PIV: Use UUID4 for GUID generation

Yubico · Aug 19, 2024 · 8069725 · 8069725
1 parent 6af66b1
commit 8069725
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/ykman/_cli/piv.py b/ykman/_cli/piv.py
@@ -79,8 +79,8 @@
 )
 from cryptography.hazmat.primitives import serialization, hashes
 from cryptography.hazmat.backends import default_backend
+from uuid import uuid4
 
-import os
 import click
 import datetime
 import logging
@@ -974,7 +974,7 @@ def _update_chuid(session):
             # Signed CHUID, leave it alone
             logger.debug("Leaving signed CHUID as-is.")
             return
-        chuid.guid = os.urandom(16)
+        chuid.guid = uuid4().bytes
         chuid_data = bytes(chuid)
         logger.debug("Updating CHUID GUID.")
     except ApduError as e:

diff --git a/ykman/piv.py b/ykman/piv.py
@@ -51,6 +51,7 @@
 from cryptography.hazmat.backends import default_backend
 from cryptography.x509.oid import NameOID
 from datetime import datetime, date
+from uuid import uuid4
 import logging
 import struct
 import os
@@ -474,7 +475,7 @@ def generate_chuid() -> bytes:
     chuid = Chuid(
         # Non-Federal Issuer FASC-N
         fasc_n=FascN(9999, 9999, 999999, 0, 1, 0000000000, 3, 0000, 1),
-        guid=os.urandom(16),
+        guid=uuid4().bytes,
         # Expires on: 2030-01-01
         expiration_date=date(2030, 1, 1),
         asymmetric_signature=b"",