warnings

Cargo.toml

@@ -1,13 +1,12 @@
 [package]
-name = "ctap_hmac"
+name = "ctap"
-description = "A Rust implementation of the FIDO2 CTAP protocol, including the HMAC extension"
+description = "A Rust implementation of the FIDO2 CTAP protocol"
-version = "0.4.5"
+version = "0.1.0"
 license = "Apache-2.0/MIT"
-homepage = "https://github.com/shimunn/ctap"
+homepage = "https://github.com/ArdaXi/ctap"
-repository = "https://github.com/shimunn/ctap"
+repository = "https://github.com/ArdaXi/ctap"
-authors = ["Arda Xi <arda@ardaxi.com>", "shimun <shimun@shimun.net>"]
+authors = ["Arda Xi <arda@ardaxi.com>"]
 edition = "2018"
-readme = "README.md"
 
 [dependencies]
 rand = "0.6"
@@ -20,16 +19,3 @@ cbor-codec = "0.7"
 ring = "0.13"
 untrusted = "0.6"
 rust-crypto = "0.2"
-derive_builder = "0.9.0"
-crossbeam = { version = "0.7.3", optional = true }
-[dev-dependencies]
-crossbeam = "0.7.3"
-hex = "0.4.0"
-[build-dependencies]
-csv = "1.1.3"
-serde = "1.0.106"
-serde_derive = "1.0.106"
-
-
-[features]
-request_multiple = ["crossbeam"]

README.md

@@ -13,28 +13,28 @@ ctap is a library implementing the [FIDO2 CTAP](https://fidoalliance.org/specs/f
 ## Usage example
 
 ```rust
-use ctap_hmac::*;
+let devices = ctap::get_devices()?;
-let device_info = get_devices()?.next().expect("no device connected");
+let device_info = &devices[0];
-let mut device = FidoDevice::new(&device_info)?;
+let mut device = ctap::FidoDevice::new(device_info)?;
 
 // This can be omitted if the FIDO device is not configured with a PIN.
 let pin = "test";
 device.unlock(pin)?;
 
 // In a real application these values would come from the requesting app.
-let cred_request = FidoCredentialRequestBuilder::default()
+let rp_id = "rp_id";
-                    .rp_id("rp_id")
+let user_id = [0];
-                    .user_name("user_name")
+let user_name = "user_name";
-                    .build().unwrap();
+let client_data_hash = [0; 32];
+let cred = device.make_credential(
+    rp_id,
+    &user_id,
+    user_name,
+    &client_data_hash
+)?;
 
-let cred = device.make_credential(&cred_request)?;
-let cred = &&cred;
-let assertion_request = FidoAssertionRequestBuilder::default()
-                            .rp_id("rp_id")
-                            .credential(&&cred)
-                            .build().unwrap();
 // In a real application the credential would be stored and used later.
-let result = device.get_assertion(&assertion_request);
+let result = device.get_assertion(&cred, &client_data_hash);
 ```
 
 ## Limitations

build.rs

@@ -1,41 +0,0 @@
-use csv::{Reader, StringRecord};
-use serde_derive::Deserialize;
-use std::env;
-use std::fs::File;
-use std::io::{Result, Write};
-use std::iter::FromIterator;
-use std::string::String;
-
-fn main() {
-    parse_error_codes().expect("Failed to parse error codes")
-}
-
-fn parse_error_codes() -> Result<()> {
-    println!("cargo:rerun-if-changed=ctap_error_codes.csv");
-    let mut out_file = File::create(format!(
-        "{}/ctap_error_codes.rs",
-        env::var("OUT_DIR").unwrap()
-    ))?;
-    out_file.write_all(b"static CTAP_ERROR_CODES: &[(usize, &str, &str)] = &[")?;
-    let mut rdr = Reader::from_path("ctap_error_codes.csv")?;
-    rdr.set_headers(StringRecord::from_iter(&["code", "name", "desc"]));
-    #[derive(Debug, Deserialize)]
-    struct ErrorCode {
-        code: String,
-        name: String,
-        desc: String,
-    }
-    for result in rdr.deserialize() {
-        let record: ErrorCode = result.unwrap();
-        out_file.write_all(
-            format!(
-                "({}, \"{}\", \"{}\"),\n",
-                i64::from_str_radix(&record.code[2..], 16).unwrap(),
-                record.name,
-                record.desc
-            )
-            .as_bytes(),
-        )?;
-    }
-    out_file.write_all(b"];")
-}

ctap_error_codes.csv

@@ -1,49 +0,0 @@
-Code,Name,Description
-0x00,"CTAP1_ERR_SUCCESS, CTAP2_OK",Indicates successful response.
-0x01,CTAP1_ERR_INVALID_COMMAND,The command is not a valid CTAP command.
-0x02,CTAP1_ERR_INVALID_PARAMETER,The command included an invalid parameter.
-0x03,CTAP1_ERR_INVALID_LENGTH,Invalid message or item length.
-0x04,CTAP1_ERR_INVALID_SEQ,Invalid message sequencing.
-0x05,CTAP1_ERR_TIMEOUT,Message timed out.
-0x06,CTAP1_ERR_CHANNEL_BUSY,Channel busy.
-0x0A,CTAP1_ERR_LOCK_REQUIRED,Command requires channel lock.
-0x0B,CTAP1_ERR_INVALID_CHANNEL,Command not allowed on this cid.
-0x11,CTAP2_ERR_CBOR_UNEXPECTED_TYPE,Invalid/unexpected CBOR error.
-0x12,CTAP2_ERR_INVALID_CBOR,Error when parsing CBOR.
-0x14,CTAP2_ERR_MISSING_PARAMETER,Missing non-optional parameter.
-0x15,CTAP2_ERR_LIMIT_EXCEEDED,Limit for number of items exceeded.
-0x16,CTAP2_ERR_UNSUPPORTED_EXTENSION,Unsupported extension.
-0x19,CTAP2_ERR_CREDENTIAL_EXCLUDED,Valid credential found in the exclude list.
-0x21,CTAP2_ERR_PROCESSING,Processing (Lengthy operation is in progress).
-0x22,CTAP2_ERR_INVALID_CREDENTIAL,Credential not valid for the authenticator.
-0x23,CTAP2_ERR_USER_ACTION_PENDING,Authentication is waiting for user interaction.
-0x24,CTAP2_ERR_OPERATION_PENDING,"Processing, lengthy operation is in progress."
-0x25,CTAP2_ERR_NO_OPERATIONS,No request is pending.
-0x26,CTAP2_ERR_UNSUPPORTED_ALGORITHM,Authenticator does not support requested algorithm.
-0x27,CTAP2_ERR_OPERATION_DENIED,Not authorized for requested operation.
-0x28,CTAP2_ERR_KEY_STORE_FULL,Internal key storage is full.
-0x29,CTAP2_ERR_NOT_BUSY,Authenticator cannot cancel as it is not busy.
-0x2A,CTAP2_ERR_NO_OPERATION_PENDING,No outstanding operations.
-0x2B,CTAP2_ERR_UNSUPPORTED_OPTION,Unsupported option.
-0x2C,CTAP2_ERR_INVALID_OPTION,Not a valid option for current operation.
-0x2D,CTAP2_ERR_KEEPALIVE_CANCEL,Pending keep alive was cancelled.
-0x2E,CTAP2_ERR_NO_CREDENTIALS,No valid credentials provided.
-0x2F,CTAP2_ERR_USER_ACTION_TIMEOUT,Timeout waiting for user interaction.
-0x30,CTAP2_ERR_NOT_ALLOWED,"Continuation command, such as, authenticatorGetNextAssertion not allowed."
-0x31,CTAP2_ERR_PIN_INVALID,PIN Invalid.
-0x32,CTAP2_ERR_PIN_BLOCKED,PIN Blocked.
-0x33,CTAP2_ERR_PIN_AUTH_INVALID,"PIN authentication, pinAuth, verification failed."
-0x34,CTAP2_ERR_PIN_AUTH_BLOCKED,"PIN authentication,pinAuth, blocked. Requires power recycle to reset."
-0x35,CTAP2_ERR_PIN_NOT_SET,No PIN has been set.
-0x36,CTAP2_ERR_PIN_REQUIRED,PIN is required for the selected operation.
-0x37,CTAP2_ERR_PIN_POLICY_VIOLATION,PIN policy violation. Currently only enforces minimum length.
-0x38,CTAP2_ERR_PIN_TOKEN_EXPIRED,pinToken expired on authenticator.
-0x39,CTAP2_ERR_REQUEST_TOO_LARGE,Authenticator cannot handle this request due to memory constraints.
-0x3A,CTAP2_ERR_ACTION_TIMEOUT,The current operation has timed out.
-0x3B,CTAP2_ERR_UP_REQUIRED,User presence is required for the requested operation.
-0x7F,CTAP1_ERR_OTHER,Other unspecified error.
-0xDF,CTAP2_ERR_SPEC_LAST,CTAP 2 spec last error.
-0xE0,CTAP2_ERR_EXTENSION_FIRST,Extension specific error.
-0xEF,CTAP2_ERR_EXTENSION_LAST,Extension specific error.
-0xF0,CTAP2_ERR_VENDOR_FIRST,Vendor specific error.
-0xFF,CTAP2_ERR_VENDOR_LAST,Vendor specific error.

