Update nitrokey crate to 0.4.0

This change finally updates the version of the nitrokey crate that we
consume to 0.4.0. Along with that we update rand_core, one of its
dependencies, to 0.5.1. Further more we add cfg-if in version 0.1.10 and
getrandom in version 0.1.13, both of which are now new (non-development)
dependencies.

Import subrepo nitrokey/:nitrokey at e81057037e9b4f370b64c0a030a725bc6bdfb870
Import subrepo cfg-if/:cfg-if at 4484a6faf816ff8058088ad857b0c6bb2f4b02b2
Import subrepo getrandom/:getrandom at d661aa7e1b8cc80b47dabe3d2135b3b47d2858af
Import subrepo rand/:rand at d877ed528248b52d947e0484364a4e1ae59ca502

20 files changed, 913 insertions, 734 deletions

diff --git a/nitrokey/.builds/archlinux-msrv.yml b/nitrokey/.builds/archlinux-msrv.yml
new file mode 100644
index 0000000..66c0390
--- /dev/null
+++ b/nitrokey/.builds/archlinux-msrv.yml
@@ -0,0 +1,22 @@
+# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
+# SPDX-License-Identifier: CC0-1.0
+image: archlinux
+packages:
+  - rustup
+  - libnitrokey
+environment:
+  USE_SYSTEM_LIBNITROKEY: "1"
+sources:
+  - https://git.ireas.org/nitrokey-rs
+tasks:
+  - setup: |
+      rustup set profile minimal
+      rustup default 1.34.2
+  - version: |
+      rustc -V
+  - build: |
+      cd nitrokey-rs
+      cargo build --release
+  - test: |
+      cd nitrokey-rs
+      cargo test
diff --git a/nitrokey/.builds/archlinux-use-system-lib.yml b/nitrokey/.builds/archlinux-use-system-lib.yml
index ac0fc0f..29bda19 100644
--- a/nitrokey/.builds/archlinux-use-system-lib.yml
+++ b/nitrokey/.builds/archlinux-use-system-lib.yml
@@ -1,5 +1,5 @@
 # Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: CC0-1.0
 image: archlinux
 packages:
   - rust
@@ -9,9 +9,17 @@ environment:
 sources:
   - https://git.ireas.org/nitrokey-rs
 tasks:
+  - version: |
+      rustc -V
   - build: |
       cd nitrokey-rs
       cargo build --release
   - test: |
       cd nitrokey-rs
       cargo test
+  - format: |
+      cd nitrokey-rs
+      cargo fmt -- --check
+  - clippy: |
+      cd nitrokey-rs
+      cargo clippy -- -D warnings
diff --git a/nitrokey/.builds/archlinux.yml b/nitrokey/.builds/archlinux.yml
index dfe2639..151eb66 100644
--- a/nitrokey/.builds/archlinux.yml
+++ b/nitrokey/.builds/archlinux.yml
@@ -1,5 +1,5 @@
 # Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: CC0-1.0
 image: archlinux
 packages:
   - rust
diff --git a/nitrokey/.builds/lint.yml b/nitrokey/.builds/lint.yml
index 86a27cd..678cde8 100644
--- a/nitrokey/.builds/lint.yml
+++ b/nitrokey/.builds/lint.yml
@@ -1,27 +1,16 @@
 # Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: CC0-1.0
 image: archlinux
 packages:
-  - rustup
-  - python
-  - python-pip
-  - python-pygit2
+  - gnupg
+  - reuse
 sources:
   - https://git.ireas.org/nitrokey-rs
 tasks:
-  - setup: |
-      pip install --user fsfe-reuse
-      rustup update stable
-      rustup self upgrade-data
-      rustup default stable
-      rustup component add rustfmt
-      rustup component add clippy
-  - format: |
+  - verify: |
       cd nitrokey-rs
-      cargo fmt -- --check
+      curl -s "https://pgp.ireas.org/0x6D533958F070C57C.txt" | gpg --import
+      git verify-commit HEAD
   - reuse: |
       cd nitrokey-rs
-      ~/.local/bin/reuse lint
-  - clippy: |
-      cd nitrokey-rs
-      cargo clippy -- -D warnings
+      reuse lint
diff --git a/nitrokey/.gitignore b/nitrokey/.gitignore
index 4cdf3b3..7ea18df 100644
--- a/nitrokey/.gitignore
+++ b/nitrokey/.gitignore
@@ -1,4 +1,5 @@
-
+# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
+# SPDX-License-Identifier: CC0-1.0
 /target
 /nitrokey-sys/target
 **/*.rs.bk
diff --git a/nitrokey/CHANGELOG.md b/nitrokey/CHANGELOG.md
index 3051d0f..d4451bc 100644
--- a/nitrokey/CHANGELOG.md
+++ b/nitrokey/CHANGELOG.md
@@ -1,9 +1,9 @@
 <!---
-Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-SPDX-License-Identifier: MIT
+Copyright (C) 2019-2020 Robin Krahl <robin.krahl@ireas.org>
+SPDX-License-Identifier: CC0-1.0
 -->
 
-# Unreleased
+# v0.4.0 (2020-01-02)
 - Remove the `test-pro` and `test-storage` features.
 - Implement `Display` for `Version`.
 - Introduce `DEFAULT_ADMIN_PIN` and `DEFAULT_USER_PIN` constants.
@@ -38,9 +38,12 @@ SPDX-License-Identifier: MIT
   - Implement `DerefMut` for `User<T>` and `Admin<T>`.
   - Add `device_mut` method to `DeviceWrapper`.
   - Require a mutable `Device` reference if a method changes the device state.
-- Update the `nitrokey-sys` dependency to version 3.5.0.
-- Update the `nitrokey-test` dependency to version 0.3 and add the
-  `nitrokey-test-state` dependency in version 0.1.0.
+- Update dependencies:
+  - `nitrokey-sys` to 3.5
+  - `nitrokey-test` to 0.3
+  - `rand_core` to 0.5
+  - `rand_os` to 0.2
+- Add `nitrokey-test-state` dependency in version 0.1.
 - Refactor connection management:
   - Add `ConcurrentAccessError` and `PoisonError` `Error` variants.
   - Add the `Manager` struct that manages connections to Nitrokey devices.
@@ -48,6 +51,10 @@ SPDX-License-Identifier: MIT
   - Add the `into_manager` function to the `Device` trait.
   - Add the `force_take` function that ignores a `PoisonError` when accessing
     the manager instance.
+- Internally refactor the `device` module into submodules.
+
+# v0.3.5 (2019-12-16)
+- Update the nitrokey-sys dependency version specification to ~3.4.
 
 # v0.3.4 (2019-01-20)
 - Fix authentication methods that assumed that `char` is signed.
diff --git a/nitrokey/Cargo.toml b/nitrokey/Cargo.toml
index 62eea02..b57591b 100644
--- a/nitrokey/Cargo.toml
+++ b/nitrokey/Cargo.toml
@@ -1,9 +1,9 @@
-# Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-# SPDX-License-Identifier: MIT
+# Copyright (C) 2019-2020 Robin Krahl <robin.krahl@ireas.org>
+# SPDX-License-Identifier: CC0-1.0
 
 [package]
 name = "nitrokey"
-version = "0.4.0-alpha.3"
+version = "0.4.0"
 authors = ["Robin Krahl <robin.krahl@ireas.org>"]
 edition = "2018"
 homepage = "https://code.ireas.org/nitrokey-rs/"
@@ -17,12 +17,11 @@ license = "MIT"
 exclude = [".builds/*"]
 
 [dependencies]
-lazy_static = "1.2.0"
+lazy_static = "1.2"
 libc = "0.2"
 nitrokey-sys = "3.5"
-rand_core = {version = "0.3", default-features = false, features = ["std"] }
-rand_os = {version = "0.1"}
+rand_core = {version = "0.5.1", features = ["getrandom"] }
 
