wip: deb VM

should make fido2luks much easier to use in boot scripts since it will
allow for usage as follows:

`fido2luks open-token /dev/disk/by-uuid/sda1 test 'bash -c "read -p Pass PW 1>&2; echo $PW"'`

which will read the password from the current terminal

.github/workflows/current.yml

@@ -1,32 +0,0 @@
-# This is a basic workflow to help you get started with Actions
-
-name: Current
-
-# Controls when the workflow will run
-on:
-  schedule:
-    - cron: '0 22 * * 6'
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v4
-      - name: Setup Attic cache
-        uses: ryanccn/attic-action@v0
-        with:
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-          cache: ${{ secrets.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
-      - name: Build Nix Package nixos-unstable
-        run: nix build --override-input nixpkgs github:nixos/nixpkgs/nixos-unstable --show-trace

.github/workflows/locked.yml

@@ -1,33 +0,0 @@
-# This is a basic workflow to help you get started with Actions
-
-name: Locked
-
-# Controls when the workflow will run
-on:
-  # Triggers the workflow on push or pull request events but only for the "master" branch
-  push:
-    branches: '*'
-  pull_request:
-    branches: '*'
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v4
-      - name: Setup Attic cache
-        uses: ryanccn/attic-action@v0
-        with:
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-          cache: ${{ secrets.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
-      - name: Build Nix Package
-        run: nix build -j 10 --show-trace

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fido2luks"
-version = "0.3.1-alpha"
+version = "0.3.0"
 authors = ["shimunn <shimun@shimun.net>"]
 edition = "2018"
 
@@ -14,26 +14,25 @@ categories = ["command-line-utilities"]
 license = "MPL-2.0"
 
 [dependencies]
+ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
 hex = "0.3.2"
-ring = "0.16.5"
+ring = "0.13.5"
 failure = "0.1.5"
 rpassword = "4.0.1"
 structopt = "0.3.2"
-libcryptsetup-rs = "0.9.1"
+libcryptsetup-rs = "0.4.2"
 serde_json = "1.0.51"
 serde_derive = "1.0.116"
 serde = "1.0.116"
-anyhow = "1.0.56"
-ctap-hid-fido2 = "3.4.1"
 
 [build-dependencies]
+ctap_hmac = { version="0.4.5", features = ["request_multiple"] }
 hex = "0.3.2"
-ring = "0.16.5"
+ring = "0.13.5"
 failure = "0.1.5"
 rpassword = "4.0.1"
-libcryptsetup-rs = "0.9.1"
+libcryptsetup-rs = "0.4.1"
 structopt = "0.3.2"
-anyhow = "1.0.56"
 
 [profile.release]
 lto = true

README.md

@@ -1,7 +1,160 @@
 # fido2luks [![Crates.io Version](https://img.shields.io/crates/v/fido2luks.svg)](https://crates.io/crates/fido2luks)
 
