Support longer PINs about nitrokey-pro-firmware HOT 4 OPEN

@szszszsz So Heads now makes sure that PINs are <= 25 characters

from nitrokey-pro-firmware.

@szszszsz Was this corrected in newer firmware versions?
Seems like this is present to firmware 0.9 0.10 and 0.11 and impacts linuxboot/heads#1167 which doesn't report any error when setting the PIN, but fails at HOTP sealing with Admin PIN.

I didn't meet this limitation in my tests with "Insurgo Open Technologies" which is 25 chars. But 26 chars+ < 32 fails...

from nitrokey-pro-firmware.

@szszszsz @jans23: the firmware (0.9, 0.10, 0.11) permits longer PINs to be provisioned (up to 64?)
But HOTP sealing (Heads) only works when provided with GPG Admin PIN <=25 chars.

linuxboot/heads#1168 circumvents this firmware issue under Heads OEM Factory Reset/Re-Ownership security components provisioning (forcing GPG Admin PIN <=25 chars and GPG User PIN <=64 chars) for all USB Security dongles, also limiting custom passphrase (which is propagated to all security components, including GPG Admin PIN) to be <=25 characters as well to circumvent this issue.

Whatever happens with this issue won't make us go back in time for Nitrokey Pro devices which aren't user upgradeable, so fixing this results in some kind of limitation for all USB Security dongles to be provisioned/used under Heads.

As of now, Heads master only limited the minimum size of the PIN to be 8 chars, not enforcing this known limitation (which is not 20 chars, but 25. Why 25, not 20, is another topic).

from nitrokey-pro-firmware.

Hi @tlaurion! Sorry for the delay.

1. Indeed the protocol used is limited to 20-25 characters for the PIN length, depending on the command. Thank you for adding this check.
2. This problem is still present in the current Nitrokey Pro firmware unfortunately.
3. As for the solution we could:
   • fix this problem in the current Nitrokey Pro firmware,
   • add support to the nitrokey-hotp-verification for this change (selecting protocol by the firmware version), and
   • leave the check from the mentioned PR only for the non-upgradable older versions, which are <= 0.10.

from nitrokey-pro-firmware.