Nitrokey / Nitrokey/nitrokey-documentation

Undocumented Pin Policy

Open
#219 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
CSS
Stars
36
Forks
53
Avg merge
1d 16h
Merged PRs (30d)
5

Description

Description

I had issues with setting the FIDO2 pin on a Nitrokey 3C NFC. The issue was
that my pin got rejected due to a pin policy violation and when looking into
the official documentation for further clarification on what the policy was I
couldn't find any in the following:

Could you please specify in your documentation on what the expected policy is
and if there have been changes to it depending on the firmware version as I am
currently on v1.6.0 while a previous Nitrokey I used was on v1.5.0 and had
no issues with a password with the same allowance of characters to what I was
attempting to use. I attempted to use the following:

m'(%8LJcr5\\dcQhtZu^p:F>T\\4ARCl_4[O8cA+v~y=\{<25f\}~iK-%KU@B$eTQi`0&+Mh1?Z^,DV#+S]$AliI
<h4>w<Gpg*kkc+B&CryRq/J$;L'6I;XSk3jLcs1k:_j=-A\}E4?jBR^B2I9),g*(x

Below is a snippet of the log that states that there was a pin policy violation.

  File "<python-path>/site-packages/fido2/ctap2/base.py", line 241, in send_cbor
    raise CtapError(status)
fido2.ctap.CtapError: CTAP error: 0x37 - PIN_POLICY_VIOLATION
12208     DEBUG       root listing all connected devices:
12218     DEBUG       root :: 'Nitrokey FIDO2' keys
12219     DEBUG       root :: 'Nitrokey Start' keys:
12229     DEBUG       root :: 'Nitrokey 3' keys

Thank you in advance
Kathrin

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with shared/set-pins.rst.inc and the reported CTAP error, then investigate the expected PIN policy for firmware v1.5.0 and v1.6.0. Done means the documentation states the policy clearly and explains any firmware-version differences relevant to the reported PIN rejection.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.