-## 0.3.0-alpha
+This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key.
+
+Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T, YubiKey(fw >= [5.2.3](https://support.yubico.com/hc/en-us/articles/360016649319-YubiKey-5-2-3-Enhancements-to-FIDO-2-Support))
+
+## Setup
+
+### Prerequisites
+
+```
+dnf install clang cargo cryptsetup-devel -y
+```
+
+### Device
+
+```
+git clone https://github.com/shimunn/fido2luks.git && cd fido2luks
+
+# Alternativly cargo build --release && sudo cp target/release/fido2luks /usr/bin/
+sudo -E cargo install -f --path . --root /usr
+
+# Copy template
+cp dracut/96luks-2fa/fido2luks.conf /etc/
+# Name is optional but useful if your authenticator has a display
+echo FIDO2LUKS_CREDENTIAL_ID=$(fido2luks credential [NAME]) >> /etc/fido2luks.conf
+
+# Load config into env
+set -a
+. /etc/fido2luks.conf
+
+# Repeat for each luks volume
+# You can also use the `--token` flag when using LUKS2 which will then store the credential in the LUKS header,
+# enabling you to use `fido2luks open-token` without passing a credential as parameter
+sudo -E fido2luks -i add-key /dev/disk/by-uuid/<DISK_UUID>
+
+# Test(only works if the luks container isn't active)
+sudo -E fido2luks -i open /dev/disk/by-uuid/<DISK_UUID> luks-<DISK_UUID>
+
+```
+
+### Dracut
+
+```
+cd dracut
+
+sudo make install
+```
+
+### Grub
+
+Add `rd.luks.2fa=<CREDENTIAL_ID>:<DISK_UUID>` to `GRUB_CMDLINE_LINUX` in /etc/default/grub
+
+Note: This is only required for your root disk, systemd will try to unlock all other LUKS partions using the same key if you added it using `fido2luks add-key`
+
+```
+grub2-mkconfig > /boot/grub2/grub.cfg
+```
+
+I'd also recommend to copy the executable onto /boot so that it is accessible in case you have to access your disk from a rescue system
+
+```
+mkdir /boot/fido2luks/
+cp /usr/bin/fido2luks /boot/fido2luks/
+cp /etc/fido2luks.conf /boot/fido2luks/
+```
+
+## Testing
+
+Just reboot and see if it works, if that's the case you should remove your old less secure password from your LUKS header:
+
+```
+# Recommend in case you lose your authenticator, store this backupfile somewhere safe
+cryptsetup luksHeaderBackup /dev/disk/by-uuid/<DISK_UUID> --header-backup-file luks_backup_<DISK_UUID>
+# There is no turning back if you mess this up, make sure you made a backup
+# You can also pass `--token` if you're using LUKS2 which will then store the credential in the LUKS header,
+# which will enable you to use `fido2luks open-token` without passing a credential as parameter
+fido2luks -i add-key --exclusive /dev/disk/by-uuid/<DISK_UUID>
+```
+
+## Addtional settings
+
+### Password less
+
+Remove your previous secret as described in the next section, in case you've already added one.
+
+Open `/etc/fido2luks.conf` and replace `FIDO2LUKS_SALT=Ask` with `FIDO2LUKS_SALT=string:<YOUR_RANDOM_STRING>`
+but be warned that this password will be included to into your initramfs.
+
+Import the new config into env:
+
+```
+set -a
+. /etc/fido2luks.conf
+```
+
+Then add the new secret to each device and update dracut afterwards `dracut -f`
+
+### Multiple keys
+
+Additional/backup keys are supported, Multiple fido2luks credentials can be added to your /etc/fido2luks.conf file. Credential tokens are comma separated.
+```
+FIDO2LUKS_CREDENTIAL_ID=<CREDENTIAL1>,<CREDENTIAL2>,<CREDENTIAL3>
+```
+
+## Removal
+
+Remove `rd.luks.2fa` from `GRUB_CMDLINE_LINUX` in /etc/default/grub
+
+```
+set -a
+. fido2luks.conf
+sudo -E fido2luks -i replace-key /dev/disk/by-uuid/<DISK_UUID>
+
+sudo rm -rf /usr/lib/dracut/modules.d/96luks-2fa /etc/dracut.conf.d/luks-2fa.conf /etc/fido2luks.conf
+```
+
+## Theory of operation
+
+fido2luks builds on two basic building blocks, LUKS as an abstraction over linux disk encryption and and the FIDO2 extension [`hmac-secret`](https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension).
+The `hmac-secret` extension allows for an secret to be dervied on the FIDO2 device from two inputs, the user supplied salt/password/keyfile and another secret contained within the FID2 device. The output of the `hmac-secret` function will then be used to decrypt the LUKS header which in turn is used to decrypt the disk.
+```
+
+        +-------------------------------------------------------------------------------+
+        |                                                                               |
+        |                       +-----------------------------------------+             |
+        |                       |               FIDO2 device              |             |
+        |                       |                                         |             |
+        |                       |                                         |             |
++-------+--------+   +------+   |                      +---------------+  |             |             +------------------------+
+| Salt/Password  +-> |sha256+------------------------> |               |  |             v             |      LUKS header       |
++----------------+   +------+   |                      |               |  |                           |                        |           +---------------+   
+                                |                      |               |  |        +--------+         +------------------------+-------->  |Disk master key| 
+                                |                      |  sha256_hmac  +---------> | sha256 +-------> | Keyslot 1              |           +---------------+ 
++----------------+              |  +----------+        |               |  |        +--------+         +------------------------+
+| FIDO credential+---------------> |Credential| +----> |               |  |                           | Keyslot 2              |
++----------------+              |  |secret    |        |               |  |                           +------------------------+
+                                |  +----------+        +---------------+  |
+                                |                                         |
+                                |                                         |
+                                +-----------------------------------------+
+
+```
+Since all these components build upon each other losing or damaging just one of them will render the disk undecryptable, it's threfore of paramount importance to backup the LUKS header and ideally set an backup password
+or utilise more than one FIDO2 device. Each additional credential and password combination will require it's own LUKS keyslot since the credential secret is randomly generated for each new credential and will thus result
+in a completly different secret.
+
+## License
+
+Licensed under
+
+ * Mozilla Public License 2.0, ([LICENSE-MPL](LICENSE-MPL) or https://www.mozilla.org/en-US/MPL/2.0/)
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the MPL 2.0
+license, shall be licensed as above, without any additional terms or
+conditions.
 
-This is just the program itself, all intitrid scripts are mostly taylored to the latest 0.2.x version and will most likely not work with 0.3.0 due to breaking changes in the CLI interface.
-I've decided it release the version in this state since I just do not have the time now or in the forseeable future to tewak all scripts since it's quite an tedious tasks which involves rebooting VMs countless times.
-If you're interested to adapt or write scripts for an particular distro I'd be more than happy to accept pull requests.

