VivoKey/otp-import
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add --reset and post-import --set-password; fix algorithm nibble parsing

Browse Source 
Add two admin operations on the OATH protocol layer: --reset (RESET
0x04/0xDEAD) and --set-password, which sets an access password after a
successful import only if the applet has none. Fix _parse_select to mask
the SELECT ALGORITHM tag to its low nibble (the applet reports the full
type|algo byte, e.g. 0x21), which previously broke validate on a locked
applet. Add a clean top-level OathError handler.
This commit is contained in:
Amal Graafstra
2026-07-08 11:38:50 -07:00
parent f8273fc904
commit 602bbc13f7
4 changed files with 130 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
README.md
View File

@@ -45,8 +45,19 @@ python apex_otp_import.py --input ... --skip-existing
# Target a specific reader, supply a password, and profile memory
python apex_otp_import.py --input ... --reader VivoKey --password '...' --profile-memory
# Import, then set an access password (only if the applet has none yet)
python apex_otp_import.py --input ... --set-password 'yourpassword'
# Reset: wipe all credentials and any password (standalone; no input needed)
python apex_otp_import.py --reset
```
Authenticating to a password-protected applet uses the standard YKOATH scheme
(PBKDF2-HMAC-SHA1 of the password with the device id as salt, then mutual
challenge-response). `--set-password` only sets a password on an applet that has
none; it does not change or remove an existing one. `--reset` clears everything.
The input is validated before any reader is touched. Duplicate credential names,
invalid Base32, over-long names/keys, and unsupported algorithms halt the run
with a report so they can be fixed in the source data.