Fix minor spec compliance issue

src/commands.rs

@@ -161,7 +161,7 @@ impl TryFrom<VerifyArguments<'_>> for Verify {
             data,
         } = arguments;
         if key_reference != VerifyKeyReference::ApplicationPin {
-            return Err(Status::FunctionNotSupported);
+            return Err(Status::KeyReferenceNotFound);
         }
         Ok(match (logout.0, data.len()) {
             (false, 0) => Verify::Status(key_reference),
@@ -368,9 +368,9 @@ impl<'l, const C: usize> TryFrom<&'l iso7816::Command<C>> for Command<'l> {
                 Self::PutData(PutData::try_from(data.as_slice())?)
             }
 
-            (0x00, Instruction::GenerateAsymmetricKeyPair, 0x00, p2) => {
-                Self::GenerateAsymmetric(GenerateKeyReference::try_from(p2)?)
-            }
+            (0x00, Instruction::GenerateAsymmetricKeyPair, 0x00, p2) => Self::GenerateAsymmetric(
+                GenerateKeyReference::try_from(p2).map_err(|_| Status::IncorrectP1OrP2Parameter)?,
+            ),
             // (0x00, 0x01, 0x10, 0x00)
             (0x00, Instruction::Unknown(0x01), 0x00, 0x00) => {
                 Self::YkExtension(YubicoPivExtension::GetSerial)

src/container.rs

@@ -134,6 +134,7 @@ impl KeyReference {
     pub fn use_security_condition(self) -> SecurityCondition {
         match self {
             Self::SecureMessaging
+            | Self::CardAuthentication
             | Self::PivCardApplicationAdministration
             | Self::KeyManagement => SecurityCondition::Always,
             Self::DigitalSignature => SecurityCondition::PinAlways,

src/lib.rs

@@ -590,7 +590,8 @@ impl<'a, T: Client> LoadedAuthenticator<'a, T> {
             return Err(Status::ConditionsOfUseNotSatisfied);
         };
 
-        if response.ct_eq(&plaintext_challenge).into() {
+        let is_eq: bool = response.ct_eq(&plaintext_challenge).into();
+        if is_eq {
             warn!("Bad auth challenge");
             return Err(Status::IncorrectDataParameter);
         }
@@ -861,28 +862,8 @@ impl<'a, T: Client> LoadedAuthenticator<'a, T> {
         //     PINPolicyAlways: 0x03,
         // }
 
-        // TODO: iterate on this, don't expect tags..
-        let input = derp::Input::from(data);
-        // let (mechanism, parameter) = input.read_all(derp::Error::Read, |input| {
-        let mechanism_data = input.read_all(Status::IncorrectDataParameter, |input| {
-            derp::nested(
-                input,
-                Status::IncorrectDataParameter,
-                Status::IncorrectDataParameter,
-                0xac,
-                |input| {
-                    derp::expect_tag_and_get_value(input, 0x80)
-                        .map(|input| input.as_slice_less_safe())
-                        .map_err(|_e| {
-                            warn!("error parsing GenerateAsymmetricKeypair: {:?}", &_e);
-                            Status::IncorrectDataParameter
-                        })
-                },
-            )
-        })?;
-
-        let [mechanism] = mechanism_data else {
-            warn!("Mechanism of len not 1: {mechanism_data:02x?}");
+        let Some([mechanism]) = tlv::get_do(&[0xAC, 0x80], data) else {
+            warn!("Generate assymetric key pair without mechanism");
             return Err(Status::IncorrectDataParameter);
         };
 

tests/command_response.ron

@@ -4,7 +4,7 @@
         cmd_resp: [
             VerifyApplicationPin(),
             VerifyApplicationPin(pin: "3131313131313131", expected_status: RemainingRetries(2)),
-            VerifyGlobalPin(expected_status: FunctionNotSupported)
+            VerifyGlobalPin(expected_status: KeyReferenceNotFound),
         ]
     ),
     IoTest(