README_NEW.md

@@ -0,0 +1,79 @@
+# fido2luks [![Crates.io Version](https://img.shields.io/crates/v/fido2luks.svg)](https://crates.io/crates/fido2luks)
+
+This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key.
+
+Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T
+
+## Installation
+
+### From Source
+
+Installing from source requires the following dependencies:
+
+Ubuntu: `cargo, libclang-dev, libcryptsetup-dev >= 2.2`
+
+Fedora: `cargo, clang-devel, cryptsetup-devel`
+
+To compile the fido2luks binary you can simply run `sudo cargo install --root /usr fido2luks` but since you may want to install the scripts included it this repo as well,
+it's recommended to clone the repo and install from there.
+
+``
+git clone https://github.com/shimunn/fido2luks.git
+cargo install --root /usr --path fido2luks
+``
+
+Continue with further instructions for [Ubuntu](initramfs-tools) or [Fedora](dracut)
+
+### From Package
+
+Ubuntu: see [releases](https://github.com/shimunn/fido2luks/releases)
+
+NixOS: https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2
+
+ArchLinux: 
+* [AUR](https://aur.archlinux.org/packages/fido2luks/)
+* [Git](PKGBUILD)
+
+Fedora: coming soon
+
+## Credentials
+
+Depending on the version of cryptsetup and the age of your installation your LUKS header might be in the LUKS2 format already if that's the case fido2luks will be able to spare you from dealing with just another config file by simply storeing all the required information within your LUKS header. 
+If your header is still using the LUKS1 format you may convert it:
+
+```
+cryptsetup convert --type luks2 <device>
+```
+
+if you want to keep using LUKS1 due to other software such as pam_mount not being compatible with LUKS2 at the moment, you will have to generate credentials by hand an add them to `/etc/fido2luks.conf` otherwise you can skip this step.
+```
+fido2luks credential [optional name]
+```
+the generated hexadecimal credential can then be added to `FIDO2LUKS_CREDENTIAL_ID=` in `/etc/fido2luks.conf` multiple credentials can be separated by comma.
+
+## Adding a Key
+
+If you had to generate a credential in the previous step you'll have to provide it to the following commands as a parameter or via an environment variable:
+
+```
+set -a
+. /etc/fido2luks.conf
+```
+
+To then add the key you need to have your current password/keyfile ready:
+
+without having generated a credential in the previous step: `fido2luks -i add-key --gen-cred <device>`
+
+with a keyfile: `fido2luks -i add-key --keyfile <path-to-keyfile <device>`
+
+if you've confirmed at a later stage that everything works as expected you may want to remove your keyfile/password by running the previous commands with the `--exclusive` flag which will remove all other keys from the device.
+
+## Replacing a Key
+
+with password: `fido2luks -i replace-key <device>`
+
+with keyfile: `fido2luks -i replace-key -d <path-to-keyfile> <device>`
+
+with another fido2 derived key: `fido2luks -i replace-key -f <device>`
+
+

build.rs

@@ -1,6 +1,7 @@
 #![allow(warnings)]
 #[macro_use]
 extern crate failure;
+extern crate ctap_hmac as ctap;
 
 #[path = "src/cli_args/mod.rs"]
 mod cli_args;
@@ -11,22 +12,17 @@ mod util;
 
 use cli_args::Args;
 use std::env;
-use std::fs;
-use std::path::PathBuf;
 use std::str::FromStr;
 use structopt::clap::Shell;
 use structopt::StructOpt;
 
 fn main() {
-    let env_outdir = env::var_os("OUT_DIR").unwrap();
-    let outdir = PathBuf::from(PathBuf::from(env_outdir).ancestors().nth(3).unwrap());
-    fs::create_dir_all(&outdir).unwrap();
     // generate completion scripts, zsh does panic for some reason
     for shell in Shell::variants().iter().filter(|shell| **shell != "zsh") {
         Args::clap().gen_completions(
             env!("CARGO_PKG_NAME"),
             Shell::from_str(shell).unwrap(),
-            &outdir,
+            env!("CARGO_MANIFEST_DIR"),
         );
     }
 }

flake.lock

@@ -1,5 +1,21 @@
 {
   "nodes": {
+    "cargo-deb": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1627137192,
+        "narHash": "sha256-zDAwiETJquiViEvBKMuI9WWgSGhVDscL/m1ufKJENBw=",
+        "owner": "mmstick",
+        "repo": "cargo-deb",
+        "rev": "f603d105b4641e00640e46b189c6ee0c8f084de2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mmstick",
+        "repo": "cargo-deb",
+        "type": "github"
+      }
+    },
     "naersk": {
       "inputs": {
         "nixpkgs": [
@@ -7,26 +23,26 @@
         ]
       },
       "locked": {
-        "lastModified": 1698420672,
+        "lastModified": 1623927034,
-        "narHash": "sha256-/TdeHMPRjjdJub7p7+w55vyABrsJlt5QkznPYy55vKA=",
+        "narHash": "sha256-sGxlmfp5eXL5sAMNqHSb04Zq6gPl+JeltIZ226OYN0w=",
-        "owner": "nix-community",
+        "owner": "nmattia",
         "repo": "naersk",
-        "rev": "aeb58d5e8faead8980a807c840232697982d47b9",
+        "rev": "e09c320446c5c2516d430803f7b19f5833781337",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "nmattia",
         "repo": "naersk",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1705496572,
+        "lastModified": 1627245147,
-        "narHash": "sha256-rPIe9G5EBLXdBdn9ilGc0nq082lzQd0xGGe092R/5QE=",
+        "narHash": "sha256-CQzH/4Mbhcx1HD+dtD7pZ0dHUZvX4eKN9b8Ifzz4gC4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "842d9d80cfd4560648c785f8a4e6f3b096790e19",
+        "rev": "23098f20376cd1c874af476e5d8ef9169105b020",
         "type": "github"
       },
       "original": {
@@ -36,36 +52,19 @@
     },
     "root": {
       "inputs": {
+        "cargo-deb": "cargo-deb",
         "naersk": "naersk",
         "nixpkgs": "nixpkgs",
         "utils": "utils"
       }
     },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "utils": {
-      "inputs": {
-        "systems": "systems"
-      },
       "locked": {
-        "lastModified": 1705309234,
+        "lastModified": 1623875721,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "narHash": "sha256-A8BU7bjS5GirpAUv4QA+QnJ4CceLHkcXdRp4xITDB0s=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "rev": "f7e004a55b120c02ecb6219596820fcd32ca8772",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,31 +3,74 @@
 
