passless-rs 0.17.0

FIDO2 security token emulator
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

//! HMAC auth session with parameter encryption for sensitive TPM operations

use soft_fido2::Result;

use log::error;
use tss_esapi::Context;
use tss_esapi::constants::SessionType;
use tss_esapi::interface_types::algorithm::HashingAlgorithm;
use tss_esapi::interface_types::session_handles::AuthSession;
use tss_esapi::structures::SymmetricDefinitionObject;

/// Execute a closure with an HMAC auth session using AES-128-CFB parameter encryption.
///
/// This mirrors the legacy seal path's session setup to encrypt sensitive parameters
/// (key material, secrets) on the wire to the TPM.
pub fn execute_with_encrypted_session<F, T>(context: &mut Context, f: F) -> Result<T>
where
    F: FnOnce(&mut Context) -> Result<T>,
{
    let session = context
        .start_auth_session(
            None,
            None,
            None,
            SessionType::Hmac,
            SymmetricDefinitionObject::AES_128_CFB.into(),
            HashingAlgorithm::Sha256,
        )
        .map_err(|e| {
            error!("Failed to start HMAC auth session: {}", e);
            soft_fido2::Error::Other
        })?
        .ok_or_else(|| {
            error!("HMAC auth session returned None");
            soft_fido2::Error::Other
        })?;

    let saved_sessions = context.sessions();
    context.set_sessions((Some(session), None, None));

    let result = f(context);

    context.set_sessions(saved_sessions);

    if let AuthSession::HmacSession(
        tss_esapi::interface_types::session_handles::HmacSession::HmacSession {
            session_handle,
            ..
        },
    ) = session
    {
        let _ = context.flush_context(session_handle.into());
    }

    result
}