Skip to content

Fix default piv key slot to match comments and docs #34350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Joerger merged 1 commit into from
Nov 9, 2023
Merged

Fix default piv key slot to match comments and docs #34350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions api/utils/keys/yubikey.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,12 +142,12 @@ func GetDefaultKeySlot(policy PrivateKeyPolicy) (piv.Slot, error) {
case PrivateKeyPolicyHardwareKeyTouch:
// private_key_policy: hardware_key_touch -> 9c
return piv.SlotSignature, nil
case PrivateKeyPolicyHardwareKeyPIN:
// private_key_policy: hardware_key_pin -> 9d
return piv.SlotCardAuthentication, nil
case PrivateKeyPolicyHardwareKeyTouchAndPIN:
// private_key_policy: hardware_key_touch_and_pin -> 9e
// private_key_policy: hardware_key_touch_and_pin -> 9d
return piv.SlotKeyManagement, nil
case PrivateKeyPolicyHardwareKeyPIN:
// private_key_policy: hardware_key_pin -> 9e
return piv.SlotCardAuthentication, nil
default:
return piv.Slot{}, trace.BadParameter("unexpected private key policy %v", policy)
}
Expand Down Expand Up @@ -715,10 +715,10 @@ func parsePIVSlot(slotKey uint32) (piv.Slot, error) {
return piv.SlotAuthentication, nil
case piv.SlotSignature.Key:
return piv.SlotSignature, nil
case piv.SlotCardAuthentication.Key:
return piv.SlotCardAuthentication, nil
case piv.SlotKeyManagement.Key:
return piv.SlotKeyManagement, nil
case piv.SlotCardAuthentication.Key:
return piv.SlotCardAuthentication, nil
default:
retiredSlot, ok := piv.RetiredKeyManagementSlot(slotKey)
if !ok {
Expand Down
4 changes: 2 additions & 2 deletions docs/pages/access-controls/guides/hardware-key-support.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,8 +210,8 @@ $ tsh clusters
By default, Teleport clients use the following PIV slots for each option:
- `hardware_key`: slot `9a`
- `hardware_key_touch`: slot `9c`
- `hardware_key_pin`: slot `9d`
- `hardware_key_and_pin`: slot `9e`
- `hardware_key_touch_and_pin`: slot `9d`
- `hardware_key_pin`: slot `9e`

If you are using any other PIV applications, you might need to specify a different slot.
For example, `yubikey-agent` uses slot `9a`. To avoid overwriting the `yubikey-agent` key and certificate,
Expand Down
2 changes: 1 addition & 1 deletion rfd/0080-hardware-key-support.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,7 +342,7 @@ If a hardware key policy is required, then a private key will be generated direc

#### PIV slot logic

PIV provides us with up to 24 different slots. Each slot has a different intended purpose, but functionally they are the same. We will use the first four slots (`9a`, `9c`, `9d`, `9e`) to support each of the 4 hardware key policy requirements (`hardware_key`, `hardware_key_touch`, `hardware_key_pin`, `hardware_key_touch_and_pin` respectively).
PIV provides us with up to 24 different slots. Each slot has a different intended purpose, but functionally they are the same. We will use the first four slots (`9a`, `9c`, `9d`, `9e`) to support each of the 4 hardware key policy requirements (`hardware_key`, `hardware_key_touch`, `hardware_key_touch_and_pin`, `hardware_key_pin` respectively).

Each of these keys will be generated for the first time when a Teleport client is required to meet its respective private key policy. Once a key is generated, it will be reused by any other Teleport client required to meet the same private key policy.

Expand Down