   inputs = {
     utils.url = "github:numtide/flake-utils";
+    cargo-deb = {
+      flake = false;
+      url = "github:mmstick/cargo-deb";
+    };
     naersk = {
-      url = "github:nix-community/naersk";
+      url = "github:nmattia/naersk";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs = { self, nixpkgs, utils, naersk }:
+  outputs = { self, nixpkgs, utils, naersk, cargo-deb }:
     let
       root = ./.;
       pname = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.name;
       forPkgs = pkgs:
         let
           naersk-lib = naersk.lib."${pkgs.system}";
-          buildInputs = with pkgs; [ cryptsetup cryptsetup.dev udev.dev ];
+          buildInputs = with pkgs; [ cryptsetup ];
+          LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
           nativeBuildInputs = with pkgs; [
-            rustPlatform.bindgenHook
+            pkgconfig
-            pkg-config
             clang
           ];
         in
         rec {
           # `nix build`
           packages.${pname} = naersk-lib.buildPackage {
-            inherit pname root buildInputs nativeBuildInputs;
+            inherit pname root buildInputs nativeBuildInputs LIBCLANG_PATH;
           };
+
+          packages."${pname}-deb" =
+            let
+              cargoDeb = naersk-lib.buildPackage {
+                pname = "cargo-deb";
+                root = cargo-deb;
+              };
+              pkg = packages.${pname};
+              vm = pkgs.vmTools.diskImageFuns.ubuntu1804x86_64 { extraPackages = [ "cargo" "cryptsetup" "libclang-dev" "libcryptsetup-dev" ]; };
+              makefile = pkgs.writeText "Makefile" "
+                .PHONY: install
+
+                cargo-deb:
+                        cargo install --debug --path cargo-deb
+
+                install: cargo-deb
+                        cargo-deb
+                        mkdir -p debs
+                        cp target/debian/*.deb debs/
+                  
+              ";
+              src = pkgs.runCommandLocal "${pname}-vendored" {} ''
+                mkdir -p $out/.cargo $out/cargo-deb/.cargo
+                printf '${pkg.cargoconfig}' > $out/.cargo/config.toml; 
+                printf '${cargoDeb.cargoconfig}' > $out/cargo-deb/.cargo/config.toml;
+                printf '.PHONY: install\ninstall:\n\tcargo install --debug --path cargo-deb\n\tcargo-deb\n\tmkdir -p debs\n\tcp target/debian/*.deb debs/' > $out/Makefile
+                cp -r ${pkg.src}/. $out/
+                cp -r ${cargoDeb.src}/. $out/cargo-deb/
+              '';
+              args = {
+                diskImage = vm;
+                inherit src;
+                name = pname;
+                buildInputs = [ ];
+                meta.description = "No descr";
+              };
+            in
+            pkgs.releaseTools.debBuild args;
+
           defaultPackage = packages.${pname};
 
           # `nix run`
@@ -51,7 +94,7 @@
           # `nix develop`
           devShell = pkgs.mkShell {
             nativeBuildInputs = with pkgs; [ rustc cargo rustfmt nixpkgs-fmt ] ++ nativeBuildInputs;
-            inherit buildInputs;
+            inherit buildInputs LIBCLANG_PATH;
           };
         };
       forSystem = system: forPkgs nixpkgs.legacyPackages."${system}";

src/cli.rs

@@ -4,13 +4,14 @@ use crate::util::sha256;
 use crate::*;
 pub use cli_args::Args;
 use cli_args::*;
-use ctap_hid_fido2::public_key_credential_descriptor::PublicKeyCredentialDescriptor;
+use ctap::{FidoCredential, FidoErrorKind};
 use std::borrow::Cow;
 use std::collections::HashSet;
 use std::io::Write;
 use std::iter::FromIterator;
 use std::path::Path;
 use std::str::FromStr;
+use std::thread;
 use std::time::Duration;
 use std::time::SystemTime;
 use structopt::clap::Shell;
@@ -25,31 +26,31 @@ fn derive_secret(
     salt: &[u8; 32],
     timeout: u64,
     pin: Option<&str>,
-) -> Fido2LuksResult<([u8; 32], PublicKeyCredentialDescriptor)> {
+) -> Fido2LuksResult<([u8; 32], FidoCredential)> {
     if credentials.is_empty() {
         return Err(Fido2LuksError::InsufficientCredentials);
     }
     let timeout = Duration::from_secs(timeout);
     let start = SystemTime::now();
 
-    //while let Ok(el) = start.elapsed() {
+    while let Ok(el) = start.elapsed() {
-    //    if el > timeout {
+        if el > timeout {
-    //        return Err(error::Fido2LuksError::NoAuthenticatorError);
+            return Err(error::Fido2LuksError::NoAuthenticatorError);
-    //    }
+        }
-    //    if get_devices()
+        if get_devices()
-    //        .map(|devices| !devices.is_empty())
+            .map(|devices| !devices.is_empty())
-    //        .unwrap_or(false)
+            .unwrap_or(false)
-    //    {
+        {
-    //        break;
+            break;
-    //    }
+        }
-    //    thread::sleep(Duration::from_millis(500));
+        thread::sleep(Duration::from_millis(500));
-    //}
+    }
 
     let credentials = credentials
         .iter()
-        .map(|hex| PublicKeyCredentialDescriptor {
+        .map(|hex| FidoCredential {
             id: hex.0.clone(),
-            ctype: Default::default(),
+            public_key: None,
         })
         .collect::<Vec<_>>();
     let credentials = credentials.iter().collect::<Vec<_>>();
@@ -181,8 +182,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
             } else {
                 None
             };
-            let cred =
+            let cred = make_credential_id(Some(name.as_ref()), pin)?;
-                make_credential_id(Some(name.as_str()).filter(|name| name.len() > 0), pin, &[])?;
             println!("{}", hex::encode(&cred.id));
             Ok(())
         }
@@ -289,10 +289,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
 
