|
CDC Badge OS
Firmware for the CDC Badge v1.0 hardware security key
|
Go to the source code of this file.
Functions | |
| void | fido2_storage_set_slot_range (uint8_t ecc_start, uint8_t ecc_end, uint16_t rmem_start, uint16_t rmem_end) |
| Configures FIDO2 storage slot ranges. | |
| uint8_t | fido2_storage_ecc_start (void) |
| Returns configured ECC start slot. | |
| uint8_t | fido2_storage_ecc_end (void) |
| Returns configured ECC end slot. | |
| uint16_t | fido2_storage_rmem_start (void) |
| Returns configured RMEM start slot. | |
| uint16_t | fido2_storage_rmem_end (void) |
| Returns configured RMEM end slot. | |
| uint8_t | fido2_storage_init (void) |
| Initialization and cache rebuild routines. | |
| bool | fido2_storage_create_credential (const char *rp_id, const uint8_t *rp_id_hash, const uint8_t *user_id, uint8_t user_id_len, const char *user_name, bool resident_key, uint8_t cred_protect, uint8_t curve, uint8_t *out_slot, uint8_t *out_cred_id, uint8_t *out_pubkey) |
| Creates or replaces credential in secure-element storage. | |
| uint8_t | fido2_storage_get_curve (uint8_t slot) |
| Returns stored curve identifier for slot. | |
| bool | fido2_storage_get_credential (uint8_t slot, fido2_credential_info_t *info) |
| Credential create/read/delete operations. | |
| bool | fido2_storage_delete_credential (uint8_t slot) |
| Deletes credential and associated slot data. | |
| uint32_t | fido2_storage_increment_sign_count (uint8_t slot) |
| Increments per-credential sign counter and persists metadata. | |
| uint8_t | fido2_storage_count (void) |
| Credential lookup operations using in-memory cache only. | |
| bool | fido2_storage_slot_used (uint8_t slot) |
| Checks whether logical slot is occupied. | |
| int8_t | fido2_storage_find_free_slot (void) |
| Finds first unused logical slot. | |
| uint8_t | fido2_storage_find_by_rp (const uint8_t *rp_id_hash, uint8_t *out_slots, uint8_t max_slots) |
| Finds credentials matching RP hash. | |
| uint8_t | fido2_storage_find_by_rp_resident (const uint8_t *rp_id_hash, uint8_t *out_slots, uint8_t max_slots) |
| Finds resident credentials matching RP hash. | |
| int8_t | fido2_storage_find_by_rp_user (const uint8_t *rp_id_hash, const uint8_t *user_id, uint8_t user_id_len) |
| Finds credential by RP hash and user handle for replacement logic. | |
| bool | fido2_storage_is_resident (uint8_t slot) |
| Returns resident-key flag for slot. | |
| int8_t | fido2_storage_find_slot_by_cred_id (const uint8_t *cred_id, uint16_t cred_id_len) |
| Resolves and verifies logical slot from credential-id blob. | |
| bool | fido2_storage_get_user (uint8_t slot, uint8_t *user_id, uint8_t *user_id_len, char *user_name, size_t user_name_max) |
| Loads user handle and optional user name for a credential slot. | |
| bool | fido2_storage_verify_cred_id (uint8_t slot, const uint8_t *cred_id) |
| Verifies credential-id for logical slot. | |
| bool | fido2_storage_get_cred_id (uint8_t slot, uint8_t *out_cred_id) |
| Builds credential-id blob for logical slot. | |
| bool | fido2_storage_sign (uint8_t slot, const uint8_t *msg, uint16_t msg_len, uint8_t *signature, uint8_t *sig_len) |
| Signing operations requiring secure-element access. | |
| bool | fido2_storage_sign_raw (uint8_t slot, const uint8_t *msg, uint16_t msg_len, uint8_t *signature, uint8_t *sig_len) |
| Signs message and returns raw signature (EdDSA/ECDSA). | |
| bool | fido2_storage_sign_der (uint8_t slot, const uint8_t *msg, uint16_t msg_len, uint8_t *signature, uint8_t *sig_len) |
| Signs data and returns DER-encoded signature for U2F compatibility. | |
| bool | fido2_storage_get_pubkey (uint8_t slot, uint8_t *pubkey) |
| Reads public key from secure-element slot. | |
| void | fido2_storage_counter_load (void) |
| NVS-backed global authentication counter operations. | |
| uint32_t | fido2_storage_counter_get (void) |
| Returns current global authentication counter. | |
| bool | fido2_storage_counter_increment (void) |
| Increments and persists global authentication counter. | |
| bool | fido2_storage_counter_flush (void) |
| No-op flush retained for API stability; per-increment path commits. | |
| uint8_t fido2_storage_count | ( | void | ) |
Credential lookup operations using in-memory cache only.
