Release v1.26.17

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Fix USB descriptor for compatibility with Windows when using CCID (#708)

• trussed: Add model and revision to status output by @robin-nitrokey in #795
• Allow cryptography <53 by @robin-nitrokey in #798
• Use secrets rather than random to generate secrets by @dirkmueller in #800
• nk3: secret: Make get-password pipe compatible by @symptog in #801
• Fix typo in NetHSM error message by @mmerklinger in #802

• @dirkmueller made their first contribution in #800
• @symptog made their first contribution in #801

Full Changelog: v0.13.0...v0.14.0

• Bump minimum Python version to 3.11.
• Refactor connection handling:
  • Wrap OSError in ConnectionError and CtapError in DeviceError for transport-agnostic error types.
  • Move connection handling into separate classes.
  • Rename TrussedDevice.from_device to TrussedDevice.from_connection.
  • Add TrussedDevice.list classmethod.
  • Add Transport enum.
  • Add TrussedDevice.ctaphid_device function.
  • Change type of TrussedDevice.path to Optional[str]
• Remove support for fido2 v1.

• Add support for credentials import and export in FIDO CXF format.
• nitrokey.trussed.admin_app: Add model and revision to AdminStatus
• nitrokey.trussed: Add the inner_checksum field to FirmwareMetadata with the checksum of the unsigned firmware image.
• nitrokey.checksum: Add unified checksum calculation for both NRF52 and LPC55 firmware files.
• nitrokey.trussed.nrfutils: Add support for NRF52 package signing and upload
• Add vid and pid properties to Model enum.
• nitrokey.nk3.secrets_app: Add register_uri function
• Enable communication with Nitrokey 3 and Nitrokey Passkeys over CCID instead of CTAPHID
  • Add recommended_transport function that indicates when CCID should be prefered. CCID is more limited than CTAPHID, so this functions only recommends CCID on Windows when not an administrator, as CTAPHID is not available in this case.
  • There is a known issue with the model identification over CCID, see issue #147

• nitrokey.nk3.secrets_app: Fix discarded authentication when using SecretsApp over CCID
• Fix SDK version check during firmware update to correctly handle release candidates

• Remove RPM specification file, associated Makefile target, and CI jobs.
• nitrokey.trussed.TrussedBase: Fix type annotations for __exit__ arguments so that all derived classes implement the contextlib.AbstractContextManager protocol.

All Changes

Release v1.25.16

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Add support for revision R2 of the NK3xN using the FM11NT082C NFC chip.
• admin-app:
  • Add model and board revision to status
  • Disable destructive reboot to bootloader
• Update applications (maintenance only):
  • admin-app v0.4.0
  • fido-authenticator v0.3.0
  • opcard v1.10.0
  • piv-authenticator v0.7.0
  • secrets-app v0.16.0

• nitrokey.trussed.admin_app: Add model and revision to AdminStatus

This release is currently in internal testing, signed binaries to be used with nitropy will be uploaded within the next days

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog

This release adds support for the new features provided by NetHSM v4.0 and v5.0.

• models:
  • Split NetworkConfig into NetworkConfigInput and NetworkConfigOutput
  • Add SystemState::Failed variant
• Add response data for error responses
• Add support for key labels (requires NetHSM v5.0):
  • apis::default_api:
    • Add label argument to keys_get, keys_key_prefix_get
    • Add keys_key_id_label_delete, keys_key_id_label_put functions
  • models: Add label field to KeyGenerateRequstData, PrivateKey, PrivateKeyPemArguments and PublicKey

• Add support for clustering (requires NetHSM v4.0):
  • apis::default_api: Add cluster_join_post, cluster_members_get, cluster_members_member_id_delete, cluster_members_member_id_put, cluster_members_post, config_tls_cluster_ca_pem_get, config_tls_cluster_ca_pem_put functions
• Add support for cluster recovery (requires NetHSM v5.0):
  • apis::default_api: Add cluster_force_new_post, cluster_members_member_id_promote_post, health_diagonse_get functions
• Add support for IPv6 network config (requires NetHSM v4.0)
• Add support for NTP config (requires NetHSM v5.0):
  • apis::default_api: Add config_ntp_get, config_ntp_put functions

All Changes

This release adds support for NethHSM v5 and the fido2 provision-credential command, updates the minimum Python version to 3.11 and fixes some bugs.

Note that the default branch for this repository is now main. The master branch will be deleted soon.

• PIV factory-reset: show proper error message when the PIN isn't locked by @sosthene-nitrokey in #771
• Windows versioninfo and version format by @mmerklinger in #774
• pre-registration for entra by @AdityaMitra5102 in #783
• nethsm generate-key: Fix interactive mechanism selection by @robin-nitrokey in #784
• PIV import and PUK fixes by @ABuljko in #766
• fido2: plug some resource leaks in the client by @kevans91 in #781
• Add NetHSM features from Nethsm v3.0.0rc by @AdityaMitra5102 in #787
• Entra provision by @AdityaMitra5102 in #789
• Update clustering features for NetHSM v5.0 and release v0.13.0rc1 by @robin-nitrokey in #788
• Release v0.13.0 by @robin-nitrokey in #793

• @AdityaMitra5102 made their first contribution in #783
• @ABuljko made their first contribution in #766
• @kevans91 made their first contribution in #781

Full Changelog: v0.12.3...v0.13.0

• Return FullClusterJoinData instead of ClusterJoinData from add_cluster_member (requires NetHSM v5)

• Update for NetHSM v5:
  • Add State.FAILED variant
  • Update clustering functionality:
    • Add FullClusterJoinData, ClusterDiagnostics, ClusterLogItem, ClusterState and ClusterSnapshot classes
    • Change NetHSM.join_cluster to also accept FullClusterJoinData
    • Add force_new_cluster, get_cluster_diagnostics, promote_cluster_member functions to NetHSM
    • Add learner field to ClusterMember
  • Add support for key labels:
    • Add label argument to add_key, add_key_pem, generate_key, list_keys functions
    • Add NetHSM.set_key_label function
    • Add optional label field to Key
  • Add support for NTP configuration:
    • Add NtpConfig class
    • Add get_config_ntp, set_ntp_config functions to NetHSM

All Changes

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog