OathStore.h

Go to the documentation of this file.

#pragma once
 
#include "cdc_core/IModule.h"
#include "cdc_core/SlotManager.h"
#include <cstdint>
#include <cstddef>
#include <ctime>
 
namespace cdc::mod_2fa {

enum class OathAlgorithm : uint8_t {
    SHA1 = 0,
    SHA256 = 1,
    SHA512 = 2
};

enum class OathType : uint8_t {
    TOTP = 0,
    HOTP = 1,
    CR = 2
};

namespace OathFlag {
    constexpr uint8_t TOUCH_REQUIRED = 0x01;
    constexpr uint8_t USB_CR_SLOT = 0x02;
}

struct OathEntry {
    uint8_t type;            
    char name[16 + 1];       
    char issuer[32 + 1];     
    uint8_t secret[64];      
    uint8_t secretLen;       
    uint8_t algorithm;       
    uint8_t digits;          
    uint32_t period;         
    uint64_t counter;        
    uint8_t flags;           
};
 
class OathStore {
public:
    static constexpr uint8_t NAME_LEN = 16;
    static constexpr uint8_t ISSUER_LEN = 32;
    static constexpr uint8_t SECRET_LEN = 64;
    static constexpr uint8_t DEFAULT_DIGITS = 6;
    static constexpr uint32_t DEFAULT_PERIOD = 30;
 
    bool readAccount(uint16_t slot, OathEntry* out);
    bool addAccount(uint8_t type, const char* name, const char* issuer,
                    const char* secretBase32, uint8_t digits, uint32_t period,
                    uint8_t algorithm, uint64_t counter, uint8_t flags = 0);
    bool updateAccount(uint16_t slot, uint8_t type, const char* name, const char* issuer,
                       const char* secretBase32, uint8_t digits, uint32_t period,
                       uint8_t algorithm, uint64_t counter, uint8_t flags = 0);
    bool deleteAccount(uint16_t slot);

    int challengeResponse(const char* entryName, const uint8_t* challenge, size_t clen,
                          uint8_t* out, bool* touchRequiredOut = nullptr);

    int challengeResponseUsbSlot(const uint8_t* challenge, size_t clen, uint8_t* out,
                                 bool* touchRequiredOut = nullptr);

    bool findUsbCrSlot(uint16_t* slotOut) const;

    void clearUsbCrFlagExcept(uint16_t keepSlot);

    bool findByName(const char* name, uint16_t* slotOut) const;

    int8_t generateCode(uint16_t slot, char* codeOut, size_t codeOutLen);
 
    bool isTimeValid() const;
    uint8_t timeRemaining(uint32_t period) const;
 
    static OathStore& instance();
 
    void setSlotRange(const cdc::core::IModule::SlotRange& range);
    uint16_t capacity() const { return slots_.capacity(); }
    bool toPhysicalSlot(uint16_t logicalIndex, uint16_t* slotOut) const {
        return slots_.toPhysicalSlot(logicalIndex, slotOut);
    }
    bool toLogicalSlot(uint16_t slot, uint16_t* logicalIndexOut) const {
        return slots_.toLogicalSlot(slot, logicalIndexOut);
    }
    bool hasSlotRange() const { return slots_.hasSlotRange(); }
    uint8_t moduleId() const { return slots_.moduleId(); }
    uint16_t rmemStart() const { return slots_.rmemStart(); }
    uint16_t rmemEnd() const { return slots_.rmemEnd(); }
 
private:
    OathStore() = default;
 
    uint32_t generate(const uint8_t* secret, size_t secretLen, uint64_t counter,
                      uint8_t digits, OathAlgorithm algorithm) const;
    bool hmacCompute(OathAlgorithm algo, const uint8_t* key, size_t keyLen,
                     const uint8_t* data, size_t dataLen,
                     uint8_t* output, size_t* outputLen) const;
    bool persistCounter(uint16_t slot, const OathEntry& entry, uint64_t counter);
 
    cdc::core::SlotManager slots_;
};
 
} // namespace cdc::mod_2fa