Answer partial (RID) application selection

CHANGELOG.md

@@ -8,6 +8,8 @@
   default (5)
 - Fix the inverted parsing of the touch requirement in SET MANAGEMENT KEY's P2
   (0xFF means no touch, 0xFE means touch required)
+- Truncate the application identifier at the 5 byte RID so SELECT with a partial
+  AID is answered
 
 ## [v0.7.0][] (2026-08-17)
 

Cargo.toml

@@ -23,7 +23,7 @@ delog = { version = "0.1.5", optional = true }
 flexiber = { version = "0.2", features = ["derive", "heapless"] }
 heapless = "0.9.1"
 hex-literal = "1"
-iso7816 = "0.2.0"
+iso7816 = "0.2.2"
 serde = { version = "1", default-features = false, features = ["derive"] }
 trussed-auth = "0.5"
 untrusted = "0.9"

src/constants.rs

@@ -23,8 +23,9 @@ pub const DERIVED_PIV_PIX: [u8; 6] = hex!("0000 2000 0100");
 pub const PIV_TRUNCATED_AID: [u8; 9] = hex!("A000000308 00001000");
 
 // pub const PIV_AID: &[u8] = &hex!("A000000308 00001000 0100");
+// Truncatable down to the 5 byte RID, which is what Yubico clients select with
 pub const PIV_AID: iso7816::Aid =
-    iso7816::Aid::new_truncatable(&hex!("A000000308 00001000 0100"), 9);
+    iso7816::Aid::new_truncatable(&hex!("A000000308 00001000 0100"), 5);
 
 pub const DERIVED_PIV_AID: [u8; 11] = hex!("A000000308 00002000 0100");
 

tests/command_response.ron

@@ -13,6 +13,26 @@
             Select
         ]
     ),
+    IoTest(
+        name: "Select by RID",
+        cmd_resp: [
+            // Yubico ecosystem clients select with only the 5 byte RID
+            IoData(
+                input: "00 A4 04 00 05 A000000308",
+                output: NonZero,
+            ),
+            // the full AID still works
+            IoData(
+                input: "00 A4 04 00 0B A000000308 00001000 0100",
+                output: NonZero,
+            ),
+            // a different PIX under the same RID is not answered by the app
+            IoData(
+                input: "00 A4 04 00 0B A000000308 00002000 0100",
+                expected_status: NotFound,
+            ),
+        ]
+    ),
     IoTest(
         name: "Bad management key",
         cmd_resp: [

tests/command_response.rs

@@ -733,7 +733,7 @@ impl IoCmd {
                     "4f 05 a000000308"
         )));
         Self::run_bytes(
-            &hex!("00 A4 04 00 0C A000000308000010000100 00"),
+            &hex!("00 A4 04 00 0B A000000308000010000100 00"),
             &matcher,
             Status::Success,
             card,