From c7b2575dd0632bab9f87cb1f9d44c419373df62f Mon Sep 17 00:00:00 2001
From: Florian Franzen <Florian.Franzen@gmail.com>
Date: Sat, 3 Oct 2026 15:21:25 +0200
Subject: [PATCH] Answer partial (RID) application selection

---
 CHANGELOG.md               |  2 ++
 Cargo.toml                 |  2 +-
 src/constants.rs           |  3 ++-
 tests/command_response.ron | 20 ++++++++++++++++++++
 tests/command_response.rs  |  2 +-
 5 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e1a0096..1dcad75f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@
   default (5)
 - Fix the inverted parsing of the touch requirement in SET MANAGEMENT KEY's P2
   (0xFF means no touch, 0xFE means touch required)
+- Truncate the application identifier at the 5 byte RID so SELECT with a partial
+  AID is answered
 
 ## [v0.7.0][] (2026-08-17)
 
diff --git a/Cargo.toml b/Cargo.toml
index 8ad1af7b..f9ba0b47 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,7 +23,7 @@ delog = { version = "0.1.5", optional = true }
 flexiber = { version = "0.2", features = ["derive", "heapless"] }
 heapless = "0.9.1"
 hex-literal = "1"
-iso7816 = "0.2.0"
+iso7816 = "0.2.2"
 serde = { version = "1", default-features = false, features = ["derive"] }
 trussed-auth = "0.5"
 untrusted = "0.9"
diff --git a/src/constants.rs b/src/constants.rs
index 29c94c8e..f4a31dfd 100644
--- a/src/constants.rs
+++ b/src/constants.rs
@@ -23,8 +23,9 @@ pub const DERIVED_PIV_PIX: [u8; 6] = hex!("0000 2000 0100");
 pub const PIV_TRUNCATED_AID: [u8; 9] = hex!("A000000308 00001000");
 
 // pub const PIV_AID: &[u8] = &hex!("A000000308 00001000 0100");
+// Truncatable down to the 5 byte RID, which is what Yubico clients select with
 pub const PIV_AID: iso7816::Aid =
-    iso7816::Aid::new_truncatable(&hex!("A000000308 00001000 0100"), 9);
+    iso7816::Aid::new_truncatable(&hex!("A000000308 00001000 0100"), 5);
 
 pub const DERIVED_PIV_AID: [u8; 11] = hex!("A000000308 00002000 0100");
 
diff --git a/tests/command_response.ron b/tests/command_response.ron
index 7bc7ecea..5d930325 100644
--- a/tests/command_response.ron
+++ b/tests/command_response.ron
@@ -13,6 +13,26 @@
             Select
         ]
     ),
+    IoTest(
+        name: "Select by RID",
+        cmd_resp: [
+            // Yubico ecosystem clients select with only the 5 byte RID
+            IoData(
+                input: "00 A4 04 00 05 A000000308",
+                output: NonZero,
+            ),
+            // the full AID still works
+            IoData(
+                input: "00 A4 04 00 0B A000000308 00001000 0100",
+                output: NonZero,
+            ),
+            // a different PIX under the same RID is not answered by the app
+            IoData(
+                input: "00 A4 04 00 0B A000000308 00002000 0100",
+                expected_status: NotFound,
+            ),
+        ]
+    ),
     IoTest(
         name: "Bad management key",
         cmd_resp: [
diff --git a/tests/command_response.rs b/tests/command_response.rs
index b0e2287d..a9bb951b 100644
--- a/tests/command_response.rs
+++ b/tests/command_response.rs
@@ -733,7 +733,7 @@ impl IoCmd {
                     "4f 05 a000000308"
         )));
         Self::run_bytes(
-            &hex!("00 A4 04 00 0C A000000308000010000100 00"),
+            &hex!("00 A4 04 00 0B A000000308000010000100 00"),
             &matcher,
             Status::Success,
             card,