             let other_secret = |salt_q: &str,
                                 verify: bool|
-             -> Fido2LuksResult<(
+             -> Fido2LuksResult<(Vec<u8>, Option<FidoCredential>)> {
-                Vec<u8>,
-                Option<PublicKeyCredentialDescriptor>,
-            )> {
                 match other_secret {
                     OtherSecret {
                         keyfile: Some(file),
@@ -317,38 +314,22 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                     )),
                 }
             };
-            let secret =
+            let secret = |q: &str,
-                |q: &str,
+                          verify: bool,
-                 verify: bool,
+                          credentials: &[HexEncoded]|
-                 credentials: &[HexEncoded]|
+             -> Fido2LuksResult<([u8; 32], FidoCredential)> {
-                 -> Fido2LuksResult<([u8; 32], PublicKeyCredentialDescriptor)> {
+                let (pin, salt) = inputs(q, verify)?;
-                    let (pin, salt) = inputs(q, verify)?;
+                prompt_interaction(interactive);
-                    prompt_interaction(interactive);
+                derive_secret(credentials, &salt, authenticator.await_time, pin.as_deref())
-                    derive_secret(credentials, &salt, authenticator.await_time, pin.as_deref())
+            };
-                };
             // Non overlap
             match &args.command {
                 Command::AddKey {
                     exclusive,
                     generate_credential,
-                    comment,
                     ..
                 } => {
-                    let (existing_secret, existing_credential) =
+                    let (existing_secret, _) = other_secret("Current password", false)?;
-                        other_secret("Current password", false)?;
-                    let excluded_credential = existing_credential.as_ref();
-                    let exclude_list = excluded_credential
-                        .as_ref()
-                        .map(core::slice::from_ref)
-                        .unwrap_or_default();
-                    existing_credential.iter().for_each(|cred| {
-                        log(&|| {
-                            format!(
-                                "using credential to unlock container: {}",
-                                hex::encode(&cred.id)
-                            )
-                        })
-                    });
                     let (new_secret, cred) = if *generate_credential && luks2 {
                         let cred = make_credential_id(
                             Some(derive_credential_name(luks.device.as_path()).as_str()),
@@ -359,7 +340,6 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                                 None
                             })
                             .as_deref(),
-                            dbg!(exclude_list),
                         )?;
                         log(&|| {
                             format!(
@@ -381,7 +361,6 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                         Some(&cred.id[..])
                             .filter(|_| !luks.disable_token || *generate_credential)
                             .filter(|_| luks2),
-                        comment.as_deref().map(String::from),
                     )?;
                     if *exclusive {
                         let destroyed = luks_dev.remove_keyslots(&[added_slot])?;
@@ -417,7 +396,6 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                                 .filter(|_| !luks.disable_token)
                                 .filter(|_| luks2)
                                 .map(|cred| &cred.id[..]),
-                            None,
                         )
                     } else {
                         let slot = luks_dev.replace_key(
@@ -455,8 +433,6 @@ pub fn run_cli() -> Fido2LuksResult<()> {
             credentials,
             retries,
             dry_run,
-            allow_discards,
-            ..
         } => {
             let inputs = |q: &str, verify: bool| -> Fido2LuksResult<(Option<String>, [u8; 32])> {
                 get_input(&secret, &authenticator, args.interactive, q, verify)
@@ -493,7 +469,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                     });
                     secret(Cow::Borrowed(&credentials.0)).and_then(|(secret, cred)| {
                         log(&|| format!("credential used: {}", hex::encode(&cred.id)));
-                        luks_dev.activate(&name, &secret, luks.slot, *dry_run, *allow_discards)
+                        luks_dev.activate(&name, &secret, luks.slot, *dry_run)
                     })
                 } else if luks2 && !luks.disable_token {
                     luks_dev.activate_token(
@@ -511,7 +487,6 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                         }),
                         luks.slot,
                         *dry_run,
-                        *allow_discards,
                     )
                 } else if luks_dev.is_luks2()? && luks.disable_token {
                     // disable-token is mostly cosmetic in this instance
@@ -523,8 +498,9 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                     Err(e) => {
                         match e {
                             Fido2LuksError::WrongSecret if retries > 0 => {}
-                            //Fido2LuksError::AuthenticatorError { ref cause }
+                            Fido2LuksError::AuthenticatorError { ref cause }
-                            //    if cause.kind() == FidoErrorKind::Timeout && retries > 0 => {}
+                                if cause.kind() == FidoErrorKind::Timeout && retries > 0 => {}
+
                             e => return Err(e),
                         };
                         retries -= 1;
@@ -565,13 +541,8 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                         continue;
                     }
                     println!(
-                        "{}{}:\n\tSlots: {}\n\tCredentials: {}",
+                        "{}:\n\tSlots: {}\n\tCredentials: {}",
                         id,
-                        token
-                            .comment
-                            .as_deref()
-                            .map(|comment| format!(" - {}", comment))
-                            .unwrap_or_default(),
                         if token.keyslots.is_empty() {
                             "None".into()
                         } else {
@@ -597,7 +568,6 @@ pub fn run_cli() -> Fido2LuksResult<()> {
             TokenCommand::Add {
                 device,
                 credentials,
-                comment,
                 slot,
             } => {
                 let mut dev = LuksDevice::load(device)?;
@@ -609,11 +579,7 @@ pub fn run_cli() -> Fido2LuksResult<()> {
                     }
                 }
                 let count = if tokens.is_empty() {
-                    dev.add_token(&Fido2LuksToken::with_credentials(
+                    dev.add_token(&Fido2LuksToken::with_credentials(&credentials.0, *slot))?;
-                        &credentials.0,
-                        *slot,
-                        comment.as_deref().map(String::from),
-                    ))?;
                     1
                 } else {
                     tokens.len()

