-
-
Notifications
You must be signed in to change notification settings - Fork 127
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
2nd attempt for Windows support #70
Comments
Yes and no not really. Yes when comparing it to other operating systems where this would not be needed. Not really when comparing it to the way Windows handles the timeout (open for X seconds but no restriction on how many sessions can be opened with it). An attacker being able to run as many sessions as it wants within 5 seconds after pin entry is not good and (to me) worse than having a FOSS tool cache the PIN. To me it is critical to unlock my Yubikey only for 1 connection/transaction and if that would mean yubikey-agent caches my PIN until that transaction is done, I'm fine with that. |
I took a deeper look today and caching the PIN is easier than I thought. I added a minimal solution to my branch. See 41efb9a ToDo:
Optional:
I would implement it with a new class Any opinion/input is highly appreciated. Especially regarding the security implication of storing the PIN in memory. |
If you use the Windows Crypto API to access the YubiKey PIV section the PIN is asked only once and the timeout ist quite long, if there is one at all. The Windows code is not accessible for me but I think we can safely assume that this can only be done by somehow storing the PIN. Seeing no other opinion here and Microsoft doing a similar approach is good enough for me to move on. During my research I found https://github.com/buptczq/WinCryptSSHAgent which I will use now. I will happily finish the work on this PR but will not contribute long term for a tool I don't use by myself. @FiloSottile I guess it's up to you to decide if you want to have and maintain Windows compatibility for yubikey-agent or not. Feel free to give feedback or just close this issue + MR |
so, reading this, has Windows support been added? README.md says "WIP". |
I would also like to know about this |
Situation
I picked up #29 rebased it on master, took care of the comments in the MR and fixed some minor issues. See #69
I kept small commits for now, so it's easier to follow my changes.
I reached a state where the agent works but got stuck with a problem that blocks me from using it for me.
Problem
Windows has a timeout for smartcard transactions (default: 5 seconds)
This does not play well with yubikey-agent:
There is a registry setting to increase the timeout, but I'm not sure about the side effects and this would only help to mitigate the problem but not solve it.
Idea
Actually I don't like that the card connections are open forever. I can imagine that this might cause other problems, too. I had for example weird things happening when I had the YubiKey Manager open and worked on yubikey-agent. But I was not aware of the timeout at that time, so that might have caused most of the weirdness.
My idea to approach this problem:
Unfortunately I struggle to find a starting point here.
I would be able to spend some time on this but I will need someone to confirm that this is wanted to be implemented and support. At least for general design questions and testing.
The text was updated successfully, but these errors were encountered: