NEWS

Yubikey-personalize NEWS -- History of user-visible changes.     -*- outline -*-

* Version 1.20.1 (unreleased)

* Version 1.20.0 (released 2019-07-03)

** Add yk_open_key_vid_pid() allowing vid and pid to be specified.

** Documentation fixes.

** Clear potentially sensitive material from buffers.

** Fix potential buffer overwrite.

* Version 1.19.3 (released 2019-02-22)

** Fix capability read.

* Version 1.19.2 (released 2019-02-19)

** Fix test on mac.

** Fix serial read and challenge response.

* Version 1.19.1 (released 2019-02-19)

** Error out on json output with randomSeed.

** Validate more length fields.

** Use correct FormatMessage function on windows.

** Overflow, bounds and error condition checks.

** Try to zero sensitive memory better.

* Version 1.19.0 (released 2018-04-24)

** Add yk_write_device_info().

** Add ykpersonalize cli switch -D for device info.

** Add code for handling personalization interface of major version 5.

* Version 1.18.1 (released 2018-01-16)

** Support reading accesscode and private ID from stdin.

** Parse optional arguments correctly.

** Documentation fixes.

** Fix for ykinfo modhex serial output when it ends with c.

** Treat all firmware versions as supported.

* Version 1.18.0 (released 2017-01-27)

** Let ykchalresp read challenge from a file.

** Add support of working with a numbered key when many connected
Thanks to Thomas Habets <habets@google.com>

** Documentation clarifications.

** Fixup argument parsing of flags with optional arguments on BSD platforms.

** Fix a file descriptor leak on windows.

* Version 1.17.3 (released 2015-12-28)

** Dont read to much if we don't find a key.

** Text updates to make options clearer.

** Correct logic for question when mode switching to non-otp mode.

** Add 4.3 as supported firmware.

* Version 1.17.2 (released 2015-09-22)

** Let _yk_write() return an error if yk_wait_for_key_status() fails.

** Fix a mistake in help, fixed is up to 16 bytes, 32 characters.

** Add 4.2 as supported firmware.

* Version 1.17.1 (released 2015-04-01)

** Fixup of 1.17.0

* Version 1.17.0 (released 2015-04-01)

** add yk_get_capabilities() to fetch capabilities.

** add -c to ykinfo to fetch capabilities.

** whitelist firmware 4.1.x

* Version 1.16.4 (released 2015-03-23)

** change the tool to accept autoeject time as a short instead of a byte

* Version 1.16.3 (released 2015-03-10)

** whitelist YubiKey version 3.4.x

** only try to set libusb configuration if it's unset on the device

* Version 1.16.2 (released 2014-11-28)

** ykinfo: fix modhex printout when serial is an odd number of hex digits.

** whitelist yubikey version 4.0.x

** try to open more PIDs and add for udev.

* Version 1.16.1 (released 2014-10-30)

** Fix udev rules so they contain four digits.

** Only try to detach the kernel driver if it's attached.
For libusb-1.0

** Let import config report errors properly.

* Version 1.16.0 (released 2014-09-26)

** Add yk_get_key_vid_pid() to get the vendor and product id of a key.

** Add flags for ykinfo to print vendor and product id.

** Fix a bug in the osx backend where it would return an error opening
a composite device with two hid interfaces.

* Version 1.15.3 (released 2014-09-04)

** Fix URLs for opensource.y.com -> developers.y.com move.

** Whitelist firmware version 3.3 and detect new PIDs.

* Version 1.15.2 (released 2014-07-30)

** Whitelist firmware version 2.5

** Read key when importing configuration.

** Fix formatting error in information about what is written to key.

** Check return codes when doinf NDEF writes.

* Version 1.15.1 (released 2014-03-12)

** Add -6 and -8 flags to ykchalresp to output the response as a truncated
OATH code. Thanks to joernchen of Phenoelit <joernchen@phenoelit.de>

** Add -t to ykchalresp to use current time / 30 as challenge in TOTP
fashion. Thanks to joernchen of Phenoelit <joernchen@phenoelit.de>

