Module phone 

A security key held against the phone (NFC) or plugged into its USB-C port, as Sioul’s own backend of openpgp-card: Android has no smart card service, so the card’s APDUs travel through a Link (the app’s, over Android’s IsoDep, or CCID over its USB host API), and the card itself is read, given its PIN and used by the same code as on a computer (super::ocard). docs/android.md, “Your security key”.

• One visit. The PIN is asked first, from what Sioul knows of the key, then one visit reads it, checks it is the one known, gives its PIN and signs or opens: one tap over NFC, while it is held; plugged in, the same, its touch asked as on a computer (PhoneReaders::taps, PhoneReaders::by_cable).
• Either way. A key plugged in comes first; else one held. A phone without NFC, or with NFC off, still takes a key plugged in (PhoneReaders::reach_note); Android’s refusal to let Sioul use the key plugged in, and another app holding it, are said as such.
• What the phone carries. Each exchange at most what its NFC controller takes; extended length only where the phone says it takes it (limit): else short APDUs, which openpgp-card chains and whose long answers it reads with GET RESPONSE.
• Nothing left unlocked. At the end of each opening, the PIN’s two checks are undone (VERIFY with P1 = FF, OpenPGP card specification 3.4.1, §7.2.2), before the key is let go: no other app finds it unlocked while it stays near the phone. Android then hands it to no other app until it has left the field (the app’s link).
• A key moved away mid-way is said as such (CardError::Removed); a card that is no OpenPGP card (a bank card), as such.
• Nothing is logged, here or in the link: never an APDU’s bytes.

Structs

Held

A key held against the phone, as the phone carries it.

PhoneBackend 🔒

PhoneReaders

Keys held against the phone, behind openpgp-card.

PhoneTransaction 🔒

Enums

LinkError

Why an exchange failed.

LinkState

Whether this phone can reach a key now.

Reach

What the link reaches now.

Via

How the key in reach came.

Constants

HELD

The name a key held to the phone goes by: none, since it leaves the field after each use (the PIN memory never ties itself to it).

MOST_EXCHANGES

The most exchanges one visit makes: a visit takes a few dozen (an RSA key’s chained ciphertext included); a card that answers “more bytes” (61xx) without end would keep openpgp-card reading, and growing its answer, until the key left (review of 23 October 2026, F5).

Statics

LINK 🔒

Traits

Link

What carries APDUs between Sioul and a key held to the phone: the app’s, over Android’s NFC; a stand-in in tests.

Functions

limit

What a phone carries in one exchange, for openpgp-card: extended length only where both the key and the phone take it, each exchange within the phone’s frame; else short APDUs (255 bytes of data, 256 of answer).

link

The link given, if any.

set_link

The app’s link to keys held to the phone, given once as it starts.

unverify 🔒

The PIN’s two checks undone (VERIFY, P1 = FF, for PW1 in modes 81 and 82), so that the key stays unlocked for no one once Sioul is done with it. A key that does not take it answers so, and the end of the field ends its checks anyway.