examples/hmac.rs

@@ -1,63 +0,0 @@
-extern crate ctap_hmac as ctap;
-
-use crypto::digest::Digest;
-use crypto::sha2::Sha256;
-use ctap::extensions::hmac::HmacExtension;
-use ctap::{FidoAssertionRequestBuilder, FidoCredential, FidoCredentialRequestBuilder};
-use hex;
-use std::env::args;
-use std::io::prelude::*;
-use std::io::stdin;
-use std::io::stdout;
-
-const RP_ID: &str = "ctap_demo";
-
-fn main() -> ctap::FidoResult<()> {
-    let mut devices = ctap::get_devices()?;
-    let device_info = &mut devices.next().expect("No authenticator found");
-    let mut device = ctap::FidoDevice::new(device_info)?;
-
-    let credential = match args().skip(1).next().map(|h| FidoCredential {
-        id: hex::decode(&h).expect("Invalid credential"),
-        public_key: None,
-    }) {
-        Some(cred) => cred,
-        _ => {
-            let req = FidoCredentialRequestBuilder::default()
-                .rp_id(RP_ID)
-                .rp_name("ctap_hmac crate")
-                .user_name("example")
-                .uv(false)
-                .build()
-                .unwrap();
-
-            println!("Authorize using your device");
-            let cred = device
-                .make_hmac_credential(&req)
-                .expect("Failed to request credential");
-            println!("Credential: {}\nNote: You can pass this credential as first argument in order to reproduce results", hex::encode(&cred.id));
-            cred
-        }
-    };
-    print!("Type in your message: ");
-    stdout().flush().unwrap();
-    let mut message = String::new();
-    stdin()
-        .read_line(&mut message)
-        .expect("Couldn't get your message\nNote: this demo does not accept binary data");
-    println!("Authorize using your device");
-
-    let mut salt = [0u8; 32];
-    let mut digest = Sha256::new();
-    digest.input(&message.as_bytes());
-    digest.result(&mut salt);
-    let credential = &&credential;
-    let request = FidoAssertionRequestBuilder::default()
-        .rp_id(RP_ID)
-        .credential(credential)
-        .build()
-        .unwrap();
-    let (_cred, (hash1, _hash2)) = device.get_hmac_assertion(&request, &salt, None)?;
-    println!("Hash: {}", hex::encode(&hash1));
-    Ok(())
-}

examples/multiple.rs

@@ -1,49 +0,0 @@
-extern crate ctap_hmac as ctap;
-use ctap::{
-    FidoAssertionRequestBuilder, FidoCredential, FidoCredentialRequestBuilder, FidoDevice,
-    FidoResult,
-};
-
-use hex;
-use std::env::args;
-use std::time::Duration;
-
-const RP_ID: &str = "ctap_demo";
-
-fn main() -> ctap::FidoResult<()> {
-    let mut credentials = args()
-        .skip(1)
-        .map(|id| FidoCredential {
-            id: hex::decode(&id).expect("Invalid credential"),
-            public_key: None,
-        })
-        .collect::<Vec<_>>();
-    if credentials.len() == 0 {
-        credentials = ctap::get_devices()?
-            .map(|h| {
-                FidoDevice::new(&h).and_then(|mut dev| {
-                    FidoCredentialRequestBuilder::default()
-                        .rp_id(RP_ID)
-                        .user_name("test")
-                        .build()
-                        .unwrap()
-                        .make_credential(&mut dev)
-                })
-            })
-            .collect::<FidoResult<Vec<FidoCredential>>>()?;
-    }
-    let credentials = credentials.iter().collect::<Vec<_>>();
-    let req = FidoAssertionRequestBuilder::default()
-        .rp_id(RP_ID)
-        .credentials(&credentials[..])
-        .build()
-        .unwrap();
-    let mut devices = ctap::get_devices()?
-        .map(|handle| FidoDevice::new(&handle))
-        .collect::<FidoResult<Vec<_>>>()?;
-    // run with --features request_multiple
-    let (cred, _) =
-        ctap::get_assertion_devices(&req, devices.iter_mut(), Some(Duration::from_secs(10)))?;
-    println!("Success, got assertion for: {}", hex::encode(&cred.id));
-    Ok(())
-}

src/cbor.rs

@@ -7,7 +7,6 @@
 use cbor_codec::value;
 use cbor_codec::value::Value;
 use cbor_codec::{Config, Decoder, Encoder, GenericDecoder, GenericEncoder};
-use cbor::skip::Skip;
 
 use byteorder::{BigEndian, ByteOrder, ReadBytesExt, WriteBytesExt};
 use failure::ResultExt;
@@ -39,7 +38,7 @@ impl<'a> Request<'a> {
         }
     }
 
-    pub fn decode<R: ReadBytesExt + Skip>(&self, reader: R) -> FidoResult<Response> {
+    pub fn decode<R: ReadBytesExt>(&self, reader: R) -> FidoResult<Response> {
         Ok(match self {
             Request::MakeCredential(_) => {
                 Response::MakeCredential(MakeCredentialResponse::decode(reader)?)
@@ -83,11 +82,7 @@ impl<'a> MakeCredentialRequest<'a> {
         let mut length = 4;
         length += !self.exclude_list.is_empty() as usize;
         length += !self.extensions.is_empty() as usize;
-        length += self
+        length += self.options.is_some() as usize;
-            .options
-            .as_ref()
-            .map(|opt| opt.encoded())
-            .unwrap_or(false) as usize;
         length += self.pin_auth.is_some() as usize;
         length += self.pin_protocol.is_some() as usize;
         encoder.object(length)?;
@@ -150,7 +145,7 @@ impl MakeCredentialResponse {
     pub fn decode<R: ReadBytesExt>(mut reader: R) -> FidoResult<Self> {
         let status = reader.read_u8().context(FidoErrorKind::CborDecode)?;
         if status != 0 {
-            Err(FidoErrorKind::CborError(CborErrorCode::from(status)))?
+            Err(FidoErrorKind::CborError(status))?
         }
         let mut decoder = Decoder::new(Config::default(), reader);
         let mut response = MakeCredentialResponse::default();
@@ -187,11 +182,7 @@ impl<'a> GetAssertionRequest<'a> {
         let mut length = 2;
         length += !self.allow_list.is_empty() as usize;
         length += !self.extensions.is_empty() as usize;
-        length += self
+        length += self.options.is_some() as usize;
-            .options
-            .as_ref()
-            .map(|opt| opt.encoded())
-            .unwrap_or(false) as usize;
         length += self.pin_auth.is_some() as usize;
         length += self.pin_protocol.is_some() as usize;
         encoder.object(length)?;
@@ -245,7 +236,7 @@ impl GetAssertionResponse {
     pub fn decode<R: ReadBytesExt>(mut reader: R) -> FidoResult<Self> {
         let status = reader.read_u8().context(FidoErrorKind::CborDecode)?;
         if status != 0 {
-            Err(FidoErrorKind::CborError(CborErrorCode::from(status)))?
+            Err(FidoErrorKind::CborError(status))?
         }
         let mut decoder = Decoder::new(Config::default(), reader);
         let mut response = GetAssertionResponse::default();
@@ -278,10 +269,10 @@ pub struct GetInfoResponse {
 }
 
