update libcryptsetup-rs

handle tokens when replacing
assemble secret in correct order
2020-06-10 13:50:28 +02:00 · 2020-06-08 19:22:19 +02:00 · 2020-06-08 18:08:24 +02:00 · 2020-06-07 14:14:51 +02:00 · 2020-06-06 23:39:23 +02:00 · 2020-06-06 23:37:22 +02:00
9 changed files with 659 additions and 306 deletions
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -55,9 +55,9 @@ dependencies = [

 [[package]]
 name = "backtrace-sys"
-version = "0.1.35"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7de8aba10a69c8e8d7622c5710229485ec32e9d55fdad160ea559c086fdcd118"
+checksum = "78848718ee1255a2485d1309ad9cdecfc2e7d0362dd11c6829364c6b35ae1bc7"
 dependencies = [
 "cc",
 "libc",
@@ -111,9 +111,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.0.50"
+version = "1.0.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95e28fa049fda1c330bcf9d723be7663a899c4679724b34c81e9f5a326aab8cd"
+checksum = "c3d87b23d6a92cd03af510a5ade527033f6aa6fa92161e2d5863a907d4c5e31d"

 [[package]]
 name = "cexpr"
@@ -247,9 +247,9 @@ dependencies = [

 [[package]]
 name = "ctap_hmac"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b22457233b74539c53c10658eb3effb7c3d50907276dab6b5fbd8391d2b4351"
+checksum = "c5fec79b66e3a7bc6a7ace0f4c98f0748892b36d3c5c317fadfce0344fd185dc"
 dependencies = [
 "byteorder",
 "cbor-codec",
@@ -287,7 +287,7 @@ dependencies = [
 "proc-macro2 1.0.10",
 "quote 1.0.3",
 "strsim 0.9.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 ]

 [[package]]
@@ -298,7 +298,7 @@ checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
 dependencies = [
 "darling_core",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 ]

 [[package]]
@@ -311,7 +311,7 @@ dependencies = [
 "derive_builder_core",
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 ]

 [[package]]
@@ -323,7 +323,7 @@ dependencies = [
 "darling",
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 ]

 [[package]]
@@ -363,13 +363,13 @@ checksum = "030a733c8287d6213886dd487564ff5c8f6aae10278b3588ed177f9d18f8d231"
 dependencies = [
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 "synstructure",
 ]

 [[package]]
 name = "fido2luks"
-version = "0.2.6"
+version = "0.2.8"
 dependencies = [
 "ctap_hmac",
 "failure",
@@ -377,6 +377,9 @@ dependencies = [
 "libcryptsetup-rs",
 "ring",
 "rpassword",
+ "serde",
+ "serde_derive",
+ "serde_json",
 "structopt",
 ]

@@ -415,9 +418,9 @@ dependencies = [

 [[package]]
 name = "hermit-abi"
-version = "0.1.10"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "725cf19794cf90aa94e65050cb4191ff5d8fa87a498383774c47b332e3af952e"
+checksum = "61565ff7aaace3525556587bd2dc31d4a07071957be715e63ce7b1eccf51a8f4"
 dependencies = [
 "libc",
 ]
@@ -463,20 +466,21 @@ checksum = "b294d6fa9ee409a054354afc4352b0b9ef7ca222c69b8812cbea9e7d2bf3783f"

 [[package]]
 name = "libc"
-version = "0.2.68"
+version = "0.2.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea0c0405123bba743ee3f91f49b1c7cfb684eef0da0a50110f758ccf24cdff0"
+checksum = "99e85c08494b21a9054e7fe1374a732aeadaff3980b6990b94bfd3a70f690005"

 [[package]]
 name = "libcryptsetup-rs"
-version = "0.2.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0177fd0ec022a5adb247e13e3238309913c28102a811227ad5de6a55697f152"
+checksum = "38cd24132ee0239515bc895782f65ab3e382a0f78e7cee30417159e5c6f81b6b"
 dependencies = [
 "either",
 "libc",
 "libcryptsetup-rs-sys",
 "pkg-config",
+ "semver",
 "serde_json",
 "uuid",
 ]
@@ -577,26 +581,26 @@ checksum = "05da548ad6865900e60eaba7f589cc0783590a92e940c26953ff81ddbab2d677"

 [[package]]
 name = "proc-macro-error"
-version = "0.4.12"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18f33027081eba0a6d8aba6d1b1c3a3be58cbb12106341c2d5759fcd9b5277e7"
+checksum = "98e9e4b82e0ef281812565ea4751049f1bdcdfccda7d3f459f2e138a40c08678"
 dependencies = [
 "proc-macro-error-attr",
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 "version_check",
 ]

 [[package]]
 name = "proc-macro-error-attr"
-version = "0.4.12"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a5b4b77fdb63c1eca72173d68d24501c54ab1269409f6b672c85deb18af69de"
+checksum = "4f5444ead4e9935abd7f27dc51f7e852a0569ac888096d5ec2499470794e2e53"
 dependencies = [
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 "syn-mid",
 "version_check",
 ]
@@ -781,17 +785,11 @@ dependencies = [
 "rand_core 0.3.1",
 ]

-[[package]]
-name = "redox_syscall"
-version = "0.1.56"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2439c63f3f6139d1b57529d16bc3b8bb855230c8efcc5d3a896c8bea7c3b1e84"
-
 [[package]]
 name = "regex"
-version = "1.3.6"
+version = "1.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f6946991529684867e47d86474e3a6d0c0ab9b82d5821e314b1ede31fa3a4b3"
+checksum = "a6020f034922e3194c711b82a627453881bc4682166cabb07134a10c26ba7692"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -860,9 +858,9 @@ checksum = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda"

 [[package]]
 name = "ryu"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535622e6be132bccd223f4bb2b8ac8d53cda3c7a6394944d3b2b33fb974f9d76"
+checksum = "ed3d612bc64430efeb3f7ee6ef26d590dce0c43249217bddc62112540c7941e1"

 [[package]]
 name = "scopeguard"
@@ -891,6 +889,17 @@ version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "36df6ac6412072f67cf767ebbde4133a5b2e88e76dc6187fa7104cd16f783399"

+[[package]]
+name = "serde_derive"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e549e3abf4fb8621bd1609f11dfc9f5e50320802273b12f3811a67e6716ea6c"
+dependencies = [
+ "proc-macro2 1.0.10",
+ "quote 1.0.3",
+ "syn 1.0.18",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.51"
@@ -922,9 +931,9 @@ checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"

