Package pyhsm :: Module yubikey
[frames] | no frames]

Module yubikey

helper functions to work with Yubikeys and YubiHSM

Functions
YHSM_ValidationResult
validate_otp(hsm, from_key)
Try to validate an OTP from a YubiKey using the internal database on the YubiHSM.
YHSM_ValidationResult
validate_yubikey_with_aead(hsm, from_key, aead, key_handle)
Try to validate an OTP from a YubiKey using the AEAD that can decrypt this YubiKey's internal secret, using the key_handle for the AEAD.
string
modhex_decode(data)
Convert a modhex string to ordinary hex.
string
modhex_encode(data)
Convert an ordinary hex string to modhex.
tuple of string
split_id_otp(from_key)
Separate public id from OTP given a YubiKey OTP as input.
Function Details

validate_otp(hsm, from_key)

 

Try to validate an OTP from a YubiKey using the internal database on the YubiHSM.

`from_key' is the modhex encoded string emitted when you press the button on your YubiKey.

Will only return on succesfull validation. All failures will result in an pyhsm.exception.YHSM_CommandFailed.

Parameters:
  • hsm (pyhsm.YHSM) - The YHSM instance
  • from_key (string) - The OTP from a YubiKey (in modhex)
Returns: YHSM_ValidationResult
validation response, if successful

validate_yubikey_with_aead(hsm, from_key, aead, key_handle)

 

Try to validate an OTP from a YubiKey using the AEAD that can decrypt this YubiKey's internal secret, using the key_handle for the AEAD.

`from_key' is the modhex encoded string emitted when you press the button on your YubiKey.

Will only return on succesfull validation. All failures will result in an pyhsm.exception.YHSM_CommandFailed.

Parameters:
  • hsm (pyhsm.YHSM) - The YHSM instance
  • from_key (string) - The OTP from a YubiKey (in modhex)
  • aead (YHSM_GeneratedAEAD or string) - AEAD containing the cryptographic key and permission flags
  • key_handle (integer or string) - The key handle that can decrypt the AEAD
Returns: YHSM_ValidationResult
validation response

modhex_decode(data)

 

Convert a modhex string to ordinary hex.

Parameters:
  • data (string) - Modhex input
Returns: string
Hex

modhex_encode(data)

 

Convert an ordinary hex string to modhex.

Parameters:
  • data (string) - Hex input
Returns: string
Modhex

split_id_otp(from_key)

 

Separate public id from OTP given a YubiKey OTP as input.

Parameters:
  • from_key (string) - The OTP from a YubiKey (in modhex)
Returns: tuple of string
public_id and OTP