feat: v1.0.7, offline init support yubikey

src/cli.rs

@@ -6,7 +6,7 @@ use clap::{App, Arg, ArgMatches, SubCommand};
 use hyper::body::Buf;
 use hyper::{Body, Client, Method, Request, Response, StatusCode};
 use rust_util::util_clap::{Command, CommandError};
-use rust_util::{debugging, opt_value_result, simple_error, success, XResult};
+use rust_util::{debugging, opt_result, opt_value_result, simple_error, success, XResult};
 use serde_json::{json, Map, Value};
 
 use crate::jose;
@@ -205,6 +205,19 @@ fn do_offline_init(_arg_matches: &ArgMatches<'_>, _sub_arg_matches: &ArgMatches<
     } else if line.starts_with("base64:") {
         let base64: String = line.chars().skip(7).collect();
         STANDARD.decode(&base64)?
+    } else if line.starts_with("LKMS:")   {
+        #[cfg(feature = "yubikey")]
+        {
+            use crate::yubikey_hmac;
+            // Yubikey Hmac encrypted key
+            let challenge = opt_result!(
+                pinentry_util::read_pin(Some("Input yubikey challenge"), Some("Challenge: ")), "Read challenge failed: {}");
+            let derived_key = yubikey_hmac::yubikey_challenge_as_32_bytes(challenge.get_pin().as_bytes())?;
+            let (key, _) = jose::deserialize_jwe_aes(&line, &derived_key)?;
+            key
+        }
+        #[cfg(not(feature = "yubikey"))]
+        return simple_error!("Yubikey feature is not enabled.");
     } else {
         line.as_bytes().to_vec()
     };