 [[package]]
 name = "structopt"
-version = "0.3.12"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8faa2719539bbe9d77869bfb15d4ee769f99525e707931452c97b693b3f159d"
+checksum = "863246aaf5ddd0d6928dfeb1a9ca65f505599e4e1b399935ef7e75107516b4ef"
 dependencies = [
 "clap",
 "lazy_static",
@@ -933,15 +942,15 @@ dependencies = [

 [[package]]
 name = "structopt-derive"
-version = "0.4.5"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f88b8e18c69496aad6f9ddf4630dd7d585bcaf765786cb415b9aec2fe5a0430"
+checksum = "d239ca4b13aee7a2142e6795cbd69e457665ff8037aed33b3effdc430d2f927a"
 dependencies = [
 "heck",
 "proc-macro-error",
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 ]

 [[package]]
@@ -957,9 +966,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0df0eb663f387145cab623dea85b09c2c5b4b0aef44e945d928e682fce71bb03"
+checksum = "410a7488c0a728c7ceb4ad59b9567eb4053d02e8cc7f5c0e0eeeb39518369213"
 dependencies = [
 "proc-macro2 1.0.10",
 "quote 1.0.3",
@@ -974,7 +983,7 @@ checksum = "7be3539f6c128a931cf19dcee741c1af532c7fd387baa739c03dd2e96479338a"
 dependencies = [
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 ]

 [[package]]
@@ -985,7 +994,7 @@ checksum = "67656ea1dc1b41b1451851562ea232ec2e5a80242139f7e679ceccfb5d61f545"
 dependencies = [
 "proc-macro2 1.0.10",
 "quote 1.0.3",
- "syn 1.0.17",
+ "syn 1.0.18",
 "unicode-xid 0.2.0",
 ]

@@ -1018,12 +1027,11 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.1.42"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db8dcfca086c1143c9270ac42a2bbd8a7ee477b78ac8e45b19abfb0cbede4b6f"
+checksum = "ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438"
 dependencies = [
 "libc",
- "redox_syscall",
 "winapi",
 ]

@@ -1105,9 +1113,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"

 [[package]]
 name = "winapi-util"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa515c5163a99cc82bab70fd3bfdd36d827be85de63737b40fcef2ce084a436e"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
 dependencies = [
 "winapi",
 ]
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fido2luks"
-version = "0.2.6"
+version = "0.2.8"
 authors = ["shimunn <shimun@shimun.net>"]
 edition = "2018"

@@ -14,13 +14,16 @@ categories = ["command-line-utilities"]
 license-file = "LICENSE"

 [dependencies]
-ctap_hmac = { version="0.4.1", features = ["request_multiple"] }
+ctap_hmac = { version="0.4.2", features = ["request_multiple"] }
 hex = "0.3.2"
 ring = "0.13.5"
 failure = "0.1.5"
 rpassword = "4.0.1"
 structopt = "0.3.2"
-libcryptsetup-rs = "0.2.0"
+libcryptsetup-rs = "0.4.1"
+serde_json = "1.0.51"
+serde_derive = "1.0.106"
+serde = "1.0.106"

 [profile.release]
 lto = true
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -12,7 +12,8 @@ use std::io::Write;
 use std::process::exit;
 use std::thread;

-use crate::util::read_password;
+use crate::util::sha256;
+use std::borrow::Cow;
 use std::time::SystemTime;

 #[derive(Debug, Eq, PartialEq, Clone)]
@@ -57,19 +58,48 @@ impl<T: Display + FromStr> FromStr for CommaSeparated<T> {
 }

 #[derive(Debug, StructOpt)]
-pub struct Args {
-    /// Request passwords via Stdin instead of using the password helper
-    #[structopt(short = "i", long = "interactive")]
-    pub interactive: bool,
-    #[structopt(subcommand)]
-    pub command: Command,
+pub struct Credentials {
+    /// FIDO credential ids, seperated by ',' generate using fido2luks credential
+    #[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
+    pub ids: CommaSeparated<HexEncoded>,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct AuthenticatorParameters {
+    /// Request a PIN to unlock the authenticator
+    #[structopt(short = "P", long = "pin")]
+    pub pin: bool,
+
+    /// Await for an authenticator to be connected, timeout after n seconds
+    #[structopt(
+        long = "await-dev",
+        name = "await-dev",
+        env = "FIDO2LUKS_DEVICE_AWAIT",
+        default_value = "15"
+    )]
+    pub await_time: u64,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct LuksParameters {
+    #[structopt(env = "FIDO2LUKS_DEVICE")]
+    device: PathBuf,
+
+    /// Try to unlock the device using a specifc keyslot, ignore all other slots
+    #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
+    slot: Option<u32>,
 }

 #[derive(Debug, StructOpt, Clone)]
-pub struct SecretGeneration {
-    /// FIDO credential ids, seperated by ',' generate using fido2luks credential
-    #[structopt(name = "credential-id", env = "FIDO2LUKS_CREDENTIAL_ID")]
-    pub credential_ids: CommaSeparated<HexEncoded>,
+pub struct LuksModParameters {
+    /// Number of milliseconds required to derive the volume decryption key
+    /// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
+    #[structopt(long = "kdf-time", name = "kdf-time")]
+    kdf_time: Option<u64>,
+}
+
+#[derive(Debug, StructOpt)]
+pub struct SecretParameters {
    /// Salt for secret generation, defaults to 'ask'
    ///
    /// Options:{n}
@@ -90,87 +120,55 @@ pub struct SecretGeneration {
        default_value = "/usr/bin/env systemd-ask-password 'Please enter second factor for LUKS disk encryption!'"
    )]
    pub password_helper: PasswordHelper,
-
-    /// Await for an authenticator to be connected, timeout after n seconds
-    #[structopt(
-        long = "await-dev",
-        name = "await-dev",
-        env = "FIDO2LUKS_DEVICE_AWAIT",
-        default_value = "15"
-    )]
-    pub await_authenticator: u64,
-
-    /// Request the password twice to ensure it being correct
-    #[structopt(
-        long = "verify-password",
-        env = "FIDO2LUKS_VERIFY_PASSWORD",
-        hidden = true
-    )]
-    pub verify_password: Option<bool>,
 }

