ctap.h File Reference

Internal FIDO2 CTAP defines, structures and function declarations. More...

Detailed Description

Internal FIDO2 CTAP defines, structures and function declarations.

Author

Nils Ollrogge nils..nosp@m.ollr.nosp@m.ogge@.nosp@m.fu-b.nosp@m.erlin.nosp@m..de

Definition in file ctap.h.

#include <stdint.h>
#include "mutex.h"
#include "cbor.h"
#include "assert.h"
#include "crypto/modes/ccm.h"
#include "timex.h"
#include "board.h"
#include "fido2/ctap.h"
#include "fido2/ctap/ctap_crypto.h"

Include dependency graph for ctap.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	ctap_config_t
	CTAP authenticator config struct. More...
struct	ctap_state_t
	CTAP state struct. More...
struct	ctap_options_t
	CTAP options struct. More...
struct	ctap_user_ent_t
	CTAP user entity struct. More...
struct	ctap_rp_ent_t
	CTAP relying party entity struct. More...
struct	ctap_public_key_cose_t
	CTAP cose key struct. More...
struct	ctap_cred_desc
	CTAP credential description struct. More...
struct	ctap_resident_key
	CTAP resident key struct. More...
struct	ctap_cred_id_t
	CTAP credential ID. More...
struct	ctap_cred_desc_alt
	CTAP credential description alternative struct. More...
struct	ctap_make_credential_req_t
	CTAP make credential request struct. More...
struct	ctap_get_assertion_req_t
	CTAP get assertion request struct. More...
struct	ctap_client_pin_req_t
	CTAP client pin request struct. More...
struct	ctap_attested_cred_data_header_t
	CTAP attested credential data header struct. More...
struct	ctap_attested_cred_data_t
	CTAP attested credential data struct. More...
struct	ctap_auth_data_header_t
	CTAP authenticator data header struct. More...
struct	ctap_auth_data_t
	CTAP authenticator data struct. More...
struct	ctap_info_t
	CTAP info struct. More...

Macros
#define	CTAP_PIN_AUTH_SZ   16
	Size of pin auth.
#define	CTAP_STACKSIZE   15000
	CTAP thread stack size.
#define	CTAP_UP_BUTTON   0
	CTAP user presence button.
#define	CONFIG_FIDO2_CTAP_DISABLE_UP   1
	Disable user presence test configuration.
#define	CTAP_UP_BUTTON_MODE   GPIO_IN_PU
	CTAP user presence button mode.
#define	CTAP_UP_BUTTON_FLANK   GPIO_FALLING
	CTAP user presence button flank.
#define	CONFIG_FIDO2_CTAP_DISABLE_LED   0
	Disable user presence test configuration.
#define	CTAP_RP_MAX_NAME_SIZE   32
	Max size of relying party name.
#define	CTAP_USER_MAX_NAME_SIZE   64 + 1
	Max size of username including null character.
#define	CTAP_USER_ID_MAX_SIZE   64
	Max size of user id.
#define	CTAP_DOMAIN_NAME_MAX_SIZE   253 + 1
	Max size of a domain name including null character.
#define	CTAP_ICON_MAX_SIZE   128 + 1
	Max size of icon including null character.
#define	CTAP_PIN_MIN_SIZE   4
	PIN min size.
#define	CTAP_PIN_ENC_MIN_SIZE   64
	Encrypted newPin min size.
#define	CTAP_PIN_ENC_MAX_SIZE   256
	Encrypted newPin max size.
#define	CTAP_PIN_MAX_SIZE   64
	PIN max size.
#define	CTAP_PIN_MAX_ATTS   8
	Max total consecutive incorrect PIN attempts.
#define	CTAP_PIN_MAX_ATTS_BOOT   3
	Max consecutive incorrect PIN attempts for 1 boot cycle.
#define	CTAP_PIN_PROT_VER   1
	PIN protocol version.
#define	CTAP_AMT_SUP_PIN_VER   1
	Total number of supported PIN protocol versions.
#define	CTAP_PIN_TOKEN_SZ   16
	Size of pin token.
#define	CTAP_CRED_KEY_LEN   16
	Size of key used to encrypt credential.
#define	CTAP_AES_CCM_L   2
	AES_CCM_L parameter.
#define	CTAP_AES_CCM_NONCE_SIZE   (15 - CTAP_AES_CCM_L)
	AES CCM nonce size.
#define	CTAP_CREDENTIAL_ID_ENC_SIZE
	Total size of AES CCM credential id.
#define	CTAP_UP_TIMEOUT   (15 * MS_PER_SEC)
	Timeout for user presence test.
#define	CTAP_GET_NEXT_ASSERTION_TIMEOUT   (30 * MS_PER_SEC)
	Max time between call to get_assertion or get_next_assertion until error is returned.
#define	CTAP_AAGUID   "9c295865fa2c36b705a42320af9c8f16"
	128 bit identifier of authenticator
#define	CTAP_AAGUID_SIZE   16
	CTAP size of authenticator AAGUID in bytes.
#define	CTAP_COSE_ALG_ES256   -7
	CTAP COSE Algorithms registry identifier for ES256.
#define	CTAP_COSE_ALG_ECDH_ES_HKDF_256   -25
	CTAP COSE Algorithms registry identifier for ECDH ES HKDF 256.
#define	CTAP_CREDENTIAL_ID_SIZE   16U
	CTAP size of credential id.
#define	CTAP_INITIALIZED_MARKER   0x4e
	CTAP state initialized marker.
#define	CTAP_MAX_EXCLUDE_LIST_SIZE   0x14
	Max size of allow list.