Get total credential count.
Returns number of cached credentials.
Definition at line 469 of file fido2_storage.cpp.
References g_storage.
Referenced by fido2_get_available_slots(), and fido2_get_credential_count().
| bool fido2_storage_counter_flush | ( | void | ) |
No-op flush retained for API stability; per-increment path commits.
No-op flush kept for API stability; per-increment path commits.
Definition at line 413 of file fido2_storage.cpp.
Referenced by cdc::mod_fido2::Fido2Module::stop().
| uint32_t fido2_storage_counter_get | ( | void | ) |
Returns current global authentication counter.
Get global auth counter value.
Definition at line 366 of file fido2_storage.cpp.
References fido2_storage_counter_load(), and g_storage.
Referenced by fido2_get_auth_counter().
| bool fido2_storage_counter_increment | ( | void | ) |
Increments and persists global authentication counter.
Increment and save global auth counter.
Definition at line 377 of file fido2_storage.cpp.
References fido2_storage_counter_load(), g_storage, LOG_E, NVS_KEY_COUNTER, NVS_NAMESPACE, and TAG.
Referenced by fido2_increment_auth_counter().
| void fido2_storage_counter_load | ( | void | ) |
NVS-backed global authentication counter operations.
Load global auth counter from NVS.
Loads global authentication counter from NVS.
Definition at line 336 of file fido2_storage.cpp.
References g_storage, LOG_I, LOG_W, NVS_KEY_COUNTER, NVS_NAMESPACE, and TAG.
Referenced by fido2_storage_counter_get(), fido2_storage_counter_increment(), and fido2_storage_init().
| bool fido2_storage_create_credential | ( | const char * | rp_id, |
| const uint8_t * | rp_id_hash, | ||
| const uint8_t * | user_id, | ||
| uint8_t | user_id_len, | ||
| const char * | user_name, | ||
| bool | resident_key, | ||
| uint8_t | cred_protect, | ||
| uint8_t | curve, | ||
| uint8_t * | out_slot, | ||
| uint8_t * | out_cred_id, | ||
| uint8_t * | out_pubkey ) |
Creates or replaces credential in secure-element storage.
Create a new credential.
| rp_id | Relying Party ID string |
| rp_id_hash | SHA-256 hash of RP ID (32 bytes) |
| user_id | User handle (opaque bytes) |
| user_id_len | Length of user handle |
| user_name | Display name (can be empty) |
| resident_key | Store as discoverable credential |
| cred_protect | Credential protection level (0-3) |
| curve | CDC_CURVE_P256 or CDC_CURVE_ED25519 |
| out_slot | Output: allocated slot index |
| out_cred_id | Output: credential ID (64 bytes) |
| out_pubkey | Output: public key (64 bytes for P-256 X||Y, 32 bytes for Ed25519) |
| rp_id | Relying-party id string. |
| rp_id_hash | RP ID hash (32 bytes). |
| user_id | User handle bytes. |
| user_id_len | User handle length. |
| user_name | User display name. |
| resident_key | Resident-key flag. |
| cred_protect | Credential protection policy. |
| curve | Requested key curve. |
| out_slot | Output logical slot. |
| out_cred_id | Output credential-id. |
| out_pubkey | Output public key bytes. |
Definition at line 759 of file fido2_storage.cpp.