src/cli_args/mod.rs

@@ -189,9 +189,6 @@ pub enum Command {
         luks: LuksParameters,
         #[structopt(flatten)]
         credentials: Credentials,
-        /// Comment to be associated with this credential
-        #[structopt(long = "comment")]
-        comment: Option<String>,
         #[structopt(flatten)]
         authenticator: AuthenticatorParameters,
         #[structopt(flatten)]
@@ -247,9 +244,6 @@ pub enum Command {
         /// Perform the whole procedure without mounting the LUKS volume on success
         #[structopt(long = "dry-run")]
         dry_run: bool,
-        /// Pass SSD trim instructions to the underlying block device
-        #[structopt(long = "allow-discards")]
-        allow_discards: bool,
     },
     /// Generate a new FIDO credential
     #[structopt(name = "credential")]
@@ -257,7 +251,7 @@ pub enum Command {
         #[structopt(flatten)]
         authenticator: AuthenticatorParameters,
         /// Name to be displayed on the authenticator display
-        #[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME", default_value = "")]
+        #[structopt(env = "FIDO2LUKS_CREDENTIAL_NAME", default_value = "fido2luks")]
         name: String,
     },
     /// Check if an authenticator is connected
@@ -298,9 +292,6 @@ pub enum TokenCommand {
             long = "creds"
         )]
         credentials: CommaSeparated<HexEncoded>,
-        /// Comment to be associated with this credential
-        #[structopt(long = "comment")]
-        comment: Option<String>,
         /// Slot to which the credentials will be added
         #[structopt(long = "slot", env = "FIDO2LUKS_DEVICE_SLOT")]
         slot: u32,

src/device.rs

@@ -1,133 +1,84 @@
 use crate::error::*;
 
 use crate::util;
-use ctap_hid_fido2;
+use ctap::{
-use ctap_hid_fido2::fidokey::get_assertion::get_assertion_params;
+    self, extensions::hmac::HmacExtension, request_multiple_devices, FidoAssertionRequestBuilder,
-use ctap_hid_fido2::fidokey::make_credential::make_credential_params;
+    FidoCredential, FidoCredentialRequestBuilder, FidoDevice, FidoError, FidoErrorKind,
-use ctap_hid_fido2::fidokey::GetAssertionArgsBuilder;
+};
-use ctap_hid_fido2::fidokey::MakeCredentialArgsBuilder;
-use ctap_hid_fido2::get_fidokey_devices;
-use ctap_hid_fido2::public_key_credential_descriptor::PublicKeyCredentialDescriptor;
-use ctap_hid_fido2::public_key_credential_user_entity::PublicKeyCredentialUserEntity;
-use ctap_hid_fido2::FidoKeyHidFactory;
-use ctap_hid_fido2::HidInfo;
-use ctap_hid_fido2::LibCfg;
 use std::time::Duration;
 
 const RP_ID: &str = "fido2luks";
 
-fn lib_cfg() -> LibCfg {
-    let mut cfg = LibCfg::init();
-    cfg.enable_log = false;
-    cfg.keep_alive_msg = String::new();
-    cfg
-}
-
 pub fn make_credential_id(
     name: Option<&str>,
     pin: Option<&str>,
-    exclude: &[&PublicKeyCredentialDescriptor],
+) -> Fido2LuksResult<FidoCredential> {
-) -> Fido2LuksResult<PublicKeyCredentialDescriptor> {
+    let mut request = FidoCredentialRequestBuilder::default().rp_id(RP_ID);
-    let mut req = MakeCredentialArgsBuilder::new(RP_ID, &[])
+    if let Some(user_name) = name {
-        .extensions(&[make_credential_params::Extension::HmacSecret(Some(true))]);
+        request = request.user_name(user_name);
-    if let Some(pin) = pin {
-        req = req.pin(pin);
-    } else {
-        req = req.without_pin_and_uv();
     }
-    for cred in exclude {
+    let request = request.build().unwrap();
-        req = req.exclude_authenticator(cred.id.as_ref());
+    let make_credential = |device: &mut FidoDevice| {
-    }
+        if let Some(pin) = pin.filter(|_| device.needs_pin()) {
-    if let Some(_) = name {
+            device.unlock(pin)?;
-        req = req.user_entity(&PublicKeyCredentialUserEntity::new(
-            Some(b"00"),
-            name.clone(),
-            name,
-        ));
-    }
-    let devices = get_devices()?;
-    let mut err: Option<Fido2LuksError> = None;
-    let req = req.build();
-    for dev in devices {
-        let handle = FidoKeyHidFactory::create_by_params(&vec![dev.param], &lib_cfg()).unwrap();
-        match handle.make_credential_with_args(&req) {
-            Ok(resp) => return Ok(resp.credential_descriptor),
-            Err(e) => err = Some(e.into()),
         }
-    }
+        device.make_hmac_credential(&request)
-    Err(err.unwrap_or(Fido2LuksError::NoAuthenticatorError))
+    };
+    Ok(request_multiple_devices(
+        get_devices()?
+            .iter_mut()
+            .map(|device| (device, &make_credential)),
+        None,
+    )?)
 }
 
