Add PIV tab with key generation and self-signed certificate support

Implements a full PIV tab for Nitrokey 3 devices: slot listing, PIN/PUK
management, PKCS#12 import, and key generation. After generating a key,
a self-signed X.509 certificate is written to the slot automatically
(matching pynitrokey CLI behaviour) so the slot shows as occupied rather
than empty. Handles NK3-specific behaviour where the PIV applet resets
PIN authentication after a GENERATE KEY APDU.

Author: ABuljko

nitrokeyapp/gui.py

@@ -15,10 +15,10 @@
 from nitrokeyapp.device_view import DeviceView
 from nitrokeyapp.error_dialog import ErrorDialog
 from nitrokeyapp.fido2_tab import Fido2Tab
-from nitrokeyapp.piv_tab import PivTab
 from nitrokeyapp.information_box import InfoBox
 from nitrokeyapp.nk3_button import Nk3Button
 from nitrokeyapp.overview_tab import OverviewTab
+from nitrokeyapp.piv_tab import PivTab
 from nitrokeyapp.progress_box import ProgressBox
 from nitrokeyapp.prompt_box import PromptBox
 from nitrokeyapp.qt_utils_mix_in import QtUtilsMixIn
@@ -304,7 +304,7 @@ def show_device(self, data: DeviceData) -> None:
         self.welcome_widget.hide()
 
         # enforce refreshing the current view
-        self.views[0].refresh(data, force=True)
+        self.views[0].refresh(data)
 
         for btn in self.device_buttons:
             btn.set_stylesheet_small()

nitrokeyapp/piv_tab/__init__.py

@@ -10,16 +10,16 @@
 
 from PySide6.QtCore import Qt, QThread, Signal, Slot
 from PySide6.QtWidgets import (
+    QComboBox,
     QDialog,
     QDialogButtonBox,
     QFileDialog,
     QFormLayout,
     QInputDialog,
+    QLabel,
     QLineEdit,
     QListWidgetItem,
     QMessageBox,
-    QComboBox,
-    QLabel,
     QVBoxLayout,
     QWidget,
 )
@@ -34,11 +34,7 @@
 
 logger = logging.getLogger(__name__)
 
-ALGO_CHOICES = [
-    ("ECC P-256", b"\x11"),
-    ("ECC P-384", b"\x14"),
-    ("RSA 2048", b"\x07"),
-]
+ALGO_CHOICES = [("ECC P-256", b"\x11"), ("ECC P-384", b"\x14"), ("RSA 2048", b"\x07")]
 
 
 class PivTab(QtUtilsMixIn, QWidget):
@@ -297,9 +293,7 @@ def _prompt_import_p12(self) -> None:
         password: Optional[bytes] = password_str.encode() if (ok and password_str) else None
 
         admin_key_str, ok = QInputDialog.getText(
-            self,
-            "Management Key",
-            "Management key (hex, leave empty for default):",
+            self, "Management Key", "Management key (hex, leave empty for default):"
         )
         if ok and admin_key_str.strip():
             try:
@@ -317,6 +311,7 @@ def _prompt_import_p12(self) -> None:
 
 # ── Helper dialog ─────────────────────────────────────────────────────────────
 
+
 class _GenerateKeyDialog(QDialog):
     def __init__(self, slot_id: str, parent: Optional[QWidget] = None) -> None:
         super().__init__(parent)

nitrokeyapp/piv_tab/data.py

@@ -13,14 +13,16 @@
 
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import ec, rsa
 from cryptography.hazmat.primitives.ciphers import Cipher, modes
 from cryptography.hazmat.primitives.serialization import Encoding, pkcs12
-from cryptography.hazmat.primitives.asymmetric import ec, rsa
 
 try:
     from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES
 except ImportError:
-    from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES  # type: ignore[no-reattr]
+    from cryptography.hazmat.primitives.ciphers.algorithms import (
+        TripleDES,  # type: ignore[no-reattr]
+    )
 
 logger = logging.getLogger(__name__)
 