 [dev-dependencies]
 nitrokey-test = "0.3"
-nitrokey-test-state = "0.1.0"
+nitrokey-test-state = "0.1"
diff --git a/nitrokey/LICENSES/CC0-1.0.txt b/nitrokey/LICENSES/CC0-1.0.txt
new file mode 100644
index 0000000..0e259d4
--- /dev/null
+++ b/nitrokey/LICENSES/CC0-1.0.txt
@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.
diff --git a/nitrokey/LICENSE b/nitrokey/LICENSES/MIT.txt
index 6c67cd5..6c67cd5 100644
--- a/nitrokey/LICENSE
+++ b/nitrokey/LICENSES/MIT.txt
diff --git a/nitrokey/README.md b/nitrokey/README.md
index a29ac6f..12a9f6d 100644
--- a/nitrokey/README.md
+++ b/nitrokey/README.md
@@ -1,6 +1,6 @@
 <!---
 Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-SPDX-License-Identifier: MIT
+SPDX-License-Identifier: CC0-1.0
 -->
 
 # nitrokey-rs
@@ -55,14 +55,18 @@ Note that the tests assume that the device’s passwords are the factory default
 (admin PIN `12345678`, user PIN `123456`, update password `12345678`) and that
 an AES key has been built.  Some tests will overwrite the data stored on the
 Nitrokey device or perform a factory reset.  Never execute the tests if you
-unless yout want to destroy all data on all connected Nitrokey devices!
+don’t want to destroy all data on any connected Nitrokey device!
 
 ## Acknowledgments
 
-Thanks to Nitrokey UG for providing a Nitrokey Storage to support the
+Thanks to Nitrokey UG for providing two Nitrokey devices to support the
 development of this crate.  Thanks to Daniel Mueller for contributions to
 `nitrokey-rs` and for the `nitrokey-test` crate.
 
+## Minimum Supported Rust Version
+
+This crate supports Rust 1.34.2 or later.
+
 ## Contact
 
 For bug reports, patches, feature requests or other messages, please send a
@@ -70,16 +74,19 @@ mail to [nitrokey-rs-dev@ireas.org][].
 
 ## License
 
-This project is licensed under the [MIT License][].  `libnitrokey` is licensed
-under the [LGPL-3.0][].
+This project is licensed under the [MIT][] license.  The documentation and
+configuration files contained in this repository are licensed under the
+[Creative Commons Zero][CC0] license.  You can find a copy of the license texts
+in the `LICENSES` directory.  `libnitrokey` is licensed under the [LGPL-3.0][].
 
-`nitrokey-rs` complies with [version 2.0 of the REUSE practices][reuse].
+`nitrokey-rs` complies with [version 3.0 of the REUSE specification][reuse].
 
 [Documentation]: https://docs.rs/nitrokey
 [Nitrokey udev rules]: https://www.nitrokey.com/documentation/frequently-asked-questions-faq#openpgp-card-not-available
 [`libnitrokey`]: https://github.com/nitrokey/libnitrokey
 [`nitrokey-test`]: https://github.com/d-e-s-o/nitrokey-test
 [nitrokey-rs-dev@ireas.org]: mailto:nitrokey-rs-dev@ireas.org
-[MIT license]: https://opensource.org/licenses/MIT
+[MIT]: https://opensource.org/licenses/MIT
+[CC0]: https://creativecommons.org/publicdomain/zero/1.0/
 [LGPL-3.0]: https://opensource.org/licenses/lgpl-3.0.html
-[reuse]: https://reuse.software/practices/2.0/
+[reuse]: https://reuse.software/practices/3.0/
diff --git a/nitrokey/TODO.md b/nitrokey/TODO.md
index efa66d3..54525ef 100644
--- a/nitrokey/TODO.md
+++ b/nitrokey/TODO.md
@@ -1,6 +1,6 @@
 <!---
 Copyright (C) 2019 Robin Krahl <robin.krahl@ireas.org>
-SPDX-License-Identifier: MIT
+SPDX-License-Identifier: CC0-1.0
 -->
 
 - Add support for the currently unsupported commands:
diff --git a/nitrokey/src/auth.rs b/nitrokey/src/auth.rs
index 0b000f7..cab1021 100644
--- a/nitrokey/src/auth.rs
+++ b/nitrokey/src/auth.rs
@@ -1,6 +1,7 @@
 // Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
 // SPDX-License-Identifier: MIT
 
+use std::convert::TryFrom as _;
 use std::marker;
 use std::ops;
 use std::os::raw::c_char;
diff --git a/nitrokey/src/config.rs b/nitrokey/src/config.rs
index c273792..cb678d7 100644
--- a/nitrokey/src/config.rs
+++ b/nitrokey/src/config.rs
@@ -1,6 +1,8 @@
 // Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
 // SPDX-License-Identifier: MIT
 
+use std::convert;
+
 use crate::error::{Error, LibraryError};
 
