Add CredentialIdVersion::V2 using AES-256-GCM

CHANGELOG.md

@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Increment the signature counter by a positive random number per assertion.
 - Add the `Config::new` method to create an instance with the default values.
 - Add support for multiple credential ID versions and add the `credential_id_version` field to `Config`.
+- Add `CredentialIdVersion::V2` using AES-256-GCM.
 
 ## [v0.4.0-rc.1](https://github.com/trussed-dev/fido-authenticator/releases/tag/v0.4.0-rc.1) (2026-05-29)
 

Cargo.toml

@@ -24,7 +24,7 @@ serde_bytes = { version = "0.11.14", default-features = false }
 serde-indexed = "0.1"
 sha2 = { version = "0.10", default-features = false }
 trussed-chunked = { version = "0.3", optional = true }
-trussed-core = { version = "0.2", features = ["aes256-cbc", "certificate-client", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "hmac-sha256", "management-client", "p256", "sha256", "ui-client"] }
+trussed-core = { version = "0.2.2", features = ["aes256-cbc", "certificate-client", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "hmac-sha256", "management-client", "p256", "sha256", "ui-client"] }
 trussed-fs-info = "0.3"
 trussed-hkdf = "0.4"
 
@@ -34,6 +34,8 @@ apdu-dispatch = ["dep:apdu-app"]
 ctaphid-dispatch = ["dep:ctaphid-app"]
 disable-reset-time-window = []
 
+credential-id-format-v2 = ["trussed-core/aes256-gcm"]
+
 # enables support for a large-blob array longer than 1024 bytes
 chunked = ["dep:trussed-chunked"]
 
@@ -67,7 +69,7 @@ rand = "0.8.4"
 rand_chacha = "0.3"
 sha2 = "0.10"
 serde_test = "1.0.176"
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b", features = ["virt"] }
+trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "ad577412599156ac98f29ee969e76537e506f2bc", features = ["virt"] }
 trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "v0.4.0", features = ["chunked", "hkdf", "virt", "fs-info"] }
 trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "017921df0930707c4af68882ccb1f8b3f1bbf7c5", default-features = false, features = ["ctaphid"] }
 usbd-ctaphid = "0.4"
@@ -77,7 +79,7 @@ x509-parser = "0.16"
 features = ["chunked", "dispatch"]
 
 [patch.crates-io]
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b" }
+trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "ad577412599156ac98f29ee969e76537e506f2bc" }
 
 [profile.test]
 opt-level = 2

fuzz/Cargo.toml

@@ -24,5 +24,5 @@ doc = false
 bench = false
 
 [patch.crates-io]
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b" }
+trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "ad577412599156ac98f29ee969e76537e506f2bc" }
 trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "v0.4.0" }

src/credential.rs

@@ -45,12 +45,17 @@ pub enum CredentialIdVersion {
     /// Private keys for non-resident credentials are wrapped using Chacha8Poly1305, serialized
     /// credential is encrypted using Chacha8Poly1305.
     V1,
+    /// Like `V1`, but using AES-256-GCM instead of Chacha8Poly1305.
+    #[cfg(feature = "credential-id-format-v2")]
+    V2,
 }
 
 impl CredentialIdVersion {
     fn mechanism(self) -> Mechanism {
         match self {
             Self::V1 => Mechanism::Chacha8Poly1305,
+            #[cfg(feature = "credential-id-format-v2")]
+            Self::V2 => Mechanism::Aes256Gcm,
         }
     }