private void CheckForYubikey()
{
string devName = YubikeyNeoManager.Instance.ListDevices().FirstOrDefault();
_hadDevice = !string.IsNullOrEmpty(devName);
if (!_hadDevice)
{
return;
}
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
_hasBeenFound = dev.GetSerialNumber() == _key.DeviceSerial;
}
}
private void DlgChangePin_Load(object sender, EventArgs e)
{
AcceptButton = cmdChange;
string devName = YubikeyNeoManager.Instance.ListDevices().FirstOrDefault();
bool hadDevice = !string.IsNullOrEmpty(devName);
if (!hadDevice)
{
return;
}
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
int yubiSerial = dev.GetSerialNumber();
lblSerialNumber.Text = yubiSerial.ToString();
}
}
private void YubikeyStateChange()
{
string devName = YubikeyNeoManager.Instance.ListDevices().FirstOrDefault();
bool hasDevice = !string.IsNullOrEmpty(devName);
_devicePresent = hasDevice;
_hasBeenEnrolled = false;
if (hasDevice)
{
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
_hasBeenEnrolled = _dataStore.Search(dev.GetSerialNumber()).Any();
}
}
RefreshView();
}
private void btnExportCert_Click(object sender, EventArgs e)
{
X509Certificate2 cert = null;
int deviceSerial = 0;
string devName = YubikeyPivManager.Instance.ListDevices().FirstOrDefault();
if (!string.IsNullOrEmpty(devName))
{
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
deviceSerial = dev.GetSerialNumber();
}
using (YubikeyPivDevice dev = YubikeyPivManager.Instance.OpenDevice(devName))
{
cert = dev.GetCertificate9a();
}
}
if (cert == null)
{
MessageBox.Show("No certificate on device.", "No Certificate", MessageBoxButtons.OK);
return;
}
SaveFileDialog saveFileDialog = new SaveFileDialog();
saveFileDialog.FileName = deviceSerial + "-" + cert.SerialNumber + ".crt"; //TODO: GetSerialNumber() can possibly fail
DialogResult dlgResult = saveFileDialog.ShowDialog();
if (dlgResult != DialogResult.OK)
{
return;
}
using (Stream fs = saveFileDialog.OpenFile())
{
byte[] data = cert.GetRawCertData();
fs.Write(data, 0, data.Length);
}
}
static void PrintNeo(string name)
{
Console.WriteLine($"[NEO] Device: {name}");
if (!YubikeyNeoManager.Instance.IsValidDevice(name))
{
Console.WriteLine(" Not a valid NEO device");
}
else
{
using (YubikeyNeoDevice device = YubikeyNeoManager.Instance.OpenDevice(name))
{
Console.WriteLine($" Serial : {device.GetSerialNumber()}");
Console.WriteLine($" Mode : {device.GetMode()}");
Console.WriteLine($" Version : {device.GetVersion()}");
}
}
Console.WriteLine();
}
private void RefreshInsertedKeyInfo()
{
string devName = YubikeyNeoManager.Instance.ListDevices().FirstOrDefault();
bool hasDevice = !string.IsNullOrEmpty(devName);
foreach (Control control in gbInsertedYubikey.Controls)
{
if (control.Name.StartsWith("lbl"))
{
control.Visible = hasDevice;
}
}
if (!hasDevice)
{
return;
}
lblAlreadyEnrolled.Visible = _hasBeenEnrolled;
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
YubicoNeoMode currentMode = dev.GetMode();
if (currentMode.HasCcid)
{
lblInsertedMode.ForeColor = Color.Black;
}
else
{
lblInsertedMode.ForeColor = Color.Red;
}
lblInsertedSerial.Text = dev.GetSerialNumber().ToString();
lblInsertedMode.Text = currentMode.ToString();
lblInsertedFirmware.Text = dev.GetVersion().ToString();
}
}
private void YubikeyStateChange()
{
string devName = YubikeyNeoManager.Instance.ListDevices().FirstOrDefault();
bool hasDevice = !string.IsNullOrEmpty(devName);
btnExportCert.Enabled = false;
btnViewCert.Enabled = false;
if (hasDevice)
{
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
YubicoLib.YubikeyNeo.YubicoNeoMode currentMode = dev.GetMode();
bool enableCcid = !currentMode.HasCcid;
btnExportCert.Enabled = !enableCcid;
btnViewCert.Enabled = !enableCcid;
}
}
RefreshInsertedKey();
}
private void RefreshInsertedKey()
{
List <string> listDevices = YubikeyNeoManager.Instance.ListDevices().ToList();
string devName = listDevices.FirstOrDefault();
bool hasDevice = !string.IsNullOrEmpty(devName);
foreach (Control control in gbInsertedKey.Controls)
{
if (control.Name.StartsWith("lbl"))
{
control.Visible = hasDevice;
}
}
if (hasDevice)
{
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
int serialNumber = dev.GetSerialNumber();
lblInsertedSerial.Text = serialNumber.ToString();
lblInsertedFirmware.Text = dev.GetVersion().ToString();