 /// The configuration for a Nitrokey.
@@ -68,8 +70,10 @@ impl Config {
     }
 }
 
-impl RawConfig {
-    pub fn try_from(config: Config) -> Result<RawConfig, Error> {
+impl convert::TryFrom<Config> for RawConfig {
+    type Error = Error;
+
+    fn try_from(config: Config) -> Result<RawConfig, Error> {
         Ok(RawConfig {
             numlock: option_to_config_otp_slot(config.numlock)?,
             capslock: option_to_config_otp_slot(config.capslock)?,
diff --git a/nitrokey/src/device/mod.rs b/nitrokey/src/device/mod.rs
new file mode 100644
index 0000000..5e15f08
--- /dev/null
+++ b/nitrokey/src/device/mod.rs
@@ -0,0 +1,464 @@
+// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
+// SPDX-License-Identifier: MIT
+
+mod pro;
+mod storage;
+mod wrapper;
+
+use std::fmt;
+
+use libc;
+use nitrokey_sys;
+
+use crate::auth::Authenticate;
+use crate::config::{Config, RawConfig};
+use crate::error::{CommunicationError, Error};
+use crate::otp::GenerateOtp;
+use crate::pws::GetPasswordSafe;
+use crate::util::{
+    get_command_result, get_cstring, get_last_error, result_from_string, result_or_error,
+};
+
+pub use pro::Pro;
+pub use storage::{
+    SdCardData, Storage, StorageProductionInfo, StorageStatus, VolumeMode, VolumeStatus,
+};
+pub use wrapper::DeviceWrapper;
+
+/// Available Nitrokey models.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Model {
+    /// The Nitrokey Storage.
+    Storage,
+    /// The Nitrokey Pro.
+    Pro,
+}
+
+impl fmt::Display for Model {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match *self {
+            Model::Pro => "Pro",
+            Model::Storage => "Storage",
+        })
+    }
+}
+
+/// A firmware version for a Nitrokey device.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct FirmwareVersion {
+    /// The major firmware version, e. g. 0 in v0.40.
+    pub major: u8,
+    /// The minor firmware version, e. g. 40 in v0.40.
+    pub minor: u8,
+}
+
+impl fmt::Display for FirmwareVersion {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "v{}.{}", self.major, self.minor)
+    }
+}
+
+/// A Nitrokey device.
+///
+/// This trait provides the commands that can be executed without authentication and that are
+/// present on all supported Nitrokey devices.
+pub trait Device<'a>: Authenticate<'a> + GetPasswordSafe<'a> + GenerateOtp + fmt::Debug {
+    /// Returns the [`Manager`][] instance that has been used to connect to this device.
+    ///
+    /// # Example
+    ///
+    /// ```
+    /// use nitrokey::{Device, DeviceWrapper};
+    ///
+    /// fn do_something(device: DeviceWrapper) {
+    ///     // reconnect to any device
+    ///     let manager = device.into_manager();
+    ///     let device = manager.connect();
+    ///     // do something with the device
+    ///     // ...
+    /// }
+    ///
+    /// match nitrokey::take()?.connect() {
+    ///     Ok(device) => do_something(device),
+    ///     Err(err) => println!("Could not connect to a Nitrokey: {}", err),
+    /// }
+    /// # Ok::<(), nitrokey::Error>(())
+    /// ```
+    fn into_manager(self) -> &'a mut crate::Manager;
+
+    /// Returns the model of the connected Nitrokey device.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let device = manager.connect()?;
+    /// println!("Connected to a Nitrokey {}", device.get_model());
+    /// #    Ok(())
+    /// # }
+    fn get_model(&self) -> Model;
+
+    /// Returns the serial number of the Nitrokey device.  The serial number is the string
+    /// representation of a hex number.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let device = manager.connect()?;
+    /// match device.get_serial_number() {
+    ///     Ok(number) => println!("serial no: {}", number),
+    ///     Err(err) => eprintln!("Could not get serial number: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    fn get_serial_number(&self) -> Result<String, Error> {
+        result_from_string(unsafe { nitrokey_sys::NK_device_serial_number() })
+    }
+
+    /// Returns the number of remaining authentication attempts for the user.  The total number of
+    /// available attempts is three.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let device = manager.connect()?;
+    /// let count = device.get_user_retry_count();
+    /// match device.get_user_retry_count() {
+    ///     Ok(count) => println!("{} remaining authentication attempts (user)", count),
+    ///     Err(err) => eprintln!("Could not get user retry count: {}", err),
+    /// }
+    /// #     Ok(())
+    /// # }
+    /// ```
+    fn get_user_retry_count(&self) -> Result<u8, Error> {
+        result_or_error(unsafe { nitrokey_sys::NK_get_user_retry_count() })
+    }
+
+    /// Returns the number of remaining authentication attempts for the admin.  The total number of
+    /// available attempts is three.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let device = manager.connect()?;
+    /// let count = device.get_admin_retry_count();
+    /// match device.get_admin_retry_count() {
+    ///     Ok(count) => println!("{} remaining authentication attempts (admin)", count),
+    ///     Err(err) => eprintln!("Could not get admin retry count: {}", err),
+    /// }
+    /// #     Ok(())
+    /// # }
+    /// ```
+    fn get_admin_retry_count(&self) -> Result<u8, Error> {
+        result_or_error(unsafe { nitrokey_sys::NK_get_admin_retry_count() })
+    }
+
+    /// Returns the firmware version.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let device = manager.connect()?;
+    /// match device.get_firmware_version() {
+    ///     Ok(version) => println!("Firmware version: {}", version),
+    ///     Err(err) => eprintln!("Could not access firmware version: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    fn get_firmware_version(&self) -> Result<FirmwareVersion, Error> {
+        let major = result_or_error(unsafe { nitrokey_sys::NK_get_major_firmware_version() })?;
+        let minor = result_or_error(unsafe { nitrokey_sys::NK_get_minor_firmware_version() })?;
+        Ok(FirmwareVersion { major, minor })
+    }
+
+    /// Returns the current configuration of the Nitrokey device.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let device = manager.connect()?;
+    /// let config = device.get_config()?;
+    /// println!("numlock binding:          {:?}", config.numlock);
+    /// println!("capslock binding:         {:?}", config.capslock);
+    /// println!("scrollock binding:        {:?}", config.scrollock);
+    /// println!("require password for OTP: {:?}", config.user_password);
+    /// #     Ok(())
+    /// # }
+    /// ```
+    fn get_config(&self) -> Result<Config, Error> {
+        let config_ptr = unsafe { nitrokey_sys::NK_read_config() };
+        if config_ptr.is_null() {
+            return Err(get_last_error());
+        }
+        let config_array_ptr = config_ptr as *const [u8; 5];
+        let raw_config = unsafe { RawConfig::from(*config_array_ptr) };
+        unsafe { libc::free(config_ptr as *mut libc::c_void) };
+        Ok(raw_config.into())
+    }
+
+    /// Changes the administrator PIN.
+    ///
+    /// # Errors
+    ///
+    /// - [`InvalidString`][] if one of the provided passwords contains a null byte
+    /// - [`WrongPassword`][] if the current admin password is wrong
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let mut device = manager.connect()?;
+    /// match device.change_admin_pin("12345678", "12345679") {
+    ///     Ok(()) => println!("Updated admin PIN."),
+    ///     Err(err) => eprintln!("Failed to update admin PIN: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    ///
+    /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
+    /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
+    fn change_admin_pin(&mut self, current: &str, new: &str) -> Result<(), Error> {
+        let current_string = get_cstring(current)?;
+        let new_string = get_cstring(new)?;
+        get_command_result(unsafe {
+            nitrokey_sys::NK_change_admin_PIN(current_string.as_ptr(), new_string.as_ptr())
+        })
+    }
+
+    /// Changes the user PIN.
+    ///
+    /// # Errors
+    ///
+    /// - [`InvalidString`][] if one of the provided passwords contains a null byte
+    /// - [`WrongPassword`][] if the current user password is wrong
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let mut device = manager.connect()?;
+    /// match device.change_user_pin("123456", "123457") {
+    ///     Ok(()) => println!("Updated admin PIN."),