 impl GetInfoResponse {
-    pub fn decode<R: ReadBytesExt + Skip>(mut reader: R) -> FidoResult<Self> {
+    pub fn decode<R: ReadBytesExt>(mut reader: R) -> FidoResult<Self> {
         let status = reader.read_u8().context(FidoErrorKind::CborDecode)?;
         if status != 0 {
-            Err(FidoErrorKind::CborError(CborErrorCode::from(status)))?
+            Err(FidoErrorKind::CborError(status))?
         }
         let mut decoder = Decoder::new(Config::default(), reader);
         let mut response = GetInfoResponse::default();
@@ -305,7 +296,7 @@ impl GetInfoResponse {
                         response.pin_protocols.push(decoder.u8()?);
                     }
                 }
-                _ => decoder.skip()?,
+                _ => continue,
             }
         }
         Ok(response)
@@ -369,7 +360,7 @@ impl ClientPinResponse {
     pub fn decode<R: ReadBytesExt>(mut reader: R) -> FidoResult<Self> {
         let status = reader.read_u8().context(FidoErrorKind::CborDecode)?;
         if status != 0 {
-            Err(FidoErrorKind::CborError(CborErrorCode::from(status)))?
+            Err(FidoErrorKind::CborError(status))?
         }
         let mut decoder = Decoder::new(Config::default(), reader);
         let mut response = ClientPinResponse::default();
@@ -424,9 +415,7 @@ impl OptionsInfo {
                 "clientPin" => options.client_pin = Some(decoder.bool()?),
                 "up" => options.up = decoder.bool()?,
                 "uv" => options.uv = Some(decoder.bool()?),
-                _ => {
+                _ => continue,
-                    decoder.bool()?;
-                }
             }
         }
         Ok(options)
@@ -598,45 +587,14 @@ impl CoseKey {
         let mut cose_key = CoseKey::default();
         cose_key.algorithm = -7;
         for _ in 0..items {
-            match generic.value()? {
+            match generic.borrow_mut().i16()? {
-                Value::Text(value::Text::Text(text)) => match &text[..] {
-                    "type" => {
-                        cose_key.key_type = match generic.value()? {
-                            Value::Text(value::Text::Text(type_)) if &type_ == "public-key" => 0u16,
-                            Value::U16(i) => i,
-                            Value::U8(i) => i.into(),
-                            _ => {
-                                continue;
-                            }
-                        }
-                    }
-                    "alg" => cose_key.algorithm = generic.borrow_mut().i32()?,
-                    _ => continue,
-                },
-                val @ Value::I8(_)
-                | val @ Value::I16(_)
-                | val @ Value::U16(_)
-                | val @ Value::U8(_) => {
-                    let int_val = match val {
-                        Value::I8(i) => i as i32,
-                        Value::I16(i) => i as i32,
-                        Value::U8(i) => i as i32,
-                        Value::U16(i) => i as i32,
-                        _ => unreachable!(),
-                    };
-                    match int_val {
                 0x01 => cose_key.key_type = generic.borrow_mut().u16()?,
                 0x02 => cose_key.algorithm = generic.borrow_mut().i32()?,
                 key if key < 0 => {
-                            cose_key.parameters.insert(key as i16, generic.value()?);
+                    cose_key.parameters.insert(key, generic.value()?);
                 }
-                        unknown => {
+                _ => {
-                            (unknown, generic.value()?); // skip unknown parameter
+                    generic.value()?; // skip unknown parameter
-                        }
-                    }
-                }
-                unknown => {
-                    (unknown, generic.value()?); // skip unknown parameter
                 }
             }
         }
@@ -734,16 +692,15 @@ impl PublicKeyCredentialDescriptor {
 pub struct AuthenticatorOptions {
     pub rk: bool,
     pub uv: bool,
-    pub up: bool,
 }
 
 impl AuthenticatorOptions {
     pub fn encoded(&self) -> bool {
-        self.rk || self.uv || self.up
+        self.rk || self.uv
     }
 
     pub fn encode<W: WriteBytesExt>(&self, encoder: &mut Encoder<W>) -> FidoResult<()> {
-        let length = (self.rk as usize) + (self.uv as usize) + (self.up as usize);
+        let length = (self.rk as usize) + (self.uv as usize);
         encoder.object(length)?;
         if self.rk {
             encoder.text("rk")?;
@@ -753,10 +710,6 @@ impl AuthenticatorOptions {
             encoder.text("uv")?;
             encoder.bool(true)?;
         }
-        if self.up {
-            encoder.text("up")?;
-            encoder.bool(true)?;
-        }
         Ok(())
     }
 }

src/error.rs

@@ -4,53 +4,21 @@
 // http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
 // http://opensource.org/licenses/MIT>, at your option. This file may not be
 // copied, modified, or distributed except according to those terms.
-use cbor_codec::{DecodeError, EncodeError};
+use cbor_codec::{EncodeError, DecodeError};
-use failure::_core::fmt::{Error, Formatter};
+
-use failure::_core::option::Option;
-use failure::{Backtrace, Context, Fail};
 use std::fmt;
 use std::fmt::Display;
+use failure::{Context, Backtrace, Fail};
 
 pub type FidoResult<T> = Result<T, FidoError>;
 
 #[derive(Debug)]
 pub struct FidoError(Context<FidoErrorKind>);
 
-#[derive(Debug, Copy, Clone, Fail, Eq, PartialEq)]
-pub struct CborErrorCode(u8);
-
-// generated using build.rs
-include!(concat!(env!("OUT_DIR"), "/ctap_error_codes.rs"));
-
-impl CborErrorCode {
-    fn detail(&self) -> Option<(u8, &'static str, &'static str)> {
-        for (code, name, desc) in CTAP_ERROR_CODES {
-            if *code == self.0 as usize {
-                return Some((self.0, name, desc));
-            }
-        }
-        None
-    }
-
-    pub fn name(&self) -> Option<&'static str> {
-        self.detail().map(|(_, name, _)| name)
-    }
-
-    pub fn description(&self) -> Option<&'static str> {
-        self.detail().map(|(_, _, desc)| desc)
-    }
-
-    pub fn code(&self) -> u8 {
-        self.0
-    }
-}
-
 #[derive(Copy, Clone, Eq, PartialEq, Debug, Fail)]
 pub enum FidoErrorKind {
     #[fail(display = "Read/write error with device.")]
     Io,
-    #[fail(display = "Operation timed out")]
-    Timeout,
     #[fail(display = "Error while reading packet from device.")]
     ReadPacket,
     #[fail(display = "Error while writing packet to device.")]
@@ -73,12 +41,10 @@ pub enum FidoErrorKind {
     EncryptPin,
     #[fail(display = "Failed to decrypt PIN.")]
     DecryptPin,
-    #[fail(display = "Failed to verify response signature.")]
+    #[fail(display = "Supplied key has incorrect type.")]
-    VerifySignature,
-    #[fail(display = "Failed to verify response signature.")]
     KeyType,
-    #[fail(display = "Device returned error: {}", _0)]
+    #[fail(display = "Device returned error: 0x{:x}", _0)]
-    CborError(CborErrorCode),
+    CborError(u8),
     #[fail(display = "Device does not support FIDO2")]
     DeviceUnsupported,
     #[fail(display = "This operating requires a PIN but none was provided.")]
@@ -86,7 +52,7 @@ pub enum FidoErrorKind {
 }
 
 impl Fail for FidoError {
-    fn cause(&self) -> Option<&dyn Fail> {
+    fn cause(&self) -> Option<&Fail> {
         self.0.cause()
     }
 