** Fix for a crash in the libusb-0.1 backend.
Thanks to Antti Keränen <detegr@gmail.com>

* Version 1.15.0 (released 2014-01-10)

** add new Neo version 3.2 as supported.

** let ykp_AES_key_from_password() return error if it can't get a random
salt.

** let -a without option mean ask for raw key on STDIN.

** let no -a given mean generate a random key

** add ykp_AES_key_from_raw() and ykp_HMAC_key_from_raw() that sets the
key from a byte array.

** remove -osalt= and possibility to generate key from password.

** add YK_ENODATA that's returned when no data is returned from
the device and no other underlying error is set.

* Version 1.14.2 (released 2013-12-30)

** let -m take challenge-response timeout and autoeject timeout
supplied with : beteen, so mode:cr-timeout:autoeject-timeout

** make sure to always wait 1 millisecond between writes to the key
newer platforms triggered a race where writes to the key could
happen in a very short (about 0.4 milliseconds) timespan and would
not be processed.

** minor fixes for the printing format.

* Version 1.14.1 (released 2013-09-16)

** Fix breakage with latest automake.

* Version 1.14.0 (released 2013-07-04)

** Fixups of import/export.
Add targetConfig to show in which slot a configuration is intended.
Possible memory leaks on error conditions.

** Add -d switch to ykpersonalize for dry-run.

** Add ykp_clear_config() for clearing configuration flags.

** Add getter functions for all configuration flags.

** Add -V to all tools to output version.

** Add ykp_get_acccode_type() and ykp_set_acccode_type()
Only to do with export, showing where the access code came from
in the ycfg.

** Add -1 and -2 options to ykinfo to show programming state.

* Version 1.13.0 (released 2013-04-22)

** Added import/export of ycfg-json format.
Invoke with -fjson to -s or -i
Add exported functions ykp_export_config() and ykp_import_config()

** Fixup output of flags when using ykp_write_config()

** Add binary builds for mac.

** Minor cleanups noticed during debian packaging.

* Version 1.12.0 (released 2013-03-14)

** Recognize firmwares 2.4 and 3.1.

** Add support for setting the new extflag LED_INV
When set the behaviour of the led on the YubiKey is inversed.

* Version 1.11.3 (released 2013-01-09)

** Fixup of broken release.

* Version 1.11.2 (released 2013-01-09)

** Fix a bug where writing a NDEF with unknown prefix ended up writing invalid
data to the YubiKey NEO. Wrote prefix as 0x24 instead of 0x00.

** Don't allow opening a YubiKey if there's more than one present in the system.

** Fix shared linking of ykinfo and ykchalresp.

* Version 1.11.1 (released 2012-12-21)

** Implement ykusb_strerror() on windows.

** Fix a bug where a YubiKey would fail to be recognized if there was
another device from Yubico (vendor id 1050) inserted and looked at
before in the device chain.

** Fix a bug where you could only set 8 bytes of the public id with
the command line tool, now all 16 bytes can be set.

** Documentation updates and fixes.

* Version 1.11.0 (released 2012-12-12)

** Added version symbols and functions.
The header file is "ykpers-version.h" and it contains the following
symbols and functions: YKPERS_VERSION_STRING, YKPERS_VERSION_NUMBER,
YKPERS_VERSION_MAJOR, YKPERS_VERSION_MINOR, YKPERS_VERSION_PATCH,
ykpers_check_version.  Requested by Giampaolo Bellini
<iw2lsi@gmail.com>.

* Version 1.10.0 (released 2012-12-11)

** Support for the new productId of the production Neo.
Has ProducId 0x110, 0x111 or 0x112 depending on mode (see the notes about
-m and device_config).

** Add support for SLOT_NDEF2.
Use SLOT_NDEF to emit slot 1 as NDEF or SLOT_NDEF2 to emit slot 2.
This also adds the function yk_write_ndef2() that takes a slot parameter.

