-bit.
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_UIF	Support for the User Interaction Flag (touch requirement).
static final com.yubico.yubikit.core.application.Feature<OpenPgpSession>	FEATURE_UNVERIFY_PIN	Support for resetting the PIN verified state.

Constructor Summary

Constructors

Constructor	Description
OpenPgpSession(com.yubico.yubikit.core.smartcard.SmartCardConnection connection)	Create new instance of OpenPgpSession and selects the application for use.
OpenPgpSession(com.yubico.yubikit.core.smartcard.SmartCardConnection connection, @Nullable com.yubico.yubikit.core.smartcard.scp.ScpKeyParams scpKeyParams)	Create new instance of OpenPgpSession and selects the application for use.

Method Summary

Modifier and Type	Method	Description
X509Certificate	attestKey(KeyRef keyRef)	Creates an attestation certificate for a key.
byte[]	authenticate(byte[] payload)	Authenticates a message using the AUT key.
void	changeAdminPin(char[] pin, char[] newPin)	Change the Admin PIN.
void	changeUserPin(char[] pin, char[] newPin)	Change the User PIN.
void	close()
byte[]	decrypt(byte[] payload)	Decrypts a value using the DEC key.
byte[]	decrypt(com.yubico.yubikit.core.keys.PublicKeyValues peerPublicKey)	Performs an ECDH key agreement using the DEC key.
void	deleteCertificate(KeyRef keyRef)	Deletes a certificate in a slot.
void	deleteKey(KeyRef keyRef)	Deletes the key in a key slot.
com.yubico.yubikit.core.keys.PublicKeyValues	generateEcKey(KeyRef keyRef, OpenPgpCurve curve)	Generate an EC key in the given slot.
com.yubico.yubikit.core.keys.PublicKeyValues	generateRsaKey(KeyRef keyRef, int keySize)	Generate an RSA key in the given slot.
OpenPgpAid	getAid()	Get the AID for the OpenPGP application.
Map<KeyRef,List<AlgorithmAttributes>>	getAlgorithmInformation()	Get the supported key algorithms for each of the key slots.
ApplicationRelatedData	getApplicationRelatedData()	Read the Application Related Data from the YubiKey.
@Nullable X509Certificate	getCertificate(KeyRef keyRef)	Get a certificate from a slot.
byte[]	getChallenge(int length)	Generate random data on the YubiKey.
byte[]	getData(int doId)	Read a Data Object from the YubiKey.
ExtendedCapabilities	getExtendedCapabilities()	Get the Extended Capabilities supported by the YubiKey.
Kdf	getKdf()	Read the current KDF settings configured for the YubiKey.
PwStatus	getPinStatus()	Get the current PIN configuration and status from the YubiKey.
com.yubico.yubikit.core.keys.PublicKeyValues	getPublicKey(KeyRef keyRef)	Read the public key from a slot.
int	getSignatureCounter()	Gets the number of signatures performed with the SIG key.
Uif	getUif(KeyRef keyRef)	Get the User Interaction Flag (touch requirement) for a key.
com.yubico.yubikit.core.Version	getVersion()
void	putCertificate(KeyRef keyRef, X509Certificate certificate)	Imports a certificate into a slot.
void	putData(int doId, byte[] data)	Write a Data Object to the YubiKey.
void	putKey(KeyRef keyRef, com.yubico.yubikit.core.keys.PrivateKeyValues privateKey)	Import a private key into the give slot.
void	reset()	Performs a factory reset on the OpenPGP application.
void	resetPin(char[] newPin, char @Nullable [] resetCode)	Resets the User PIN in case it is lost or blocked.
void	setAlgorithmAttributes(KeyRef keyRef, AlgorithmAttributes attributes)	Sets the algorithm attributes to use for a key slot.
void	setFingerprint(KeyRef keyRef, byte[] fingerprint)	Set the fingerprint of a key, format specified in RFC 4880.
void	setGenerationTime(KeyRef keyRef, int timestamp)	Set the generation timestamp of a key.
void	setKdf(Kdf kdf)	Set up a PIN Key Derivation Function.
void	setPinAttempts(int userAttempts, int resetAttempts, int adminAttempts)	Set the number of PIN attempts to allow before blocking.
void	setResetCode(char[] resetCode)	Set the Reset Code for User PIN.
void	setSignaturePinPolicy(PinPolicy pinPolicy)	Set the PIN policy for the signature key slot.
void	setUif(KeyRef keyRef, Uif uif)	Set the User Interaction Flag (touch requirement) for a key.
byte[]	sign(byte[] payload)	Signs a message using the SIG key.
void	unverifyAdminPin()	Resets the verification state of the Admin PIN to unverified.
void	unverifyUserPin()	Resets the verification state of the User PIN to unverified.
void	verifyAdminPin(char[] pin)	Verify the Admin PIN.
void	verifyUserPin(char[] pin, boolean extended)	Verify the User PIN.

