fido2_types.h

Go to the documentation of this file.

/*
 * Copyright (c) 2026 Siratul Islam <email@sirat.me>
 *
 * SPDX-License-Identifier: Apache-2.0
 */

 
#ifndef ZEPHYR_INCLUDE_AUTHENTICATION_FIDO2_FIDO2_TYPES_H_
#define ZEPHYR_INCLUDE_AUTHENTICATION_FIDO2_FIDO2_TYPES_H_
 
#include <stddef.h>
#include <stdint.h>
#include <stdbool.h>
#include <zephyr/sys/util.h>

 
#ifdef __cplusplus
extern "C" {
#endif

#define FIDO2_CREDENTIAL_ID_MAX_SIZE 128

#define FIDO2_RP_ID_MAX_LEN 128

#define FIDO2_RP_NAME_MAX_LEN 64

#define FIDO2_USER_NAME_MAX_LEN 64

#define FIDO2_USER_DISPLAY_NAME_MAX_LEN 64

#define FIDO2_USER_ID_MAX_SIZE 64

#define FIDO2_AAGUID_SIZE 16

#define FIDO2_SHA256_SIZE 32

#define FIDO2_PIN_HASH_SIZE 16

#define FIDO2_DISCOVERABLE_CRED_ID_SIZE 32

#define FIDO2_NON_DISCOVERABLE_CRED_ID_SIZE 64

#define FIDO2_AUTH_DATA_HEADER_SIZE 37

#define FIDO2_ATTESTED_CRED_DATA_MAX_SIZE                                                          \
        (FIDO2_AAGUID_SIZE + 2 + FIDO2_CREDENTIAL_ID_MAX_SIZE + FIDO2_COSE_KEY_MAX_SIZE)

#define FIDO2_AUTH_DATA_MAX_SIZE (FIDO2_AUTH_DATA_HEADER_SIZE + FIDO2_ATTESTED_CRED_DATA_MAX_SIZE)

#define FIDO2_MAX_EXTENSIONS 8

#define FIDO2_MAX_VERSIONS 4

#define FIDO2_EXT_HMAC_SECRET     BIT(0)
#define FIDO2_EXT_LARGE_BLOB_KEY  BIT(1)
#define FIDO2_EXT_CRED_BLOB       BIT(2)
#define FIDO2_EXT_THIRD_PARTY_PAY BIT(3)

#define FIDO2_TRANSPORT_USB BIT(0)
#define FIDO2_TRANSPORT_BLE BIT(1)
#define FIDO2_TRANSPORT_NFC BIT(2)

#define AUTH_DATA_FLAG_UP BIT(0)
#define AUTH_DATA_FLAG_UV BIT(2)
#define AUTH_DATA_FLAG_AT BIT(6)
#define AUTH_DATA_FLAG_ED BIT(7)

enum fido2_status {
        FIDO2_OK = 0x00,                          
        FIDO2_ERR_INVALID_COMMAND = 0x01,         
        FIDO2_ERR_INVALID_PARAMETER = 0x02,       
        FIDO2_ERR_INVALID_LENGTH = 0x03,          
        FIDO2_ERR_INVALID_SEQ = 0x04,             
        FIDO2_ERR_TIMEOUT = 0x05,                 
        FIDO2_ERR_CHANNEL_BUSY = 0x06,            
        FIDO2_ERR_LOCK_REQUIRED = 0x0A,           
        FIDO2_ERR_INVALID_CHANNEL = 0x0B,         
        FIDO2_ERR_CBOR_UNEXPECTED_TYPE = 0x11,    
        FIDO2_ERR_INVALID_CBOR = 0x12,            
        FIDO2_ERR_MISSING_PARAMETER = 0x14,       
        FIDO2_ERR_LIMIT_EXCEEDED = 0x15,          
        FIDO2_ERR_UNSUPPORTED_EXTENSION = 0x16,   
        FIDO2_ERR_FP_DATABASE_FULL = 0x17,        
        FIDO2_ERR_LARGE_BLOB_STORAGE_FULL = 0x18, 
        FIDO2_ERR_CREDENTIAL_EXCLUDED = 0x19,     
        FIDO2_ERR_PROCESSING = 0x21,              
        FIDO2_ERR_INVALID_CREDENTIAL = 0x22,      
        FIDO2_ERR_USER_ACTION_PENDING = 0x23,     
        FIDO2_ERR_OPERATION_PENDING = 0x24,       
        FIDO2_ERR_NO_OPERATIONS = 0x25,           
        FIDO2_ERR_UNSUPPORTED_ALGORITHM = 0x26,   
        FIDO2_ERR_OPERATION_DENIED = 0x27,        
        FIDO2_ERR_KEY_STORE_FULL = 0x28,          
        FIDO2_ERR_UNSUPPORTED_OPTION = 0x2B,      
        FIDO2_ERR_INVALID_OPTION = 0x2C,          
        FIDO2_ERR_KEEPALIVE_CANCEL = 0x2D,        
        FIDO2_ERR_NO_CREDENTIALS = 0x2E,          
        FIDO2_ERR_USER_ACTION_TIMEOUT = 0x2F,     
        FIDO2_ERR_NOT_ALLOWED = 0x30,             
        FIDO2_ERR_PIN_INVALID = 0x31,             
        FIDO2_ERR_PIN_BLOCKED = 0x32,             
        FIDO2_ERR_PIN_AUTH_INVALID = 0x33,        
        FIDO2_ERR_PIN_AUTH_BLOCKED = 0x34,        
        FIDO2_ERR_PIN_NOT_SET = 0x35,             
        FIDO2_ERR_PUAT_REQUIRED = 0x36,           
        FIDO2_ERR_PIN_POLICY_VIOLATION = 0x37,    
        FIDO2_ERR_RESERVED = 0x38,                
        FIDO2_ERR_REQUEST_TOO_LARGE = 0x39,       
        FIDO2_ERR_ACTION_TIMEOUT = 0x3A,          
        FIDO2_ERR_UP_REQUIRED = 0x3B,             
        FIDO2_ERR_UV_BLOCKED = 0x3C,              
        FIDO2_ERR_INTEGRITY_FAILURE = 0x3D,       
        FIDO2_ERR_INVALID_SUBCOMMAND = 0x3E,      
        FIDO2_ERR_UV_INVALID = 0x3F,              
        FIDO2_ERR_UNAUTHORIZED_PERMISSION = 0x40, 
        FIDO2_ERR_OTHER = 0x7F,                   
};