-impl SecretGeneration {
-    pub fn patch(&self, args: &Args, verify_password: Option<bool>) -> Self {
-        let mut me = self.clone();
-        if args.interactive {
-            me.password_helper = PasswordHelper::Stdin;
+fn derive_secret(
+    credentials: &[HexEncoded],
+    salt: &[u8; 32],
+    timeout: u64,
+    pin: Option<&str>,
+) -> Fido2LuksResult<([u8; 32], FidoCredential)> {
+    let timeout = Duration::from_secs(timeout);
+    let start = SystemTime::now();
+
+    while let Ok(el) = start.elapsed() {
+        if el > timeout {
+            return Err(error::Fido2LuksError::NoAuthenticatorError);
        }
-        me.verify_password = me.verify_password.or(verify_password);
-        me
+        if get_devices()
+            .map(|devices| !devices.is_empty())
+            .unwrap_or(false)
+        {
+            break;
+        }
+        thread::sleep(Duration::from_millis(500));
    }

-    pub fn obtain_secret(&self, password_query: &str) -> Fido2LuksResult<[u8; 32]> {
-        let mut salt = [0u8; 32];
-        match self.password_helper {
-            PasswordHelper::Stdin if !self.verify_password.unwrap_or(true) => {
-                salt.copy_from_slice(&util::sha256(&[&read_password(
-                    password_query,
-                    self.verify_password.unwrap_or(true),
-                )?
-                .as_bytes()[..]]));
-            }
-            _ => {
-                salt = self.salt.obtain(&self.password_helper)?;
-            }
-        }
-        let timeout = Duration::from_secs(self.await_authenticator);
-        let start = SystemTime::now();
+    let credentials = credentials
+        .iter()
+        .map(|hex| FidoCredential {
+            id: hex.0.clone(),
+            public_key: None,
+        })
+        .collect::<Vec<_>>();
+    let credentials = credentials.iter().collect::<Vec<_>>();
+    let (unsalted, cred) =
+        perform_challenge(&credentials, salt, timeout - start.elapsed().unwrap(), pin)?;

-        while let Ok(el) = start.elapsed() {
-            if el > timeout {
-                Err(error::Fido2LuksError::NoAuthenticatorError)?;
-            }
-            if get_devices()
-                .map(|devices| !devices.is_empty())
-                .unwrap_or(false)
-            {
-                break;
-            }
-            thread::sleep(Duration::from_millis(500));
-        }
-        let credentials = &self
-            .credential_ids
-            .0
-            .iter()
-            .map(|HexEncoded(id)| FidoCredential {
-                id: id.to_vec(),
-                public_key: None,
-            })
-            .collect::<Vec<_>>();
-        let credentials = credentials.iter().collect::<Vec<_>>();
-        Ok(assemble_secret(
-            &perform_challenge(&credentials[..], &salt, timeout - start.elapsed().unwrap())?,
-            &salt,
-        ))
-    }
+    Ok((sha256(&[salt, &unsalted[..]]), cred.clone()))
 }

-#[derive(Debug, StructOpt, Clone)]
-pub struct LuksSettings {
-    /// Number of milliseconds required to derive the volume decryption key
-    /// Defaults to 10ms when using an authenticator or the default by cryptsetup when using a password
-    #[structopt(long = "kdf-time", name = "kdf-time")]
-    kdf_time: Option<u64>,
+fn read_pin() -> Fido2LuksResult<String> {
+    util::read_password("Authenticator PIN", false)
+}
+
+#[derive(Debug, StructOpt)]
+pub struct Args {
+    /// Request passwords via Stdin instead of using the password helper
+    #[structopt(short = "i", long = "interactive")]
+    pub interactive: bool,
+    #[structopt(subcommand)]
+    pub command: Command,
 }

 #[derive(Debug, StructOpt, Clone)]
@@ -184,24 +182,6 @@ pub struct OtherSecret {
    fido_device: bool,
 }

