ckochandClaude Opus 5.5
6c7e6ab5f5
Firmware for the Pico / Pico 2 that acts as a USB FIDO2 authenticator: CTAP2 and U2F, passkeys, BOOTSEL as the touch button, and clientPIN with PIN/UV auth protocols 1 and 2. A host simulator runs the same core so the python-fido2 test suite exercises it without hardware. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
802 B
C
20 lines
802 B
C
// Credential IDs are self-contained: the private key is re-derived from the
|
|
// device master secret, so non-resident credentials need no storage.
|
|
//
|
|
// credential ID = version (1) || nonce (32) || tag (16)
|
|
// private key = HMAC(master, "skey-key" || version || nonce || rpIdHash)
|
|
// tag = HMAC(master, "skey-tag" || version || nonce || rpIdHash)
|
|
#pragma once
|
|
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
#define CRED_ID_LEN 49
|
|
|
|
// Makes a new credential bound to rp_id_hash.
|
|
bool cred_create(const uint8_t rp_id_hash[32], uint8_t cred_id[CRED_ID_LEN], uint8_t priv[32], uint8_t pub[64]);
|
|
|
|
// Recovers the private key if this device issued cred_id for rp_id_hash.
|
|
bool cred_unwrap(const uint8_t rp_id_hash[32], const uint8_t *cred_id, size_t len, uint8_t priv[32]);
|