 pub fn perform_challenge<'a>(
-    credentials: &'a [&'a PublicKeyCredentialDescriptor],
+    credentials: &'a [&'a FidoCredential],
     salt: &[u8; 32],
-    _timeout: Duration,
+    timeout: Duration,
     pin: Option<&str>,
-) -> Fido2LuksResult<([u8; 32], &'a PublicKeyCredentialDescriptor)> {
+) -> Fido2LuksResult<([u8; 32], &'a FidoCredential)> {
-    if credentials.is_empty() {
+    let request = FidoAssertionRequestBuilder::default()
-        return Err(Fido2LuksError::InsufficientCredentials);
+        .rp_id(RP_ID)
-    }
+        .credentials(credentials)
-    let mut req = GetAssertionArgsBuilder::new(RP_ID, &[]).extensions(&[
+        .build()
-        get_assertion_params::Extension::HmacSecret(Some(util::sha256(&[&salt[..]]))),
+        .unwrap();
-    ]);
+    let get_assertion = |device: &mut FidoDevice| {
-    for cred in credentials {
+        if let Some(pin) = pin.filter(|_| device.needs_pin()) {
-        req = req.add_credential_id(&cred.id);
+            device.unlock(pin)?;
-    }
-    if let Some(pin) = pin {
-        req = req.pin(pin);
-    } else {
-        req = req.without_pin_and_uv();
-    }
-    let process_response = |resp: Vec<get_assertion_params::Assertion>| -> Fido2LuksResult<([u8; 32], &'a PublicKeyCredentialDescriptor)> {
-    for att in resp {
-        for ext in att.extensions.iter() {
-            match ext {
-                get_assertion_params::Extension::HmacSecret(Some(secret)) => {
-                    //TODO: eliminate unwrap
-                    let cred_used = credentials
-                        .iter()
-                        .copied()
-                        .find(|cred| {
-                            att.credential_id == cred.id
-                        })
-                        .unwrap();
-                    return Ok((secret.clone(), cred_used));
-                }
-                _ => continue,
-            }
         }
-     }
+        device.get_hmac_assertion(&request, &util::sha256(&[&salt[..]]), None)
-        Err(Fido2LuksError::WrongSecret)
     };
-
+    let (credential, (secret, _)) = request_multiple_devices(
-    let devices = get_devices()?;
+        get_devices()?
-    let mut err: Option<Fido2LuksError> = None;
+            .iter_mut()
-    let req = req.build();
+            .map(|device| (device, &get_assertion)),
-    for dev in devices {
+        Some(timeout),
-        let handle = FidoKeyHidFactory::create_by_params(&vec![dev.param], &lib_cfg()).unwrap();
+    )?;
-        match handle.get_assertion_with_args(&req) {
+    Ok((secret, credential))
-            Ok(resp) => return process_response(resp),
-            Err(e) => err = Some(e.into()),
-        }
-    }
-    Err(err.unwrap_or(Fido2LuksError::NoAuthenticatorError))
 }
 
 pub fn may_require_pin() -> Fido2LuksResult<bool> {
-    for dev in get_devices()? {
+    for di in ctap::get_devices()? {
-        let handle = FidoKeyHidFactory::create_by_params(&vec![dev.param], &lib_cfg()).unwrap();
+        if let Ok(dev) = FidoDevice::new(&di) {
-        let info = handle.get_info()?;
+            if dev.needs_pin() {
-        let needs_pin = info
+                return Ok(true);
-            .options
+            }
-            .iter()
-            .any(|(name, val)| &name[..] == "clientPin" && *val);
-        if needs_pin {
-            return Ok(true);
         }
     }
     Ok(false)
 }
 
-pub fn get_devices() -> Fido2LuksResult<Vec<HidInfo>> {
+pub fn get_devices() -> Fido2LuksResult<Vec<FidoDevice>> {
-    Ok(get_fidokey_devices())
+    let mut devices = Vec::with_capacity(2);
+    for di in ctap::get_devices()? {
+        match FidoDevice::new(&di) {
+            Err(e) => match e.kind() {
+                FidoErrorKind::ParseCtap | FidoErrorKind::DeviceUnsupported => (),
+                err => return Err(FidoError::from(err).into()),
+            },
+            Ok(dev) => devices.push(dev),
+        }
+    }
+    Ok(devices)
 }

src/error.rs

@@ -1,4 +1,4 @@
-use anyhow;
+use ctap::FidoError;
 use libcryptsetup_rs::LibcryptErr;
 use std::io;
 use std::io::ErrorKind;
@@ -14,7 +14,7 @@ pub enum Fido2LuksError {
     #[fail(display = "unable to read keyfile: {}", cause)]
     KeyfileError { cause: io::Error },
     #[fail(display = "authenticator error: {}", cause)]
-    AuthenticatorError { cause: anyhow::Error },
+    AuthenticatorError { cause: ctap::FidoError },
     #[fail(display = "no authenticator found, please ensure your device is plugged in")]
     NoAuthenticatorError,
     #[fail(display = " {}", cause)]
@@ -35,12 +35,6 @@ pub enum Fido2LuksError {
     InsufficientCredentials,
 }
 
-impl From<anyhow::Error> for Fido2LuksError {
-    fn from(cause: anyhow::Error) -> Self {
-        Fido2LuksError::AuthenticatorError { cause }
-    }
-}
-
 impl Fido2LuksError {
     pub fn exit_code(&self) -> i32 {
         use Fido2LuksError::*;
@@ -97,6 +91,12 @@ impl From<LuksError> for Fido2LuksError {
     }
 }
 
+impl From<FidoError> for Fido2LuksError {
+    fn from(e: FidoError) -> Self {
+        AuthenticatorError { cause: e }
+    }
+}
+
 impl From<LibcryptErr> for Fido2LuksError {
     fn from(e: LibcryptErr) -> Self {
         match e {

src/luks.rs

@@ -1,8 +1,9 @@
 use crate::error::*;
 
