mirror of
https://github.com/trussed-dev/fido-authenticator.git
synced 2026-06-20 04:16:16 -07:00
Remove associated data in wrapping of keys
Trussed itself already ignored this associated data (https://github.com/trussed-dev/trussed/pull/108), and the unwrapping was already performed with no associated data. Not removing it would lead to breakage once (https://github.com/trussed-dev/trussed/pull/108) is merged. Adding the AD to the unwrapping step would break compatibility with currently registerd credentials. Security: This is not an issue because the credentials stored locally contain the proper app id which is checked when the credential is decrypted.
This commit is contained in:
committed by
Nicolas Stalder
parent
0e56942591
commit
f788d2a248
@@ -344,7 +344,6 @@ mod test {
|
||||
fn credential_data() -> CredentialData {
|
||||
use ctap_types::webauthn::{PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity};
|
||||
|
||||
|
||||
CredentialData {
|
||||
rp: PublicKeyCredentialRpEntity {
|
||||
id: String::from("John Doe"),
|
||||
@@ -424,7 +423,6 @@ mod test {
|
||||
fn random_credential_data() -> CredentialData {
|
||||
use ctap_types::webauthn::{PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity};
|
||||
|
||||
|
||||
CredentialData {
|
||||
rp: PublicKeyCredentialRpEntity {
|
||||
id: random_string(),
|
||||
|
||||
+2
-2
@@ -63,7 +63,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
|
||||
let wrapped_key =
|
||||
syscall!(self
|
||||
.trussed
|
||||
.wrap_key_chacha8poly1305(wrapping_key, private_key, ®.app_id,))
|
||||
.wrap_key_chacha8poly1305(wrapping_key, private_key, &[]))
|
||||
.wrapped_key;
|
||||
// debug!("wrapped_key = {:?}", &wrapped_key);
|
||||
|
||||
@@ -208,7 +208,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
|
||||
let key_result = syscall!(self.trussed.unwrap_key_chacha8poly1305(
|
||||
wrapping_key,
|
||||
bytes,
|
||||
b"",
|
||||
&[],
|
||||
Location::Volatile,
|
||||
))
|
||||
.key;
|
||||
|
||||
+6
-8
@@ -320,12 +320,11 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
|
||||
false => {
|
||||
// WrappedKey version
|
||||
let wrapping_key = self.state.persistent.key_wrapping_key(&mut self.trussed)?;
|
||||
let wrapped_key = syscall!(self.trussed.wrap_key_chacha8poly1305(
|
||||
wrapping_key,
|
||||
private_key,
|
||||
&rp_id_hash,
|
||||
))
|
||||
.wrapped_key;
|
||||
let wrapped_key =
|
||||
syscall!(self
|
||||
.trussed
|
||||
.wrap_key_chacha8poly1305(wrapping_key, private_key, &[]))
|
||||
.wrapped_key;
|
||||
|
||||
// 32B key, 12B nonce, 16B tag + some info on algorithm (P256/Ed25519)
|
||||
// Turns out it's size 92 (enum serialization not optimized yet...)
|
||||
@@ -1465,8 +1464,7 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
|
||||
let key_result = syscall!(self.trussed.unwrap_key_chacha8poly1305(
|
||||
wrapping_key,
|
||||
&bytes,
|
||||
b"",
|
||||
// &rp_id_hash,
|
||||
&[],
|
||||
Location::Volatile,
|
||||
))
|
||||
.key;
|
||||
|
||||
Reference in New Issue
Block a user