Derive the GET SERIAL response from the device UUID

CHANGELOG.md

@@ -8,6 +8,7 @@
   default (5)
 - Fix the inverted parsing of the touch requirement in SET MANAGEMENT KEY's P2
   (0xFF means no touch, 0xFE means touch required)
+- Derive the GET SERIAL response from the device uuid instead of a shared constant
 
 ## [v0.7.0][] (2026-08-17)
 

src/lib.rs

@@ -197,8 +197,14 @@ where
         info!("yubico extension: {:?}", instruction);
         match instruction {
             YubicoPivExtension::GetSerial => {
-                // make up a 4-byte serial
-                reply.extend_from_slice(&[0x00, 0x52, 0xf7, 0x43]).ok();
+                // derive a stable per-device serial from the uuid; fall back to
+                // a made-up constant on platforms that do not provide one
+                let serial = self
+                    .options
+                    .uuid
+                    .map(|uuid| [uuid[0], uuid[1], uuid[2], uuid[3]])
+                    .unwrap_or([0x00, 0x52, 0xf7, 0x43]);
+                reply.extend_from_slice(&serial).ok();
             }
 
             YubicoPivExtension::GetVersion => {

tests/command_response.ron

@@ -487,6 +487,26 @@
             )
         ]
     ),
+    IoTest(
+        name: "Serial derived from the uuid",
+        uuid_config: WithUuid("00112233445566778899AABBCCDDEEFF"),
+        cmd_resp: [
+            IoData(
+                input: "00 F8 00 00 00",
+                output: Data("00 11 22 33"),
+            ),
+        ]
+    ),
+    IoTest(
+        name: "Serial without a uuid",
+        uuid_config: None,
+        cmd_resp: [
+            IoData(
+                input: "00 F8 00 00 00",
+                output: Data("00 52 F7 43"),
+            ),
+        ]
+    ),
     IoTest(
         name: "Protected DOS",
         uuid_config: WithBoth("00112233445566778899AABBCCDDEEFF"),