v1.26.20

v1.26.19

• Explicitely reject compromised emSign intermediary certificates
• Add missing environment variable to error message
• Add v5.0 tag to test matrix
• Do not report CKA_DERIVE as true for EC keys (ECDSA, EdDSA and Brainpool), as NetHSM only supports signing with them
• Set CKA_DECRYPT and CKA_SIGN for RSA keys according to the key mechanisms reported by the NetHSM
• Set CKA_DECRYPT and CKA_SIGN for AES keys according to the key mechanisms reported by the NetHSM

Full Changelog

This is a maintenance release that updates the bundled root certificates to remove the compromised emSign certificate, see GHSA-6q48-6c7w-9gw2.

• Add test for nethsm commands by @AdityaMitra5102 in #805
• NetHSM CLI improvements by @mmerklinger in #809
• Update OpenPGP key for Markus by @robin-nitrokey in #811
• Update dependencies and release v0.14.1 by @robin-nitrokey in #812

Full Changelog: v0.14.0...v0.14.1

v1.26.18

Release v1.26.17

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Fix USB descriptor for compatibility with Windows when using CCID (#708)

• trussed: Add model and revision to status output by @robin-nitrokey in #795
• Allow cryptography <53 by @robin-nitrokey in #798
• Use secrets rather than random to generate secrets by @dirkmueller in #800
• nk3: secret: Make get-password pipe compatible by @symptog in #801
• Fix typo in NetHSM error message by @mmerklinger in #802

• @dirkmueller made their first contribution in #800
• @symptog made their first contribution in #801

Full Changelog: v0.13.0...v0.14.0

• Bump minimum Python version to 3.11.
• Refactor connection handling:
  • Wrap OSError in ConnectionError and CtapError in DeviceError for transport-agnostic error types.
  • Move connection handling into separate classes.
  • Rename TrussedDevice.from_device to TrussedDevice.from_connection.
  • Add TrussedDevice.list classmethod.
  • Add Transport enum.
  • Add TrussedDevice.ctaphid_device function.
  • Change type of TrussedDevice.path to Optional[str]
• Remove support for fido2 v1.

• Add support for credentials import and export in FIDO CXF format.
• nitrokey.trussed.admin_app: Add model and revision to AdminStatus
• nitrokey.trussed: Add the inner_checksum field to FirmwareMetadata with the checksum of the unsigned firmware image.
• nitrokey.checksum: Add unified checksum calculation for both NRF52 and LPC55 firmware files.
• nitrokey.trussed.nrfutils: Add support for NRF52 package signing and upload
• Add vid and pid properties to Model enum.
• nitrokey.nk3.secrets_app: Add register_uri function
• Enable communication with Nitrokey 3 and Nitrokey Passkeys over CCID instead of CTAPHID
  • Add recommended_transport function that indicates when CCID should be prefered. CCID is more limited than CTAPHID, so this functions only recommends CCID on Windows when not an administrator, as CTAPHID is not available in this case.
  • There is a known issue with the model identification over CCID, see issue #147

• nitrokey.nk3.secrets_app: Fix discarded authentication when using SecretsApp over CCID
• Fix SDK version check during firmware update to correctly handle release candidates

• Remove RPM specification file, associated Makefile target, and CI jobs.
• nitrokey.trussed.TrussedBase: Fix type annotations for __exit__ arguments so that all derived classes implement the contextlib.AbstractContextManager protocol.

All Changes

Release v1.25.16

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Add support for revision R2 of the NK3xN using the FM11NT082C NFC chip.
• admin-app:
  • Add model and board revision to status
  • Disable destructive reboot to bootloader
• Update applications (maintenance only):
  • admin-app v0.4.0
  • fido-authenticator v0.3.0
  • opcard v1.10.0
  • piv-authenticator v0.7.0
  • secrets-app v0.16.0

• nitrokey.trussed.admin_app: Add model and revision to AdminStatus

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days