+    ///     Err(err) => eprintln!("Failed to update admin PIN: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    ///
+    /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
+    /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
+    fn change_user_pin(&mut self, current: &str, new: &str) -> Result<(), Error> {
+        let current_string = get_cstring(current)?;
+        let new_string = get_cstring(new)?;
+        get_command_result(unsafe {
+            nitrokey_sys::NK_change_user_PIN(current_string.as_ptr(), new_string.as_ptr())
+        })
+    }
+
+    /// Unlocks the user PIN after three failed login attempts and sets it to the given value.
+    ///
+    /// # Errors
+    ///
+    /// - [`InvalidString`][] if one of the provided passwords contains a null byte
+    /// - [`WrongPassword`][] if the admin password is wrong
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let mut device = manager.connect()?;
+    /// match device.unlock_user_pin("12345678", "123456") {
+    ///     Ok(()) => println!("Unlocked user PIN."),
+    ///     Err(err) => eprintln!("Failed to unlock user PIN: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    ///
+    /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
+    /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
+    fn unlock_user_pin(&mut self, admin_pin: &str, user_pin: &str) -> Result<(), Error> {
+        let admin_pin_string = get_cstring(admin_pin)?;
+        let user_pin_string = get_cstring(user_pin)?;
+        get_command_result(unsafe {
+            nitrokey_sys::NK_unlock_user_password(
+                admin_pin_string.as_ptr(),
+                user_pin_string.as_ptr(),
+            )
+        })
+    }
+
+    /// Locks the Nitrokey device.
+    ///
+    /// This disables the password store if it has been unlocked.  On the Nitrokey Storage, this
+    /// also disables the volumes if they have been enabled.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let mut device = manager.connect()?;
+    /// match device.lock() {
+    ///     Ok(()) => println!("Locked the Nitrokey device."),
+    ///     Err(err) => eprintln!("Could not lock the Nitrokey device: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    fn lock(&mut self) -> Result<(), Error> {
+        get_command_result(unsafe { nitrokey_sys::NK_lock_device() })
+    }
+
+    /// Performs a factory reset on the Nitrokey device.
+    ///
+    /// This commands performs a factory reset on the smart card (like the factory reset via `gpg
+    /// --card-edit`) and then clears the flash memory (password safe, one-time passwords etc.).
+    /// After a factory reset, [`build_aes_key`][] has to be called before the password safe or the
+    /// encrypted volume can be used.
+    ///
+    /// # Errors
+    ///
+    /// - [`InvalidString`][] if the provided password contains a null byte
+    /// - [`WrongPassword`][] if the admin password is wrong
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let mut device = manager.connect()?;
+    /// match device.factory_reset("12345678") {
+    ///     Ok(()) => println!("Performed a factory reset."),
+    ///     Err(err) => eprintln!("Could not perform a factory reset: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    ///
+    /// [`build_aes_key`]: #method.build_aes_key
+    fn factory_reset(&mut self, admin_pin: &str) -> Result<(), Error> {
+        let admin_pin_string = get_cstring(admin_pin)?;
+        get_command_result(unsafe { nitrokey_sys::NK_factory_reset(admin_pin_string.as_ptr()) })
+    }
+
+    /// Builds a new AES key on the Nitrokey.
+    ///
+    /// The AES key is used to encrypt the password safe and the encrypted volume.  You may need
+    /// to call this method after a factory reset, either using [`factory_reset`][] or using `gpg
+    /// --card-edit`.  You can also use it to destroy the data stored in the password safe or on
+    /// the encrypted volume.
+    ///
+    /// # Errors
+    ///
+    /// - [`InvalidString`][] if the provided password contains a null byte
+    /// - [`WrongPassword`][] if the admin password is wrong
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use nitrokey::Device;
+    /// # use nitrokey::Error;
+    ///
+    /// # fn try_main() -> Result<(), Error> {
+    /// let mut manager = nitrokey::take()?;
+    /// let mut device = manager.connect()?;
+    /// match device.build_aes_key("12345678") {
+    ///     Ok(()) => println!("New AES keys have been built."),
+    ///     Err(err) => eprintln!("Could not build new AES keys: {}", err),
+    /// };
+    /// #     Ok(())
+    /// # }
+    /// ```
+    ///
+    /// [`factory_reset`]: #method.factory_reset
+    fn build_aes_key(&mut self, admin_pin: &str) -> Result<(), Error> {
+        let admin_pin_string = get_cstring(admin_pin)?;
+        get_command_result(unsafe { nitrokey_sys::NK_build_aes_key(admin_pin_string.as_ptr()) })
+    }
+}
+
+fn get_connected_model() -> Option<Model> {
+    match unsafe { nitrokey_sys::NK_get_device_model() } {
+        nitrokey_sys::NK_device_model_NK_PRO => Some(Model::Pro),
+        nitrokey_sys::NK_device_model_NK_STORAGE => Some(Model::Storage),
+        _ => None,
+    }
+}
+
+pub(crate) fn create_device_wrapper(
+    manager: &mut crate::Manager,
+    model: Model,
+) -> DeviceWrapper<'_> {
+    match model {
+        Model::Pro => Pro::new(manager).into(),
+        Model::Storage => Storage::new(manager).into(),
+    }
+}
+
+pub(crate) fn get_connected_device(
+    manager: &mut crate::Manager,
+) -> Result<DeviceWrapper<'_>, Error> {
+    match get_connected_model() {
+        Some(model) => Ok(create_device_wrapper(manager, model)),
+        None => Err(CommunicationError::NotConnected.into()),
+    }
+}
+
+pub(crate) fn connect_enum(model: Model) -> bool {
+    let model = match model {
+        Model::Storage => nitrokey_sys::NK_device_model_NK_STORAGE,
+        Model::Pro => nitrokey_sys::NK_device_model_NK_PRO,
+    };
+    unsafe { nitrokey_sys::NK_login_enum(model) == 1 }
+}
diff --git a/nitrokey/src/device/pro.rs b/nitrokey/src/device/pro.rs
new file mode 100644
index 0000000..a65345e
--- /dev/null
+++ b/nitrokey/src/device/pro.rs
@@ -0,0 +1,79 @@
+// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
+// SPDX-License-Identifier: MIT
+
+use nitrokey_sys;
+
+use crate::device::{Device, Model};
+use crate::otp::GenerateOtp;
+
+/// A Nitrokey Pro device without user or admin authentication.
+///
+/// Use the [`connect`][] method to obtain an instance wrapper or the [`connect_pro`] method to
+/// directly obtain an instance.  If you want to execute a command that requires user or admin
+/// authentication, use [`authenticate_admin`][] or [`authenticate_user`][].
+///
+/// # Examples
+///
+/// Authentication with error handling:
+///
+/// ```no_run
+/// use nitrokey::{Authenticate, User, Pro};
+/// # use nitrokey::Error;
+///
+/// fn perform_user_task<'a>(device: &User<'a, Pro<'a>>) {}
+/// fn perform_other_task(device: &Pro) {}
+///
+/// # fn try_main() -> Result<(), Error> {
+/// let mut manager = nitrokey::take()?;
+/// let device = manager.connect_pro()?;
+/// let device = match device.authenticate_user("123456") {
+///     Ok(user) => {
+///         perform_user_task(&user);
+///         user.device()
+///     },
+///     Err((device, err)) => {
+///         eprintln!("Could not authenticate as user: {}", err);
+///         device
+///     },
+/// };
+/// perform_other_task(&device);
+/// #     Ok(())
+/// # }
+/// ```
+///
+/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin
+/// [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user
+/// [`connect`]: struct.Manager.html#method.connect
+/// [`connect_pro`]: struct.Manager.html#method.connect_pro
+#[derive(Debug)]
+pub struct Pro<'a> {
+    manager: Option<&'a mut crate::Manager>,
+}
+
+impl<'a> Pro<'a> {
+    pub(crate) fn new(manager: &'a mut crate::Manager) -> Pro<'a> {
+        Pro {
+            manager: Some(manager),
+        }
+    }
+}
+
+impl<'a> Drop for Pro<'a> {
+    fn drop(&mut self) {
+        unsafe {
+            nitrokey_sys::NK_logout();
+        }
+    }
+}
+
+impl<'a> Device<'a> for Pro<'a> {
+    fn into_manager(mut self) -> &'a mut crate::Manager {
+        self.manager.take().unwrap()
+    }
+
+    fn get_model(&self) -> Model {
+        Model::Pro
+    }
+}
+
+impl<'a> GenerateOtp for Pro<'a> {}
diff --git a/nitrokey/src/device.rs b/nitrokey/src/device/storage.rs
index 758d4c1..370ce36 100644
--- a/nitrokey/src/device.rs
+++ b/nitrokey/src/device/storage.rs
@@ -3,163 +3,12 @@
 