-impl OtherSecret {
-    pub fn obtain(
-        &self,
-        secret_gen: &SecretGeneration,
-        verify_password: bool,
-        password_question: &str,
-    ) -> Fido2LuksResult<Vec<u8>> {
-        match &self.keyfile {
-            Some(keyfile) => util::read_keyfile(keyfile.clone()),
-            None if self.fido_device => {
-                Ok(Vec::from(&secret_gen.obtain_secret(password_question)?[..]))
-            }
-            None => util::read_password(password_question, verify_password)
-                .map(|p| p.as_bytes().to_vec()),
-        }
-    }
-}
-
 #[derive(Debug, StructOpt)]
 pub enum Command {
    #[structopt(name = "print-secret")]
@@ -210,53 +190,91 @@ pub enum Command {
        #[structopt(short = "b", long = "bin")]
        binary: bool,
        #[structopt(flatten)]
-        secret_gen: SecretGeneration,
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
    },
    /// Adds a generated key to the specified LUKS device
    #[structopt(name = "add-key")]
    AddKey {
-        #[structopt(env = "FIDO2LUKS_DEVICE")]
-        device: PathBuf,
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
        /// Will wipe all other keys
        #[structopt(short = "e", long = "exclusive")]
        exclusive: bool,
+        /// Will add an token to your LUKS 2 header, including the credential id
+        #[structopt(short = "t", long = "token")]
+        token: bool,
        #[structopt(flatten)]
        existing_secret: OtherSecret,
        #[structopt(flatten)]
-        secret_gen: SecretGeneration,
-        #[structopt(flatten)]
-        luks_settings: LuksSettings,
+        luks_mod: LuksModParameters,
    },
    /// Replace a previously added key with a password
    #[structopt(name = "replace-key")]
    ReplaceKey {
-        #[structopt(env = "FIDO2LUKS_DEVICE")]
-        device: PathBuf,
+        #[structopt(flatten)]
+        luks: LuksParameters,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
        /// Add the password and keep the key
        #[structopt(short = "a", long = "add-password")]
        add_password: bool,
+        /// Will add an token to your LUKS 2 header, including the credential id
+        #[structopt(short = "t", long = "token")]
+        token: bool,
        #[structopt(flatten)]
        replacement: OtherSecret,
        #[structopt(flatten)]
-        secret_gen: SecretGeneration,
-        #[structopt(flatten)]
-        luks_settings: LuksSettings,
+        luks_mod: LuksModParameters,
    },
    /// Open the LUKS device
    #[structopt(name = "open")]
    Open {
-        #[structopt(env = "FIDO2LUKS_DEVICE")]
-        device: PathBuf,
+        #[structopt(flatten)]
+        luks: LuksParameters,
        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
        name: String,
+        #[structopt(flatten)]
+        credentials: Credentials,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
        #[structopt(short = "r", long = "max-retries", default_value = "0")]
        retries: i32,
+    },
+    /// Open the LUKS device using credentials embedded in the LUKS 2 header
+    #[structopt(name = "open-token")]
+    OpenToken {
        #[structopt(flatten)]
-        secret_gen: SecretGeneration,
+        luks: LuksParameters,
+        #[structopt(env = "FIDO2LUKS_MAPPER_NAME")]
+        name: String,
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
+        #[structopt(flatten)]
+        secret: SecretParameters,
+        #[structopt(short = "r", long = "max-retries", default_value = "0")]
+        retries: i32,
    },
    /// Generate a new FIDO credential
    #[structopt(name = "credential")]
    Credential {
+        #[structopt(flatten)]
+        authenticator: AuthenticatorParameters,
        /// Name to be displayed on the authenticator if it has a display
        #[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME")]
        name: Option<String>,
@@ -273,104 +291,242 @@ pub fn parse_cmdline() -> Args {
 pub fn run_cli() -> Fido2LuksResult<()> {
    let mut stdout = io::stdout();
    let args = parse_cmdline();
+    let interactive = args.interactive;
    match &args.command {
-        Command::Credential { name } => {
-            let cred = make_credential_id(name.as_ref().map(|n| n.as_ref()))?;
+        Command::Credential {
+            authenticator,
+            name,
+        } => {
+            let pin_string;
+            let pin = if authenticator.pin {
+                pin_string = read_pin()?;
+                Some(pin_string.as_ref())
+            } else {
+                None
+            };
+            let cred = make_credential_id(name.as_ref().map(|n| n.as_ref()), pin)?;
            println!("{}", hex::encode(&cred.id));
            Ok(())
        }
        Command::PrintSecret {
            binary,
-            ref secret_gen,
+            authenticator,
+            credentials,
+            secret,
        } => {
-            let secret = secret_gen
-                .patch(&args, Some(false))
-                .obtain_secret("Password")?;
-            if *binary {
-                stdout.write(&secret[..])?;
+            let pin_string;
+            let pin = if authenticator.pin {
+                pin_string = read_pin()?;
+                Some(pin_string.as_ref())
            } else {
-                stdout.write(hex::encode(&secret[..]).as_bytes())?;
+                None
+            };
+            let salt = if interactive || secret.password_helper == PasswordHelper::Stdin {
+                util::read_password_hashed("Password", false)
+            } else {
+                secret.salt.obtain(&secret.password_helper)
+            }?;
+            let (secret, _cred) = derive_secret(
+                credentials.ids.0.as_slice(),
+                &salt,
+                authenticator.await_time,
+                pin,
+            )?;
+            if *binary {
+                stdout.write_all(&secret[..])?;
+            } else {
+                stdout.write_all(hex::encode(&secret[..]).as_bytes())?;
            }
            Ok(stdout.flush()?)
        }
        Command::AddKey {
-            device,
-            exclusive,
-            existing_secret,
-            ref secret_gen,
-            luks_settings,
-        } => {
-            let secret_gen = secret_gen.patch(&args, None);
-            let old_secret = existing_secret.obtain(&secret_gen, false, "Existing password")?;
-            let secret = secret_gen.obtain_secret("Password")?;
-            let added_slot = luks::add_key(
-                device.clone(),
-                &secret,
-                &old_secret[..],
-                luks_settings.kdf_time.or(Some(10)),
-            )?;
-            if *exclusive {
-                let destroyed = luks::remove_keyslots(&device, &[added_slot])?;
-                println!(
-                    "Added to key to device {}, slot: {}\nRemoved {} old keys",
-                    device.display(),
-                    added_slot,
-                    destroyed
-                );
-            } else {
-                println!(
-                    "Added to key to device {}, slot: {}",
-                    device.display(),
-                    added_slot
-                );
-            }
-            Ok(())
+            luks,
+            authenticator,
+            credentials,
+            secret,
+            luks_mod,
+            existing_secret: other_secret,
+            token,
+            ..
        }
-        Command::ReplaceKey {
-            device,
-            add_password,
-            replacement,
-            ref secret_gen,
-            luks_settings,
+        | Command::ReplaceKey {
+            luks,
+            authenticator,
+            credentials,
+            secret,
+            luks_mod,
+            replacement: other_secret,
+            token,
+            ..
        } => {
-            let secret_gen = secret_gen.patch(&args, Some(false));
-            let secret = secret_gen.obtain_secret("Password")?;
-            let new_secret = replacement.obtain(&secret_gen, true, "Replacement password")?;
-            let slot = if *add_password {
-                luks::add_key(device, &new_secret[..], &secret, luks_settings.kdf_time)
+            let pin = if authenticator.pin {
+                Some(read_pin()?)
            } else {
-                luks::replace_key(device, &new_secret[..], &secret, luks_settings.kdf_time)
-            }?;
-            println!(
-                "Added to password to device {}, slot: {}",
-                device.display(),
-                slot
-            );
-            Ok(())
+                None
+            };
+            let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
+                if interactive || secret.password_helper == PasswordHelper::Stdin {
+                    util::read_password_hashed(q, verify)
+                } else {
+                    secret.salt.obtain(&secret.password_helper)
+                }
+            };
+            let other_secret = |salt_q: &str, verify: bool| -> Fido2LuksResult<(Vec<u8>, Option<FidoCredential>)> {
+                match other_secret {
+                    OtherSecret {
+                        keyfile: Some(file),
+                        ..
+                    } => Ok((util::read_keyfile(file)?, None)),
+                    OtherSecret {
+                        fido_device: true, ..
+                    } => Ok(derive_secret(
+                        &credentials.ids.0,
+                        &salt(salt_q, verify)?,
+                        authenticator.await_time,
+                        pin.as_deref(),
+                    )
+                    .map(|(secret, cred)| (secret[..].to_vec(), Some(cred)))?),
+                    _ => Ok((util::read_password(salt_q, verify)?.as_bytes().to_vec(), None)),
+                }
+            };
+            let secret = |verify: bool| -> Fido2LuksResult<([u8; 32], FidoCredential)> {
+                derive_secret(
+                    &credentials.ids.0,
+                    &salt("Password", verify)?,
+                    authenticator.await_time,
+                    pin.as_deref(),
+                )
+            };
+            // Non overlap
+            match &args.command {
+                Command::AddKey {
+                    exclusive,  ..
+                } => {
+                    let (existing_secret, _) = other_secret("Current password", false)?;
+                    let (new_secret, cred) = secret(true)?;
+                    let added_slot = luks::add_key(
+                        &luks.device,
+                        &new_secret,
+                        &existing_secret[..],
+                        luks_mod.kdf_time.or(Some(10)),
+                        Some(&cred.id[..]).filter(|_| *token),
+                    )?;
+                    if *exclusive {
+                        let destroyed = luks::remove_keyslots(&luks.device, &[added_slot])?;
+                        println!(
+                            "Added to key to device {}, slot: {}\nRemoved {} old keys",
+                            luks.device.display(),
+                            added_slot,
+                            destroyed
+                        );
+                    } else {
+                        println!(
+                            "Added to key to device {}, slot: {}",
+                            luks.device.display(),
+                            added_slot
+                        );
+                    }
+                    Ok(())
+                }
+                Command::ReplaceKey { add_password, .. } => {
+                    let (existing_secret, _) = secret(false)?;
+                    let (replacement_secret, cred) = other_secret("Replacement password", true)?;
+                    let slot = if *add_password {
+                        luks::add_key(
+                            &luks.device,
+                            &replacement_secret[..],
+                            &existing_secret,
+                            luks_mod.kdf_time,
+                            cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
+                        )
+                    } else {
+                        luks::replace_key(
+                            &luks.device,
+                            &replacement_secret[..],
+                            &existing_secret,
+                            luks_mod.kdf_time,
+                            cred.as_ref().filter(|_| *token).map(|cred| &cred.id[..]),
+                        )
+                    }?;
+                    println!(
+                        "Added to password to device {}, slot: {}",
+                        luks.device.display(),
+                        slot
+                    );
+                    Ok(())
+                }
+                _ => unreachable!(),
+            }
        }
        Command::Open {
-            device,
+            luks,
+            authenticator,
+            secret,
+            name,
+            retries,
+            ..
+        }
+        | Command::OpenToken {
+            luks,
+            authenticator,
+            secret,
            name,
            retries,
-            ref secret_gen,
        } => {
+            let pin_string;
+            let pin = if authenticator.pin {
+                pin_string = read_pin()?;
+                Some(pin_string.as_ref())
+            } else {
+                None
+            };
+            let salt = |q: &str, verify: bool| -> Fido2LuksResult<[u8; 32]> {
+                if interactive || secret.password_helper == PasswordHelper::Stdin {
+                    util::read_password_hashed(q, verify)
+                } else {
+                    secret.salt.obtain(&secret.password_helper)
+                }
+            };
+
+            // Cow shouldn't be necessary
+            let secret = |credentials: Cow<'_, Vec<HexEncoded>>| {
+                derive_secret(
+                    credentials.as_ref(),
+                    &salt("Password", false)?,
+                    authenticator.await_time,
+                    pin,
+                )
+            };
+
            let mut retries = *retries;
            loop {
-                match secret_gen
-                    .patch(&args, Some(false))
-                    .obtain_secret("Password")
-                    .and_then(|secret| luks::open_container(&device, &name, &secret))
-                {
+                let secret = match &args.command {
+                    Command::Open { credentials, .. } => secret(Cow::Borrowed(&credentials.ids.0))
+                        .and_then(|(secret, _cred)| {
+                            luks::open_container(&luks.device, &name, &secret, luks.slot)
+                        }),
+                    Command::OpenToken { .. } => luks::open_container_token(
+                        &luks.device,
+                        &name,
+                        Box::new(|credentials: Vec<String>| {
+                            let creds = credentials
+                                .into_iter()
+                                .flat_map(|cred| HexEncoded::from_str(cred.as_ref()).ok())
+                                .collect::<Vec<_>>();
+                            secret(Cow::Owned(creds))
+                                .map(|(secret, cred)| (secret, hex::encode(&cred.id)))
+                        }),
+                    ),
+                    _ => unreachable!(),
+                };
+                match secret {
                    Err(e) => {
                        match e {
-                            Fido2LuksError::WrongSecret if retries > 0 => (),
+                            Fido2LuksError::WrongSecret if retries > 0 => {}
                            Fido2LuksError::AuthenticatorError { ref cause }
-                                if cause.kind() == FidoErrorKind::Timeout && retries > 0 =>
-                            {
-                                ()
-                            }
+                                if cause.kind() == FidoErrorKind::Timeout && retries > 0 => {}