Methods inherited from class com.yubico.yubikit.core.application.ApplicationSession

require, supports

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

FEATURE_RESET

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_RESET

Support for factory reset.

FEATURE_UIF

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_UIF

Support for the User Interaction Flag (touch requirement).

FEATURE_ATTESTATION

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_ATTESTATION

Support for public key attestation.

FEATURE_CACHED

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_CACHED

Support for the "cached" UIF settings.

FEATURE_RSA4096_KEYS

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_RSA4096_KEYS

Support for 4096 (and 3072) bit RSA keys, in addition to 2048-bit.

FEATURE_EC_KEYS

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_EC_KEYS

Support for private keys using Elliptic Curve cryptography.

FEATURE_UNVERIFY_PIN

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_UNVERIFY_PIN

Support for resetting the PIN verified state.

FEATURE_PIN_ATTEMPTS

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_PIN_ATTEMPTS

Support for changing the number of PIN attempts allowed before becoming blocked.

FEATURE_RSA_GENERATION

public static final com.yubico.yubikit.core.application.Feature<OpenPgpSession> FEATURE_RSA_GENERATION

Support for generating RSA keys.

Constructor Details

OpenPgpSession

public OpenPgpSession(com.yubico.yubikit.core.smartcard.SmartCardConnection connection)
               throws IOException,
com.yubico.yubikit.core.application.ApplicationNotAvailableException,
com.yubico.yubikit.core.smartcard.ApduException

Create new instance of OpenPgpSession and selects the application for use.

Parameters:

connection - a smart card connection to a YubiKey

Throws:

IOException - in case of communication error

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

com.yubico.yubikit.core.application.ApplicationNotAvailableException - if the application is missing or disabled

OpenPgpSession

public OpenPgpSession(com.yubico.yubikit.core.smartcard.SmartCardConnection connection,
 @Nullable com.yubico.yubikit.core.smartcard.scp.ScpKeyParams scpKeyParams)
               throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.ApplicationNotAvailableException

Create new instance of OpenPgpSession and selects the application for use.

Parameters:

connection - a smart card connection to a YubiKey

scpKeyParams - SCP key parameters to establish a secure connection

Throws:

IOException - in case of communication error

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

com.yubico.yubikit.core.application.ApplicationNotAvailableException - if the application is missing or disabled

Method Details

getVersion

public com.yubico.yubikit.core.Version getVersion()

Specified by:

getVersion in class com.yubico.yubikit.core.application.ApplicationSession<OpenPgpSession>

close

public void close()
           throws IOException

Throws:

IOException

getData

public byte[] getData(int doId)
               throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Read a Data Object from the YubiKey.

Parameters:

doId - the ID of the Data Object to read

Returns:

the value of the Data Object

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

putData

public void putData(int doId,
 byte[] data)
             throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Write a Data Object to the YubiKey.

Parameters:

doId - the ID of the Data Object to read

data - the value to write to the Data Object

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getApplicationRelatedData

public ApplicationRelatedData getApplicationRelatedData()
                                                 throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Read the Application Related Data from the YubiKey.