References CDC_CURVE_ED25519, cred_protect, curve, ecc_slot_for_logical(), cdc::hal::ED25519, erase_slot_data(), FIDO2_CRED_ID_LEN, FIDO2_FLAG_RESIDENT, FIDO2_RMEM_MAGIC, FIDO2_RMEM_MAGIC_LEN, FIDO2_RP_ID_MAX_LEN, fido2_storage_find_by_rp_user(), fido2_storage_find_free_slot(), FIDO2_USER_ID_MAX_LEN, FIDO2_USER_NAME_MAX_LEN, g_storage, cdc::hal::getSecureElementInstance(), LOG_D, LOG_E, LOG_I, cdc::hal::OK, cdc::hal::P256, rp_id, rp_id_hash, TAG, update_cache_from_stored(), user_id, user_id_len, user_name, and write_rmem_credential().
Referenced by cdc::mod_fido2::create_credential_and_respond(), and u2f_register().
| bool fido2_storage_delete_credential | ( | uint8_t | slot | ) |
Deletes credential and associated slot data.
Delete credential by slot.
| slot | Logical slot index (0..count-1) |
| slot | Logical slot index. |
Definition at line 892 of file fido2_storage.cpp.
References erase_slot_data(), g_storage, LOG_I, slot_logical_valid(), and TAG.
Referenced by ctap2_cred_management(), fido2_delete_credential(), fido2_factory_reset(), cdc::mod_fido2::mc_rollback_credential(), and u2f_register().
| uint8_t fido2_storage_ecc_end | ( | void | ) |
Returns configured ECC end slot.
Definition at line 111 of file fido2_storage.cpp.
References s_ecc_end.
Referenced by fido2_get_available_slots().
| uint8_t fido2_storage_ecc_start | ( | void | ) |
Returns configured ECC start slot.
Definition at line 105 of file fido2_storage.cpp.
References s_ecc_start.
Referenced by fido2_get_available_slots(), and cdc::mod_fido2::showDetail().
| uint8_t fido2_storage_find_by_rp | ( | const uint8_t * | rp_id_hash, |
| uint8_t * | out_slots, | ||
| uint8_t | max_slots ) |
Finds credentials matching RP hash.
Find credentials matching RP ID hash.
| rp_id_hash | SHA-256 of RP ID |
| out_slots | Array to store matching slot indices |
| max_slots | Array size |
| rp_id_hash | RP ID hash (32 bytes). |
| out_slots | Output slot array. |
| max_slots | Maximum writable slots. |
Definition at line 504 of file fido2_storage.cpp.
References ecc_count(), FIDO2_MAX_CREDENTIALS, g_storage, and rp_id_hash.
Referenced by cdc::mod_fido2::check_appid_exclude(), fido2_find_credentials_by_rp(), and ga_find_credentials().
| uint8_t fido2_storage_find_by_rp_resident | ( | const uint8_t * | rp_id_hash, |
| uint8_t * | out_slots, | ||
| uint8_t | max_slots ) |
Finds resident credentials matching RP hash.
Find resident (discoverable) credentials matching RP ID hash.
| rp_id_hash | SHA-256 of RP ID |
| out_slots | Array to store matching slot indices |
| max_slots | Array size |
| rp_id_hash | RP ID hash (32 bytes). |
| out_slots | Output slot array. |
| max_slots | Maximum writable slots. |
Definition at line 526 of file fido2_storage.cpp.
References ecc_count(), FIDO2_MAX_CREDENTIALS, g_storage, LOG_D, rp_id_hash, and TAG.
| int8_t fido2_storage_find_by_rp_user | ( | const uint8_t * | rp_id_hash, |
| const uint8_t * | user_id, | ||
| uint8_t | user_id_len ) |
Finds credential by RP hash and user handle for replacement logic.
Find existing credential for same RP ID + User ID combination. Used to detect credentials that should be replaced (per FIDO2 spec).
| rp_id_hash | SHA-256 of RP ID |
| user_id | User handle |
| user_id_len | Length of user handle |
| rp_id_hash | RP ID hash (32 bytes). |
| user_id | User handle bytes. |
| user_id_len | User handle length. |
Definition at line 564 of file fido2_storage.cpp.