-                            e => break Err(e)?,
+                            e => return Err(e),
                        }
                        retries -= 1;
                        eprintln!("{}", e);
--- a/src/config.rs
+++ b/src/config.rs
@@ -24,7 +24,7 @@ impl Default for InputSalt {

 impl From<&str> for InputSalt {
    fn from(s: &str) -> Self {
-        let mut parts = s.split(":").into_iter();
+        let mut parts = s.split(':');
        match parts.next() {
            Some("ask") | Some("Ask") => InputSalt::AskPassword,
            Some("file") => InputSalt::File {
@@ -84,9 +84,10 @@ impl InputSalt {
    }
 }

-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum PasswordHelper {
    Script(String),
+    #[allow(dead_code)]
    Systemd,
    Stdin,
 }
@@ -134,7 +135,7 @@ impl PasswordHelper {
            Systemd => unimplemented!(),
            Stdin => Ok(util::read_password("Password", true)?),
            Script(password_helper) => {
-                let mut helper_parts = password_helper.split(" ");
+                let mut helper_parts = password_helper.split(' ');

                let password = Command::new((&mut helper_parts).next().unwrap())
                    .args(helper_parts)
--- a/src/device.rs
+++ b/src/device.rs
@@ -7,15 +7,23 @@ use ctap::{
 };
 use std::time::Duration;

-const RP_ID: &'static str = "fido2luks";
+const RP_ID: &str = "fido2luks";

