dr8/yubico-pam — comment on commit 2f3d5e721cbfc905582da6208495c1da6dd2f79c
File:  line 0
By dr8:

Bug fix: pam_yubico did not use the client key to validate the server HMAC signature, allowing for various attacks.

With this fix, pam_yubico will validate the server responses using the HMAC signature, if a key is given, but will allow any signature if a key is not given.

This commit tidys up the code. The reason that my first commit (d705f429bc) failed, was that when the client_key was not set, it did not run the command ykclient_set_client_b64(), which had the unintended side effect of not setting the value of the client_id in the ykclient, so all attempts to use pam_yubico without setting a client key failed.

My second commit also worked, but was a bit heavy handed, because I hadn't quite pieced together what was going wrong, and my C is very rusty, particularly around pointers.