Unpair a client when no available slots

[reynico]

I've been playing with keycard-cli, following this tutorial. Despite I've run the commands always with a keycard-unpair {{ session_pairing_index }} command, the AvailableSlots indicator was in decrease.

Right now the card has no available slots and I have no idea how can I really unpair the slots. As a last resort, I've tried to:

./keycard-cli shell <<END
  keycard-select
  keycard-set-secrets 123 1234 dnaxx
  keycard-open-secure-channel
  keycard-verify-pin {{ session_pin }}
  keycard-unpair {{ session_pairing_index }}
END

but the API returns

cannot open secure channel without setting pairing info

[bitgamma]

if you do not have any pairing slot available, you will need to reset the card. You can find an example script at https://github.com/status-im/keycard-cli/blob/develop/_shell-commands-examples/01-install.sh

You can download the latest applet at https://github.com/status-im/status-keycard/releases. Please adjust the path in the script accordingly. I would also skip the installation of the NDEF applet since it is not really needed (line 13-14 of the script I sent).

I have checked the keycard-unpair command and it seems to work. The problem is that keycard-cli interrupts script execution as it encounters the first error so probably what happened is that the corresponding line was never reached for other reasons.

[reynico]

Thank you! I haven't seen any error messages from keycard-cli during the execution, is there any way to debug that?

[reynico]

The problem is that keycard-cli interrupts script execution as it encounters the first error so probably what happened is that the corresponding line was never reached for other reasons.

I've been able to reproduce it. If the requested command fails, the interrupted execution doesn't free the used slot. Is there any way to change that behavior? It seems quite problematic if somehow you end up out of available slots.

[bitgamma]

a PR would be welcome, but as a workaround you can unpair immediately after PIN authentication instead of the end of the script. Unpairing does not close the active securechannel so you can continue using the card until a reset

[willianpaixao]

@bitgamma you mean like the example below:

keycard-select
keycard-set-secrets 123456 123456789012 KeycardDefaultPairing
keycard-pair

keycard-open-secure-channel
keycard-verify-pin {{ session_pin }}
keycard-unpair {{ session_pairing_index }}

keycard-derive-key m/1/2/3
keycard-sign 0000000000000000000000000000000000000000000000000000000000000000

[bitgamma]

yes

[willianpaixao]

Should I update the files in the _shell folder?

[bitgamma]

sure, thanks!

[willianpaixao]

I hope this helps. #28

[willianpaixao]

But do you agree that long-term solution would be for the automatic unpairing of the device once the slot has been authenticated?

[bitgamma]

thanks for the PR, merged! I'd prefer to avoid adding automatic commands to the CLI and keep the scripts more explicit in their intent. The ability to output (save) pairing is probably a better aproach

[willianpaixao]

Understood, do you think pairingKey and pairingIndex are enough to save and later load a paired slot?
Also, all the changes are restricted to the cli or any refactor is needed in the keycard-go library?

Sorry for the dumb question, the time that would take me to debug and test to find out the answer can be quickly answered by the code's author.

[bitgamma]

yes these two parameters are enough. No changes to the keycard-go library is needed.