 use std::fmt;
 
-use libc;
 use nitrokey_sys;
 
-use crate::auth::Authenticate;
-use crate::config::{Config, RawConfig};
-use crate::error::{CommunicationError, Error};
+use crate::device::{Device, FirmwareVersion, Model};
+use crate::error::Error;
 use crate::otp::GenerateOtp;
-use crate::pws::GetPasswordSafe;
-use crate::util::{
-    get_command_result, get_cstring, get_last_error, result_from_string, result_or_error,
-};
-
-/// Available Nitrokey models.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum Model {
-    /// The Nitrokey Storage.
-    Storage,
-    /// The Nitrokey Pro.
-    Pro,
-}
-
-impl fmt::Display for Model {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(match *self {
-            Model::Pro => "Pro",
-            Model::Storage => "Storage",
-        })
-    }
-}
-
-/// The access mode of a volume on the Nitrokey Storage.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub enum VolumeMode {
-    /// A read-only volume.
-    ReadOnly,
-    /// A read-write volume.
-    ReadWrite,
-}
-
-impl fmt::Display for VolumeMode {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(match *self {
-            VolumeMode::ReadOnly => "read-only",
-            VolumeMode::ReadWrite => "read-write",
-        })
-    }
-}
-
-/// A wrapper for a Nitrokey device of unknown type.
-///
-/// Use the [`connect`][] method to obtain a wrapped instance.  The wrapper implements all traits
-/// that are shared between all Nitrokey devices so that the shared functionality can be used
-/// without knowing the type of the underlying device.  If you want to use functionality that is
-/// not available for all devices, you have to extract the device.
-///
-/// # Examples
-///
-/// Authentication with error handling:
-///
-/// ```no_run
-/// use nitrokey::{Authenticate, DeviceWrapper, User};
-/// # use nitrokey::Error;
-///
-/// fn perform_user_task<'a>(device: &User<'a, DeviceWrapper<'a>>) {}
-/// fn perform_other_task(device: &DeviceWrapper) {}
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect()?;
-/// let device = match device.authenticate_user("123456") {
-///     Ok(user) => {
-///         perform_user_task(&user);
-///         user.device()
-///     },
-///     Err((device, err)) => {
-///         eprintln!("Could not authenticate as user: {}", err);
-///         device
-///     },
-/// };
-/// perform_other_task(&device);
-/// #     Ok(())
-/// # }
-/// ```
-///
-/// Device-specific commands:
-///
-/// ```no_run
-/// use nitrokey::{DeviceWrapper, Storage};
-/// # use nitrokey::Error;
-///
-/// fn perform_common_task(device: &DeviceWrapper) {}
-/// fn perform_storage_task(device: &Storage) {}
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect()?;
-/// perform_common_task(&device);
-/// match device {
-///     DeviceWrapper::Storage(storage) => perform_storage_task(&storage),
-///     _ => (),
-/// };
-/// #     Ok(())
-/// # }
-/// ```
-///
-/// [`connect`]: struct.Manager.html#method.connect
-#[derive(Debug)]
-pub enum DeviceWrapper<'a> {
-    /// A Nitrokey Storage device.
-    Storage(Storage<'a>),
-    /// A Nitrokey Pro device.
-    Pro(Pro<'a>),
-}
-
-/// A Nitrokey Pro device without user or admin authentication.
-///
-/// Use the [`connect`][] method to obtain an instance wrapper or the [`connect_pro`] method to
-/// directly obtain an instance.  If you want to execute a command that requires user or admin
-/// authentication, use [`authenticate_admin`][] or [`authenticate_user`][].
-///
-/// # Examples
-///
-/// Authentication with error handling:
-///
-/// ```no_run
-/// use nitrokey::{Authenticate, User, Pro};
-/// # use nitrokey::Error;
-///
-/// fn perform_user_task<'a>(device: &User<'a, Pro<'a>>) {}
-/// fn perform_other_task(device: &Pro) {}
-///
-/// # fn try_main() -> Result<(), Error> {
-/// let mut manager = nitrokey::take()?;
-/// let device = manager.connect_pro()?;
-/// let device = match device.authenticate_user("123456") {
-///     Ok(user) => {
-///         perform_user_task(&user);
-///         user.device()
-///     },
-///     Err((device, err)) => {
-///         eprintln!("Could not authenticate as user: {}", err);
-///         device
-///     },
-/// };
-/// perform_other_task(&device);
-/// #     Ok(())
-/// # }
-/// ```
-///
-/// [`authenticate_admin`]: trait.Authenticate.html#method.authenticate_admin
-/// [`authenticate_user`]: trait.Authenticate.html#method.authenticate_user
-/// [`connect`]: struct.Manager.html#method.connect
-/// [`connect_pro`]: struct.Manager.html#method.connect_pro
-#[derive(Debug)]
-pub struct Pro<'a> {
-    manager: Option<&'a mut crate::Manager>,
-}
+use crate::util::{get_command_result, get_cstring};
 
 /// A Nitrokey Storage device without user or admin authentication.
 ///
@@ -205,6 +54,24 @@ pub struct Storage<'a> {
     manager: Option<&'a mut crate::Manager>,
 }
 
+/// The access mode of a volume on the Nitrokey Storage.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum VolumeMode {
+    /// A read-only volume.
+    ReadOnly,
+    /// A read-write volume.
+    ReadWrite,
+}
+
+impl fmt::Display for VolumeMode {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match *self {
+            VolumeMode::ReadOnly => "read-only",
+            VolumeMode::ReadWrite => "read-write",
+        })
+    }
+}
+
 /// The status of a volume on a Nitrokey Storage device.
 #[derive(Debug)]
 pub struct VolumeStatus {
@@ -231,21 +98,6 @@ pub struct SdCardData {
     pub manufacturer: u8,
 }
 
-/// A firmware version for a Nitrokey device.
-#[derive(Clone, Copy, Debug, PartialEq)]
-pub struct FirmwareVersion {
-    /// The major firmware version, e. g. 0 in v0.40.
-    pub major: u8,
-    /// The minor firmware version, e. g. 40 in v0.40.
-    pub minor: u8,
-}
-
-impl fmt::Display for FirmwareVersion {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "v{}.{}", self.major, self.minor)
-    }
-}
-
 /// Production information for a Storage device.
 #[derive(Debug)]
 pub struct StorageProductionInfo {
@@ -289,503 +141,6 @@ pub struct StorageStatus {
     pub stick_initialized: bool,
 }
 