@@ -29,8 +31,23 @@
 
 # SELECT PIV APDU (matches pynitrokey's piv_app.py)
 PIV_SELECT_APDU = [
-    0x00, 0xA4, 0x04, 0x00, 0x0C,
-    0xA0, 0x00, 0x00, 0x03, 0x08, 0x00, 0x00, 0x10, 0x00, 0x01, 0x00, 0x00,
+    0x00,
+    0xA4,
+    0x04,
+    0x00,
+    0x0C,
+    0xA0,
+    0x00,
+    0x00,
+    0x03,
+    0x08,
+    0x00,
+    0x00,
+    0x10,
+    0x00,
+    0x01,
+    0x00,
+    0x00,
 ]
 
 # Map from slot hex string to certificate container object ID
@@ -62,6 +79,7 @@
 
 # ─── TLV helpers (ported from pynitrokey/tlv.py) ─────────────────────────────
 
+
 def _tlv_build_one(tag: int, data: bytes) -> bytes:
     if tag <= 0xFF:
         tag_bytes = bytes([tag])
@@ -132,6 +150,7 @@ def find_by_id(tag: int, items: list[tuple[int, bytes]]) -> Optional[bytes]:
 
 # ─── Data classes ─────────────────────────────────────────────────────────────
 
+
 @dataclass
 class PivCertInfo:
     subject: str
@@ -179,6 +198,7 @@ def has_cert(self) -> bool:
 
 # ─── PIV error ────────────────────────────────────────────────────────────────
 
+
 class PivError(Exception):
     def __init__(self, status: int, message: str = "") -> None:
         self.status = status
@@ -207,6 +227,7 @@ def pin_retries(self) -> int:
 
 # ─── PivApp ───────────────────────────────────────────────────────────────────
 
+
 class PivApp:
     """PIV APDU session over a smartcard (pyscard) connection."""
 
@@ -234,14 +255,16 @@ def __exit__(self, *args: Any) -> None:
     def open(cls) -> "PivApp":
         """Open a PIV session on the first NK3 found via smartcard interface."""
         try:
-            from smartcard.Exceptions import CardConnectionException, NoCardException
-            from smartcard.ExclusiveTransmitCardConnection import ExclusiveTransmitCardConnection
-            from smartcard.System import readers as list_readers
-        except ImportError:
-            raise PivError(
-                0x0000,
-                "pyscard is not installed. Run: pip install pyscard",
+            from smartcard.Exceptions import (  # type: ignore[import-untyped]
+                CardConnectionException,
+                NoCardException,
+            )
+            from smartcard.ExclusiveTransmitCardConnection import (  # type: ignore[import-untyped]
+                ExclusiveTransmitCardConnection,
             )
+            from smartcard.System import readers as list_readers  # type: ignore[import-untyped]
+        except ImportError:
+            raise PivError(0x0000, "pyscard is not installed. Run: pip install pyscard") from None
 
         nk3_atr = list(NK3_ATR)
         for reader in list_readers():
@@ -316,16 +339,19 @@ def authenticate_admin(self, admin_key: bytes = DEFAULT_ADMIN_KEY) -> None:
         """Mutual-authenticate with the management key (3DES or AES)."""
         if len(admin_key) == 24:
             from cryptography.hazmat.primitives.ciphers import algorithms as _alg
-            algorithm = TripleDES(admin_key)
+
+            algorithm: Any = TripleDES(admin_key)
             algo_byte = 0x03
             expected_len = 8
         elif len(admin_key) == 16:
             from cryptography.hazmat.primitives.ciphers import algorithms as _alg
+
             algorithm = _alg.AES128(admin_key)
             algo_byte = 0x08
             expected_len = 16
         elif len(admin_key) == 32:
             from cryptography.hazmat.primitives.ciphers import algorithms as _alg
+
             algorithm = _alg.AES256(admin_key)
             algo_byte = 0x0C
             expected_len = 16
@@ -493,8 +519,7 @@ def generate_key_and_cert(
             if modulus_data is None or exponent_data is None:
                 raise PivError(0x0000, "No RSA key data in generate key response")
             public_key_rsa = rsa.RSAPublicNumbers(
-                int.from_bytes(exponent_data, "big"),
-                int.from_bytes(modulus_data, "big"),
+                int.from_bytes(exponent_data, "big"), int.from_bytes(modulus_data, "big")
             ).public_key()
             signer = _RsaPivSigner(self, key_ref, public_key_rsa)
             cert = (
@@ -514,25 +539,36 @@ def generate_key_and_cert(
         slot_id_hex = format(key_ref, "02X")
         self.write_certificate(slot_id_hex, cert_der)
 