@@ -133,33 +99,3 @@ impl From<DecodeError> for FidoError {
         FidoError(err.context(FidoErrorKind::CborDecode))
     }
 }
-
-impl From<u8> for CborErrorCode {
-    fn from(code: u8) -> Self {
-        Self(code)
-    }
-}
-
-impl Display for CborErrorCode {
-    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error> {
-        if let Some((code, _name, desc)) = self.detail() {
-            write!(f, "CborError: 0x{:x?}: {}", code, desc)?;
-        } else {
-            write!(f, "CborError: 0x{:x?}: unknown", self.code())?;
-        }
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use super::*;
-
-    #[test]
-    fn cbor_error_code() {
-        assert_eq!(
-            CborErrorCode(0x33).to_string(),
-            "CborError: 0x33: PIN authentication, pinAuth, verification failed."
-        )
-    }
-}

src/extensions/hmac.rs

@@ -1,4 +1,4 @@
-use crate::{FidoAssertionRequest, FidoAssertionRequestBuilder, FidoCredentialRequest};
+use crate::cbor;
 use crate::{FidoCredential, FidoDevice, FidoErrorKind, FidoResult};
 use cbor_codec::value::{Bytes, Int, Key, Text, Value};
 use cbor_codec::Encoder;
@@ -11,22 +11,30 @@ use rust_crypto::sha2::Sha256;
 use std::collections::BTreeMap;
 use std::io::Cursor;
 
+#[derive(Debug, Clone)]
+pub struct FidoHmacCredential {
+    pub id: Vec<u8>,
+    pub rp_id: String,
+}
+
+impl From<FidoCredential> for FidoHmacCredential {
+    fn from(cred: FidoCredential) -> Self {
+        FidoHmacCredential {
+            id: cred.id,
+            rp_id: cred.rp_id,
+        }
+    }
+}
+
 pub trait HmacExtension {
     fn extension_name() -> &'static str {
         "hmac-secret"
     }
 
-    fn extension_input() -> &'static Value {
-        &Value::Bool(true)
-    }
-
-    /// Generates data for the extension field as part of the assertion request
     fn get_dict(&mut self, salt: &[u8; 32], salt2: Option<&[u8; 32]>) -> FidoResult<Value> {
         let mut map = BTreeMap::new();
         map.insert(
-            Key::Text(Text::Text(
+            Key::Text(Text::Text(Self::extension_name().to_owned())),
-                <Self as HmacExtension>::extension_name().to_owned(),
-            )),
             self.get_data(salt, salt2)?,
         );
         Ok(Value::Map(map))
@@ -34,52 +42,26 @@ pub trait HmacExtension {
 
     fn get_data(&mut self, salt: &[u8; 32], salt2: Option<&[u8; 32]>) -> FidoResult<Value>;
 
-    /// Convenience function to create an credential which includes extension specific data
+    fn make_hmac_credential(&mut self) -> FidoResult<FidoHmacCredential>;
-    /// Use `FidoDevice::make_credential` if you need more control
-    fn make_hmac_credential(
-        &mut self,
-        request: &FidoCredentialRequest,
-    ) -> FidoResult<FidoCredential>;
 
-    /// Request an assertion from the authenticator for a given credential and salt(s).
+    fn get_hmac_assertion(
-    /// at least one `salt` must be provided, consider using a hashing function like SHA256
-    /// to ensure that your salt will fit 32 bytes.
-    /// Salt(s), credential and the authenticator internal secret will then be used to
-    /// generate a secret.
-    ///
-    /// This method will return the secret whether the assertion matches the credential
-    /// provided, and will fail if a PIN is required but not provided or if the
-    /// device returns malformed data.
-    ///
-    fn get_hmac_assertion<'a: 'b, 'b>(
         &mut self,
-        assertion: &FidoAssertionRequest<'a, 'b>,
+        credential: &FidoHmacCredential,
         salt: &[u8; 32],
         salt2: Option<&[u8; 32]>,
-    ) -> FidoResult<(&'a FidoCredential, ([u8; 32], Option<[u8; 32]>))>;
+    ) -> FidoResult<([u8; 32], Option<[u8; 32]>)>;
 
-    /// Convenience function for `get_hmac_assertion` that will accept arbitrary
-    /// lenght input which will then be hashed and passed on
     fn hmac_challange(
         &mut self,
-        rp_id: &str,
+        credential: &FidoHmacCredential,
-        credential: &FidoCredential,
         input: &[u8],
     ) -> FidoResult<[u8; 32]> {
         let mut salt = [0u8; 32];
         let mut digest = Sha256::new();
         digest.input(input);
         digest.result(&mut salt);
-        self.get_hmac_assertion(
+        self.get_hmac_assertion(credential, &salt, None)
-            &FidoAssertionRequestBuilder::default()
+            .map(|secret| secret.0)
-                .rp_id(rp_id)
-                .credential(&credential)
-                .build()
-                .unwrap(),
-            &salt,
-            None,
-        )
-        .map(|(_cred, secret)| secret.0)
     }
 }
 
@@ -136,40 +118,59 @@ impl HmacExtension for FidoDevice {
         Ok(Value::Map(map))
     }
 
-    fn make_hmac_credential(
+    fn make_hmac_credential(&mut self) -> FidoResult<FidoHmacCredential> {
-        &mut self,
+        self.make_credential("hmac", &[0u8], "commandline", &[0u8; 32])
-        request: &FidoCredentialRequest,
+            .map(|cred| cred.into())
-    ) -> FidoResult<FidoCredential> {
-        let mut request = request.clone();
-        request.rk = true;
-        request.extension_data.insert(
-            <Self as HmacExtension>::extension_name(),
-            <Self as HmacExtension>::extension_input(),
-        );
-        self.make_credential(&request)
     }
 
-    fn get_hmac_assertion<'a: 'b, 'b>(
+    fn get_hmac_assertion(
         &mut self,
-        request: &FidoAssertionRequest<'a, 'b>,
+        credential: &FidoHmacCredential,
         salt: &[u8; 32],
         salt2: Option<&[u8; 32]>,
-    ) -> FidoResult<(&'a FidoCredential, ([u8; 32], Option<[u8; 32]>))> {
+    ) -> FidoResult<([u8; 32], Option<[u8; 32]>)> {
+        let client_data_hash = [0u8; 32];
         while self.shared_secret.is_none() {
             self.init_shared_secret()?;
         }
-        let ext_data: Value = self.get_data(salt, salt2)?;
+        if self.needs_pin && self.pin_token.is_none() {
-        let mut request = request.clone();
+            Err(FidoErrorKind::PinRequired)?
-        request
+        }
-            .extension_data
-            .insert(<Self as HmacExtension>::extension_name(), &ext_data);
 