lblInsertedMode.Text = dev.GetMode().ToString();
lblInsertedHasBeenEnrolled.Text = _dataStore.Search(serialNumber).Any().ToString();
}
}
if (listDevices.Count > 1)
{
lblMultipleKeys.Text = $"{listDevices.Count:N0} keys inserted";
}
else
{
lblMultipleKeys.Text = "";
}
}
private void EnrollWorkerOnDoWork(object sender, DoWorkEventArgs doWorkEventArgs)
{
string devName = YubikeyNeoManager.Instance.ListDevices().FirstOrDefault();
bool hasDevice = !string.IsNullOrEmpty(devName);
if (!hasDevice)
{
throw new InvalidOperationException("No yubikey");
}
// 0. Get lock on yubikey
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
// 1. Prep device info
int deviceId = dev.GetSerialNumber();
string neoFirmware = dev.GetVersion().ToString();
Version pivFirmware;
using (YubikeyPivDevice piv = YubikeyPivManager.Instance.OpenDevice(devName))
pivFirmware = piv.GetVersion();
_enrollWorker.ReportProgress(1);
// 2 - Generate PUK, prep PIN
byte[] randomKey = Utilities.GenerateRandomKey();
string puk = Utilities.MapBytesToString(randomKey.Take(8).ToArray());
string pin = txtPin.Text;
_enrollWorker.ReportProgress(2);
// 3 - Prep CA
WindowsCertificate enrollmentAgent = WindowsCertStoreUtilities.FindCertificate(_settings.EnrollmentAgentCertificate);
string ca = _settings.CSREndpoint;
string caTemplate = _settings.EnrollmentCaTemplate;
string user = txtUser.Text;
if (enrollmentAgent == null)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to find the certificate with thumbprint: " + _settings.EnrollmentAgentCertificate;
return;
}
_enrollWorker.ReportProgress(3);
// 4 - Prep Management Key
// TODO: Consider a new key every time?
byte[] mgmKey = _settings.EnrollmentManagementKey;
_enrollWorker.ReportProgress(4);
RSAParameters publicKey;
X509Certificate2 cert;
byte[] chuid;
using (YubikeyPivDevice pivTool = YubikeyPivManager.Instance.OpenDevice(devName))
{
// 5 - Yubico: Reset device
pivTool.BlockPin();
pivTool.BlockPuk();
bool reset = pivTool.ResetDevice();
if (!reset)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to reset the YubiKey";
return;
}
_enrollWorker.ReportProgress(5);
// 6 - Yubico: Management Key
bool authenticated = pivTool.Authenticate(YubikeyPivDevice.DefaultManagementKey);
if (!authenticated)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to authenticate with the YubiKey";
return;
}
bool setMgmKey = pivTool.SetManagementKey(mgmKey);
if (!setMgmKey)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to set the management key";
return;
}
_enrollWorker.ReportProgress(6);
// 7 - Yubico: Set CHUID
bool setChuid = pivTool.SetCHUID(Guid.NewGuid(), out chuid);
if (!setChuid)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to set CHUID";
return;
}
_enrollWorker.ReportProgress(7);
// 8 - Yubico: PIN
int tmp;
bool setPin = pivTool.ChangePin(YubikeyPivDevice.DefaultPin, pin, out tmp);
if (!setPin)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to set the PIN code";
return;
}
_enrollWorker.ReportProgress(8);
// 9 - Yubico: PUK
bool setPuk = pivTool.ChangePuk(YubikeyPivDevice.DefaultPuk, puk, out tmp);
if (!setPuk)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to set the PUK code";
return;
}
_enrollWorker.ReportProgress(9);
// 10 - Yubico: Generate Key
YubikeyAlgorithm algorithm = (YubikeyAlgorithm)drpAlgorithm.SelectedItem;
bool keyGenerated = pivTool.GenerateKey9a(algorithm.Value, out publicKey);
if (!keyGenerated)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to generate a keypair";
return;
}
_enrollWorker.ReportProgress(10);
}
// 11 - Yubico: Make CSR
string csr;
string csrError;
bool madeCsr = MakeCsr(Utilities.ExportPublicKeyToPEMFormat(publicKey), pin, out csrError, out csr);
if (!madeCsr)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to generate a CSR" + Environment.NewLine + csrError;
return;
}
_enrollWorker.ReportProgress(11);
// 12 - Enroll
string enrollError;
bool enrolled = CertificateUtilities.Enroll(user, enrollmentAgent, ca, caTemplate, csr, out enrollError, out cert);
if (!enrolled)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to enroll a certificate." + Environment.NewLine + enrollError;
return;
}
_enrollWorker.ReportProgress(12);
using (YubikeyPivDevice pivTool = YubikeyPivManager.Instance.OpenDevice(devName))
{
