From f788d2a248835dfae1b8d5a208a018c8656af8dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sosth=C3=A8ne=20Gu=C3=A9don?= <sosthene@nitrokey.com>
Date: Thu, 16 Mar 2023 15:07:47 +0100
Subject: [PATCH] Remove associated data in wrapping of keys

Trussed itself already ignored this associated data (https://github.com/trussed-dev/trussed/pull/108),
and the unwrapping was already performed with no associated data.
Not removing it would lead to breakage once (https://github.com/trussed-dev/trussed/pull/108) is merged.
Adding the AD to the unwrapping step would break compatibility with currently registerd credentials.

Security: This is not an issue because the credentials stored locally contain
the proper app id which is checked when the credential is decrypted.
---
 src/credential.rs |  2 --
 src/ctap1.rs      |  4 ++--
 src/ctap2.rs      | 14 ++++++--------
 3 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/src/credential.rs b/src/credential.rs
index ee45d6e..dac78c6 100644
--- a/src/credential.rs
+++ b/src/credential.rs
@@ -344,7 +344,6 @@ mod test {
     fn credential_data() -> CredentialData {
         use ctap_types::webauthn::{PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity};
 
-        
         CredentialData {
             rp: PublicKeyCredentialRpEntity {
                 id: String::from("John Doe"),
@@ -424,7 +423,6 @@ mod test {
     fn random_credential_data() -> CredentialData {
         use ctap_types::webauthn::{PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity};
 
-        
         CredentialData {
             rp: PublicKeyCredentialRpEntity {
                 id: random_string(),
diff --git a/src/ctap1.rs b/src/ctap1.rs
index e56e0b0..e519b82 100644
--- a/src/ctap1.rs
+++ b/src/ctap1.rs
@@ -63,7 +63,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
         let wrapped_key =
             syscall!(self
                 .trussed
-                .wrap_key_chacha8poly1305(wrapping_key, private_key, &reg.app_id,))
+                .wrap_key_chacha8poly1305(wrapping_key, private_key, &[]))
             .wrapped_key;
         // debug!("wrapped_key = {:?}", &wrapped_key);
 
@@ -208,7 +208,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
                 let key_result = syscall!(self.trussed.unwrap_key_chacha8poly1305(
                     wrapping_key,
                     bytes,
-                    b"",
+                    &[],
                     Location::Volatile,
                 ))
                 .key;
diff --git a/src/ctap2.rs b/src/ctap2.rs
index 9fd18e1..ca857a1 100644
--- a/src/ctap2.rs
+++ b/src/ctap2.rs
@@ -320,12 +320,11 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
             false => {
                 // WrappedKey version
                 let wrapping_key = self.state.persistent.key_wrapping_key(&mut self.trussed)?;
-                let wrapped_key = syscall!(self.trussed.wrap_key_chacha8poly1305(
-                    wrapping_key,
-                    private_key,
-                    &rp_id_hash,
-                ))
-                .wrapped_key;
+                let wrapped_key =
+                    syscall!(self
+                        .trussed
+                        .wrap_key_chacha8poly1305(wrapping_key, private_key, &[]))
+                    .wrapped_key;
 
                 // 32B key, 12B nonce, 16B tag + some info on algorithm (P256/Ed25519)
                 // Turns out it's size 92 (enum serialization not optimized yet...)
@@ -1465,8 +1464,7 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
                 let key_result = syscall!(self.trussed.unwrap_key_chacha8poly1305(
                     wrapping_key,
                     &bytes,
-                    b"",
-                    // &rp_id_hash,
+                    &[],
                     Location::Volatile,
                 ))
                 .key;