Class YubikeySmartCardBackend

java.lang.Object

org.bouncycastle.openpgp.smartcard.OpenPGPSmartCardBackend<YubikeyOpenPGPSmartCard>

org.bouncycastle.openpgp.smartcard.yubikey.YubikeySmartCardBackend

public class YubikeySmartCardBackend
extends OpenPGPSmartCardBackend<YubikeyOpenPGPSmartCard>

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static interface	YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider

Field Summary

Fields inherited from class OpenPGPSmartCardBackend

SHORTENED_IDENTIFIER_LENGTH, STORED_FINGERPRINT_LENGTH

Constructor Summary

Constructors

Constructor	Description
YubikeySmartCardBackend(com.yubico.yubikit.desktop.YubiKitManager yubiKitManager, org.bouncycastle.openpgp.operator.jcajce.JcaPGPKeyConverter keyConverter, org.bouncycastle.openpgp.operator.jcajce.JcaKeyFingerprintCalculator fingerprintCalculator, YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)

Method Summary

Modifier and Type	Method	Description
YubikeySmartCardBackend	addAllowedCardSerial(Integer number)	Nominate a device serial number this backend is permitted to open.
static YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider	bcImpl()
org.bouncycastle.openpgp.PGPPublicKey	convertPublicKey(com.yubico.yubikit.core.keys.PublicKeyValues pkVal, byte[] storedFingerprint, Date creationTime)	Convert the key from PublicKeyValues into a bare PGPPublicKey, brute-forcing the algorithm id.
static YubikeySmartCardBackend	createInstance()
static YubikeySmartCardBackend	createInstance(com.yubico.yubikit.desktop.YubiKitManager yubiKitManager, org.bouncycastle.jce.provider.BouncyCastleProvider provider, YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
static YubikeySmartCardBackend	createInstance(com.yubico.yubikit.desktop.YubiKitManager yubiKitManager, YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
static YubikeySmartCardBackend	createInstance(YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
String	getName()	Return the name of the backend.
static YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider	jceImpl()
static YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider	jceImpl(Provider provider)	JCE-backed decryptor factory provider drawing its cryptographic primitives from the given JCA provider.
List<YubikeyOpenPGPSmartCard>	listSmartCards()	Return the connected YubiKey devices whose serial number has been allow-listed with addAllowedCardSerial(Integer).
org.bouncycastle.openpgp.operator.PublicKeyDataDecryptorFactory	providePublicKeyDataDecryptorFactory(org.bouncycastle.openpgp.api.OpenPGPKey.OpenPGPSecretKey secretKey, YubikeyOpenPGPSmartCard card, org.bouncycastle.openpgp.api.KeyPassphraseProvider userPinProvider)

Methods inherited from class OpenPGPSmartCardBackend

findSmartCard, fingerprintMatches, providePublicKeyDataDecryptorFactory, shortenedIdentifierForLegacyHardwareMatches, toStoredFingerprint, toStoredFingerprint, toStoredFingerprint

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

YubikeySmartCardBackend

public YubikeySmartCardBackend(com.yubico.yubikit.desktop.YubiKitManager yubiKitManager,
 org.bouncycastle.openpgp.operator.jcajce.JcaPGPKeyConverter keyConverter,
 org.bouncycastle.openpgp.operator.jcajce.JcaKeyFingerprintCalculator fingerprintCalculator,
 YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)

Method Details

createInstance

public static YubikeySmartCardBackend createInstance()

createInstance

public static YubikeySmartCardBackend createInstance(YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)

createInstance

public static YubikeySmartCardBackend createInstance(com.yubico.yubikit.desktop.YubiKitManager yubiKitManager,
 YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)

createInstance

public static YubikeySmartCardBackend createInstance(com.yubico.yubikit.desktop.YubiKitManager yubiKitManager,
 org.bouncycastle.jce.provider.BouncyCastleProvider provider,
 YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider decryptorFactoryProvider)

getName

public String getName()

Description copied from class: OpenPGPSmartCardBackend

Return the name of the backend.

Specified by:

getName in class OpenPGPSmartCardBackend<YubikeyOpenPGPSmartCard>

Returns:

backend name

listSmartCards

public List<YubikeyOpenPGPSmartCard> listSmartCards()
                                             throws CardException

Return the connected YubiKey devices whose serial number has been allow-listed with addAllowedCardSerial(Integer). Devices that have not been allow-listed are never opened, so no APDU is exchanged with a device the caller did not nominate; a backend with an empty allow-list therefore always returns an empty list.

Specified by:

listSmartCards in class OpenPGPSmartCardBackend<YubikeyOpenPGPSmartCard>

Returns:

allow-listed smart cards

Throws:

CardException - if the device layer cannot be queried, or a nominated device cannot be read

providePublicKeyDataDecryptorFactory

public org.bouncycastle.openpgp.operator.PublicKeyDataDecryptorFactory providePublicKeyDataDecryptorFactory(org.bouncycastle.openpgp.api.OpenPGPKey.OpenPGPSecretKey secretKey,
 YubikeyOpenPGPSmartCard card,
 org.bouncycastle.openpgp.api.KeyPassphraseProvider userPinProvider)
                                                                                                     throws org.bouncycastle.openpgp.PGPException

Specified by:

providePublicKeyDataDecryptorFactory in class OpenPGPSmartCardBackend<YubikeyOpenPGPSmartCard>

Throws:

org.bouncycastle.openpgp.PGPException

addAllowedCardSerial

public YubikeySmartCardBackend addAllowedCardSerial(Integer number)

Nominate a device serial number this backend is permitted to open. Nothing is enumerated until at least one serial has been added - see listSmartCards().

Parameters:

number - device serial number

Returns:

this

convertPublicKey

public org.bouncycastle.openpgp.PGPPublicKey convertPublicKey(com.yubico.yubikit.core.keys.PublicKeyValues pkVal,
 byte[] storedFingerprint,
 Date creationTime)
                                                       throws org.bouncycastle.openpgp.PGPException,
NoSuchAlgorithmException,
InvalidKeySpecException

Convert the key from PublicKeyValues into a bare PGPPublicKey, brute-forcing the algorithm id. Brute-forcing is done by comparing the fingerprint of the reconstructed PGP key to the fingerprint stored on the key.

Parameters:

pkVal - Yubikey PublicKeyValues

storedFingerprint - fingerprint as it is stored on the Yubikey device

creationTime - creation time as it is stored on the Yubikey device

Returns:

converted PGP public key

Throws:

org.bouncycastle.openpgp.PGPException - if the key cannot be reconstructed

NoSuchAlgorithmException - if no Provider supports an implementation for the PublicKeyValues algorithm

InvalidKeySpecException - if the PublicKeyValues specification is inappropriate to produce a public key

bcImpl

public static YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider bcImpl()

jceImpl

public static YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider jceImpl()

jceImpl

public static YubikeySmartCardBackend.YubikeyDecryptorFactoryProvider jceImpl(Provider provider)

JCE-backed decryptor factory provider drawing its cryptographic primitives from the given JCA provider.

Parameters:

provider - provider object for cryptographic primitives.

Returns:

decryptor factory provider.