1FIDO_ASSERT_SET_AUTHD... BSD Library Functions Manual FIDO_ASSERT_SET_AUTHD...
2
4 fido_assert_set_authdata, fido_assert_set_authdata_raw,
5 fido_assert_set_clientdata, fido_assert_set_clientdata_hash,
6 fido_assert_set_count, fido_assert_set_extensions,
7 fido_assert_set_hmac_salt, fido_assert_set_hmac_secret,
8 fido_assert_set_up, fido_assert_set_uv, fido_assert_set_rp,
9 fido_assert_set_sig — set parameters of a FIDO2 assertion
10
12 #include <fido.h>
13 typedef enum {
15 FIDO_OPT_OMIT = 0, /* use authenticator's default */
16 FIDO_OPT_FALSE, /* explicitly set option to false */
17 FIDO_OPT_TRUE, /* explicitly set option to true */
18 } fido_opt_t;
19 int
21 fido_assert_set_authdata(fido_assert_t *assert, size_t idx,
22 const unsigned char *ptr, size_t len);
23 int
25 fido_assert_set_authdata_raw(fido_assert_t *assert, size_t idx,
26 const unsigned char *ptr, size_t len);
27 int
29 fido_assert_set_clientdata(fido_assert_t *assert,
30 const unsigned char *ptr, size_t len);
31 int
33 fido_assert_set_clientdata_hash(fido_assert_t *assert,
34 const unsigned char *ptr, size_t len);
35 int
37 fido_assert_set_count(fido_assert_t *assert, size_t n);
38 int
40 fido_assert_set_extensions(fido_assert_t *assert, int flags);
41 int
43 fido_assert_set_hmac_salt(fido_assert_t *assert,
44 const unsigned char *ptr, size_t len);
45 int
47 fido_assert_set_hmac_secret(fido_assert_t *assert, size_t idx,
48 const unsigned char *ptr, size_t len);
49 int
51 fido_assert_set_up(fido_assert_t *assert, fido_opt_t up);
52 int
54 fido_assert_set_uv(fido_assert_t *assert, fido_opt_t uv);
55 int
57 fido_assert_set_rp(fido_assert_t *assert, const char *id);
58 int
60 fido_assert_set_sig(fido_assert_t *assert, size_t idx,
61 const unsigned char *ptr, size_t len);
62
64 The fido_assert_set_authdata set of functions define the various parame‐
65 ters of a FIDO2 assertion, allowing a fido_assert_t type to be prepared
66 for a subsequent call to fido_dev_get_assert(3) or fido_assert_verify(3).
67 For the complete specification of a FIDO2 assertion and the format of its
68 constituent parts, please refer to the Web Authentication (webauthn)
69 standard.
70 The fido_assert_set_count() function sets the number of assertion state‐
72 ments in assert to n.
73 The fido_assert_set_authdata() and fido_assert_set_sig() functions set
75 the authenticator data and signature parts of the statement with index
76 idx of assert to ptr, where ptr points to len bytes. A copy of ptr is
77 made, and no references to the passed pointer are kept. Please note that
78 the first assertion statement of assert has an idx of 0. The authentica‐
79 tor data passed to fido_assert_set_authdata() must be a CBOR-encoded byte
80 string, as obtained from fido_assert_authdata_ptr(). Alternatively, a
81 raw binary blob may be passed to fido_assert_set_authdata_raw().
82 The fido_assert_set_clientdata_hash() function sets the client data hash
84 of assert to ptr, where ptr points to len bytes. A copy of ptr is made,
85 and no references to the passed pointer are kept.
86 The fido_assert_set_clientdata() function allows an application to set
88 the client data hash of assert by specifying the assertion's unhashed
89 client data. This is required by Windows Hello, which calculates the
90 client data hash internally. For compatibility with Windows Hello, ap‐
91 plications should use fido_assert_set_clientdata() instead of
92 fido_assert_set_clientdata_hash().
93 The fido_assert_set_rp() function sets the relying party id of assert,
95 where id is a NUL-terminated UTF-8 string. The content of id is copied,
96 and no references to the passed pointer are kept.
97 The fido_assert_set_extensions() function sets the extensions of assert
99 to the bitmask flags. At the moment, only the FIDO_EXT_CRED_BLOB,
100 FIDO_EXT_HMAC_SECRET, and FIDO_EXT_LARGEBLOB_KEY extensions are sup‐
101 ported. If flags is zero, the extensions of assert are cleared.
102 The fido_assert_set_hmac_salt() and fido_assert_set_hmac_secret() func‐
104 tions set the hmac-salt and hmac-secret parts of assert to ptr, where ptr
105 points to len bytes. A copy of ptr is made, and no references to the
106 passed pointer are kept. The HMAC Secret (hmac-secret) Extension is a
107 CTAP 2.0 extension. Note that the resulting hmac-secret varies according
108 to whether user verification was performed by the authenticator. The
109 fido_assert_set_hmac_secret() function is normally only useful when writ‐
110 ing tests.
111 The fido_assert_set_up() and fido_assert_set_uv() functions set the up
113 (user presence) and uv (user verification) attributes of assert. Both
114 are FIDO_OPT_OMIT by default, allowing the authenticator to use its de‐
115 fault settings.
116 Use of the fido_assert_set_authdata set of functions may happen in two
118 distinct situations: when asking a FIDO2 device to produce a series of
119 assertion statements, prior to fido_dev_get_assert(3) (i.e, in the con‐
120 text of a FIDO2 client), or when verifying assertion statements using
121 fido_assert_verify(3) (i.e, in the context of a FIDO2 server).
122 For a complete description of the generation of a FIDO2 assertion and its
124 verification, please refer to the FIDO2 specification. An example of how
125 to use the fido_assert_set_authdata set of functions can be found in the
126 examples/assert.c file shipped with libfido2.
127
129 The fido_assert_set_authdata functions return FIDO_OK on success. The
130 error codes returned by the fido_assert_set_authdata set of functions are
131 defined in <fido/err.h>.
132
134 fido_assert_allow_cred(3), fido_assert_verify(3), fido_dev_get_assert(3)
135BSD April 27, 2022 BSD