kmwebnet/OpenSK
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

apply suggestions: Vec to slice, if let to match, comments

Browse Source
This commit is contained in:
Fabian Kaczmarczyck
2020-03-12 16:10:31 +01:00
parent 8d52e8aad7
commit db6be4efac
2 changed files with 27 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/ctap/data_formats.rs
View File

@@ -224,8 +224,8 @@ impl From<Extensions> for cbor::Value {
fn from(extensions: Extensions) -> Self { fn from(extensions: Extensions) -> Self {
cbor_map_btree!(extensions cbor_map_btree!(extensions
.0 .0
.iter() .into_iter()
.map(|(key, value)| (cbor_text!(key), value.clone())) .map(|(key, value)| (cbor_text!(key), value))
.collect()) .collect())
} }
} }
@@ -1095,7 +1095,7 @@ mod test {
); );
let credential = PublicKeyCredentialSource { let credential = PublicKeyCredentialSource {
cred_random: Some([0x00; 32].to_vec()), cred_random: Some(vec![0x00; 32]),
..credential ..credential
}; };

49
src/ctap/mod.rs
View File

@@ -81,9 +81,13 @@ const PIN_PADDED_LENGTH: usize = 64;
// - 32 byte relying party ID hashed with SHA256, // - 32 byte relying party ID hashed with SHA256,
// - 32 byte HMAC-SHA256 over everything else. // - 32 byte HMAC-SHA256 over everything else.
pub const ENCRYPTED_CREDENTIAL_ID_SIZE: usize = 112; pub const ENCRYPTED_CREDENTIAL_ID_SIZE: usize = 112;
// Set this bit when checking user presence.
const UP_FLAG: u8 = 0x01; const UP_FLAG: u8 = 0x01;
// Set this bit when checking user verification.
const UV_FLAG: u8 = 0x04; const UV_FLAG: u8 = 0x04;
// Set this bit when performing attestation.
const AT_FLAG: u8 = 0x40; const AT_FLAG: u8 = 0x40;
// Set this bit when an extension is used.
const ED_FLAG: u8 = 0x80; const ED_FLAG: u8 = 0x80;
pub const TOUCH_TIMEOUT_MS: isize = 30000; pub const TOUCH_TIMEOUT_MS: isize = 30000;
@@ -111,7 +115,7 @@ fn check_pin_auth(hmac_key: &[u8], hmac_contents: &[u8], pin_auth: &[u8]) -> boo
// The last step is to re-encrypt the outputs. // The last step is to re-encrypt the outputs.
pub fn encrypt_hmac_secret_output( pub fn encrypt_hmac_secret_output(
shared_secret: &[u8; 32], shared_secret: &[u8; 32],
salt_enc: Vec<u8>, salt_enc: &[u8],
cred_random: &[u8], cred_random: &[u8],
) -> Result<Vec<u8>, Ctap2StatusCode> { ) -> Result<Vec<u8>, Ctap2StatusCode> {
if salt_enc.len() != 32 && salt_enc.len() != 64 { if salt_enc.len() != 32 && salt_enc.len() != 64 {
@@ -421,11 +425,8 @@ where
return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_ALGORITHM); return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_ALGORITHM);
} }
let use_hmac_extension = if let Some(extensions) = extensions { let use_hmac_extension =
extensions.has_make_credential_hmac_secret()? extensions.map_or(Ok(false), |e| e.has_make_credential_hmac_secret())?;
} else {
false
};
if use_hmac_extension && !options.rk { if use_hmac_extension && !options.rk {
// The extension is actually supported, but we need resident keys. // The extension is actually supported, but we need resident keys.
return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION); return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION);
@@ -611,10 +612,9 @@ where
} }
} }
let get_assertion_hmac_secret_input = if let Some(extensions) = extensions { let get_assertion_hmac_secret_input = match extensions {
extensions.get_assertion_hmac_secret().transpose()? Some(extensions) => extensions.get_assertion_hmac_secret().transpose()?,
} else { None => None,
None
}; };
if get_assertion_hmac_secret_input.is_some() && !options.up { if get_assertion_hmac_secret_input.is_some() && !options.up {
// The extension is actually supported, but we need user presence. // The extension is actually supported, but we need user presence.
@@ -703,11 +703,10 @@ where
return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION); return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION);
} }
let encrypted_output = if let Some(cred_random) = &credential.cred_random { let encrypted_output = match &credential.cred_random {
encrypt_hmac_secret_output(&shared_secret, salt_enc, cred_random)? Some(cr) => encrypt_hmac_secret_output(&shared_secret, &salt_enc[..], cr)?,
} else { // This is the case if the credential was not created with HMAC-secret.
// This happens because the credential was not created with HMAC-secret. None => return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION),
return Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION);
}; };
let extensions = cbor_map! { let extensions = cbor_map! {
@@ -1524,25 +1523,25 @@ mod test {
#[test] #[test]
fn test_encrypt_hmac_secret_output() { fn test_encrypt_hmac_secret_output() {
let shared_secret = [0x55; 32]; let shared_secret = [0x55; 32];
let salt_enc = vec![0x5E; 32]; let salt_enc = [0x5E; 32];
let cred_random = vec![0xC9; 32]; let cred_random = [0xC9; 32];
let output = encrypt_hmac_secret_output(&shared_secret, salt_enc, &cred_random); let output = encrypt_hmac_secret_output(&shared_secret, &salt_enc, &cred_random);
assert_eq!(output.unwrap().len(), 32); assert_eq!(output.unwrap().len(), 32);
let salt_enc = vec![0x5E; 48]; let salt_enc = [0x5E; 48];
let output = encrypt_hmac_secret_output(&shared_secret, salt_enc, &cred_random); let output = encrypt_hmac_secret_output(&shared_secret, &salt_enc, &cred_random);
assert_eq!( assert_eq!(
output, output,
Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION) Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION)
); );
let salt_enc = vec![0x5E; 64]; let salt_enc = [0x5E; 64];
let output = encrypt_hmac_secret_output(&shared_secret, salt_enc, &cred_random); let output = encrypt_hmac_secret_output(&shared_secret, &salt_enc, &cred_random);
assert_eq!(output.unwrap().len(), 64); assert_eq!(output.unwrap().len(), 64);
let salt_enc = vec![0x5E; 32]; let salt_enc = [0x5E; 32];
let cred_random = vec![0xC9; 33]; let cred_random = [0xC9; 33];
let output = encrypt_hmac_secret_output(&shared_secret, salt_enc, &cred_random); let output = encrypt_hmac_secret_output(&shared_secret, &salt_enc, &cred_random);
assert_eq!( assert_eq!(
output, output,
Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION) Err(Ctap2StatusCode::CTAP2_ERR_UNSUPPORTED_EXTENSION)