Returns:

the parsed Application Related Data

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getAid

public OpenPgpAid getAid()

Get the AID for the OpenPGP application.

Returns:

the parsed OpenPgpAid

getExtendedCapabilities

public ExtendedCapabilities getExtendedCapabilities()

Get the Extended Capabilities supported by the YubiKey.

Returns:

the parsed ExtendedCapabilities

getPinStatus

public PwStatus getPinStatus()
                      throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Get the current PIN configuration and status from the YubiKey.

Returns:

a PwStatus object with remaining attempts, maximum PIN lengths, and signature PIN policy

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getKdf

public Kdf getKdf()
           throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Read the current KDF settings configured for the YubiKey.

Returns:

a Kdf object, capable of deriving a key from a PIN

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

setKdf

public void setKdf(Kdf kdf)
            throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Set up a PIN Key Derivation Function.

This enables (or disables) the use of a KDF for PIN verification, as well as resetting the User and Admin PINs to their default (initial) values.

If a Reset Code is present, it will be invalidated.

This command requires Admin PIN verification.

Parameters:

kdf - the KDF configuration to set

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

verifyUserPin

public void verifyUserPin(char[] pin,
 boolean extended)
                   throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.InvalidPinException

Verify the User PIN.

This will unlock functionality that requires User PIN verification. Note that with extended=false only sign operations are allowed. Inversely, with extended=true sign operations are NOT allowed.

Parameters:

pin - the User PIN to verify

extended - false to verify for signature use, true for other uses

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

com.yubico.yubikit.core.application.InvalidPinException - in case of the wrong PIN

verifyAdminPin

public void verifyAdminPin(char[] pin)
                    throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.InvalidPinException

Verify the Admin PIN.

This will unlock functionality that requires Admin PIN verification.

Parameters:

pin - the Admin PIN to verify

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

com.yubico.yubikit.core.application.InvalidPinException - in case of the wrong PIN

unverifyUserPin

public void unverifyUserPin()
                     throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Resets the verification state of the User PIN to unverified.

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

unverifyAdminPin

public void unverifyAdminPin()
                      throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Resets the verification state of the Admin PIN to unverified.

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getSignatureCounter

public int getSignatureCounter()
                        throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Gets the number of signatures performed with the SIG key.

Returns:

the number of signatures

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getChallenge

public byte[] getChallenge(int length)
                    throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Generate random data on the YubiKey.

Parameters:

length - the number of bytes to generate

Returns:

random data of the given length

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

setSignaturePinPolicy

public void setSignaturePinPolicy(PinPolicy pinPolicy)
                           throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Set the PIN policy for the signature key slot.

A PIN policy of ONCE (the default) requires the User PIN to be verified once per session prior to creating a signature. A policy of ALWAYS requires a new PIN verification prior to each signature made.

Parameters:

pinPolicy - the PIN policy to set

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

reset

public void reset()
           throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Performs a factory reset on the OpenPGP application.

WARNING: This will delete all stored keys, certificates and other data.

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

setPinAttempts

public void setPinAttempts(int userAttempts,
 int resetAttempts,
 int adminAttempts)
                    throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Set the number of PIN attempts to allow before blocking.

WARNING: On YubiKey NEO this will reset the PINs to their default values.

Requires Admin PIN verification.

Parameters:

userAttempts - the number of attempts for the User PIN

resetAttempts - the number of attempts for the Reset Code

adminAttempts - the number of attempts for the Admin PIN

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

changeUserPin

public void changeUserPin(char[] pin,
 char[] newPin)
                   throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.InvalidPinException

Change the User PIN.

Parameters:

pin - the current User PIN

newPin - the new User PIN to set

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

com.yubico.yubikit.core.application.InvalidPinException - in case of the wrong PIN in case of the wrong PIN

changeAdminPin

public void changeAdminPin(char[] pin,
 char[] newPin)
                    throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.InvalidPinException

Change the Admin PIN.

