Space opt

Cargo.toml

@@ -28,6 +28,7 @@ trussed-staging = { version = "0.1.0", default-features = false, optional = true
 apdu-dispatch = { version = "0.1", optional = true }
 ctaphid-dispatch = { version = "0.1", optional = true }
 iso7816 = { version = "0.1", optional = true }
+serde-byte-array = "0.1.2"
 
 [features]
 dispatch = ["apdu-dispatch", "ctaphid-dispatch", "iso7816"]
@@ -46,6 +47,7 @@ log-error = []
 
 [dev-dependencies]
 env_logger = "0.11.0"
+hex-literal = "0.4.1"
 # quickcheck = "1"
 rand = "0.8.4"
 trussed = { version = "0.1", features = ["virt"] }
@@ -56,10 +58,12 @@ usbd-ctaphid = "0.1.0"
 features = ["dispatch"]
 
 [patch.crates-io]
+cbor-smol = { git = "https://github.com/sosthene-nitrokey/cbor-smol.git", rev = "94ee8c28edf9248b402aa4335c1dee157995197b"}
 ctap-types = { git = "https://github.com/trussed-dev/ctap-types.git", rev = "7d4ad69e64ad308944c012aef5b9cfd7654d9be8" }
 ctaphid-dispatch = { git = "https://github.com/trussed-dev/ctaphid-dispatch.git", rev = "57cb3317878a8593847595319aa03ef17c29ec5b" }
 apdu-dispatch = { git = "https://github.com/trussed-dev/apdu-dispatch.git", rev = "915fc237103fcecc29d0f0b73391f19abf6576de" }
-trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "b1781805a2e33615d2d00b8bec80c0b1f5870ca1" }
+trussed = { git = "https://github.com/nitrokey/trussed.git", rev = "907805eb84c8eb34ed99c922b24433602440ff9f" }
+littlefs2 = { git = "https://github.com/sosthene-nitrokey/littlefs2.git", rev = "99b1a9832c46c9097e73ca1fa43e119026e2068f" }
 trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging", rev = "3b9594d93f89a5e760fe78fa5a96f125dfdcd470" }
 serde-indexed = { git = "https://github.com/sosthene-nitrokey/serde-indexed.git", rev = "5005d23cb4ee8622e62188ea0f9466146f851f0d" }
 trussed-usbip = { git = "https://github.com/Nitrokey/pc-usbip-runner.git", tag = "v0.0.1-nitrokey.1" }

src/ctap2.rs

@@ -1128,7 +1128,69 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
 
         // we are only dealing with discoverable credentials.
         debug_now!("Allowlist not passed, fetching RKs");
+        let legacy_present = self.prepare_cache(rp_id_hash, uv_performed)?;
+        if legacy_present {
+            self.prepare_cache_legacy(rp_id_hash, uv_performed)?;
+        }
+
+        let num_credentials = self.state.runtime.remaining_credentials();
+        let credential = self.state.runtime.pop_credential(&mut self.trussed);
+        credential.map(|credential| (Credential::Full(credential), num_credentials))
+    }
+
+    /// Populate the cache with the RP credentials.
+    ///
+    /// Returns true if legacy credentials are present and therefore prepare_cache_legacy should be called too
+    #[inline(never)]
+    fn prepare_cache(&mut self, rp_id_hash: &Bytes<32>, uv_performed: bool) -> Option<bool> {
+        use crate::state::CachedCredential;
+        use core::str::FromStr;
 
+        let rp_rk_dir = rp_rk_dir(rp_id_hash);
+        let mut maybe_entry = syscall!(self.trussed.read_dir_first_alphabetical(
+            Location::Internal,
+            PathBuf::from(b"rk"),
+            Some(rp_rk_dir.clone())
+        ))
+        .entry;
+
+        let mut legacy_detected = false;
+        while let Some(entry) = maybe_entry.take() {
+            if !entry.path().as_ref().starts_with(rp_rk_dir.as_ref()) {
+                // We got past all credentials for the relevant RP
+                break;
+            }
+
+            if entry.path() == &*rp_rk_dir {
+                debug_assert!(entry.metadata().is_dir());
+                legacy_detected = true;
+                continue;
+            }
+
+            let credential_data = syscall!(self
+                .trussed
+                .read_file(Location::Internal, entry.path().into(),))
+            .data;
+
+            let credential = FullCredential::deserialize(&credential_data).ok()?;
+            let timestamp = credential.creation_time;
+            let credential = Credential::Full(credential);
+
+            if self.check_credential_applicable(&credential, false, uv_performed) {
+                self.state.runtime.push_credential(CachedCredential {
+                    timestamp,
+                    path: String::from_str(entry.path().as_str_ref_with_trailing_nul()).ok()?,
+                });
+            }
+
+            maybe_entry = syscall!(self.trussed.read_dir_next()).entry;
+        }
+        Some(legacy_detected)
+    }
+
+    /// Populate the cache with the legacy `rp_id/cred_id` rk
+    #[inline(never)]
+    fn prepare_cache_legacy(&mut self, rp_id_hash: &Bytes<32>, uv_performed: bool) -> Option<()> {
         let mut maybe_path =
             syscall!(self
                 .trussed
@@ -1158,10 +1220,7 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
                 .entry
                 .map(|entry| PathBuf::from(entry.path()));
         }
-
-        let num_credentials = self.state.runtime.remaining_credentials();
-        let credential = self.state.runtime.pop_credential(&mut self.trussed);
-        credential.map(|credential| (Credential::Full(credential), num_credentials))
+        Some(())
     }
 
     fn decrypt_pin_hash_and_maybe_escalate(
@@ -1941,11 +2000,12 @@ fn rp_rk_dir(rp_id_hash: &Bytes<32>) -> PathBuf {
 }
 
 fn rk_path(rp_id_hash: &Bytes<32>, credential_id_hash: &Bytes<32>) -> PathBuf {
-    let mut path = rp_rk_dir(rp_id_hash);
-
-    let mut hex = [0u8; 16];
-    format_hex(&credential_id_hash[..8], &mut hex);
-    path.push(&PathBuf::from(&hex));
+    let mut buf = [0; 33];
+    buf[16] = b'.';
+    format_hex(&rp_id_hash[..8], &mut buf[..16]);
+    format_hex(&credential_id_hash[..8], &mut buf[17..]);
 
+    let mut path = PathBuf::from("rk");
+    path.push(&PathBuf::from(buf.as_slice()));
     path
 }