References ecc_count(), FIDO2_MAX_CREDENTIALS, g_storage, LOG_D, rp_id_hash, TAG, user_id, and user_id_len.
Referenced by cdc::mod_fido2::ctap2_make_credential(), and fido2_storage_create_credential().
| int8_t fido2_storage_find_free_slot | ( | void | ) |
Finds first unused logical slot.
Find first free slot.
Definition at line 487 of file fido2_storage.cpp.
References ecc_count(), FIDO2_MAX_CREDENTIALS, and g_storage.
Referenced by fido2_storage_create_credential().
| int8_t fido2_storage_find_slot_by_cred_id | ( | const uint8_t * | cred_id, |
| uint16_t | cred_id_len ) |
Resolves and verifies logical slot from credential-id blob.
Find slot by credential ID.
| cred_id | Credential ID bytes |
| cred_id_len | Credential ID length |
| cred_id | Credential ID bytes. |
| cred_id_len | Credential ID length. |
Definition at line 598 of file fido2_storage.cpp.
References FIDO2_CRED_ID_LEN, fido2_storage_get_cred_id(), g_storage, and slot_logical_valid().
Referenced by ctap2_cred_management(), ga_parse_allow_list(), and u2f_authenticate().
| bool fido2_storage_get_cred_id | ( | uint8_t | slot, |
| uint8_t * | out_cred_id ) |
Builds credential-id blob for logical slot.
Get credential ID for slot.
| slot | ECC slot index |
| out_cred_id | Output buffer (FIDO2_CRED_ID_LEN bytes) |
| slot | Logical slot index. |
| out_cred_id | Output credential-id buffer. |
Definition at line 679 of file fido2_storage.cpp.
References FIDO2_CRED_ID_LEN, g_storage, LOG_E, read_rmem_credential(), slot_logical_valid(), and TAG.
Referenced by cred_mgmt_encode_credential(), ctap2_get_assertion(), ctap2_get_next_assertion(), fido2_storage_find_slot_by_cred_id(), and fido2_storage_verify_cred_id().
| bool fido2_storage_get_credential | ( | uint8_t | slot, |
| fido2_credential_info_t * | info ) |
Credential create/read/delete operations.
Get credential info by slot.
| slot | Logical slot index (0..count-1) |
| info | Output structure |
Returns cached credential metadata for slot.
| slot | Logical slot index. |
| info | Output credential info. |
Definition at line 706 of file fido2_storage.cpp.
References FIDO2_RP_ID_MAX_LEN, fido2_storage_get_user(), FIDO2_USER_NAME_MAX_LEN, g_storage, slot_logical_valid(), and user_id_len.
Referenced by cred_mgmt_count_unique_rps(), cred_mgmt_encode_credential(), cred_mgmt_encode_rp(), cred_mgmt_find_creds_for_rp(), ctap2_get_assertion(), ctap2_get_next_assertion(), fido2_get_credential_info(), ga_find_credentials(), and u2f_authenticate().
| uint8_t fido2_storage_get_curve | ( | uint8_t | slot | ) |
Returns stored curve identifier for slot.
Get curve type for a credential.
| slot | Logical slot index (0..count-1) |
| slot | Logical slot index. |
Definition at line 737 of file fido2_storage.cpp.
References g_storage, and slot_logical_valid().
| bool fido2_storage_get_pubkey | ( | uint8_t | slot, |
| uint8_t * | pubkey ) |
Reads public key from secure-element slot.
Get public key for credential.
| slot | ECC slot index |
| pubkey | Output: uncompressed P-256 public key (65 bytes) |
| slot | Logical slot index. |
| pubkey | Output public-key buffer. |
Definition at line 1062 of file fido2_storage.cpp.
References curve, ecc_slot_for_logical(), cdc::hal::getSecureElementInstance(), cdc::hal::OK, cdc::hal::P256, and slot_logical_valid().
