Nitropad-Qubes-U2F-Proxy

Occupy · June 7, 2020, 10:44am

Hi, I have reinstall Qubes official image but not the nitrokey specific image after wrong manipulation with LUKS.
I have no problem in general but it´s impossible to have Nitrokey U2F to work with u2f proxy. I applied this U2F proxy | Qubes OS but nothing work.
Have you get a specific hack on your install ? udev or other in sys-usb ?

jan · June 9, 2020, 3:27pm

By default U2F proxy runs as root (see /etc/qubes-rpc/policy/u2f.{Register,Authenticate} - there should be user=root), so udev rules should not be an issue.

The issue is with u2flib-host library we use there. It includes a whitelist of supported devices and Nitrokey is not there:

github.com

Yubico/python-u2flib-host/blob/master/u2flib_host/hid_transport.py#L40


import os
try:
    import hidraw as hid  # Prefer hidraw
except ImportError:
    import hid
from time import time, sleep
from u2flib_host.device import U2FDevice
from u2flib_host.yubicommon.compat import byte2int, int2byte
from u2flib_host import exc


DEVICES = [
    (0x1050, 0x0200),  # Gnubby
    (0x1050, 0x0113),  # YubiKey NEO U2F
    (0x1050, 0x0114),  # YubiKey NEO OTP+U2F
    (0x1050, 0x0115),  # YubiKey NEO U2F+CCID
    (0x1050, 0x0116),  # YubiKey NEO OTP+U2F+CCID
    (0x1050, 0x0120),  # Security Key by Yubico
    (0x1050, 0x0410),  # YubiKey Plus
    (0x1050, 0x0402),  # YubiKey 4 U2F
    (0x1050, 0x0403),  # YubiKey 4 OTP+U2F
    (0x1050, 0x0406),  # YubiKey 4 U2F+CCID

After adding (0x20a0, 0x42b1) there, it works with Nitrokey FIDO2.

Here is a patch so that later this manual fix won’t be required anymore.

Occupy · June 9, 2020, 9:43pm

Ok to apply this patch but where is that file ?

jan · June 11, 2020, 7:27am

The updated library with those devices included is in current-testing repository already. Will be available as an update in about a week.

jan · June 19, 2020, 8:08am

I understand this issue is closed now and no manual patching required.

szszszsz · June 19, 2020, 8:54am

According to the comment the package is available for stable Fedora 29+ and Debian’s Stretch and Buster.