-pub fn make_credential_id(name: Option<&str>) -> Fido2LuksResult<FidoCredential> {
+pub fn make_credential_id(
+    name: Option<&str>,
+    pin: Option<&str>,
+) -> Fido2LuksResult<FidoCredential> {
    let mut request = FidoCredentialRequestBuilder::default().rp_id(RP_ID);
    if let Some(user_name) = name {
        request = request.user_name(user_name);
    }
    let request = request.build().unwrap();
-    let make_credential = |device: &mut FidoDevice| device.make_hmac_credential(&request);
+    let make_credential = |device: &mut FidoDevice| {
+        if let Some(pin) = pin {
+            device.unlock(pin)?;
+        }
+        device.make_hmac_credential(&request)
+    };
    Ok(request_multiple_devices(
        get_devices()?
            .iter_mut()
@@ -24,26 +32,30 @@ pub fn make_credential_id(name: Option<&str>) -> Fido2LuksResult<FidoCredential>
    )?)
 }

-pub fn perform_challenge(
-    credentials: &[&FidoCredential],
+pub fn perform_challenge<'a>(
+    credentials: &'a [&'a FidoCredential],
    salt: &[u8; 32],
    timeout: Duration,
-) -> Fido2LuksResult<[u8; 32]> {
+    pin: Option<&str>,
+) -> Fido2LuksResult<([u8; 32], &'a FidoCredential)> {
    let request = FidoAssertionRequestBuilder::default()
        .rp_id(RP_ID)
        .credentials(credentials)
        .build()
        .unwrap();
    let get_assertion = |device: &mut FidoDevice| {
+        if let Some(pin) = pin {
+            device.unlock(pin)?;
+        }
        device.get_hmac_assertion(&request, &util::sha256(&[&salt[..]]), None)
    };
-    let (_, (secret, _)) = request_multiple_devices(
+    let (credential, (secret, _)) = request_multiple_devices(
        get_devices()?
            .iter_mut()
            .map(|device| (device, &get_assertion)),
        Some(timeout),
    )?;
-    Ok(secret)
+    Ok((secret, credential))
 }

 pub fn get_devices() -> Fido2LuksResult<Vec<FidoDevice>> {
@@ -52,7 +64,7 @@ pub fn get_devices() -> Fido2LuksResult<Vec<FidoDevice>> {
        match FidoDevice::new(&di) {
            Err(e) => match e.kind() {
                FidoErrorKind::ParseCtap | FidoErrorKind::DeviceUnsupported => (),
-                err => Err(FidoError::from(err))?,
+                err => return Err(FidoError::from(err).into()),
            },
            Ok(dev) => devices.push(dev),
        }
--- a/src/error.rs
+++ b/src/error.rs
@@ -13,11 +13,13 @@ pub enum Fido2LuksError {
    AuthenticatorError { cause: ctap::FidoError },
    #[fail(display = "no authenticator found, please ensure your device is plugged in")]
    NoAuthenticatorError,
-    #[fail(display = "luks err")]
-    LuksError {
+    #[fail(display = " {}", cause)]
+    CryptsetupError {
        cause: libcryptsetup_rs::LibcryptErr,
    },
-    #[fail(display = "no authenticator found, please ensure your device is plugged in")]
+    #[fail(display = "{}", cause)]
+    LuksError { cause: LuksError },
+    #[fail(display = "{}", cause)]
    IoError { cause: io::Error },
    #[fail(display = "supplied secret isn't valid for this device")]
    WrongSecret,
@@ -46,7 +48,35 @@ pub enum AskPassError {
    Mismatch,
 }

+#[derive(Debug, Fail)]
+pub enum LuksError {
+    #[fail(display = "This feature requires to the LUKS device to be formatted as LUKS 2")]
+    Luks2Required,
+    #[fail(display = "Invalid token: {}", _0)]
+    InvalidToken(String),
+    #[fail(display = "No token found")]
+    NoToken,
+    #[fail(display = "The device already exists")]
+    DeviceExists,
+}
+
+impl LuksError {
+    pub fn activate(e: LibcryptErr) -> Fido2LuksError {
+        match e {
+            LibcryptErr::IOError(ref io) => match io.raw_os_error() {
+                Some(1) if io.kind() == ErrorKind::PermissionDenied => Fido2LuksError::WrongSecret,
+                Some(17) => Fido2LuksError::LuksError {
+                    cause: LuksError::DeviceExists,
+                },
+                _ => return Fido2LuksError::CryptsetupError { cause: e },
+            },
+            _ => Fido2LuksError::CryptsetupError { cause: e },
+        }
+    }
+}
+
 use libcryptsetup_rs::LibcryptErr;
+use std::io::ErrorKind;
 use std::string::FromUtf8Error;
 use Fido2LuksError::*;

@@ -62,7 +92,7 @@ impl From<LibcryptErr> for Fido2LuksError {
            LibcryptErr::IOError(e) if e.raw_os_error().iter().any(|code| code == &1i32) => {
                WrongSecret
            }
-            _ => LuksError { cause: e },
+            _ => CryptsetupError { cause: e },
        }
    }
 }
--- a/src/luks.rs
+++ b/src/luks.rs
@@ -1,67 +1,212 @@
 use crate::error::*;

-use libcryptsetup_rs::{CryptActivateFlags, CryptDevice, CryptInit, EncryptionFormat, KeyslotInfo};
+use libcryptsetup_rs::{
+    CryptActivateFlags, CryptDevice, CryptInit, CryptTokenInfo, EncryptionFormat, KeyslotInfo,
+    TokenInput,
+};
+use std::collections::{HashMap, HashSet};
 use std::path::Path;

 fn load_device_handle<P: AsRef<Path>>(path: P) -> Fido2LuksResult<CryptDevice> {
    let mut device = CryptInit::init(path.as_ref())?;
-    //TODO: determine luks version some way other way than just trying
-    let mut load = |format| device.context_handle().load::<()>(format, None).map(|_| ());
-    vec![EncryptionFormat::Luks2, EncryptionFormat::Luks1]
-        .into_iter()
-        .fold(None, |res, format| match res {
-            Some(Ok(())) => res,
-            Some(e) => Some(e.or(load(format))),
-            None => Some(load(format)),
-        })
-        .unwrap()?;
+    device.context_handle().load::<()>(None, None)?;
    Ok(device)
 }

