PIV: Use UUID4 for GUID generation

Yubico · Aug 19, 2024 · 8069725 · 8069725
1 parent 6af66b1
commit 8069725
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/ykman/_cli/piv.py b/ykman/_cli/piv.py
@@ -79,8 +79,8 @@
 )
 from cryptography.hazmat.primitives import serialization, hashes
 from cryptography.hazmat.backends import default_backend
+from uuid import uuid4
 
-import os
 import click
 import datetime
 import logging
@@ -974,7 +974,7 @@ def _update_chuid(session):
  # Signed CHUID, leave it alone
  logger.debug("Leaving signed CHUID as-is.")
  return
- chuid.guid = os.urandom(16)
+ chuid.guid = uuid4().bytes
  chuid_data = bytes(chuid)
  logger.debug("Updating CHUID GUID.")
  except ApduError as e:

diff --git a/ykman/piv.py b/ykman/piv.py
@@ -51,6 +51,7 @@
 from cryptography.hazmat.backends import default_backend
 from cryptography.x509.oid import NameOID
 from datetime import datetime, date
+from uuid import uuid4
 import logging
 import struct
 import os
@@ -474,7 +475,7 @@ def generate_chuid() -> bytes:
  chuid = Chuid(
  # Non-Federal Issuer FASC-N
  fasc_n=FascN(9999, 9999, 999999, 0, 1, 0000000000, 3, 0000, 1),
- guid=os.urandom(16),
+ guid=uuid4().bytes,
  # Expires on: 2030-01-01
  expiration_date=date(2030, 1, 1),
  asymmetric_signature=b"",