Parameters:

pin - the current Admin PIN

newPin - the new Admin PIN to set

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

com.yubico.yubikit.core.application.InvalidPinException - in case of the wrong PIN

setResetCode

public void setResetCode(char[] resetCode)
                  throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Set the Reset Code for User PIN.

The Reset Code can be used to set a new User PIN if it is lost or becomes blocked, using the reset_pin method.

This command requires Admin PIN verification.

Parameters:

resetCode - the Reset Code to set

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

resetPin

public void resetPin(char[] newPin,
 char @Nullable [] resetCode)
              throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.InvalidPinException

Resets the User PIN in case it is lost or blocked.

This can be done either after performing Admin PIN verification, or by providing the Reset Code.

This command requires Admin PIN verification, or the Reset Code.

Parameters:

newPin - the new User PIN to set

resetCode - the Reset Code, which is needed if the Admin pin has not been verified

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

com.yubico.yubikit.core.application.InvalidPinException - in case of the wrong PIN

getUif

public Uif getUif(KeyRef keyRef)
           throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Get the User Interaction Flag (touch requirement) for a key.

Parameters:

keyRef - the key slot to read UIF for

Returns:

the User Interaction Flag for the given slot

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

setUif

public void setUif(KeyRef keyRef,
 Uif uif)
            throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Set the User Interaction Flag (touch requirement) for a key.

Requires Admin PIN verification.

Parameters:

keyRef - the key slot to set UIF for

uif - the UIF setting to use for the key in the given slot

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getAlgorithmInformation

public Map<KeyRef,List<AlgorithmAttributes>> getAlgorithmInformation()
                                                              throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.BadResponseException

Get the supported key algorithms for each of the key slots.

Returns:

a mapping from key ref to list of supported algorithms

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

com.yubico.yubikit.core.application.BadResponseException - in case of incorrect YubiKey response

setAlgorithmAttributes

public void setAlgorithmAttributes(KeyRef keyRef,
 AlgorithmAttributes attributes)
                            throws com.yubico.yubikit.core.application.BadResponseException,
com.yubico.yubikit.core.smartcard.ApduException,
IOException

Sets the algorithm attributes to use for a key slot.

Parameters:

keyRef - the key slot to set attributes for

attributes - the algorithm attributes to set for the slot

Throws:

com.yubico.yubikit.core.application.BadResponseException - in case of incorrect YubiKey response

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

setGenerationTime

public void setGenerationTime(KeyRef keyRef,
 int timestamp)
                       throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Set the generation timestamp of a key.

Parameters:

keyRef - the key slot to set the timestamp for

timestamp - the timestamp to set

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

setFingerprint

public void setFingerprint(KeyRef keyRef,
 byte[] fingerprint)
                    throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Set the fingerprint of a key, format specified in RFC 4880.

Parameters:

keyRef - the slot of the key to set the fingerprint for

fingerprint - the fingerprint to set

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getCertificate

public @Nullable X509Certificate getCertificate(KeyRef keyRef)
                                         throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Get a certificate from a slot.

Parameters:

keyRef - the slot to get a certificate from

Returns:

the certificate stored in the give slot

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

putCertificate

public void putCertificate(KeyRef keyRef,
 X509Certificate certificate)
                    throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Imports a certificate into a slot.

Requires Admin PIN verification.

Parameters:

keyRef - the slot to put the certificate in

certificate - the certificate to import

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

deleteCertificate

public void deleteCertificate(KeyRef keyRef)
                       throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Deletes a certificate in a slot.

Requires Admin PIN verification.

Parameters:

keyRef - the slot in which to delete the certificate

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

generateRsaKey

public com.yubico.yubikit.core.keys.PublicKeyValues generateRsaKey(KeyRef keyRef,
 int keySize)
                                                            throws com.yubico.yubikit.core.application.BadResponseException,
com.yubico.yubikit.core.smartcard.ApduException,
IOException

Generate an RSA key in the given slot.

Requires Admin PIN verification.

