From bb11de1addbec3985dd9d375fcb11354e9475de2 Mon Sep 17 00:00:00 2001
From: Florian Franzen <Florian.Franzen@gmail.com>
Date: Sat, 3 Oct 2026 15:12:24 +0200
Subject: [PATCH] Derive the serial number from the device uuid

---
 CHANGELOG.md               |  1 +
 src/lib.rs                 | 10 ++++++++--
 tests/command_response.ron | 20 ++++++++++++++++++++
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e1a0096..7df95d56 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
   default (5)
 - Fix the inverted parsing of the touch requirement in SET MANAGEMENT KEY's P2
   (0xFF means no touch, 0xFE means touch required)
+- Derive the GET SERIAL response from the device uuid instead of a shared constant
 
 ## [v0.7.0][] (2026-08-17)
 
diff --git a/src/lib.rs b/src/lib.rs
index 52aefebf..7a9aa1c5 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -197,8 +197,14 @@ where
         info!("yubico extension: {:?}", instruction);
         match instruction {
             YubicoPivExtension::GetSerial => {
-                // make up a 4-byte serial
-                reply.extend_from_slice(&[0x00, 0x52, 0xf7, 0x43]).ok();
+                // derive a stable per-device serial from the uuid; fall back to
+                // a made-up constant on platforms that do not provide one
+                let serial = self
+                    .options
+                    .uuid
+                    .map(|uuid| [uuid[0], uuid[1], uuid[2], uuid[3]])
+                    .unwrap_or([0x00, 0x52, 0xf7, 0x43]);
+                reply.extend_from_slice(&serial).ok();
             }
 
             YubicoPivExtension::GetVersion => {
diff --git a/tests/command_response.ron b/tests/command_response.ron
index 7bc7ecea..7f100cf9 100644
--- a/tests/command_response.ron
+++ b/tests/command_response.ron
@@ -487,6 +487,26 @@
             )
         ]
     ),
+    IoTest(
+        name: "Serial derived from the uuid",
+        uuid_config: WithUuid("00112233445566778899AABBCCDDEEFF"),
+        cmd_resp: [
+            IoData(
+                input: "00 F8 00 00 00",
+                output: Data("00 11 22 33"),
+            ),
+        ]
+    ),
+    IoTest(
+        name: "Serial without a uuid",
+        uuid_config: None,
+        cmd_resp: [
+            IoData(
+                input: "00 F8 00 00 00",
+                output: Data("00 52 F7 43"),
+            ),
+        ]
+    ),
     IoTest(
         name: "Protected DOS",
         uuid_config: WithBoth("00112233445566778899AABBCCDDEEFF"),