-        let (cred, auth_data) = self.get_assertion(&request)?;
+        if client_data_hash.len() != 32 {
+            Err(FidoErrorKind::CborEncode)?
+        }
+        let pin_auth = self
+            .pin_token
+            .as_ref()
+            .map(|token| token.auth(&client_data_hash));
+        let ext_data: Value = self.get_data(salt, salt2)?;
+        let allow_list = [cbor::PublicKeyCredentialDescriptor {
+            cred_type: String::from("public-key"),
+            id: credential.id.clone(),
+        }];
+        let request = cbor::GetAssertionRequest {
+            rp_id: &credential.rp_id,
+            client_data_hash: &client_data_hash,
+            allow_list: &allow_list,
+            extensions: &[(<Self as HmacExtension>::extension_name(), &ext_data)],
+            options: Some(cbor::AuthenticatorOptions {
+                rk: false,
+                uv: true,
+            }),
+            pin_auth,
+            pin_protocol: pin_auth.and(Some(0x01)),
+        };
+        let response = match self.cbor(cbor::Request::GetAssertion(request))? {
+            cbor::Response::GetAssertion(resp) => resp,
+            _ => Err(FidoErrorKind::CborDecode)?,
+        };
         let shared_secret = self.shared_secret.as_ref().unwrap();
         let mut decryptor = shared_secret.decryptor();
         let mut hmac_secret_combined = [0u8; 64];
         let _output = RefWriteBuffer::new(&mut hmac_secret_combined);
-        let hmac_secret_enc = match auth_data
+        let hmac_secret_enc = match response
+            .auth_data
             .extensions
             .get(<Self as HmacExtension>::extension_name())
             .ok_or(FidoErrorKind::CborDecode)?
@@ -184,23 +185,16 @@ impl HmacExtension for FidoDevice {
             }),
             _ => Err(FidoErrorKind::CborDecode),
         }?;
-        let mut hmac_secret = [0u8; 64];
+        let mut hmac_secret = ([0u8; 32], [0u8; 32]);
         decryptor
             .decrypt(
                 &mut RefReadBuffer::new(&hmac_secret_enc),
-                &mut RefWriteBuffer::new(&mut hmac_secret),
+                &mut RefWriteBuffer::new(unsafe {
+                    std::mem::transmute::<_, &mut [u8; 64]>(&mut hmac_secret)
+                }),
                 true,
             )
-            .map_err(|_| FidoErrorKind::ReadPacket)?;
+            .expect("failed to decrypt secret");
-        let mut hmac_secret_0 = [0u8; 32];
+        Ok((hmac_secret.0, salt2.map(|_| hmac_secret.1)))
-        let mut hmac_secret_1 = [0u8; 32];
-        hmac_secret_0.copy_from_slice(&hmac_secret[0..32]);
-        hmac_secret_1.copy_from_slice(&hmac_secret[32..]);
-        let cred = request
-            .credentials
-            .into_iter()
-            .find(|c| c.id == cred.id)
-            .unwrap();
-        Ok((cred, (hmac_secret_0, salt2.and(Some(hmac_secret_1)))))
     }
 }

src/extensions/mod.rs

@@ -1,2 +1 @@
 pub mod hmac;
-pub use hmac::*;

src/hid_linux.rs

@@ -4,11 +4,11 @@
 // http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
 // http://opensource.org/licenses/MIT>, at your option. This file may not be
 // copied, modified, or distributed except according to those terms.
-pub use super::hid_common::*;
-use byteorder::{ByteOrder, LittleEndian};
-use std::fs;
 use std::io;
+use std::fs;
 use std::path::PathBuf;
+use byteorder::{ByteOrder, LittleEndian};
+pub use super::hid_common::*;
 
 static REPORT_DESCRIPTOR_KEY_MASK: u8 = 0xfc;
 static LONG_ITEM_ENCODING: u8 = 0xfe;
@@ -18,9 +18,9 @@ static REPORT_SIZE: u8 = 0x74;
 
 pub fn enumerate() -> io::Result<impl Iterator<Item = DeviceInfo>> {
     fs::read_dir("/sys/class/hidraw").map(|entries| {
-        entries
+        entries.filter_map(|entry| entry.ok()).filter_map(|entry| {
-            .filter_map(|entry| entry.ok())
+            path_to_device(&entry.path()).ok()
-            .filter_map(|entry| path_to_device(&entry.path()).ok())
+        })
     })
 }
 

src/lib.rs

@@ -9,76 +9,67 @@
 //! # Example
 //!
 //! ```
-//! # use ctap_hmac::*;
+//! # fn do_fido() -> ctap::FidoResult<()> {
-//! # fn do_fido() -> FidoResult<()> {
+//! let mut devices = ctap::get_devices()?;
+//! let device_info = &devices.next().unwrap();
+//! let mut device = ctap::FidoDevice::new(device_info)?;
 //!
-//!use ctap_hmac::*;
+//! // This can be omitted if the FIDO device is not configured with a PIN.
-//!let device_info = get_devices()?.next().expect("no device connected");
+//! let pin = "test";
-//!let mut device = FidoDevice::new(&device_info)?;
+//! device.unlock(pin)?;
 //!
-//!// This can be omitted if the FIDO device is not configured with a PIN.
+//! // In a real application these values would come from the requesting app.
-//!let pin = "test";
+//! let rp_id = "rp_id";
-//!device.unlock(pin)?;
+//! let user_id = [0];
-//!
+//! let user_name = "user_name";
-//!// In a real application these values would come from the requesting app.
+//! let client_data_hash = [0; 32];
-//!let cred_request = FidoCredentialRequestBuilder::default()
+//! let cred = device.make_credential(
-//!     .rp_id("rp_id")
+//!     rp_id,
-//!     .user_name("user_name")
+//!     &user_id,
-//!     .build().unwrap();
+//!     user_name,
-//!let cred = device.make_credential(&cred_request)?;
+//!     &client_data_hash
-//!let cred = &&cred;
+//! )?;
-//!let assertion_request = FidoAssertionRequestBuilder::default()
-//!     .rp_id("rp_id")
-//!     .credential(cred)
-//!     .build().unwrap();
-//!// In a real application the credential would be stored and used later.
-//!let result = device.get_assertion(&assertion_request);
 //!
+//! // In a real application the credential would be stored and used later.
+//! let result = device.get_assertion(&cred, &client_data_hash);
 //! # Ok(())
 //! # }
 
 #![allow(dead_code)]
 
-extern crate failure;
 extern crate rand;
+extern crate failure;
 #[macro_use]
 extern crate failure_derive;
 #[macro_use]
 extern crate num_derive;
-#[macro_use]
+extern crate num_traits;
-extern crate derive_builder;
 extern crate byteorder;
 extern crate cbor as cbor_codec;
-extern crate crypto as rust_crypto;
-extern crate num_traits;
 extern crate ring;
 extern crate untrusted;
+extern crate crypto as rust_crypto;
 
-mod cbor;
+mod packet;
-mod crypto;
-mod error;
-pub mod extensions;
 mod hid_common;
 mod hid_linux;
-mod packet;
+mod error;
-mod util;
+mod crypto;
+mod cbor;
+pub mod extensions;
 
 use std::cmp;
-use std::fs;
-use std::io::{Cursor, Write};
-use std::u16;
 use std::u8;
+use std::u16;
+use std::fs;
+use std::io::{Write, Cursor};
 
-use self::cbor::{AuthenticatorOptions, PublicKeyCredentialDescriptor};
+use failure::{Fail, ResultExt};
-pub use self::error::*;
+use rand::prelude::*;
+use num_traits::FromPrimitive;
 use self::hid_linux as hid;
 use self::packet::CtapCommand;
-pub use self::util::*;
+pub use self::error::*;
-use crate::cbor::{AuthenticatorData, GetAssertionRequest};
-use failure::{Fail, ResultExt};
-use num_traits::FromPrimitive;
-use rand::prelude::*;
-use std::collections::BTreeMap;
 
 static BROADCAST_CID: [u8; 4] = [0xff, 0xff, 0xff, 0xff];
 
@@ -86,18 +77,23 @@ static BROADCAST_CID: [u8; 4] = [0xff, 0xff, 0xff, 0xff];
 pub fn get_devices() -> FidoResult<impl Iterator<Item = hid::DeviceInfo>> {
     hid::enumerate()
         .context(FidoErrorKind::Io)
-        .map(|devices| devices.filter(|dev| dev.usage_page == 0xf1d0 && dev.usage == 0x21))
+        .map(|devices| {
+            devices.filter(|dev| dev.usage_page == 0xf1d0 && dev.usage == 0x21)
+        })
         .map_err(From::from)
 }
 