** Add -m flag for ykpersonalize, set usb mode of YubiKey NEO.
0 means pure YubiKey mode, 1 means pure CCID mode and 2 means YubiKey/CCID
composite mode. Add 80 to set EJECT_FLAG.
To use this with the api, see the functions:
ykp_alloc_device_config(), ykp_free_device_config(), ykp_set_device_mode(),
ykp_set_device_chalresp_timeout(), ykp_set_device_autoeject_time() and
yk_write_device_config().

** Add -S flag for ykpersonalize, set the scanmap of the YubiKey NEO.
Take an 90 character string describing 45 scancodes. See man page for more
info. To use this with the api see yk_write_scan_map().

** In the api add ykp_ndef_as_text() to export the text from a YK_NDEF structure.

** Higher timeout for configuration writes as in particular swap can take
longer than 600 ms.

* Version 1.9.0 (released 2012-11-08)

** ykinfo: New tool to print information about YubiKey.

** ykpersonalize: Add -z flag to zap configuration on YubiKey.

** Fix PBKDF2 implementation.

* Version 1.8.2 (released 2012-10-17)

** Add udev rules files to packed distribution.

* Version 1.8.1 (released 2012-10-17)

** Memory leak fixes and potential crash fixes in osx backend.

** Error reporting fixes in osx backend, reporting correct errors and
better errors.

** Provide new another udev permissions file that works on udev version
greater than 188. Autodetects from configure which to use. Thanks to
Maxim Burgerhout <maxim@wzzrd.com>.

** Add new binary ykinfo, can be used to get serial number, version and
touch level from a YubiKey.

* Version 1.8.0 (released 2012-09-28)

** Added ./configure --enable-gcc-warnings to enable a lot of warnings.

** Added Continuous integration at travis-ci
(http://travis-ci.org/#!/Yubico/yubikey-personalization)

** Added yk_challenge_response() function for doing challenge response
with a key.

** Fixed functions for NDEF writing, adding:
ykp_ndef_alloc(), ykp_ndef_free() and ykp_set_ndef_access_code()
also providing compatible name YK_NDEF in ykcore.h and exporting
yk_write_ndef() there.
Change return values from ndef_construct_*() functions to make them
consistent with the rest of the library.

** Fixed a crash bug when the library was called from different threads.

** Check return code from libusb_init() so we avoid crashing there.
Also use a usb context instead of relying on default.

** Fix numerous warnings.

** Fix compilation in MSVC2010.

* Version 1.7.0 (released 2012-06-07)

** Add support for new features in YubiKey 2.3:
ALLOW_UPDATE flag that allows updating of configuration in slots.
Update command (-u) to do update of existing config.
Swap command (-x) to swap contents of two updatable slots
DORMANT flag that's settable/removable if ALLOW_UPDATE is set
USE_NUMERIC_KEYPAD flag for sending the OATH OTP using keypad scan codes instead
FAST_TRIG flag for faster triggering of slot one if slot two is empty

** Change the library around some to make the 2.3 features available.
Use ykp_alloc() instead of ykp_create_config().
Use ykp_configure_version() instead of ykp_configure_for() to set the version.
Use ykp_configure_command() instead of ykp_configure_for() to set slot.
Use yk_write_command() instead of yk_write_config().

The new commands doesn't set any default configuration at all.

** Add library support for the YubiKey NEO beta
ykp_construct_ndef_uri() for preparing a URI to write.
ykp_construct_ndef_text() for preparing a text to write.
yk_write_ndef() to write the constructed NDEF.

** Add support for the YubiKey NEO beta
Writing NDEF URI with -n http://example.com/foo/
Writing NDEF Text record with -t example

** Windows: Bump yubico-c dependency to version 1.9.

** Windows: Build fixes related to self checks.

* Version 1.6.4 (released 2012-05-24)

** Implement option -ooath-id to easily set OATH token identifier.

** Fix numerous compiler warnings from clang. Thanks to
Clemens Lang <neverpanic@gmail.com>.

* Version 1.6.3 (released 2011-12-15)

** No real change for regular users. Fix a bug in a test case for
big endian systems.

* Version 1.6.2 (released 2011-11-28)

** Check return value of calloc() when creating errno variables.

** Fix build on OpenBSD with it's own libusb. Reported and patched by
Doug Huff <mith@jrbobdobbs.org>.

** Use correct return type for getopt() - fixes problem on CPUs where
'char' defaults to unsigned. Reported by <serge.hallyn@canonical.com>.