-pub fn open_container<P: AsRef<Path>>(path: P, name: &str, secret: &[u8]) -> Fido2LuksResult<()> {
+fn check_luks2(device: &mut CryptDevice) -> Fido2LuksResult<()> {
+    match device.format_handle().get_type()? {
+        EncryptionFormat::Luks2 => Ok(()),
+        _ => Err(Fido2LuksError::LuksError {
+            cause: LuksError::Luks2Required,
+        }),
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct Fido2LuksToken {
+    #[serde(rename = "type")]
+    type_: String,
+    credential: Vec<String>,
+    keyslots: Vec<String>,
+}
+
+impl Fido2LuksToken {
+    fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self {
+        Self {
+            type_: "fido2luks\0".into(), // Doubles as c style string
+            credential: vec![hex::encode(credential_id)],
+            keyslots: vec![slot.to_string()],
+        }
+    }
+}
+
+pub fn open_container<P: AsRef<Path>>(
+    path: P,
+    name: &str,
+    secret: &[u8],
+    slot_hint: Option<u32>,
+) -> Fido2LuksResult<()> {
    let mut device = load_device_handle(path)?;
    device
        .activate_handle()
-        .activate_by_passphrase(Some(name), None, secret, CryptActivateFlags::empty())
+        .activate_by_passphrase(Some(name), slot_hint, secret, CryptActivateFlags::empty())
        .map(|_slot| ())
        .map_err(|_e| Fido2LuksError::WrongSecret)
 }

+pub fn open_container_token<P: AsRef<Path>>(
+    path: P,
+    name: &str,
+    secret: impl Fn(Vec<String>) -> Fido2LuksResult<([u8; 32], String)>,
+) -> Fido2LuksResult<()> {
+    let mut device = load_device_handle(path)?;
+    check_luks2(&mut device)?;
+
+    let mut creds = HashMap::new();
+    for i in 0..256 {
+        let status = device.token_handle().status(i)?;
+        match status {
+            CryptTokenInfo::Inactive => break,
+            CryptTokenInfo::Internal(s)
+            | CryptTokenInfo::InternalUnknown(s)
+            | CryptTokenInfo::ExternalUnknown(s)
+            | CryptTokenInfo::External(s)
+                if &s != "fido2luks" =>
+            {
+                continue
+            }
+            _ => (),
+        };
+        let json = device.token_handle().json_get(i)?;
+        let info: Fido2LuksToken =
+            serde_json::from_value(json.clone()).map_err(|_| Fido2LuksError::LuksError {
+                cause: LuksError::InvalidToken(json.to_string()),
+            })?;
+        let slots = || {
+            info.keyslots
+                .iter()
+                .filter_map(|slot| slot.parse::<u32>().ok())
+        };
+        for cred in info.credential.iter().cloned() {
+            creds
+                .entry(cred)
+                .or_insert_with(|| slots().collect::<HashSet<u32>>())
+                .extend(slots());
+        }
+    }
+    if creds.is_empty() {
+        return Err(Fido2LuksError::LuksError {
+            cause: LuksError::NoToken,
+        });
+    }
+    let (secret, credential) = secret(creds.keys().cloned().collect())?;
+    let slots = creds.get(&credential).unwrap();
+    let slots = slots
+        .iter()
+        .cloned()
+        .map(Option::Some)
+        .chain(std::iter::once(None).take(slots.is_empty() as usize));
+    for slot in slots {
+        match device
+            .activate_handle()
+            .activate_by_passphrase(Some(name), slot, &secret, CryptActivateFlags::empty())
+            .map(|_slot| ())
+            .map_err(LuksError::activate)
+        {
+            Err(Fido2LuksError::WrongSecret) => (),
+            res => return res,
+        }
+    }
+    Err(Fido2LuksError::WrongSecret)
+}
+
 pub fn add_key<P: AsRef<Path>>(
    path: P,
    secret: &[u8],
    old_secret: &[u8],
    iteration_time: Option<u64>,
+    credential_id: Option<&[u8]>,
 ) -> Fido2LuksResult<u32> {
    let mut device = load_device_handle(path)?;
    if let Some(millis) = iteration_time {
        device.settings_handle().set_iteration_time(millis)
    }
    let slot = device
-        .keyslot_handle(None)
-        .add_by_passphrase(old_secret, secret)?;
+        .keyslot_handle()
+        .add_by_passphrase(None, old_secret, secret)?;
+    if let Some(id) = credential_id {
+        /*  if let e @ Err(_) = check_luks2(&mut device) {
+            //rollback
+            device.keyslot_handle(Some(slot)).destroy()?;
+            return e.map(|_| 0u32);
+        }*/
+        device.token_handle().json_set(TokenInput::AddToken(
+            &serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
+        ))?;
+    }
+
    Ok(slot)
 }