 /// A credential created by a FIDO2 authenticator.
-#[derive(Debug, Clone)]
+#[derive(Debug)]
 pub struct FidoCredential {
     /// The ID provided by the authenticator.
     pub id: Vec<u8>,
     /// The public key provided by the authenticator, in uncompressed form.
-    pub public_key: Option<Vec<u8>>,
+    pub public_key: Vec<u8>,
+    /// The Relying Party ID provided by the platform when this key was generated.
+    pub rp_id: String,
 }
+
 /// An opened FIDO authenticator.
 pub struct FidoDevice {
     device: fs::File,
@@ -109,145 +105,6 @@ pub struct FidoDevice {
     aaguid: [u8; 16],
 }
 
-pub struct FidoCancelHandle {
-    device: fs::File,
-    packet_size: u16,
-    channel_id: [u8; 4],
-}
-
-impl FidoCancelHandle {
-    pub fn cancel(&mut self) -> FidoResult<()> {
-        let payload = &[1u8];
-        let to_send = payload.len() as u16;
-        let max_payload = (self.packet_size - 7) as usize;
-        let (frame, payload) = payload.split_at(cmp::min(payload.len(), max_payload));
-        packet::write_init_packet(
-            &mut self.device,
-            64,
-            &self.channel_id,
-            &CtapCommand::Cancel,
-            to_send,
-            frame,
-        )?;
-        if payload.is_empty() {
-            return Ok(());
-        }
-        let max_payload = (self.packet_size - 5) as usize;
-        for (seq, frame) in (0..u8::MAX).zip(payload.chunks(max_payload)) {
-            packet::write_cont_packet(&mut self.device, 64, &self.channel_id, seq, frame)?;
-        }
-        self.device.flush().context(FidoErrorKind::WritePacket)?;
-        Ok(())
-    }
-
-    pub fn cancel_after<T>(&mut self, body: impl Fn(()) -> T) -> FidoResult<T> {
-        let res = body(());
-        match self.cancel() {
-            Ok(_) => Ok(res),
-            Err(e) => Err(e),
-        }
-    }
-}
-
-/// Request a new credential from the authenticator. The `rp_id` should be
-/// a stable string used to identify the party for whom the credential is
-/// created, for convenience it will be returned with the credential.
-/// `user_id` and `user_name` are not required when requesting attestations
-/// but they MAY be displayed to the user and MAY be stored on the device
-/// to be returned with an attestation if the device supports this.
-/// `client_data_hash` SHOULD be a SHA256 hash of provided `client_data`,
-/// this is only used to verify the attestation provided by the
-/// authenticator. When not implementing WebAuthN this can be any random
-/// 32-byte array.
-///
-/// This method will fail if a PIN is required but the device is not
-/// unlocked or if the device returns malformed data.
-#[derive(Clone, Debug, Builder)]
-#[builder(setter(into))]
-#[builder(pattern = "owned")]
-pub struct FidoCredentialRequest<'a> {
-    /// create resident key
-    #[builder(default)]
-    rk: bool,
-    /// user verification
-    #[builder(default)]
-    uv: bool,
-    /// relying party id
-    rp_id: &'a str,
-    /// relying party id
-    #[builder(default)]
-    rp_name: Option<&'a str>,
-    /// relying party icon url
-    #[builder(default)]
-    rp_icon_url: Option<&'a str>,
-    /// user id
-    #[builder(default = "&[0u8]")]
-    user_id: &'a [u8],
-    /// user name
-    #[builder(default)]
-    user_name: Option<&'a str>,
-    /// user icon url
-    #[builder(default)]
-    user_icon_url: Option<&'a str>,
-    /// user display name
-    #[builder(default)]
-    user_display_name: Option<&'a str>,
-    #[builder(default = "&[]")]
-    exclude_list: &'a [&'a FidoCredential],
-    #[builder(default = "&[0u8; 32]")]
-    client_data_hash: &'a [u8],
-    #[builder(default)]
-    extension_data: BTreeMap<&'a str, &'a cbor_codec::value::Value>,
-}
-
-impl<'a> FidoCredentialRequest<'a> {
-    pub fn make_credential(&self, device: &mut FidoDevice) -> FidoResult<FidoCredential> {
-        device.make_credential(&self)
-    }
-}
-
-/// Request an assertion from the authenticator for a given credential.
-/// `client_data_hash` SHOULD be a SHA256 hash of provided `client_data`,
-/// this is signed and verified as part of the attestation. When not
-/// implementing WebAuthN this can be any random 32-byte array.
-///
-/// This method will return whether the assertion matches the credential
-/// provided, and will fail if a PIN is required but not provided or if the
-/// device returns malformed data.
-#[derive(Clone, Debug, Builder)]
-#[builder(setter(into))]
-#[builder(pattern = "owned")]
-pub struct FidoAssertionRequest<'a, 'b> {
-    #[builder(default)]
-    up: bool,
-    #[builder(default)]
-    rk: bool,
-    #[builder(default)]
-    uv: bool,
-    /// The Relying Party ID provided by the platform when this key was generated.
-    rp_id: &'a str,
-    credentials: &'a [&'a FidoCredential],
-    #[builder(default = "&[]")]
-    exclude_list: &'a [&'a FidoCredential],
-    #[builder(default = "&[0u8; 32]")]
-    client_data_hash: &'a [u8],
-    #[builder(default)]
-    extension_data: BTreeMap<&'b str, &'b cbor_codec::value::Value>,
-}
-
-impl<'a, 'b> FidoAssertionRequest<'a, 'b> {
-    pub fn get_assertion(&self, device: &mut FidoDevice) -> FidoResult<&'a FidoCredential> {
-        device.get_assertion(self).map(|res| res.0)
-    }
-}
-
-impl<'a, 'b> FidoAssertionRequestBuilder<'a, 'b> {
-    pub fn credential(mut self, credential: &'a &'a FidoCredential) -> Self {
-        self.credentials = Some(std::slice::from_ref(credential));
-        self
-    }
-}
-
 impl FidoDevice {
     /// Open and initialize a given device. DeviceInfo is provided by the `get_devices`
     /// function. This method will allocate a channel for this application, verify that
@@ -287,15 +144,10 @@ impl FidoDevice {
             cbor::Response::GetInfo(resp) => resp,
             _ => Err(FidoErrorKind::CborDecode)?,
         };
-        if !response.versions.iter().any(|ver| ["FIDO_2_0", "FIDO_2_1_PRE"].contains(&ver.as_str())) {
+        if !response.versions.iter().any(|ver| ver == "FIDO_2_0") {
             Err(FidoErrorKind::DeviceUnsupported)?
         }
-        // Require pin protocol version 1, only if pin-protocol is supported at all
+        if !response.pin_protocols.iter().any(|ver| *ver == 1) {
-        if !response
-            .pin_protocols
-            .iter()
-            .any(|ver| *ver == 1) && response.pin_protocols.len() > 0
-        {
             Err(FidoErrorKind::DeviceUnsupported)?
         }
         self.needs_pin = response.options.client_pin == Some(true);
@@ -325,11 +177,6 @@ impl FidoDevice {
         }
     }
 
-    /// True if this authenticator requires a PIN
-    pub fn needs_pin(&self) -> bool {
-        self.needs_pin
-    }
-
     /// Unlock the device with the provided PIN. Internally this will generate
     /// an ECDH keypair, send the encrypted PIN to the device and store the PIN
     /// token that the device generates on every power cycle. The PIN itself is
@@ -362,93 +209,6 @@ impl FidoDevice {
         }
     }
 
