calculated large blob key

canokeys · Oct 18, 2023 · 0327e26 · 0327e26
1 parent 14a6567
commit 0327e26
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 5 deletions.
diff --git a/applets/ctap/ctap-internal.h b/applets/ctap/ctap-internal.h
@@ -247,7 +247,6 @@ typedef struct {
   user_entity user;
   bool deleted;
   bool has_large_blob_key;
-  uint8_t large_blob_key[LARGE_BLOB_KEY_SIZE];
   uint8_t cred_blob_len;
   uint8_t cred_blob[MAX_CRED_BLOB_LENGTH];
 } __packed CTAP_discoverable_credential;

diff --git a/applets/ctap/ctap.c b/applets/ctap/ctap.c
@@ -591,7 +591,6 @@ static uint8_t ctap_make_credential(CborEncoder *encoder, uint8_t *params, size_
     memcpy(&dc.credential_id, data_buf + 55, sizeof(dc.credential_id));
     memcpy(&dc.user, &mc.user, sizeof(user_entity)); // c
     dc.has_large_blob_key = mc.ext_large_blob_key;
-    if (dc.has_large_blob_key) random_buffer(dc.large_blob_key, LARGE_BLOB_KEY_SIZE);
     dc.cred_blob_len = 0;
     if (mc.ext_has_cred_blob && mc.ext_cred_blob_len <= MAX_CRED_BLOB_LENGTH) {
       dc.cred_blob_len = mc.ext_cred_blob_len;
@@ -704,9 +703,13 @@ static uint8_t ctap_make_credential(CborEncoder *encoder, uint8_t *params, size_
   CHECK_CBOR_RET(ret);
 
   if (mc.ext_large_blob_key) {
+    uint8_t *large_blob_key = dc.cred_blob; // reuse buffer
+    static_assert(LARGE_BLOB_KEY_SIZE <= MAX_CRED_BLOB_LENGTH, "Reuse buffer");
+    ret = make_large_blob_key(dc.credential_id.nonce, large_blob_key);
+    CHECK_CBOR_RET(ret);
     ret = cbor_encode_int(&map, MC_RESP_LARGE_BLOB_KEY);
     CHECK_CBOR_RET(ret);
-    ret = cbor_encode_byte_string(&map, dc.large_blob_key, LARGE_BLOB_KEY_SIZE);
+    ret = cbor_encode_byte_string(&map, large_blob_key, LARGE_BLOB_KEY_SIZE);
     CHECK_CBOR_RET(ret);
   }
 
@@ -1157,9 +1160,13 @@ static uint8_t ctap_get_assertion(CborEncoder *encoder, uint8_t *params, size_t
   }
 
   if (dc.has_large_blob_key) {
+    uint8_t *large_blob_key = dc.cred_blob; // reuse buffer
+    static_assert(LARGE_BLOB_KEY_SIZE <= MAX_CRED_BLOB_LENGTH, "Reuse buffer");
+    ret = make_large_blob_key(dc.credential_id.nonce, large_blob_key);
+    CHECK_CBOR_RET(ret);
     ret = cbor_encode_int(&map, GA_RESP_LARGE_BLOB_KEY);
     CHECK_CBOR_RET(ret);
-    ret = cbor_encode_byte_string(&map, dc.large_blob_key, LARGE_BLOB_KEY_SIZE);
+    ret = cbor_encode_byte_string(&map, large_blob_key, LARGE_BLOB_KEY_SIZE);
     CHECK_CBOR_RET(ret);
   }
 
@@ -1810,9 +1817,13 @@ static uint8_t ctap_credential_management(CborEncoder *encoder, const uint8_t *p
       ret = cbor_encode_int(&map, dc.credential_id.nonce[CREDENTIAL_NONCE_CP_POS]);
       CHECK_CBOR_RET(ret);
       if (dc.has_large_blob_key) {
+        uint8_t *large_blob_key = dc.cred_blob; // reuse buffer
+        static_assert(LARGE_BLOB_KEY_SIZE <= MAX_CRED_BLOB_LENGTH, "Reuse buffer");
+        ret = make_large_blob_key(dc.credential_id.nonce, large_blob_key);
+        CHECK_CBOR_RET(ret);
         ret = cbor_encode_int(&map, CM_RESP_LARGE_BLOB_KEY);
         CHECK_CBOR_RET(ret);
-        ret = cbor_encode_byte_string(&map, dc.large_blob_key, LARGE_BLOB_KEY_SIZE);
+        ret = cbor_encode_byte_string(&map, large_blob_key, LARGE_BLOB_KEY_SIZE);
         CHECK_CBOR_RET(ret);
       }
       ret = cbor_encoder_close_container(encoder, &map);

diff --git a/applets/ctap/secret.c b/applets/ctap/secret.c
@@ -422,3 +422,19 @@ int make_hmac_secret_output(uint8_t *nonce, uint8_t *salt, uint8_t len, uint8_t
   if (len == 64) hmac_sha256(hmac_buf, HE_KEY_SIZE, salt + 32, 32, output + 32);
   return 0;
 }
+
+int make_large_blob_key(uint8_t *nonce, uint8_t *output) {
+  static_assert(LARGE_BLOB_KEY_SIZE == HE_KEY_SIZE, "Reuse buffer");
+  // use hmac-sha256(transform(HE_KEY), credential_id::nonce) as LargeBlobKey
+  int err = read_he_key(output);
+  if (err < 0) return err;
+
+  // make it different from hmac extension key
+  output[0] ^= output[1];
+  output[1] ^= output[2];
+  output[HE_KEY_SIZE-2] ^= output[0];
+  output[HE_KEY_SIZE-1] ^= output[3];
+
+  hmac_sha256(output, HE_KEY_SIZE, nonce, CREDENTIAL_NONCE_SIZE, output);
+  return 0;
+}
diff --git a/applets/ctap/secret.h b/applets/ctap/secret.h
@@ -47,5 +47,6 @@ int verify_pin_hash(uint8_t *buf);
 int get_pin_retries(void);
 int set_pin_retries(uint8_t ctr);
 int make_hmac_secret_output(uint8_t *nonce, uint8_t *salt, uint8_t len, uint8_t *output, bool uv);
+int make_large_blob_key(uint8_t *nonce, uint8_t *output);
 
 #endif // CANOKEY_CORE_FIDO2_SECRET_H_