Parameters:

keyRef - the slot to generate the key in

keySize - the bitlength of the key to generate

Returns:

the public key of the generated key pair

Throws:

com.yubico.yubikit.core.application.BadResponseException - in case of incorrect YubiKey response

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

generateEcKey

public com.yubico.yubikit.core.keys.PublicKeyValues generateEcKey(KeyRef keyRef,
 OpenPgpCurve curve)
                                                           throws com.yubico.yubikit.core.application.BadResponseException,
com.yubico.yubikit.core.smartcard.ApduException,
IOException

Generate an EC key in the given slot.

Requires Admin PIN verification.

Parameters:

keyRef - the key slot to generate a key in

curve - the elliptic curve of the key to generate

Returns:

the public key of the generated key pair

Throws:

com.yubico.yubikit.core.application.BadResponseException - in case of incorrect YubiKey response

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

putKey

public void putKey(KeyRef keyRef,
 com.yubico.yubikit.core.keys.PrivateKeyValues privateKey)
            throws com.yubico.yubikit.core.application.BadResponseException,
com.yubico.yubikit.core.smartcard.ApduException,
IOException

Import a private key into the give slot.

Requires Admin PIN verification.

Parameters:

keyRef - the slot to import the key into

privateKey - the private key to import

Throws:

com.yubico.yubikit.core.application.BadResponseException - in case of incorrect YubiKey response

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

getPublicKey

public com.yubico.yubikit.core.keys.PublicKeyValues getPublicKey(KeyRef keyRef)
                                                          throws com.yubico.yubikit.core.smartcard.ApduException,
IOException,
com.yubico.yubikit.core.application.BadResponseException

Read the public key from a slot.

Parameters:

keyRef - the key slot to read from

Returns:

the public key stored in the given slot

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

com.yubico.yubikit.core.application.BadResponseException - in case of incorrect YubiKey response

deleteKey

public void deleteKey(KeyRef keyRef)
               throws com.yubico.yubikit.core.application.BadResponseException,
com.yubico.yubikit.core.smartcard.ApduException,
IOException

Deletes the key in a key slot.

Parameters:

keyRef - the slot to delete

Throws:

com.yubico.yubikit.core.application.BadResponseException - in case of incorrect YubiKey response

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

sign

public byte[] sign(byte[] payload)
            throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Signs a message using the SIG key.

NOTE: This performs a raw signature. Messages should be hashed and/or padded prior. Requires User PIN verification.

Parameters:

payload - the message to sign

Returns:

the generated signature

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

decrypt

public byte[] decrypt(byte[] payload)
               throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Decrypts a value using the DEC key.

This method should be used for RSA keys to perform an RSA decryption using PKCS#1 v1.5 padding. For RSA the `value` should be an encrypted block. For ECDH the `value` should be a peer public-key to perform the key exchange with, and the result will be the derived shared secret.

Requires (extended) User PIN verification.

Parameters:

payload - the ciphertext to decrypt

Returns:

the decrypted and unpadded plaintext

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

decrypt

public byte[] decrypt(com.yubico.yubikit.core.keys.PublicKeyValues peerPublicKey)
               throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Performs an ECDH key agreement using the DEC key.

This method should be used for EC keys where encryption is done using a shared secret.

Parameters:

peerPublicKey - the public key to perform the agreement with

Returns:

the key agreement shared secret

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

authenticate

public byte[] authenticate(byte[] payload)
                    throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Authenticates a message using the AUT key.

Requires User PIN verification.

Parameters:

payload - the message to authenticate

Returns:

the generated signature

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error

attestKey

public X509Certificate attestKey(KeyRef keyRef)
                          throws com.yubico.yubikit.core.smartcard.ApduException,
IOException

Creates an attestation certificate for a key.

The certificate is written to the certificate slot for the key, and its content is returned.

Requires User PIN verification.

Parameters:

keyRef - the slot to attest

Returns:

the attestation certificate

Throws:

com.yubico.yubikit.core.smartcard.ApduException - in case of an error response from the YubiKey

IOException - in case of connection error