feat: v1.12.2

src/cmd_external_sign.rs

@@ -2,7 +2,7 @@ use crate::cmd_sign_jwt::digest_by_jwt_algorithm;
 use crate::keyutil::{parse_key_uri, KeyUri, KeyUsage, YubikeyPivKey};
 use crate::pivutil::ToStr;
 use crate::util::{base64_decode, base64_encode};
-use crate::{cmdutil, pivutil, seutil, util};
+use crate::{cmdutil, ecdsautil, hmacutil, pivutil, seutil, util, yubikeyutil};
 use clap::{App, ArgMatches, SubCommand};
 use jwt::AlgorithmType;
 use rust_util::util_clap::{Command, CommandError};
@@ -10,7 +10,6 @@ use rust_util::XResult;
 use serde_json::Value;
 use std::collections::BTreeMap;
 use yubikey::piv::{sign_data, AlgorithmId};
-use yubikey::YubiKey;
 
 pub struct CommandImpl;
 
@@ -26,6 +25,7 @@ impl Command for CommandImpl {
             .arg(cmdutil::build_parameter_arg())
             .arg(cmdutil::build_message_arg())
             .arg(cmdutil::build_pin_arg())
+            .arg(cmdutil::build_serial_arg())
     }
 
     fn run(&self, _arg_matches: &ArgMatches, sub_arg_matches: &ArgMatches) -> CommandError {
@@ -64,7 +64,7 @@ fn sign(sub_arg_matches: &ArgMatches) -> XResult<Vec<u8>> {
             seutil::secure_enclave_p256_sign(&key.private_key, &message_bytes)
         }
         KeyUri::YubikeyPivKey(key) => {
-            let mut yk = opt_result!(YubiKey::open(), "Find YubiKey failed: {}");
+            let mut yk = yubikeyutil::open_yubikey_with_args(sub_arg_matches)?;
             let pin_opt = pivutil::check_read_pin(&mut yk, key.slot, sub_arg_matches);
 
             // FIXME Check Yubikey slot algorithm
@@ -84,6 +84,28 @@ fn sign(sub_arg_matches: &ArgMatches) -> XResult<Vec<u8>> {
             );
             Ok(signed_data.to_vec())
         }
+        KeyUri::YubikeyHmacEncSoftKey(key) => {
+            let private_key = hmacutil::try_hmac_decrypt_to_string(&key.hmac_enc_private_key)?;
+
+            let p256_private_key_d = ecdsautil::parse_p256_private_key(&private_key).ok();
+            let p384_private_key_d = ecdsautil::parse_p384_private_key(&private_key).ok();
+
+            let (jwt_algorithm, private_key_d) = match (p256_private_key_d, p384_private_key_d) {
+                (Some(p256_private_key_d), None) => (AlgorithmType::Es256, p256_private_key_d),
+                (None, Some(p384_private_key_d)) => (AlgorithmType::Es384, p384_private_key_d),
+                _ => return simple_error!("Invalid private key: {}", private_key),
+            };
+
+            let raw_in = digest_by_jwt_algorithm(jwt_algorithm, &message_bytes)?;
+
+            let signed_data = match jwt_algorithm {
+                AlgorithmType::Es256 => ecdsautil::sign_p256_der(&private_key_d, &raw_in)?,
+                AlgorithmType::Es384 => ecdsautil::sign_p384_der(&private_key_d, &raw_in)?,
+                _ => return simple_error!("SHOULD NOT HAPPEN: {:?}", jwt_algorithm),
+            };
+
+            Ok(signed_data)
+        }
     }
 }