-/// A Nitrokey device.
-///
-/// This trait provides the commands that can be executed without authentication and that are
-/// present on all supported Nitrokey devices.
-pub trait Device<'a>: Authenticate<'a> + GetPasswordSafe<'a> + GenerateOtp + fmt::Debug {
-    /// Returns the [`Manager`][] instance that has been used to connect to this device.
-    ///
-    /// # Example
-    ///
-    /// ```
-    /// use nitrokey::{Device, DeviceWrapper};
-    ///
-    /// fn do_something(device: DeviceWrapper) {
-    ///     // reconnect to any device
-    ///     let manager = device.into_manager();
-    ///     let device = manager.connect();
-    ///     // do something with the device
-    ///     // ...
-    /// }
-    ///
-    /// # fn main() -> Result<(), nitrokey::Error> {
-    /// match nitrokey::take()?.connect() {
-    ///     Ok(device) => do_something(device),
-    ///     Err(err) => println!("Could not connect to a Nitrokey: {}", err),
-    /// }
-    /// #     Ok(())
-    /// # }
-    /// ```
-    fn into_manager(self) -> &'a mut crate::Manager;
-
-    /// Returns the model of the connected Nitrokey device.
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let device = manager.connect()?;
-    /// println!("Connected to a Nitrokey {}", device.get_model());
-    /// #    Ok(())
-    /// # }
-    fn get_model(&self) -> Model;
-
-    /// Returns the serial number of the Nitrokey device.  The serial number is the string
-    /// representation of a hex number.
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let device = manager.connect()?;
-    /// match device.get_serial_number() {
-    ///     Ok(number) => println!("serial no: {}", number),
-    ///     Err(err) => eprintln!("Could not get serial number: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    fn get_serial_number(&self) -> Result<String, Error> {
-        result_from_string(unsafe { nitrokey_sys::NK_device_serial_number() })
-    }
-
-    /// Returns the number of remaining authentication attempts for the user.  The total number of
-    /// available attempts is three.
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let device = manager.connect()?;
-    /// let count = device.get_user_retry_count();
-    /// match device.get_user_retry_count() {
-    ///     Ok(count) => println!("{} remaining authentication attempts (user)", count),
-    ///     Err(err) => eprintln!("Could not get user retry count: {}", err),
-    /// }
-    /// #     Ok(())
-    /// # }
-    /// ```
-    fn get_user_retry_count(&self) -> Result<u8, Error> {
-        result_or_error(unsafe { nitrokey_sys::NK_get_user_retry_count() })
-    }
-
-    /// Returns the number of remaining authentication attempts for the admin.  The total number of
-    /// available attempts is three.
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let device = manager.connect()?;
-    /// let count = device.get_admin_retry_count();
-    /// match device.get_admin_retry_count() {
-    ///     Ok(count) => println!("{} remaining authentication attempts (admin)", count),
-    ///     Err(err) => eprintln!("Could not get admin retry count: {}", err),
-    /// }
-    /// #     Ok(())
-    /// # }
-    /// ```
-    fn get_admin_retry_count(&self) -> Result<u8, Error> {
-        result_or_error(unsafe { nitrokey_sys::NK_get_admin_retry_count() })
-    }
-
-    /// Returns the firmware version.
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let device = manager.connect()?;
-    /// match device.get_firmware_version() {
-    ///     Ok(version) => println!("Firmware version: {}", version),
-    ///     Err(err) => eprintln!("Could not access firmware version: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    fn get_firmware_version(&self) -> Result<FirmwareVersion, Error> {
-        let major = result_or_error(unsafe { nitrokey_sys::NK_get_major_firmware_version() })?;
-        let minor = result_or_error(unsafe { nitrokey_sys::NK_get_minor_firmware_version() })?;
-        Ok(FirmwareVersion { major, minor })
-    }
-
-    /// Returns the current configuration of the Nitrokey device.
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let device = manager.connect()?;
-    /// let config = device.get_config()?;
-    /// println!("numlock binding:          {:?}", config.numlock);
-    /// println!("capslock binding:         {:?}", config.capslock);
-    /// println!("scrollock binding:        {:?}", config.scrollock);
-    /// println!("require password for OTP: {:?}", config.user_password);
-    /// #     Ok(())
-    /// # }
-    /// ```
-    fn get_config(&self) -> Result<Config, Error> {
-        let config_ptr = unsafe { nitrokey_sys::NK_read_config() };
-        if config_ptr.is_null() {
-            return Err(get_last_error());
-        }
-        let config_array_ptr = config_ptr as *const [u8; 5];
-        let raw_config = unsafe { RawConfig::from(*config_array_ptr) };
-        unsafe { libc::free(config_ptr as *mut libc::c_void) };
-        Ok(raw_config.into())
-    }
-
-    /// Changes the administrator PIN.
-    ///
-    /// # Errors
-    ///
-    /// - [`InvalidString`][] if one of the provided passwords contains a null byte
-    /// - [`WrongPassword`][] if the current admin password is wrong
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let mut device = manager.connect()?;
-    /// match device.change_admin_pin("12345678", "12345679") {
-    ///     Ok(()) => println!("Updated admin PIN."),
-    ///     Err(err) => eprintln!("Failed to update admin PIN: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    ///
-    /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
-    /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
-    fn change_admin_pin(&mut self, current: &str, new: &str) -> Result<(), Error> {
-        let current_string = get_cstring(current)?;
-        let new_string = get_cstring(new)?;
-        get_command_result(unsafe {
-            nitrokey_sys::NK_change_admin_PIN(current_string.as_ptr(), new_string.as_ptr())
-        })
-    }
-
-    /// Changes the user PIN.
-    ///
-    /// # Errors
-    ///
-    /// - [`InvalidString`][] if one of the provided passwords contains a null byte
-    /// - [`WrongPassword`][] if the current user password is wrong
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let mut device = manager.connect()?;
-    /// match device.change_user_pin("123456", "123457") {
-    ///     Ok(()) => println!("Updated admin PIN."),
-    ///     Err(err) => eprintln!("Failed to update admin PIN: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    ///
-    /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
-    /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
-    fn change_user_pin(&mut self, current: &str, new: &str) -> Result<(), Error> {
-        let current_string = get_cstring(current)?;
-        let new_string = get_cstring(new)?;
-        get_command_result(unsafe {
-            nitrokey_sys::NK_change_user_PIN(current_string.as_ptr(), new_string.as_ptr())
-        })
-    }
-
-    /// Unlocks the user PIN after three failed login attempts and sets it to the given value.
-    ///
-    /// # Errors
-    ///
-    /// - [`InvalidString`][] if one of the provided passwords contains a null byte
-    /// - [`WrongPassword`][] if the admin password is wrong
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let mut device = manager.connect()?;
-    /// match device.unlock_user_pin("12345678", "123456") {
-    ///     Ok(()) => println!("Unlocked user PIN."),
-    ///     Err(err) => eprintln!("Failed to unlock user PIN: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    ///
-    /// [`InvalidString`]: enum.LibraryError.html#variant.InvalidString
-    /// [`WrongPassword`]: enum.CommandError.html#variant.WrongPassword
-    fn unlock_user_pin(&mut self, admin_pin: &str, user_pin: &str) -> Result<(), Error> {
-        let admin_pin_string = get_cstring(admin_pin)?;
-        let user_pin_string = get_cstring(user_pin)?;
-        get_command_result(unsafe {
-            nitrokey_sys::NK_unlock_user_password(
-                admin_pin_string.as_ptr(),
-                user_pin_string.as_ptr(),
-            )
-        })
-    }
-
-    /// Locks the Nitrokey device.
-    ///
-    /// This disables the password store if it has been unlocked.  On the Nitrokey Storage, this
-    /// also disables the volumes if they have been enabled.
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let mut device = manager.connect()?;
-    /// match device.lock() {
-    ///     Ok(()) => println!("Locked the Nitrokey device."),
-    ///     Err(err) => eprintln!("Could not lock the Nitrokey device: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    fn lock(&mut self) -> Result<(), Error> {
-        get_command_result(unsafe { nitrokey_sys::NK_lock_device() })
-    }
-
-    /// Performs a factory reset on the Nitrokey device.
-    ///
-    /// This commands performs a factory reset on the smart card (like the factory reset via `gpg
-    /// --card-edit`) and then clears the flash memory (password safe, one-time passwords etc.).
-    /// After a factory reset, [`build_aes_key`][] has to be called before the password safe or the
-    /// encrypted volume can be used.
-    ///
-    /// # Errors
-    ///
-    /// - [`InvalidString`][] if the provided password contains a null byte
-    /// - [`WrongPassword`][] if the admin password is wrong
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let mut device = manager.connect()?;
-    /// match device.factory_reset("12345678") {
-    ///     Ok(()) => println!("Performed a factory reset."),
-    ///     Err(err) => eprintln!("Could not perform a factory reset: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    ///
-    /// [`build_aes_key`]: #method.build_aes_key
-    fn factory_reset(&mut self, admin_pin: &str) -> Result<(), Error> {
-        let admin_pin_string = get_cstring(admin_pin)?;
-        get_command_result(unsafe { nitrokey_sys::NK_factory_reset(admin_pin_string.as_ptr()) })
-    }
-
-    /// Builds a new AES key on the Nitrokey.
-    ///
-    /// The AES key is used to encrypt the password safe and the encrypted volume.  You may need
-    /// to call this method after a factory reset, either using [`factory_reset`][] or using `gpg
-    /// --card-edit`.  You can also use it to destroy the data stored in the password safe or on
-    /// the encrypted volume.
-    ///
-    /// # Errors
-    ///
-    /// - [`InvalidString`][] if the provided password contains a null byte
-    /// - [`WrongPassword`][] if the admin password is wrong
-    ///
-    /// # Example
-    ///
-    /// ```no_run
-    /// use nitrokey::Device;
-    /// # use nitrokey::Error;
-    ///
-    /// # fn try_main() -> Result<(), Error> {
-    /// let mut manager = nitrokey::take()?;
-    /// let mut device = manager.connect()?;
-    /// match device.build_aes_key("12345678") {