-    pub fn cancel_handle(&mut self) -> FidoResult<FidoCancelHandle> {
-        Ok(self
-            .device
-            .try_clone()
-            .map(|device| FidoCancelHandle {
-                device,
-                packet_size: self.packet_size,
-                channel_id: self.channel_id,
-            })
-            .context(FidoErrorKind::Io)?)
-    }
-
-    pub fn make_credential(
-        &mut self,
-        request: &FidoCredentialRequest<'_>,
-    ) -> FidoResult<FidoCredential> {
-        let rp = cbor::PublicKeyCredentialRpEntity {
-            id: request.rp_id,
-            name: request.rp_name,
-            icon: request.rp_icon_url,
-        };
-        let user = cbor::PublicKeyCredentialUserEntity {
-            id: request.user_id,
-            name: request.user_name.unwrap_or(""),
-            icon: request.user_icon_url,
-            display_name: request.user_display_name,
-        };
-
-        let options = Some(AuthenticatorOptions {
-            up: false,
-            uv: request.uv,
-            rk: request.rk,
-        });
-        if self.needs_pin && self.pin_token.is_none() {
-            Err(FidoErrorKind::PinRequired)?
-        }
-        if request.client_data_hash.len() != 32 {
-            Err(FidoErrorKind::CborEncode)?
-        }
-        while self.shared_secret.is_none() {
-            self.init_shared_secret()?;
-        }
-        let pub_key_cred_params = [("public-key", -7)];
-        let pin_auth = self
-            .pin_token
-            .as_ref()
-            .map(|token| token.auth(&request.client_data_hash));
-        let request = cbor::MakeCredentialRequest {
-            client_data_hash: request.client_data_hash,
-            rp,
-            user,
-            pub_key_cred_params: &pub_key_cred_params,
-            exclude_list: &request
-                .exclude_list
-                .iter()
-                .map(|cred| PublicKeyCredentialDescriptor {
-                    cred_type: "public-key".into(),
-                    id: cred.id.clone(),
-                })
-                .collect::<Vec<_>>()[..],
-            extensions: &request
-                .extension_data
-                .iter()
-                .map(|(name, data)| (*name, *data))
-                .collect::<Vec<_>>()[..],
-            options,
-            pin_auth,
-            pin_protocol: pin_auth.and(Some(0x01)),
-        };
-
-        let response = match self.cbor(cbor::Request::MakeCredential(request))? {
-            cbor::Response::MakeCredential(resp) => resp,
-            _ => Err(FidoErrorKind::CborDecode)?,
-        };
-        let public_key = cbor::P256Key::from_cose(
-            &response
-                .auth_data
-                .attested_credential_data
-                .credential_public_key,
-        )?
-        .bytes();
-        Ok(FidoCredential {
-            id: response.auth_data.attested_credential_data.credential_id,
-            public_key: Some(Vec::from(&public_key[..])),
-        })
-    }
-
     /// Request a new credential from the authenticator. The `rp_id` should be
     /// a stable string used to identify the party for whom the credential is
     /// created, for convenience it will be returned with the credential.
@@ -462,92 +222,121 @@ impl FidoDevice {
     ///
     /// This method will fail if a PIN is required but the device is not
     /// unlocked or if the device returns malformed data.
-    pub fn get_assertion<'a, 'b>(
+    pub fn make_credential(
         &mut self,
-        assertion: &FidoAssertionRequest<'a, 'b>,
+        rp_id: &str,
-    ) -> FidoResult<(&'a FidoCredential, AuthenticatorData)> {
+        user_id: &[u8],
-        while self.shared_secret.is_none() {
+        user_name: &str,
-            self.init_shared_secret()?;
+        client_data_hash: &[u8],
-        }
+    ) -> FidoResult<FidoCredential> {
         if self.needs_pin && self.pin_token.is_none() {
             Err(FidoErrorKind::PinRequired)?
         }
-        if assertion.client_data_hash.len() != 32 {
+        if client_data_hash.len() != 32 {
             Err(FidoErrorKind::CborEncode)?
         }
-        let pin_auth = self
+        let pin_auth = self.pin_token.as_ref().map(
-            .pin_token
+            |token| token.auth(&client_data_hash),
-            .as_ref()
+        );
-            .map(|token| token.auth(&assertion.client_data_hash));
+        let rp = cbor::PublicKeyCredentialRpEntity {
-        let request = GetAssertionRequest {
+            id: rp_id,
-            rp_id: assertion.rp_id,
+            name: None,
-            client_data_hash: assertion.client_data_hash,
+            icon: None,
-            allow_list: &assertion
+        };
-                .credentials
+        let user = cbor::PublicKeyCredentialUserEntity {
-                .iter()
+            id: user_id,
-                .map(|cred| PublicKeyCredentialDescriptor {
+            name: user_name,
-                    cred_type: "public-key".into(),
+            icon: None,
-                    id: cred.id.clone(),
+            display_name: None,
-                })
+        };
-                .collect::<Vec<_>>()[..],
+        let pub_key_cred_params = [("public-key", -7)];
-            extensions: &assertion
+        let request = cbor::MakeCredentialRequest {
-                .extension_data
+            client_data_hash,
-                .iter()
+            rp,
-                .map(|(name, data)| (*name, *data))
+            user,
-                .collect::<Vec<_>>()[..],
+            pub_key_cred_params: &pub_key_cred_params,
-            options: Some(AuthenticatorOptions {
+            exclude_list: Default::default(),
-                rk: assertion.rk,
+            extensions: Default::default(),
-                uv: assertion.uv,
+            options: Some(cbor::AuthenticatorOptions {
-                up: assertion.up,
+                rk: false,
+                uv: true,
             }),
-            pin_auth: pin_auth,
+            pin_auth,
+            pin_protocol: pin_auth.and(Some(0x01)),
+        };
+        let response = match self.cbor(cbor::Request::MakeCredential(request))? {
+            cbor::Response::MakeCredential(resp) => resp,
+            _ => Err(FidoErrorKind::CborDecode)?,
+        };
+        let public_key = cbor::P256Key::from_cose(
+            &response
+                .auth_data
+                .attested_credential_data
+                .credential_public_key,
+        )?
+            .bytes();
+        Ok(FidoCredential {
+            id: response.auth_data.attested_credential_data.credential_id,
+            rp_id: String::from(rp_id),
+            public_key: Vec::from(&public_key[..]),
+        })
+    }
+
+    /// Request an assertion from the authenticator for a given credential.
+    /// `client_data_hash` SHOULD be a SHA256 hash of provided `client_data`,
+    /// this is signed and verified as part of the attestation. When not
+    /// implementing WebAuthN this can be any random 32-byte array.
+    ///
+    /// This method will return whether the assertion matches the credential
+    /// provided, and will fail if a PIN is required but not provided or if the
+    /// device returns malformed data.
+    pub fn get_assertion(
+        &mut self,
+        credential: &FidoCredential,
+        client_data_hash: &[u8],
+    ) -> FidoResult<bool> {
+        if self.needs_pin && self.pin_token.is_none() {
+            Err(FidoErrorKind::PinRequired)?
+        }
+        if client_data_hash.len() != 32 {
+            Err(FidoErrorKind::CborEncode)?
+        }
+        let pin_auth = self.pin_token.as_ref().map(
+            |token| token.auth(&client_data_hash),
+        );
+        let allow_list = [
+            cbor::PublicKeyCredentialDescriptor {
+                cred_type: String::from("public-key"),
+                id: credential.id.clone(),
+            },
+        ];
+        let request = cbor::GetAssertionRequest {
+            rp_id: &credential.rp_id,
+            client_data_hash: client_data_hash,
+            allow_list: &allow_list,
+            extensions: Default::default(),
+            options: Some(cbor::AuthenticatorOptions {
+                rk: false,
+                uv: true,
+            }),
+            pin_auth,
             pin_protocol: pin_auth.and(Some(0x01)),
         };
         let response = match self.cbor(cbor::Request::GetAssertion(request))? {
             cbor::Response::GetAssertion(resp) => resp,
             _ => Err(FidoErrorKind::CborDecode)?,
         };
-        let credential = assertion
+        Ok(crypto::verify_signature(
-            .credentials
+            &credential.public_key,
-            .iter()
+            &client_data_hash,
-            .flat_map(|cred| {
-                response
-                    .credential
-                    .as_ref()
-                    .filter(|rcred| rcred.id == cred.id)
-                    .map(|_| *cred)
-            })
-            .next();
-
-        credential
-            .and_then(|cred| {
-                if cred
-                    .public_key
-                    .as_ref()
-                    .map(|public_key| {
-                        crypto::verify_signature(
-                            &public_key,
-                            &assertion.client_data_hash,
             &response.auth_data_bytes,
             &response.signature,
-                        )
+        ))
-                    })
-                    .unwrap_or(true)
-                {
-                    Some(cred)
-                } else {
-                    None
-                }
-            })
-            .ok_or(FidoError::from(FidoErrorKind::VerifySignature))
-            .map(|cred| (cred, response.auth_data))
     }
 