+fn find_token(
+    device: &mut CryptDevice,
+    slot: u32,
+) -> Fido2LuksResult<Option<(u32, Fido2LuksToken)>> {
+    for i in 0..256 {
+        let status = device.token_handle().status(i)?;
+        match status {
+            CryptTokenInfo::Inactive => break,
+            CryptTokenInfo::Internal(s)
+            | CryptTokenInfo::InternalUnknown(s)
+            | CryptTokenInfo::ExternalUnknown(s)
+            | CryptTokenInfo::External(s)
+                if &s != "fido2luks" =>
+            {
+                continue
+            }
+            _ => (),
+        };
+        let json = device.token_handle().json_get(i)?;
+        let info: Fido2LuksToken =
+            serde_json::from_value(json.clone()).map_err(|_| Fido2LuksError::LuksError {
+                cause: LuksError::InvalidToken(json.to_string()),
+            })?;
+        if info.keyslots.contains(&slot.to_string()) {
+            return Ok(Some((i, info)));
+        }
+    }
+    Ok(None)
+}
+
 pub fn remove_keyslots<P: AsRef<Path>>(path: P, exclude: &[u32]) -> Fido2LuksResult<u32> {
    let mut device = load_device_handle(path)?;
-    let mut handle;
    let mut destroyed = 0;
-    //TODO: detect how many keyslots there are instead of trying within a given range
-    for slot in 0..1024 {
-        handle = device.keyslot_handle(Some(slot));
-        match handle.status()? {
+    let mut tokens = Vec::new();
+    for slot in 0..256 {
+        match device.keyslot_handle().status(slot)? {
            KeyslotInfo::Inactive => continue,
-            KeyslotInfo::Active if !exclude.contains(&slot) => {
-                handle.destroy()?;
+            KeyslotInfo::Active | KeyslotInfo::ActiveLast if !exclude.contains(&slot) => {
+                if let Ok(_) = check_luks2(&mut device) {
+                    if let Some((token, _)) = find_token(&mut device, slot)? {
+                        tokens.push(token);
+                    }
+                }
+                device.keyslot_handle().destroy(slot)?;
                destroyed += 1;
            }
-            _ => (),
-        }
-        match handle.status()? {
            KeyslotInfo::ActiveLast => break,
            _ => (),
        }
+        if device.keyslot_handle().status(slot)? == KeyslotInfo::ActiveLast {
+            break;
+        }
+    }
+    // Ensure indices stay valid
+    tokens.sort();
+    for token in tokens.iter().rev() {
+        device
+            .token_handle()
+            .json_set(TokenInput::RemoveToken(*token))?;
    }
    Ok(destroyed)
 }
@@ -71,13 +216,26 @@ pub fn replace_key<P: AsRef<Path>>(
    secret: &[u8],
    old_secret: &[u8],
    iteration_time: Option<u64>,
+    credential_id: Option<&[u8]>,
 ) -> Fido2LuksResult<u32> {
    let mut device = load_device_handle(path)?;
    // Set iteration time not sure wether this applies to luks2 as well
    if let Some(millis) = iteration_time {
        device.settings_handle().set_iteration_time(millis)
    }
-    Ok(device
-        .keyslot_handle(None)
-        .change_by_passphrase(None, None, old_secret, secret)? as u32)
+    let slot = device
+        .keyslot_handle()
+        .change_by_passphrase(None, None, old_secret, secret)? as u32;
+    if let Some(id) = credential_id {
+        if check_luks2(&mut device).is_ok() {
+            let token = find_token(&mut device, slot)?.map(|(t, _)| t);
+            if let Some(token) = token {
+                device.token_handle().json_set(TokenInput::ReplaceToken(
+                    token,
+                    &serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
+                ))?;
+            }
+        }
+    }
+    Ok(slot)
 }
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,6 +1,8 @@
 #[macro_use]
 extern crate failure;
 extern crate ctap_hmac as ctap;
+#[macro_use]
+extern crate serde_derive;
 use crate::cli::*;
 use crate::config::*;
 use crate::device::*;
@@ -16,10 +18,6 @@ mod error;
 mod luks;
 mod util;

-fn assemble_secret(hmac_result: &[u8], salt: &[u8]) -> [u8; 32] {
-    util::sha256(&[salt, hmac_result])
-}
-
 fn main() -> Fido2LuksResult<()> {
    match run_cli() {
        Err(e) => {
@@ -32,20 +30,3 @@ fn main() -> Fido2LuksResult<()> {
        _ => exit(0),
    }
 }
-
-#[cfg(test)]
-mod test {
-
-    use super::*;
-
-    #[test]
-    fn test_assemble_secret() {
-        assert_eq!(
-            assemble_secret(b"abc", b"def"),
-            [
-                46, 82, 82, 140, 142, 159, 249, 196, 227, 160, 142, 72, 151, 77, 59, 62, 180, 36,
-                33, 47, 241, 94, 17, 232, 133, 103, 247, 32, 152, 253, 43, 19
-            ]
-        )
-    }
-}
--- a/src/util.rs
+++ b/src/util.rs
@@ -4,7 +4,7 @@ use std::fs::File;
 use std::io::Read;
 use std::path::PathBuf;

-pub fn sha256<'a>(messages: &[&[u8]]) -> [u8; 32] {
+pub fn sha256(messages: &[&[u8]]) -> [u8; 32] {
    let mut digest = digest::Context::new(&digest::SHA256);
    for m in messages.iter() {
        digest.update(m);
@@ -23,12 +23,16 @@ pub fn read_password(q: &str, verify: bool) -> Fido2LuksResult<String> {
        {
            Err(Fido2LuksError::AskPassError {
                cause: AskPassError::Mismatch,
-            })?
+            })
        }
        pass => Ok(pass),
    }
 }

+pub fn read_password_hashed(q: &str, verify: bool) -> Fido2LuksResult<[u8; 32]> {
+    read_password(q, verify).map(|pass| sha256(&[pass.as_bytes()]))
+}
+
 pub fn read_keyfile<P: Into<PathBuf>>(path: P) -> Fido2LuksResult<Vec<u8>> {
    let mut file = File::open(path.into())?;
    let mut key = Vec::new();
Author	SHA1	Message	Date
shimun	4507107fac	update libcryptsetup-rs	2020-06-10 13:50:28 +02:00
shimun	a8482c50a2	handle tokens when replacing	2020-06-08 19:22:19 +02:00
shimun	09be5ef551	assemble secret in correct order	2020-06-08 18:08:24 +02:00
shimun	6f6c84ddba	skip luks2 check until underlying issue is fixed	2020-06-07 14:14:51 +02:00
shimun	5a05cad695	more precise description	2020-06-06 23:39:23 +02:00
shimun	d8d24b40f5	Merge branch 'cli_reorg'	2020-06-06 23:37:22 +02:00
shimun	c1a82b9ae6	update libcryptsetup_rs to 0.4.0	2020-06-06 22:43:18 +02:00
shimun	a26b79bcd6	reduced redundant code	2020-05-05 23:53:50 +02:00
shimun	f774580c9c	update to current api	2020-05-05 23:28:44 +02:00
shimun	69732a1ad6	restore order	2020-04-29 20:33:28 +02:00
shimun	b8ae9d91f0	rudimentary pin support	2020-04-29 19:56:18 +02:00
shimun	fcdd2a2d3d	add option to specify keyslot	2020-04-29 18:55:25 +02:00
shimun	c3d6425e2d	reorganised cli	2020-04-29 18:50:55 +02:00
shimun	0b19760175	hint slots	2020-04-28 19:09:53 +02:00
shimun	2ec8679c47	open token	2020-04-28 14:27:14 +02:00
shimun	65e1dead8b	remove token	2020-04-27 22:07:00 +02:00
shimun	478fb5e036	store luks token	2020-04-27 19:26:21 +02:00
shimun	1547f5e199	get format	2020-04-27 18:12:06 +02:00
shimun	5c0364587e	update ctap	2020-04-26 18:58:37 +02:00
shimun	9307503bdc	applied clippy lints	2020-04-07 20:06:24 +02:00