-use libcryptsetup_rs::consts::flags::CryptActivate;
+use libcryptsetup_rs::{
-use libcryptsetup_rs::consts::vals::{EncryptionFormat, KeyslotInfo};
+    CryptActivateFlags, CryptDevice, CryptInit, CryptTokenInfo, EncryptionFormat, KeyslotInfo,
-use libcryptsetup_rs::{CryptDevice, CryptInit, CryptTokenInfo, TokenInput};
+    TokenInput,
+};
 use std::collections::{HashMap, HashSet};
 use std::path::Path;
 
@@ -141,7 +142,6 @@ impl LuksDevice {
         old_secret: &[u8],
         iteration_time: Option<u64>,
         credential_id: Option<&[u8]>,
-        comment: Option<String>,
     ) -> Fido2LuksResult<u32> {
         if let Some(millis) = iteration_time {
             self.device.settings_handle().set_iteration_time(millis)
@@ -152,7 +152,7 @@ impl LuksDevice {
             .add_by_passphrase(None, old_secret, secret)?;
         if let Some(id) = credential_id {
             self.device.token_handle().json_set(TokenInput::AddToken(
-                &serde_json::to_value(&Fido2LuksToken::new(id, slot, comment)).unwrap(),
+                &serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap(),
             ))?;
         }
 
@@ -204,7 +204,7 @@ impl LuksDevice {
             None,
             None,
             old_secret,
-            CryptActivate::empty(),
+            CryptActivateFlags::empty(),
         )?;
 
         // slot should stay the same but better be safe than sorry
@@ -216,18 +216,9 @@ impl LuksDevice {
         )? as u32;
         if let Some(id) = credential_id {
             if self.is_luks2()? {
-                let (token_id, token_data) = match self.find_token(slot)? {
+                let token = self.find_token(slot)?.map(|(t, _)| t);
-                    Some((id, data)) => (Some(id), Some(data)),
+                let json = serde_json::to_value(&Fido2LuksToken::new(id, slot)).unwrap();
-                    _ => (None, None),
+                if let Some(token) = token {
-                };
-                let json = serde_json::to_value(&Fido2LuksToken::new(
-                    id,
-                    slot,
-                    // retain comment on replace
-                    token_data.map(|data| data.comment).flatten(),
-                ))
-                .unwrap();
-                if let Some(token) = token_id {
                     self.device
                         .token_handle()
                         .json_set(TokenInput::ReplaceToken(token, &json))?;
@@ -247,15 +238,15 @@ impl LuksDevice {
         secret: &[u8],
         slot_hint: Option<u32>,
         dry_run: bool,
-        allow_discard: bool,
     ) -> Fido2LuksResult<u32> {
-        let mut flags = CryptActivate::empty();
-        if allow_discard {
-            flags = flags | CryptActivate::ALLOW_DISCARDS;
-        }
         self.device
             .activate_handle()
-            .activate_by_passphrase(Some(name).filter(|_| !dry_run), slot_hint, secret, flags)
+            .activate_by_passphrase(
+                Some(name).filter(|_| !dry_run),
+                slot_hint,
+                secret,
+                CryptActivateFlags::empty(),
+            )
             .map_err(LuksError::activate)
     }
 
@@ -265,7 +256,6 @@ impl LuksDevice {
         secret: impl Fn(Vec<String>) -> Fido2LuksResult<([u8; 32], String)>,
         slot_hint: Option<u32>,
         dry_run: bool,
-        allow_discard: bool,
     ) -> Fido2LuksResult<u32> {
         if !self.is_luks2()? {
             return Err(LuksError::Luks2Required.into());
@@ -309,7 +299,7 @@ impl LuksDevice {
                 .chain(std::iter::once(None).take(slots.is_empty() as usize)), // Try all slots as last resort
         );
         for slot in slots {
-            match self.activate(name, &secret, slot, dry_run, allow_discard) {
+            match self.activate(name, &secret, slot, dry_run) {
                 Err(Fido2LuksError::WrongSecret) => (),
                 res => return res,
             }
@@ -324,19 +314,16 @@ pub struct Fido2LuksToken {
     pub type_: String,
     pub credential: HashSet<String>,
     pub keyslots: HashSet<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub comment: Option<String>,
 }
 
 impl Fido2LuksToken {
-    pub fn new(credential_id: impl AsRef<[u8]>, slot: u32, comment: Option<String>) -> Self {
+    pub fn new(credential_id: impl AsRef<[u8]>, slot: u32) -> Self {
-        Self::with_credentials(std::iter::once(credential_id), slot, comment)
+        Self::with_credentials(std::iter::once(credential_id), slot)
     }
 
     pub fn with_credentials<I: IntoIterator<Item = B>, B: AsRef<[u8]>>(
         credentials: I,
         slot: u32,
-        comment: Option<String>,
     ) -> Self {
         Self {
             credential: credentials
@@ -344,7 +331,6 @@ impl Fido2LuksToken {
                 .map(|cred| hex::encode(cred.as_ref()))
                 .collect(),
             keyslots: vec![slot.to_string()].into_iter().collect(),
-            comment,
             ..Default::default()
         }
     }
@@ -359,7 +345,6 @@ impl Default for Fido2LuksToken {
             type_: Self::default_type().into(),
             credential: HashSet::new(),
             keyslots: HashSet::new(),
-            comment: None,
         }
     }
 }

src/main.rs

@@ -1,5 +1,6 @@
 #[macro_use]
 extern crate failure;
+extern crate ctap_hmac as ctap;
 #[macro_use]
 extern crate serde_derive;
 use crate::cli::*;