     fn cbor(&mut self, request: cbor::Request) -> FidoResult<cbor::Response> {
         let mut buf = Cursor::new(Vec::new());
-        request
+        request.encode(&mut buf).context(FidoErrorKind::CborEncode)?;
-            .encode(&mut buf)
-            .context(FidoErrorKind::CborEncode)?;
         let response = self.exchange(CtapCommand::Cbor, &buf.into_inner())?;
         request
             .decode(Cursor::new(response))
@@ -584,9 +373,11 @@ impl FidoDevice {
         while first_packet.is_none() {
             let packet = packet::InitPacket::from_reader(&mut self.device, 64)?;
             if packet.cmd == CtapCommand::Error {
-                Err(packet::CtapError::from_u8(packet.payload[0])
+                Err(
+                    packet::CtapError::from_u8(packet.payload[0])
                         .unwrap_or(packet::CtapError::Other)
-                    .context(FidoErrorKind::ParseCtap))?
+                        .context(FidoErrorKind::ParseCtap),
+                )?
             }
             if packet.cid == self.channel_id && &packet.cmd == cmd {
                 first_packet = Some(packet);

src/packet.rs

@@ -4,9 +4,9 @@
 // http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
 // http://opensource.org/licenses/MIT>, at your option. This file may not be
 // copied, modified, or distributed except according to those terms.
-use super::error::*;
-use failure::ResultExt;
 use num_traits::{FromPrimitive, ToPrimitive};
+use failure::ResultExt;
+use super::error::*;
 
 use std::io::{Read, Write};
 
@@ -81,9 +81,9 @@ pub fn write_init_packet<W: Write>(
         Err(FidoErrorKind::WritePacket)?
     }
     packet.resize(report_size + 1, 0);
-    writer
+    writer.write_all(&packet).context(
-        .write_all(&packet)
+        FidoErrorKind::WritePacket,
-        .context(FidoErrorKind::WritePacket)?;
+    )?;
     Ok(())
 }
 
@@ -98,9 +98,9 @@ impl InitPacket {
     pub fn from_reader<R: Read>(mut reader: R, report_size: usize) -> FidoResult<InitPacket> {
         let mut buf = Vec::with_capacity(report_size);
         buf.resize(report_size, 0);
-        reader
+        reader.read_exact(&mut buf[0..report_size]).context(
-            .read_exact(&mut buf[0..report_size])
+            FidoErrorKind::ReadPacket,
-            .context(FidoErrorKind::ReadPacket)?;
+        )?;
         let mut cid = [0; 4];
         cid.copy_from_slice(&buf[0..4]);
         let cmd = match CtapCommand::from_u8(buf[4] ^ FRAME_INIT) {
@@ -142,9 +142,9 @@ pub fn write_cont_packet<W: Write>(
         Err(FidoErrorKind::WritePacket)?
     }
     packet.resize(report_size + 1, 0);
-    writer
+    writer.write_all(&packet).context(
-        .write_all(&packet)
+        FidoErrorKind::WritePacket,
-        .context(FidoErrorKind::WritePacket)?;
+    )?;
     Ok(())
 }
 
@@ -162,9 +162,9 @@ impl ContPacket {
     ) -> FidoResult<ContPacket> {
         let mut buf = Vec::with_capacity(report_size);
         buf.resize(report_size, 0);
-        reader
+        reader.read_exact(&mut buf[0..report_size]).context(
-            .read_exact(&mut buf[0..report_size])
+            FidoErrorKind::ReadPacket,
-            .context(FidoErrorKind::ReadPacket)?;
+        )?;
         let mut cid = [0; 4];
         cid.copy_from_slice(&buf[0..4]);
         let seq = buf[4];

src/util.rs

@@ -1,88 +0,0 @@
-#[cfg(feature = "request_multiple")]
-use crate::{
-    cbor::AuthenticatorData, FidoAssertionRequest, FidoCredential, FidoCredentialRequest,
-    FidoDevice, FidoErrorKind, FidoResult,
-};
-#[cfg(feature = "request_multiple")]
-use crossbeam::thread;
-#[cfg(feature = "request_multiple")]
-use std::sync::mpsc::channel;
-#[cfg(feature = "request_multiple")]
-use std::time::Duration;
-#[cfg(feature = "request_multiple")]
-pub fn request_multiple_devices<
-    'a,
-    T: Send + 'a,
-    F: Fn(&mut FidoDevice) -> FidoResult<T> + 'a + Sync,
->(
-    devices: impl Iterator<Item = (&'a mut FidoDevice, &'a F)>,
-    timeout: Option<Duration>,
-) -> FidoResult<T> {
-    thread::scope(|scope| -> FidoResult<T> {
-        let (tx, rx) = channel();
-        let handles = devices
-            .map(|(device, fn_)| {
-                let cancel = device.cancel_handle()?;
-                let tx = tx.clone();
-                let thread_handle = scope.spawn(move |_| tx.send(fn_(device)));
-                Ok((cancel, thread_handle))
-            })
-            .collect::<FidoResult<Vec<_>>>()?;
-        let mut err = None;
-        let mut slept = Duration::from_millis(0);
-        let interval = Duration::from_millis(10);
-        let mut received = 0usize;
-        let res = loop {
-            match timeout {
-                Some(t) if t < slept => {
-                    break if let Some(cause) = err {
-                        cause
-                    } else {
-                        Err(FidoErrorKind::Timeout.into())
-                    };
-                }
-                _ => (),
-            }
-            if timeout.map(|t| t < slept).unwrap_or(true) {}
-            if let Ok(msg) = rx.recv_timeout(interval) {
-                received += 1;
-                match msg {
-                    e @ Err(_) if received == handles.len() => break e,
-                    e @ Err(_) => err = Some(e),
-                    res @ Ok(_) => break res,
-                }
-            } else {
-                slept += interval;
-            }
-        };
-        for (mut cancel, join) in handles {
-            // Canceling out of courtesy don't care if it fails
-            let _ = cancel.cancel();
-            let _ = join.join();
-        }
-        res
-    })
-    .unwrap()
-}
-
-/// Will send the `assertion_request` to all supplied `devices` and return either the first successful assertion or the last error
-#[cfg(feature = "request_multiple")]
-pub fn get_assertion_devices<'a>(
-    assertion_request: &'a FidoAssertionRequest,
-    devices: impl Iterator<Item = &'a mut FidoDevice>,
-    timeout: Option<Duration>,
-) -> FidoResult<(&'a FidoCredential, AuthenticatorData)> {
-    let get_assertion = |device: &mut FidoDevice| device.get_assertion(assertion_request);
-    request_multiple_devices(devices.map(|device| (device, &get_assertion)), timeout)
-}
-
-/// Will send the `credential_request` to all supplied `devices` and return either the first credential or the last error
-#[cfg(feature = "request_multiple")]
-pub fn make_credential_devices<'a>(
-    credential_request: &'a FidoCredentialRequest,
-    devices: impl Iterator<Item = &'a mut FidoDevice>,
-    timeout: Option<Duration>,
-) -> FidoResult<FidoCredential> {
-    let make_credential = |device: &mut FidoDevice| device.make_credential(credential_request);
-    request_multiple_devices(devices.map(|device| (device, &make_credential)), timeout)
-}