fido2_storage.h

Go to the documentation of this file.

// FIDO2 Storage Layer (TROPIC01 + NVS)
// Handles credential storage in ECC slots and R-Memory
 
#pragma once
#include <stdint.h>
#include <stdbool.h>
#include <stddef.h>
#include "mod_fido2/fido2.h"
 
#ifdef __cplusplus
extern "C" {
#endif
 
// ============================================================================
// Storage Layout
// ============================================================================
// ECC Slots:         Private keys (P-256 or Ed25519 for WebAuthn/SSH)
// R-Memory slots:    Credential metadata (rp_id, user_id, sign_count, curve, etc.)
// NVS "fido2":       Global auth counter, PIN hash
 
void fido2_storage_set_slot_range(uint8_t ecc_start, uint8_t ecc_end,
                                  uint16_t rmem_start, uint16_t rmem_end);
uint8_t fido2_storage_ecc_start(void);
uint8_t fido2_storage_ecc_end(void);
uint16_t fido2_storage_rmem_start(void);
uint16_t fido2_storage_rmem_end(void);
 
// ============================================================================
// Initialization
// ============================================================================

uint8_t fido2_storage_init(void);
 
// ============================================================================
// Credential Operations
// ============================================================================

bool fido2_storage_create_credential(
    const char *rp_id,
    const uint8_t *rp_id_hash,
    const uint8_t *user_id,
    uint8_t user_id_len,
    const char *user_name,
    bool resident_key,
    uint8_t cred_protect,
    uint8_t curve,
    uint8_t *out_slot,
    uint8_t *out_cred_id,
    uint8_t *out_pubkey
);

uint8_t fido2_storage_get_curve(uint8_t slot);

bool fido2_storage_get_credential(uint8_t slot, fido2_credential_info_t *info);

bool fido2_storage_delete_credential(uint8_t slot);

uint32_t fido2_storage_increment_sign_count(uint8_t slot);
 
// ============================================================================
// Lookup Operations (use cache - no TROPIC01 access)
// ============================================================================

uint8_t fido2_storage_count(void);

bool fido2_storage_slot_used(uint8_t slot);

int8_t fido2_storage_find_free_slot(void);

uint8_t fido2_storage_find_by_rp(const uint8_t *rp_id_hash,
                                  uint8_t *out_slots, uint8_t max_slots);

uint8_t fido2_storage_find_by_rp_resident(const uint8_t *rp_id_hash,
                                          uint8_t *out_slots, uint8_t max_slots);

int8_t fido2_storage_find_by_rp_user(const uint8_t *rp_id_hash,
                                      const uint8_t *user_id,
                                      uint8_t user_id_len);

bool fido2_storage_is_resident(uint8_t slot);

int8_t fido2_storage_find_slot_by_cred_id(const uint8_t *cred_id, uint16_t cred_id_len);

bool fido2_storage_get_user(uint8_t slot,
                            uint8_t *user_id,
                            uint8_t *user_id_len,
                            char *user_name,
                            size_t user_name_max);

bool fido2_storage_verify_cred_id(uint8_t slot, const uint8_t *cred_id);

bool fido2_storage_get_cred_id(uint8_t slot, uint8_t *out_cred_id);
 
// ============================================================================
// Signing Operations (requires TROPIC01 access)
// ============================================================================

bool fido2_storage_sign(uint8_t slot, const uint8_t *msg, uint16_t msg_len,
                        uint8_t *signature, uint8_t *sig_len);

bool fido2_storage_sign_raw(uint8_t slot, const uint8_t *msg, uint16_t msg_len,
                            uint8_t *signature, uint8_t *sig_len);

bool fido2_storage_sign_der(uint8_t slot, const uint8_t *msg, uint16_t msg_len,
                            uint8_t *signature, uint8_t *sig_len);

bool fido2_storage_get_pubkey(uint8_t slot, uint8_t *pubkey);
 
// ============================================================================
// NVS Counter Operations
// ============================================================================

void fido2_storage_counter_load(void);

uint32_t fido2_storage_counter_get(void);

bool fido2_storage_counter_increment(void);

bool fido2_storage_counter_flush(void);
 
#ifdef __cplusplus
}
#endif