** Header files are now usable from C++.
Reported by Giampaolo Bellini.

** ykchalresp incorrectly rejected some newer firmwares.
Reported by Giampaolo Bellini.

* Version 1.6.1 (released 2011-08-15)

** Fix test_args_to_config crash on some platform.
The problem was due to mixing PIC and non-PIC object code.

* Version 1.6.0 (released 2011-07-20)

** Accept firmware version 2.3.x too.

** ykpersonalize: New parameter -oath-imf for OATH Initial Moving Factor.
Contributed by Frank Cusack <frank@google.com>.

** libykpers: New apis for setting/getting OATH Initial Moving Factor.
The APIs are ykp_set_oath_imf and ykp_get_oath_imf.

* Version 1.5.2 (released 2011-05-10)

** Added an udev file.
Use --with-udevrulesdir=/lib/udev/rules.d or similar.  Contributed by
Tollef Fog Heen.

** Improve and distribute ykpers4win.mk.

** Cleanup native Windows backend code.

** Fix coredump for challenges of 128 characters in hex decoding.

** Demand that slot choosing parameters comes first on command line.

* Version 1.5.1 (released 2011-04-11)

** Added native Windows backend.
It is used automatically when building with a Mingw compiler, but you
use --with-backend=windows to request it.

** Distribute ykdef.h needed by challenge-response applications.

** Bugfixes :

*** Fixed a crash in the self test on 64-bit platforms.

*** Fixed a build error in self tests when "-z muldefs" is not supported.

*** -ofixed= was incorrectly excluded from pretty-printing of configuration
for OATH-HOTP. 

*** Configuring slot 2 was broken on Windows.

* Version 1.5.0 (released 2011-03-09)
** An additional binary (ykchalresp) to perform challenge-response was added.

** When generating keys from passphrase, generate 160 bit keys for modes
that support it (OATH-HOTP and HMAC challenge response).

** OATH-HOTP usability improvements.

** Serial number of YubiKey (2.2+) is shown with `ykpersonalize -v'.

** Make `configure' detect FreeBSD 8 libusb implementation.

* Version 1.4.1 (released 2011-01-19)
** Restore OATH-HOTP symbols for LIBYKPERS_1.0.
Accidentally moved to LIBYKPERS_1.4 in 1.4.0.

* Version 1.4.0 (released 2011-01-17)
** Add support for new features in YubiKey 2.2.
Most notably challenge-response, but also serial number retrieval.

** Stricter argument parsing, to help user avoid configuration surprises.

** Bugfixes :
*** Ask kernel to detach USB HID driver with libusb 0.1 too.

*** Properly reject keys (-a) with upper case hex, instead of just ignoring
those bits.

*** Really check Yubikey compatibility when setting options.

*** Pretty-printer did not handle bit overloaded cfgflags.
It is better now, but not perfect.

* Version 1.3.5 (released 2010-11-25)

** Fixes to make it work under Windows.
Only tested with libusb-1.0 from trunk.  See doc/WindowsBuild.wiki.

* Version 1.3.4 (released 2010-09-10)

** Fix crash on Mac OS X.
Reported by rosmiitto in Issue #6:
<http://code.google.com/p/yubikey-personalization/issues/detail?id=6>.