Typedefs
typedef struct ctap_cred_desc	ctap_cred_desc_t
	CTAP cred struct forward declaration.
typedef struct ctap_cred_desc_alt	ctap_cred_desc_alt_t
	Alternative CTAP cred struct forward declaration.
typedef struct ctap_resident_key	ctap_resident_key_t
	CTAP resident key credential forward declaration.

Functions
int	fido2_ctap_get_sig (const uint8_t *auth_data, size_t auth_data_len, const uint8_t *client_data_hash, const ctap_resident_key_t *rk, uint8_t *sig, size_t *sig_len)
	Create signature from authenticator data.
bool	fido2_ctap_cred_params_supported (uint8_t cred_type, int32_t alg_type)
	Check if requested algorithm is supported.
int	fido2_ctap_encrypt_rk (ctap_resident_key_t *rk, uint8_t *nonce, size_t nonce_len, ctap_cred_id_t *id)
	Encrypt resident key with AES CCM.
bool	fido2_ctap_pin_is_set (void)
	Check if PIN has been set on authenticator.
ctap_state_t *	fido2_ctap_get_state (void)
	Get a pointer to the authenticator state.

CTAP methods
#define	CTAP_MAKE_CREDENTIAL   0x01
	authenticatorMakeCredential method
#define	CTAP_GET_ASSERTION   0x02
	authenticatorGetAssertion method
#define	CTAP_GET_INFO   0x04
	authenticatorGetInfo method
#define	CTAP_CLIENT_PIN   0x06
	authenticatorClientPIN method
#define	CTAP_RESET   0x07
	authenticatorReset method
#define	CTAP_GET_NEXT_ASSERTION   0x08
	authenticatorGetNextAssertion method

CTAP authenticator data option flags
#define	CTAP_AUTH_DATA_FLAG_UP   (1 << 0)
	user present
#define	CTAP_AUTH_DATA_FLAG_UV   (1 << 2)
	user verified
#define	CTAP_AUTH_DATA_FLAG_AT   (1 << 6)
	attested credential data included
#define	CTAP_AUTH_DATA_FLAG_ED   (1 << 7)
	extension data included

CTAP version flags
#define	CTAP_VERSION_FLAG_FIDO_PRE   0x01
	FIDO 2.1 flag.
#define	CTAP_VERSION_FLAG_FIDO   0x02
	FIDO 2 flag.
#define	CTAP_VERSION_FLAG_U2F_V2   0x04
	U2F V2 flag.

CTAP get info response options map CBOR key values
All options are in the form key-value pairs with string IDs and boolean values
#define	CTAP_GET_INFO_RESP_OPTIONS_ID_PLAT   "plat"
	platform device string
#define	CTAP_GET_INFO_RESP_OPTIONS_ID_RK   "rk"
	resident key string
#define	CTAP_GET_INFO_RESP_OPTIONS_ID_CLIENT_PIN   "clientPin"
	client PIN string
#define	CTAP_GET_INFO_RESP_OPTIONS_ID_UP   "up"
	user presence string
#define	CTAP_GET_INFO_RESP_OPTIONS_ID_UV   "uv"
	user verification string

CTAP get info options flags
#define	CTAP_INFO_OPTIONS_FLAG_PLAT   (1 << 0)
	platform device flag
#define	CTAP_INFO_OPTIONS_FLAG_RK   (1 << 1)
	resident key flag
#define	CTAP_INFO_OPTIONS_FLAG_CLIENT_PIN   (1 << 2)
	clientPIN flag
#define	CTAP_INFO_OPTIONS_FLAG_UP   (1 << 3)
	user presence flag
#define	CTAP_INFO_OPTIONS_FLAG_UV   (1 << 4)
	user verification flag

CTAP Client PIN request subCommand CBOR key values
#define	CTAP_CP_REQ_SUB_COMMAND_GET_RETRIES   0x01
	getRetries subCommand
#define	CTAP_CP_REQ_SUB_COMMAND_GET_KEY_AGREEMENT   0x02
	getKeyAgreement subCommand
#define	CTAP_CP_REQ_SUB_COMMAND_SET_PIN   0x03
	setPIN subCommand
#define	CTAP_CP_REQ_SUB_COMMAND_CHANGE_PIN   0x04
	changePIN subCommand
#define	CTAP_CP_REQ_SUB_COMMAND_GET_PIN_TOKEN   0x05
	getPinToken subCommand

CTAP credential types
#define	CTAP_PUB_KEY_CRED_PUB_KEY   0x01
	public key credential type
#define	CTAP_PUB_KEY_CRED_UNKNOWN   0x02
	unknown credential type

CTAP COSE key CBOR map key values
#define	CTAP_COSE_KEY_LABEL_KTY   1
	key type identifier
#define	CTAP_COSE_KEY_LABEL_ALG   3
	algorithm identifier
#define	CTAP_COSE_KEY_LABEL_CRV   -1
	elliptic curve identifier
#define	CTAP_COSE_KEY_LABEL_X   -2
	x coordinate
#define	CTAP_COSE_KEY_LABEL_Y   -3
	y coordinate
#define	CTAP_COSE_KEY_KTY_EC2   2
	2 coordinate elliptic curve key identifier
#define	CTAP_COSE_KEY_CRV_P256   1
	secp256r1 elliptic curve key identifier