Referenced by cred_mgmt_encode_credential(), cred_mgmt_slot_has_key(), and cdc::mod_fido2::showDetail().
| bool fido2_storage_get_user | ( | uint8_t | slot, |
| uint8_t * | user_id, | ||
| uint8_t * | user_id_len, | ||
| char * | user_name, | ||
| size_t | user_name_max ) |
Loads user handle and optional user name for a credential slot.
Get user information for a credential slot.
| slot | ECC slot index |
| user_id | Output user handle buffer |
| user_id_len | Output user handle length |
| user_name | Output user name buffer (can be NULL) |
| user_name_max | Output buffer size for user_name |
| slot | Logical slot index. |
| user_id | Output user-handle buffer. |
| user_id_len | Output user-handle length. |
| user_name | Output user-name buffer. |
| user_name_max | User-name buffer size. |
Definition at line 627 of file fido2_storage.cpp.
References FIDO2_USER_ID_MAX_LEN, FIDO2_USER_NAME_MAX_LEN, g_storage, read_rmem_credential(), slot_logical_valid(), user_id, user_id_len, and user_name.
Referenced by fido2_storage_get_credential().
| uint32_t fido2_storage_increment_sign_count | ( | uint8_t | slot | ) |
Increments per-credential sign counter and persists metadata.
Increment and get sign count for a credential.
| slot | Logical slot index |
| slot | Logical slot index. |
Definition at line 915 of file fido2_storage.cpp.
References g_storage, LOG_E, read_rmem_credential(), slot_logical_valid(), TAG, and write_rmem_credential().
Referenced by ctap2_get_assertion(), ctap2_get_next_assertion(), and u2f_authenticate().
| uint8_t fido2_storage_init | ( | void | ) |
Initialization and cache rebuild routines.
Initialize storage layer. Loads credential metadata from TROPIC01 cache.
Initializes FIDO2 storage cache from secure element and NVS.
Definition at line 423 of file fido2_storage.cpp.
References ecc_count(), FIDO2_FLAG_RESIDENT, FIDO2_MAX_CREDENTIALS, fido2_storage_counter_load(), g_storage, cdc::hal::getSecureElementInstance(), LOG_D, LOG_E, LOG_I, read_rmem_credential(), rmem_count(), slot_range_valid(), TAG, and update_cache_from_stored().
Referenced by fido2_init().
| bool fido2_storage_is_resident | ( | uint8_t | slot | ) |
Returns resident-key flag for slot.
Check if slot contains a resident (discoverable) credential.
| slot | Logical slot index. |
Definition at line 552 of file fido2_storage.cpp.
References g_storage, and slot_logical_valid().
Referenced by cred_mgmt_count_unique_rps(), cred_mgmt_find_creds_for_rp(), and ctap2_cred_management().
| uint16_t fido2_storage_rmem_end | ( | void | ) |
Returns configured RMEM end slot.
Definition at line 123 of file fido2_storage.cpp.
References s_rmem_end.
| uint16_t fido2_storage_rmem_start | ( | void | ) |
Returns configured RMEM start slot.
Definition at line 117 of file fido2_storage.cpp.
References s_rmem_start.
| void fido2_storage_set_slot_range | ( | uint8_t | ecc_start, |
| uint8_t | ecc_end, | ||
| uint16_t | rmem_start, | ||
| uint16_t | rmem_end ) |
Configures FIDO2 storage slot ranges.
| ecc_start | First ECC slot. |
| ecc_end | Last ECC slot. |
| rmem_start | First RMEM slot. |
| rmem_end | Last RMEM slot. |
Definition at line 93 of file fido2_storage.cpp.
References s_ecc_end, s_ecc_start, s_rmem_end, and s_rmem_start.
Referenced by cdc::mod_fido2::Fido2Module::init().
| bool fido2_storage_sign | ( | uint8_t | slot, |
| const uint8_t * | msg, | ||
| uint16_t | msg_len, | ||
| uint8_t * | signature, | ||
| uint8_t * | sig_len ) |
Signing operations requiring secure-element access.