-    ///     Ok(()) => println!("New AES keys have been built."),
-    ///     Err(err) => eprintln!("Could not build new AES keys: {}", err),
-    /// };
-    /// #     Ok(())
-    /// # }
-    /// ```
-    ///
-    /// [`factory_reset`]: #method.factory_reset
-    fn build_aes_key(&mut self, admin_pin: &str) -> Result<(), Error> {
-        let admin_pin_string = get_cstring(admin_pin)?;
-        get_command_result(unsafe { nitrokey_sys::NK_build_aes_key(admin_pin_string.as_ptr()) })
-    }
-}
-
-fn get_connected_model() -> Option<Model> {
-    match unsafe { nitrokey_sys::NK_get_device_model() } {
-        nitrokey_sys::NK_device_model_NK_PRO => Some(Model::Pro),
-        nitrokey_sys::NK_device_model_NK_STORAGE => Some(Model::Storage),
-        _ => None,
-    }
-}
-
-pub(crate) fn create_device_wrapper(
-    manager: &mut crate::Manager,
-    model: Model,
-) -> DeviceWrapper<'_> {
-    match model {
-        Model::Pro => Pro::new(manager).into(),
-        Model::Storage => Storage::new(manager).into(),
-    }
-}
-
-pub(crate) fn get_connected_device(
-    manager: &mut crate::Manager,
-) -> Result<DeviceWrapper<'_>, Error> {
-    match get_connected_model() {
-        Some(model) => Ok(create_device_wrapper(manager, model)),
-        None => Err(CommunicationError::NotConnected.into()),
-    }
-}
-
-pub(crate) fn connect_enum(model: Model) -> bool {
-    let model = match model {
-        Model::Storage => nitrokey_sys::NK_device_model_NK_STORAGE,
-        Model::Pro => nitrokey_sys::NK_device_model_NK_PRO,
-    };
-    unsafe { nitrokey_sys::NK_login_enum(model) == 1 }
-}
-
-impl<'a> DeviceWrapper<'a> {
-    fn device(&self) -> &dyn Device<'a> {
-        match *self {
-            DeviceWrapper::Storage(ref storage) => storage,
-            DeviceWrapper::Pro(ref pro) => pro,
-        }
-    }
-
-    fn device_mut(&mut self) -> &mut dyn Device<'a> {
-        match *self {
-            DeviceWrapper::Storage(ref mut storage) => storage,
-            DeviceWrapper::Pro(ref mut pro) => pro,
-        }
-    }
-}
-
-impl<'a> From<Pro<'a>> for DeviceWrapper<'a> {
-    fn from(device: Pro<'a>) -> Self {
-        DeviceWrapper::Pro(device)
-    }
-}
-
-impl<'a> From<Storage<'a>> for DeviceWrapper<'a> {
-    fn from(device: Storage<'a>) -> Self {
-        DeviceWrapper::Storage(device)
-    }
-}
-
-impl<'a> GenerateOtp for DeviceWrapper<'a> {
-    fn get_hotp_slot_name(&self, slot: u8) -> Result<String, Error> {
-        self.device().get_hotp_slot_name(slot)
-    }
-
-    fn get_totp_slot_name(&self, slot: u8) -> Result<String, Error> {
-        self.device().get_totp_slot_name(slot)
-    }
-
-    fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> {
-        self.device_mut().get_hotp_code(slot)
-    }
-
-    fn get_totp_code(&self, slot: u8) -> Result<String, Error> {
-        self.device().get_totp_code(slot)
-    }
-}
-
-impl<'a> Device<'a> for DeviceWrapper<'a> {
-    fn into_manager(self) -> &'a mut crate::Manager {
-        match self {
-            DeviceWrapper::Pro(dev) => dev.into_manager(),
-            DeviceWrapper::Storage(dev) => dev.into_manager(),
-        }
-    }
-
-    fn get_model(&self) -> Model {
-        match *self {
-            DeviceWrapper::Pro(_) => Model::Pro,
-            DeviceWrapper::Storage(_) => Model::Storage,
-        }
-    }
-}
-
-impl<'a> Pro<'a> {
-    pub(crate) fn new(manager: &'a mut crate::Manager) -> Pro<'a> {
-        Pro {
-            manager: Some(manager),
-        }
-    }
-}
-
-impl<'a> Drop for Pro<'a> {
-    fn drop(&mut self) {
-        unsafe {
-            nitrokey_sys::NK_logout();
-        }
-    }
-}
-
-impl<'a> Device<'a> for Pro<'a> {
-    fn into_manager(mut self) -> &'a mut crate::Manager {
-        self.manager.take().unwrap()
-    }
-
-    fn get_model(&self) -> Model {
-        Model::Pro
-    }
-}
-
-impl<'a> GenerateOtp for Pro<'a> {}
-
 impl<'a> Storage<'a> {
     pub(crate) fn new(manager: &'a mut crate::Manager) -> Storage<'a> {
         Storage {
diff --git a/nitrokey/src/device/wrapper.rs b/nitrokey/src/device/wrapper.rs
new file mode 100644
index 0000000..a3a18f9
--- /dev/null
+++ b/nitrokey/src/device/wrapper.rs
@@ -0,0 +1,134 @@
+// Copyright (C) 2018-2019 Robin Krahl <robin.krahl@ireas.org>
+// SPDX-License-Identifier: MIT
+
+use crate::device::{Device, Model, Pro, Storage};
+use crate::error::Error;
+use crate::otp::GenerateOtp;
+
+/// A wrapper for a Nitrokey device of unknown type.
+///
+/// Use the [`connect`][] method to obtain a wrapped instance.  The wrapper implements all traits
+/// that are shared between all Nitrokey devices so that the shared functionality can be used
+/// without knowing the type of the underlying device.  If you want to use functionality that is
+/// not available for all devices, you have to extract the device.
+///
+/// # Examples
+///
+/// Authentication with error handling:
+///
+/// ```no_run
+/// use nitrokey::{Authenticate, DeviceWrapper, User};
+/// # use nitrokey::Error;
+///
+/// fn perform_user_task<'a>(device: &User<'a, DeviceWrapper<'a>>) {}
+/// fn perform_other_task(device: &DeviceWrapper) {}
+///
+/// # fn try_main() -> Result<(), Error> {
+/// let mut manager = nitrokey::take()?;
+/// let device = manager.connect()?;
+/// let device = match device.authenticate_user("123456") {
+///     Ok(user) => {
+///         perform_user_task(&user);
+///         user.device()
+///     },
+///     Err((device, err)) => {
+///         eprintln!("Could not authenticate as user: {}", err);
+///         device
+///     },
+/// };
+/// perform_other_task(&device);
+/// #     Ok(())
+/// # }
+/// ```
+///
+/// Device-specific commands:
+///
+/// ```no_run
+/// use nitrokey::{DeviceWrapper, Storage};
+/// # use nitrokey::Error;
+///
+/// fn perform_common_task(device: &DeviceWrapper) {}
+/// fn perform_storage_task(device: &Storage) {}
+///
+/// # fn try_main() -> Result<(), Error> {
+/// let mut manager = nitrokey::take()?;
+/// let device = manager.connect()?;
+/// perform_common_task(&device);
+/// match device {
+///     DeviceWrapper::Storage(storage) => perform_storage_task(&storage),
+///     _ => (),
+/// };
+/// #     Ok(())
+/// # }
+/// ```
+///
+/// [`connect`]: struct.Manager.html#method.connect
+#[derive(Debug)]
+pub enum DeviceWrapper<'a> {
+    /// A Nitrokey Storage device.
+    Storage(Storage<'a>),
+    /// A Nitrokey Pro device.
+    Pro(Pro<'a>),
+}
+
+impl<'a> DeviceWrapper<'a> {
+    fn device(&self) -> &dyn Device<'a> {
+        match *self {
+            DeviceWrapper::Storage(ref storage) => storage,
+            DeviceWrapper::Pro(ref pro) => pro,
+        }
+    }
+
+    fn device_mut(&mut self) -> &mut dyn Device<'a> {
+        match *self {
+            DeviceWrapper::Storage(ref mut storage) => storage,
+            DeviceWrapper::Pro(ref mut pro) => pro,
+        }
+    }
+}
+
+impl<'a> From<Pro<'a>> for DeviceWrapper<'a> {
+    fn from(device: Pro<'a>) -> Self {
+        DeviceWrapper::Pro(device)
+    }
+}
+
+impl<'a> From<Storage<'a>> for DeviceWrapper<'a> {
+    fn from(device: Storage<'a>) -> Self {
+        DeviceWrapper::Storage(device)
+    }
+}
+
+impl<'a> GenerateOtp for DeviceWrapper<'a> {
+    fn get_hotp_slot_name(&self, slot: u8) -> Result<String, Error> {
+        self.device().get_hotp_slot_name(slot)
+    }
+
+    fn get_totp_slot_name(&self, slot: u8) -> Result<String, Error> {
+        self.device().get_totp_slot_name(slot)
+    }
+
+    fn get_hotp_code(&mut self, slot: u8) -> Result<String, Error> {
+        self.device_mut().get_hotp_code(slot)
+    }
+
+    fn get_totp_code(&self, slot: u8) -> Result<String, Error> {
+        self.device().get_totp_code(slot)
+    }
+}
+
+impl<'a> Device<'a> for DeviceWrapper<'a> {
+    fn into_manager(self) -> &'a mut crate::Manager {
+        match self {
+            DeviceWrapper::Pro(dev) => dev.into_manager(),
+            DeviceWrapper::Storage(dev) => dev.into_manager(),
+        }
+    }
+
+    fn get_model(&self) -> Model {
+        match *self {
+            DeviceWrapper::Pro(_) => Model::Pro,
+            DeviceWrapper::Storage(_) => Model::Storage,
+        }
+    }
+}
diff --git a/nitrokey/src/lib.rs b/nitrokey/src/lib.rs
index a4402c5..059792d 100644
--- a/nitrokey/src/lib.rs
+++ b/nitrokey/src/lib.rs
@@ -243,14 +243,12 @@ impl Manager {
     ///
     /// fn do_something(device: DeviceWrapper) {}
     ///
-    /// # fn main() -> Result<(), nitrokey::Error> {
     /// let mut manager = nitrokey::take()?;
     /// match manager.connect() {
     ///     Ok(device) => do_something(device),
     ///     Err(err) => println!("Could not connect to a Nitrokey: {}", err),
     /// }
-    /// #     Ok(())
-    /// # }
+    /// # Ok::<(), nitrokey::Error>(())
     /// ```
     ///
     /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
@@ -276,13 +274,11 @@ impl Manager {
     ///
     /// fn do_something(device: DeviceWrapper) {}
     ///
-    /// # fn main() -> Result<(), nitrokey::Error> {
     /// match nitrokey::take()?.connect_model(Model::Pro) {
     ///     Ok(device) => do_something(device),
     ///     Err(err) => println!("Could not connect to a Nitrokey Pro: {}", err),
     /// }
-    /// #     Ok(())
-    /// # }
+    /// # Ok::<(), nitrokey::Error>(())
     /// ```
     ///
     /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
@@ -307,13 +303,11 @@ impl Manager {
     ///
     /// fn use_pro(device: Pro) {}
     ///
-    /// # fn main() -> Result<(), nitrokey::Error> {
     /// match nitrokey::take()?.connect_pro() {
     ///     Ok(device) => use_pro(device),
     ///     Err(err) => println!("Could not connect to the Nitrokey Pro: {}", err),
     /// }
-    /// #     Ok(())
-    /// # }
+    /// # Ok::<(), nitrokey::Error>(())
     /// ```
     ///
     /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
@@ -338,13 +332,11 @@ impl Manager {
     ///
     /// fn use_storage(device: Storage) {}
     ///
-    /// # fn main() -> Result<(), nitrokey::Error> {
     /// match nitrokey::take()?.connect_storage() {
     ///     Ok(device) => use_storage(device),
     ///     Err(err) => println!("Could not connect to the Nitrokey Storage: {}", err),
     /// }
-    /// #     Ok(())
-    /// # }
+    /// # Ok::<(), nitrokey::Error>(())
     /// ```
     ///
     /// [`NotConnected`]: enum.CommunicationError.html#variant.NotConnected
@@ -453,11 +445,9 @@ pub fn set_log_level(level: LogLevel) {
 /// # Example
 ///
 /// ```
-/// # fn main() -> Result<(), nitrokey::Error> {
 /// let version = nitrokey::get_library_version()?;
 /// println!("Using libnitrokey {}", version.git);
-/// #    Ok(())
-/// # }
+/// # Ok::<(), nitrokey::Error>(())
 /// ```
 ///
 /// [`Utf8Error`]: enum.Error.html#variant.Utf8Error
diff --git a/nitrokey/src/util.rs b/nitrokey/src/util.rs
index fdb73c3..5a56c55 100644
--- a/nitrokey/src/util.rs
+++ b/nitrokey/src/util.rs
@@ -5,8 +5,7 @@ use std::ffi::{CStr, CString};
 use std::os::raw::{c_char, c_int};
 