-    def import_rsa2048(self, key_ref: int, key: rsa.RSAPrivateNumbers, public_key: rsa.RSAPublicNumbers) -> None:
+    def import_rsa2048(
+        self, key_ref: int, key: rsa.RSAPrivateNumbers, public_key: rsa.RSAPublicNumbers
+    ) -> None:
         self.send_receive(
-            0xFE, 0x07, key_ref,
-            Tlv.build([
-                (0x01, key.p.to_bytes(128, "big")),
-                (0x02, key.q.to_bytes(128, "big")),
-                (0x03, public_key.e.to_bytes((public_key.e.bit_length() + 7) // 8, "big")),
-            ]),
+            0xFE,
+            0x07,
+            key_ref,
+            Tlv.build(
+                [
+                    (0x01, key.p.to_bytes(128, "big")),
+                    (0x02, key.q.to_bytes(128, "big")),
+                    (0x03, public_key.e.to_bytes((public_key.e.bit_length() + 7) // 8, "big")),
+                ]
+            ),
         )
 
     def write_certificate(self, slot_id: str, cert_der: bytes) -> None:
         container_id = KEY_TO_CERT_OBJ_ID[slot_id.upper()]
-        payload = Tlv.build([
-            (0x5C, container_id),
-            (0x53, Tlv.build([(0x70, cert_der), (0x71, bytes([0]))])),
-        ])
+        payload = Tlv.build(
+            [(0x5C, container_id), (0x53, Tlv.build([(0x70, cert_der), (0x71, bytes([0]))]))]
+        )
         self.send_receive(0xDB, 0x3F, 0xFF, payload)
 
-    def import_p12(self, slot_id: str, p12_data: bytes, password: Optional[bytes], admin_key: bytes = DEFAULT_ADMIN_KEY) -> None:
+    def import_p12(
+        self,
+        slot_id: str,
+        p12_data: bytes,
+        password: Optional[bytes],
+        admin_key: bytes = DEFAULT_ADMIN_KEY,
+    ) -> None:
         """Import a PKCS#12 file (RSA 2048 only) into a slot."""
         private_key, certificate, _ = pkcs12.load_key_and_certificates(p12_data, password)
 
@@ -545,9 +581,7 @@ def import_p12(self, slot_id: str, p12_data: bytes, password: Optional[bytes], a
 
         self.authenticate_admin(admin_key)
         self.import_rsa2048(
-            key_ref,
-            private_key.private_numbers(),
-            private_key.public_key().public_numbers(),
+            key_ref, private_key.private_numbers(), private_key.public_key().public_numbers()
         )
         self._select_piv()
         self.authenticate_admin(admin_key)
@@ -568,16 +602,17 @@ def list_slots(self) -> list[PivSlotInfo]:
                         logger.warning(f"Failed to parse cert for slot {slot_id}: {e}")
             except PivError as e:
                 logger.debug(f"Error reading slot {slot_id}: {e}")
-            slots.append(PivSlotInfo(
-                slot_id=slot_id,
-                display_name=SLOT_DISPLAY_NAMES[slot_id],
-                cert=cert_info,
-            ))
+            slots.append(
+                PivSlotInfo(
+                    slot_id=slot_id, display_name=SLOT_DISPLAY_NAMES[slot_id], cert=cert_info
+                )
+            )
         return slots
 