** Fix bug that prevented salting during AES key generation
** from passwords from working.  Reported by Ben.

** Add contrib/ sub-directory and contrib/programming.sh from David Dindorp.
See contrib/README for more information.

* Version 1.3.3 (released 2010-05-20)

** Don't warn about upcoming YubiKey firmware 2.2.x, it is compatible.

* Version 1.3.2 (released 2010-03-12)

** Don't warn on YubiKey with firmware 0.9.9, they work fine.

** Fix old firmware error message, it was missing a newline.

* Version 1.3.1 (released 2010-01-30)

** Fix build failure in some cases

* Version 1.3 (released 2010-01-30)

** libykpers-1: Give warning on unknown firmwares, but don't stop

** OATH-HOTP support

ykpersonalize now supports the OATH-HOTP flags.

** Updated documentation

The documentation has been updated to explain the flags a bit better
and OATH-HOTP documentation has been added.

* Version 1.2 (released 2010-01-22)

** libykpers-1: Whitelist firmware version 2.1 too.

* Version 1.1 (released 2009-10-03)

** hex and modhex bugfixes
Check of hex and modhex strings perfected.

** Segfaults and improper error codes when asking for help
Contributed by Tollef Fog Heen.

* Version 1.0 (released 2009-09-18)

** Stable release!

* Version 0.999 (released 2009-09-17)

** Fix build warnings.
May fix decoding issues on some platforms (depending on whether
returning a 'void' value is treated as true or false).

* Version 0.99 (released 2009-09-12)

** libykpers: Fix build error related to _ykp_errno_location on non-Linux.
Reported by Patrick Neave <p.neave@gmail.com>.

* Version 0.98 (released 2009-09-08)

** ykpersonalize: Exit with non-0 return code when yubikey is not present.
Reported by Greg Woods <woods@ucar.edu>.

** ykpersonalize.1: Keep in sync with tool.
By Tollef Fog Heen <tfheen@err.no>.

* Version 0.97 (released 2009-09-03)

** libykpers-1: Add linker version script.
If linker scripts are not supported, fall back on Libtool
-export-symbols-regex.  Suggested by Tollef Fog Heen <tfheen@err.no>.

** ykpersonalize: Make -h work even if there is no yubikey present.
Suggested by Peter Hultqvist <peter.h@nsf.scout.se>.

** ykpersonalize.1: Link to reference manual for explanation of options.
Suggested by Peter Hultqvist <peter.h@nsf.scout.se>.

** Now requires libyubikey v1.5 or later.

* Version 0.96 (released 2009-08-27)

** Make all input numbers hex by default.
It's still possible to give modhex numbers by preceding them with
`m:'.

** Make it possible to program the second configuration.
Added the two flags -1 and -2 to ykpersonalize.  This is to support
the YubiKey II.

** Have ykpersonalize show the new configuration and prompt.
This makes it possible for the user to prevent incorrect configurations.

** Rename installed library to "libykpers-1" and place
** installed header files in sub-directory ykpers-1/.
From now on we promise to retain API and ABI under this name forever.
The shared library will be installed as /usr/lib/libykpers-1.so and
the header files into /usr/include/ykpers-1/.  If there is ever an
incompatible API or ABI change in the future, it will be released as a
a new library libykpers-2 with header files in ykpers-2/.

** Add pkg-config script "ykpers-1".
To learn which flags to build the applications that uses the library,
use "pkg-config --cflags --libs ykpers-1".

* Version 0.95 (released 2009-08-17)

** Enable handling of programming access code.
Includes modification of help (-h) text and manual.

* Version 0.94 (released 2009-08-10)

** Improve error handling for libusb-1.0 backend.
Thanks to Tollef Fog Heen.

** Added man page for ykpersonalize.
Thanks to Tollef Fog Heen.

* Version 0.93 (released 2009-08-07)

** Support for libusb-1.0 through --with-backend=libusb-1.0.
Thanks to Tollef Fog Heen.

** Clarify -a parameter.
Thanks to Alphonse R.M. Hoge.

* Version 0.92 (released 2009-05-25)

** Mac OS X build fixes.

* Version 0.91 (released 2009-05-07)

** Added Mac OS X backend.
Contributed by Christer Kaivo-oja <christer.kaivooja@gmail.com>.

** Added --with-backend parameter to chose backend.

* Version 0.9 (released 2009-05-05)

** Initial release candidate.