Module pin

ndn_cert::challenge

Module pin 

Source
Expand description

PIN/OTP challenge — client proves identity by submitting a pre-shared PIN.

The PIN is known to both the CA (pre-provisioned at device manufacture time or via out-of-band admin workflow) and the device operator. It is never stored in plaintext on the CA — only the SHA-256 hash is retained.

§YubiKey HOTP integration

When paired with a YubiKey configured in HOTP mode (slot 2, long-press), this challenge enables secure headless bootstrapping:

  1. Admin provisions the YubiKey HOTP seed via the dashboard (→ ykpersonalize)
  2. YubiKey is plugged into the headless router
  3. Router starts enrollment; enrollment client reads from stdin
  4. Operator presses the YubiKey button → 44-char OTP emitted via USB HID
  5. Enrollment client captures the code and submits it as { "code": "..." }
  6. CA verifies hash → certificate issued

The max_tries limit protects against brute-force; set to 1 for HOTP where each press generates a unique non-replayable code.

Structs§

PinChallenge
NDNCERT PIN/OTP challenge handler.