Sign raw message with credential key, returns DER-encoded signature. TROPIC01 computes SHA256(msg) internally before signing.
| slot | ECC slot index |
| Message transfer (badge-to-badge) | Raw message to sign (NOT a pre-computed hash!) |
| msg_len | Length of message |
| signature | Output DER-encoded signature |
| sig_len | Output signature length |
Signs message hash with ECDSA and returns DER signature.
| slot | Logical slot index. |
| Message transfer (badge-to-badge) | Message bytes. |
| msg_len | Message length. |
| signature | Output signature buffer. |
| sig_len | Output signature length. |
Definition at line 947 of file fido2_storage.cpp.
References ecc_slot_for_logical(), FIDO2_SIG_SIZE, g_storage, cdc::hal::getSecureElementInstance(), LOG_D, LOG_E, cdc::hal::OK, raw_sig_to_der(), slot_logical_valid(), and TAG.
| bool fido2_storage_sign_der | ( | uint8_t | slot, |
| const uint8_t * | msg, | ||
| uint16_t | msg_len, | ||
| uint8_t * | signature, | ||
| uint8_t * | sig_len ) |
Signs data and returns DER-encoded signature for U2F compatibility.
Sign raw message with credential private key (TROPIC01 hashes internally). Returns DER-encoded signature for U2F compatibility.
| slot | ECC slot index |
| Message transfer (badge-to-badge) | Raw message to sign (authData || clientDataHash) |
| msg_len | Message length |
| signature | Output DER-encoded signature |
| sig_len | Output signature length |
Signs message hash and returns DER-encoded ECDSA signature.
| slot | Logical slot index. |
| Message transfer (badge-to-badge) | Message bytes. |
| msg_len | Message length. |
| signature | Output DER buffer. |
| sig_len | Output DER length. |
Definition at line 1030 of file fido2_storage.cpp.
References ecc_slot_for_logical(), FIDO2_SIG_SIZE, g_storage, cdc::hal::getSecureElementInstance(), LOG_D, LOG_E, cdc::hal::OK, raw_sig_to_der(), slot_logical_valid(), and TAG.
| bool fido2_storage_sign_raw | ( | uint8_t | slot, |
| const uint8_t * | msg, | ||
| uint16_t | msg_len, | ||
| uint8_t * | signature, | ||
| uint8_t * | sig_len ) |
Signs message and returns raw signature (EdDSA/ECDSA).
Sign raw message with credential private key (TROPIC01 hashes internally). Returns raw signature format (r || s = 64 bytes) for CTAP2/WebAuthn.
| slot | ECC slot index |
| Message transfer (badge-to-badge) | Raw message to sign (authData || clientDataHash) |
| msg_len | Message length |
| signature | Output raw signature (64 bytes) |
| sig_len | Output signature length (always 64) |
| slot | Logical slot index. |
| Message transfer (badge-to-badge) | Message bytes. |
| msg_len | Message length. |
| signature | Output raw signature buffer. |
| sig_len | Output signature length. |
Definition at line 982 of file fido2_storage.cpp.
References CDC_CURVE_ED25519, curve, ecc_slot_for_logical(), FIDO2_SIG_SIZE, g_storage, cdc::hal::getSecureElementInstance(), LOG_D, LOG_E, cdc::hal::OK, slot_logical_valid(), and TAG.
Referenced by ctap2_get_next_assertion(), ga_sign_assertion(), and u2f_authenticate().
| bool fido2_storage_slot_used | ( | uint8_t | slot | ) |
Checks whether logical slot is occupied.
Check if slot has a credential.
| slot | Logical slot index. |
Definition at line 478 of file fido2_storage.cpp.
References g_storage, and slot_logical_valid().
Referenced by fido2_factory_reset(), and fido2_get_credential_info().
| bool fido2_storage_verify_cred_id | ( | uint8_t | slot, |
| const uint8_t * | cred_id ) |
Verifies credential-id for logical slot.
Verify credential ID belongs to slot.
| slot | ECC slot index |
| cred_id | Credential ID to verify |
| slot | Logical slot index. |
| cred_id | Credential ID bytes. |
Definition at line 664 of file fido2_storage.cpp.
References FIDO2_CRED_ID_LEN, and fido2_storage_get_cred_id().