enum fido2_cmd {
        FIDO2_CMD_MAKE_CREDENTIAL = 0x01,    
        FIDO2_CMD_GET_ASSERTION = 0x02,      
        FIDO2_CMD_GET_INFO = 0x04,           
        FIDO2_CMD_CLIENT_PIN = 0x06,         
        FIDO2_CMD_RESET = 0x07,              
        FIDO2_CMD_GET_NEXT_ASSERTION = 0x08, 
        FIDO2_CMD_CREDENTIAL_MGMT = 0x0A,    
        FIDO2_CMD_SELECTION = 0x0B,          
};

enum fido2_cred_protect {
        FIDO2_CRED_PROTECT_UV_OPTIONAL = 0x01,
        FIDO2_CRED_PROTECT_UV_OPTIONAL_WITH_LIST = 0x02,
        FIDO2_CRED_PROTECT_UV_REQUIRED = 0x03,
};

enum fido2_cose_alg {
        FIDO2_COSE_ES256 = -7,   
        FIDO2_COSE_EDDSA = -8,   
        FIDO2_COSE_RS256 = -257, 
};

struct fido2_credential {
        uint8_t id[FIDO2_CREDENTIAL_ID_MAX_SIZE];
        uint16_t id_len;
        uint8_t rp_id_hash[FIDO2_SHA256_SIZE];
        char rp_id[FIDO2_RP_ID_MAX_LEN];
        char rp_name[FIDO2_RP_NAME_MAX_LEN];
        char user_name[FIDO2_USER_NAME_MAX_LEN];
        char user_display_name[FIDO2_USER_DISPLAY_NAME_MAX_LEN];
        uint8_t user_id[FIDO2_USER_ID_MAX_SIZE];
        uint16_t user_id_len;
        uint32_t key_id;
        uint32_t sign_count;
        uint32_t extensions;
        int32_t algorithm;
        bool discoverable;
        uint8_t cred_protect;
};

struct fido2_device_info {
        const char *versions[FIDO2_MAX_VERSIONS];
        uint8_t num_versions;
        const char *extensions[FIDO2_MAX_EXTENSIONS];
        uint8_t num_extensions;
        uint8_t aaguid[FIDO2_AAGUID_SIZE];
        uint16_t max_credential_count;
        uint16_t max_credential_id_length;
        uint16_t max_msg_size;
        uint8_t transports;
        struct {
                bool plat;                 
                bool rk;                   
                bool client_pin;           
                bool up;                   
                bool uv;                   
                bool cred_mgmt;            
                bool pin_uv_auth_token;    
                bool make_cred_uv_not_rqd; 
                bool always_uv;            
                bool no_mc_ga_permissions_with_client_pin; 
        } options;
        uint32_t firmware_version;
        uint8_t pin_uv_auth_protocols[2];
        uint8_t num_pin_uv_auth_protocols;
        uint8_t pin_retries;
};
 
#ifdef __cplusplus
}
#endif

 
#endif /* ZEPHYR_INCLUDE_AUTHENTICATION_FIDO2_FIDO2_TYPES_H_ */