Add Kensington VeriMark IT (Synaptics Tudor, 047d:8054) support - #276
Open
Rambomst wants to merge 1 commit into
Open
Add Kensington VeriMark IT (Synaptics Tudor, 047d:8054) support#276Rambomst wants to merge 1 commit into
Rambomst wants to merge 1 commit into
Conversation
The VeriMark IT is a different device family from the Prometheus sensors and needs its own bring-up: * it takes ownership with a 0x93 command carrying a host-generated ECDH key (persisted under /var/lib/python-validity so it survives reboots) instead of the flash-based pairing; * the TLS record layer is AES-256-GCM with a mixed SHA256/SHA384 handshake (CertVerify signs a SHA256 hash, Finished uses a SHA384 PRF); * enroll, on-chip 1:N identify and delete all run on the device, and a match returns only a 16-byte template id, so which user and finger a print belongs to is tracked host-side. tls.py gains an opt-in AES-GCM path plus the SHA384-PRF and mixed-hash Finished hooks; the existing CBC/HMAC path is unchanged (the new behaviour is guarded so it defaults to the old values). tudor.py is the device driver: pairing + GCM bring-up, on-chip enroll/identify/delete (TudorSensor) and a host-side identity store (TudorDb). init.open() dispatches to it for 047d:8054 and specialises the sensor/db singletons in place, so the fprintd dbus-service is unchanged. usb.py and the udev rule register the device. Reconstructed from captured Windows-driver traffic and tested end to end via open-fprintd (fprintd-enroll / fprintd-verify / PAM login) on a real reader.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The VeriMark IT is a different device family from the Prometheus sensors and needs its own bring-up:
tls.py gains an opt-in AES-GCM path plus the SHA384-PRF and mixed-hash Finished hooks; the existing CBC/HMAC path is unchanged (the new behaviour is guarded so it defaults to the old values). tudor.py is the device driver: pairing + GCM bring-up, on-chip enroll/identify/delete (TudorSensor) and a host-side identity store (TudorDb). init.open() dispatches to it for 047d:8054 and specialises the sensor/db singletons in place, so the fprintd dbus-service is unchanged. usb.py and the udev rule register the device.
Reconstructed from captured Windows-driver traffic and tested end to end via open-fprintd (fprintd-enroll / fprintd-verify / PAM login) on a real reader.