 
 # ─── Helpers ──────────────────────────────────────────────────────────────────
 
+
 def _encode_pin(pin: str) -> bytes:
     body = pin.encode("utf-8")
     if len(body) > 8:
@@ -599,6 +634,7 @@ def _prepare_pkcs1v15_sha256(data: bytes) -> bytes:
 
 # ─── PIV signing proxy classes (wrap device signing for cert generation) ──────
 
+
 class _RsaPivSigner(rsa.RSAPrivateKey):
     def __init__(self, device: PivApp, key_ref: int, public_key: rsa.RSAPublicKey) -> None:
         self._device = device

nitrokeyapp/piv_tab/ui.py

@@ -15,11 +15,13 @@
 class PivPinUi(QObject):
     """Prompt for PIV PIN via a modal dialog (runs in the UI thread)."""
 
-    query = Signal(int)   # emitted from worker thread; delivered to UI thread
+    query = Signal(int)  # emitted from worker thread; delivered to UI thread
     queried = Signal(str)
     cancelled = Signal()
 
-    def __init__(self, app_widget: QWidget, title: str = "PIV PIN", label: str = "Enter PIV PIN:") -> None:
+    def __init__(
+        self, app_widget: QWidget, title: str = "PIV PIN", label: str = "Enter PIV PIN:"
+    ) -> None:
         super().__init__(app_widget)
         self.app_widget = app_widget
         self.title = title
@@ -30,20 +32,15 @@ def __init__(self, app_widget: QWidget, title: str = "PIV PIN", label: str = "En
     def _show_dialog(self, retries: int) -> None:
         label = f"{self.label} (remaining retries: {retries})" if retries >= 0 else self.label
         pin, ok = QInputDialog.getText(
-            self.app_widget,
-            self.title,
-            label,
-            QLineEdit.EchoMode.Password,
+            self.app_widget, self.title, label, QLineEdit.EchoMode.Password
         )
         if ok and pin:
             self.queried.emit(pin)
         else:
             self.cancelled.emit()
 
     def connect_actions(
-        self,
-        queried: Optional[Callable[[str], None]],
-        cancelled: Optional[Callable[[], None]],
+        self, queried: Optional[Callable[[str], None]], cancelled: Optional[Callable[[], None]]
     ) -> "PivPinUiConnection":
         conn = PivPinUiConnection(self)
         if queried:

nitrokeyapp/piv_tab/worker.py

@@ -17,7 +17,7 @@
 from nitrokeyapp.device_data import DeviceData
 from nitrokeyapp.worker import Job, Worker
 
-from .data import DEFAULT_ADMIN_KEY, PivApp, PivError, PivSlotInfo
+from .data import DEFAULT_ADMIN_KEY, PivApp, PivError
 from .ui import PivPinUi, PivPinUiConnection
 
 logger = logging.getLogger(__name__)
@@ -55,6 +55,7 @@ def update(self, data: DeviceData, pin: str) -> None:
 
 # ─── Jobs ─────────────────────────────────────────────────────────────────────
 
+
 class CheckDeviceJob(Job):
     device_checked = Signal(bool)
 
@@ -271,6 +272,7 @@ def _do_generate(self, pin: str, pin_was_queried: bool = False) -> None:
 
 # ─── Worker ───────────────────────────────────────────────────────────────────
 
+
 class PivWorker(Worker):
     device_checked = Signal(bool)
     slots_listed = Signal(list)
@@ -315,7 +317,7 @@ def reset_piv(self, data: DeviceData) -> None:
         job.piv_reset.connect(self.piv_reset)
         self.run(job)
 
-    @Slot(DeviceData, str, bytes, object, bytes)
+    @Slot(DeviceData, str, bytes, object, bytes)  # type: ignore[arg-type]
     def import_p12(
         self,
         data: DeviceData,