// 13 - Yubico: Import Cert
bool authenticatedForCert = pivTool.Authenticate(mgmKey);
if (!authenticatedForCert)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = "Unable to authenticate prior to importing a certificate";
return;
}
YubicoPivReturnCode imported = pivTool.SetCertificate9a(cert);
if (imported != YubicoPivReturnCode.YKPIV_OK)
{
doWorkEventArgs.Cancel = true;
_enrollWorkerMessage = $"Unable to import a certificate, return code {imported}";
return;
}
_enrollWorker.ReportProgress(13);
}
// 14 - Create enrolled item
EnrolledYubikey newEnrollment = new EnrolledYubikey();
newEnrollment.DeviceSerial = deviceId;
newEnrollment.Certificate.Serial = cert.SerialNumber;
newEnrollment.Certificate.Thumbprint = cert.Thumbprint;
newEnrollment.Certificate.Subject = cert.Subject;
newEnrollment.Certificate.Issuer = cert.Issuer;
newEnrollment.Certificate.StartDate = cert.NotBefore;
newEnrollment.Certificate.ExpireDate = cert.NotAfter;
newEnrollment.Certificate.RawCertificate = cert.RawData;
newEnrollment.CA = ca;
newEnrollment.Username = user;
newEnrollment.ManagementKey = mgmKey;
newEnrollment.PukKey = puk;
newEnrollment.Chuid = BitConverter.ToString(chuid).Replace("-", "");
newEnrollment.EnrolledAt = DateTime.UtcNow;
newEnrollment.YubikeyVersions.NeoFirmware = neoFirmware;
newEnrollment.YubikeyVersions.PivApplet = pivFirmware.ToString();
_dataStore.Add(newEnrollment);
_enrollWorker.ReportProgress(14);
// 15 - Save store
_dataStore.Save(MainForm.FileStore);
_enrollWorker.ReportProgress(15);
// Report
doWorkEventArgs.Cancel = false;
_enrollWorkerMessage = "Success";
}
}
private void terminateToolStripMenuItem1_Click(object sender, EventArgs e)
{
if (lstItems.SelectedItems.Count <= 0)
{
return;
}
EnrolledYubikey item = lstItems.SelectedItems[0].Tag as EnrolledYubikey;
if (item == null)
{
return;
}
X509Certificate2 currentCert = new X509Certificate2(item.Certificate.RawCertificate);
DialogResult dlgResult = MessageBox.Show("This will terminate the Yubikey, wiping the PIN, PUK, Management Key and Certificates. " +
"This will also revoke the certificate. Proceeed?" + Environment.NewLine + Environment.NewLine +
"Will revoke: " + currentCert.Subject + Environment.NewLine +
"By: " + currentCert.Issuer, "Terminate (WILL revoke)",
MessageBoxButtons.YesNo, MessageBoxIcon.Exclamation, MessageBoxDefaultButton.Button2);
if (dlgResult != DialogResult.Yes)
{
return;
}
DlgPleaseInsertYubikey yubiWaiter = new DlgPleaseInsertYubikey(item);
DialogResult result = yubiWaiter.ShowDialog();
if (result != DialogResult.OK)
{
return;
}
DlgProgress prg = new DlgProgress("Terminating certificate");
prg.WorkerAction = worker =>
{
worker.ReportProgress(20, "Revoking certificate ...");
// Begin
try
{
CertificateUtilities.RevokeCertificate(item.CA, item.Certificate.Serial);
// Revoked
_dataStore.Remove(item);
}
catch (Exception ex)
{
MessageBox.Show(
"Unable to revoke certificate " + item.Certificate.Serial + " of " + item.CA +
" enrolled on " + item.EnrolledAt + ". There was an error." + Environment.NewLine +
Environment.NewLine + ex.Message, "An error occurred.", MessageBoxButtons.OK, MessageBoxIcon.Warning);
return;
}
// Wipe the Yubikey
worker.ReportProgress(50, "Wiping Yubikey ...");
string devName = YubikeyNeoManager.Instance.ListDevices().FirstOrDefault();
bool hasDevice = !string.IsNullOrEmpty(devName);
if (hasDevice)
{
using (YubikeyNeoDevice dev = YubikeyNeoManager.Instance.OpenDevice(devName))
{
int serial = dev.GetSerialNumber();
if (item.DeviceSerial != serial)
{
// Something went seriously wrong - perhaps the user switched keys?
MessageBox.Show("Unable to reset the yubikey. The inserted key did not match the key you wanted to wipe.", "An error occurred.", MessageBoxButtons.OK, MessageBoxIcon.Warning);
return;
}
}
using (YubikeyPivDevice piv = YubikeyPivManager.Instance.OpenDevice(devName))
{
piv.BlockPin();
worker.ReportProgress(70);
piv.BlockPuk();
worker.ReportProgress(90);
bool reset = piv.ResetDevice();
if (!reset)
{
MessageBox.Show("Unable to reset the yubikey. Try resetting it manually.", "An error occurred.", MessageBoxButtons.OK, MessageBoxIcon.Warning);
}
worker.ReportProgress(100);
}
}
// Write to disk
_dataStore.Save(FileStore);
};
prg.ShowDialog();
RefreshUserStore();
RefreshInsertedKey();
}