 use libc::{c_void, free};
-use rand_core::RngCore;
-use rand_os::OsRng;
+use rand_core::{OsRng, RngCore};
 
 use crate::error::{Error, LibraryError};
 
@@ -77,9 +76,8 @@ pub fn get_last_error() -> Error {
 }
 
 pub fn generate_password(length: usize) -> Result<Vec<u8>, Error> {
-    let mut rng = OsRng::new().map_err(|err| Error::RandError(Box::new(err)))?;
     let mut data = vec![0u8; length];
-    rng.fill_bytes(&mut data[..]);
+    OsRng.fill_bytes(&mut data[..]);
     Ok(data)
 }
 
diff --git a/nitrokey/tests/otp.rs b/nitrokey/tests/otp.rs
index aafda59..38cd8a9 100644
--- a/nitrokey/tests/otp.rs
+++ b/nitrokey/tests/otp.rs
@@ -44,12 +44,12 @@ where
     unwrap_ok!(device.authenticate_admin(DEFAULT_ADMIN_PIN))
 }
 
-fn configure_hotp(admin: &mut ConfigureOtp, counter: u8) {
+fn configure_hotp(admin: &mut dyn ConfigureOtp, counter: u8) {
     let slot_data = OtpSlotData::new(1, "test-hotp", HOTP_SECRET, OtpMode::SixDigits);
     assert_ok!((), admin.write_hotp_slot(slot_data, counter.into()));
 }
 
-fn check_hotp_codes(device: &mut GenerateOtp, offset: u8) {
+fn check_hotp_codes(device: &mut dyn GenerateOtp, offset: u8) {
     HOTP_CODES.iter().enumerate().for_each(|(i, code)| {
         if i >= offset as usize {
             assert_ok!(code.to_string(), device.get_hotp_code(1));
@@ -146,13 +146,13 @@ fn hotp_erase(device: DeviceWrapper) {
     assert_ok!("test2".to_string(), device.get_hotp_slot_name(2));
 }
 
-fn configure_totp(admin: &mut ConfigureOtp, factor: u64) {
+fn configure_totp(admin: &mut dyn ConfigureOtp, factor: u64) {
     let slot_data = OtpSlotData::new(1, "test-totp", TOTP_SECRET, OtpMode::EightDigits);
     let time_window = 30u64.checked_mul(factor).unwrap();
     assert_ok!((), admin.write_totp_slot(slot_data, time_window as u16));
 }
 
-fn check_totp_codes(device: &mut GenerateOtp, factor: u64, timestamp_size: TotpTimestampSize) {
+fn check_totp_codes(device: &mut dyn GenerateOtp, factor: u64, timestamp_size: TotpTimestampSize) {
     for (base_time, codes) in TOTP_CODES {
         let time = base_time.checked_mul(factor).unwrap();
         let is_u64 = time > u32::max_value() as u64;