credential_exchange_format/passkey.rs
1use serde::{Deserialize, Serialize};
2
3use crate::b64url::B64Url;
4
5/// Passkey
6///
7/// Note: Passkeys using a non-zero signature counter MUST be excluded from the export and the
8/// exporter SHOULD inform the user that such passkeys are excluded from the export. Importers MUST
9/// set a zero value for the imported passkey signature counters and MUST NOT increment them after
10/// the fact.
11#[derive(Clone, Debug, Serialize, Deserialize)]
12#[serde(rename_all = "camelCase")]
13pub struct PasskeyCredential {
14 /// This member contains a [WebAuthn](https://www.w3.org/TR/webauthn-3)
15 /// [Credential ID](https://www.w3.org/TR/webauthn-3/#credential-id) which uniquely identifies
16 /// the passkey instance. The decoded raw value MUST be equal to the value given in
17 /// [PublicKeyCredential](https://www.w3.org/TR/webauthn-3/#iface-pkcredential)'s
18 /// [rawId](https://www.w3.org/TR/webauthn-3/#dom-publickeycredential-rawid) field during
19 /// [registration](https://www.w3.org/TR/webauthn-3/#registration).
20 pub credential_id: B64Url,
21 /// This member specifies the [WebAuthn](https://www.w3.org/TR/webauthn-3)
22 /// [Relying Party Identifier](https://www.w3.org/TR/webauthn-3/#relying-party-identifier) to
23 /// which the passkey instance is tied to. The value MUST be equal to the
24 /// [RP ID](https://www.w3.org/TR/webauthn-3/#rp-id) that was defined by the authenticator
25 /// during credential [registration](https://www.w3.org/TR/webauthn-3/#registration).
26 pub rp_id: String,
27 /// This member contains a [human-palatable](https://www.w3.org/TR/webauthn-3/#human-palatability)
28 /// identifier for the [user account](https://www.w3.org/TR/webauthn-3/#user-account) to which
29 /// the passkey instance is tied to. The value SHOULD be equal to the value in
30 /// [PublicKeyCredentialUserEntity](https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialuserentity)'s
31 /// [name](https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialentity-name) member given
32 /// to the authenticator during [registration](https://www.w3.org/TR/webauthn-3/#registration).
33 ///
34 /// The only case where the value MAY not be the one set during [registration](https://www.w3.org/TR/webauthn-3/#registration)
35 /// is if the [exporting provider](https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html#exporting-provider)
36 /// allows the user to edit their username. In such a case, the value of
37 /// this field MUST be the user edited value. See [§ 3.3.3.1 Editability of passkey fields](https://fidoalliance.org/specs/cx/cxf-v1.0-wd-20241003.html#sctn-editability-of-passkey-fields)
38 /// for more details.
39 pub username: String,
40 /// This member contains a [human-palatable](https://www.w3.org/TR/webauthn-3/#human-palatability)
41 /// identifier for the [user account](https://www.w3.org/TR/webauthn-3/#user-account), intended
42 /// only for display. The value SHOULD be equal to the value in
43 /// [PublicKeyCredentialUserEntity](https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialuserentity)'s
44 /// [displayName](https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialuserentity-displayname)
45 /// member given to the authenticator during [registration](https://www.w3.org/TR/webauthn-3/#registration).
46 ///
47 /// The only case where the value MAY not be the one set during [registration](https://www.w3.org/TR/webauthn-3/#registration)
48 /// is if the [exporting provider](https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html#exporting-provider)
49 /// allows the user to edit their username. In such a case, the value of
50 /// this field MUST be the user edited value. See [§ 3.3.3.1 Editability of passkey fields](https://fidoalliance.org/specs/cx/cxf-v1.0-wd-20241003.html#sctn-editability-of-passkey-fields)
51 /// for more details.
52 pub user_display_name: String,
53 /// This member contains the [user handle](https://www.w3.org/TR/webauthn-3/#user-handle) which
54 /// is the value used to identify the [user account](https://www.w3.org/TR/webauthn-3/#user-account)
55 /// associated to this passkey instance. The value MUST be equal to the value in
56 /// [PublicKeyCredentialUserEntity](https://www.w3.org/TR/webauthn-3/#dictdef-publickeycredentialuserentity)'s
57 /// [id](https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialuserentity-id) member given
58 /// to the authenticator during [registration](https://www.w3.org/TR/webauthn-3/#registration).
59 pub user_handle: B64Url,
60 /// The [private key](https://www.w3.org/TR/webauthn-3/#credential-private-key) associated to
61 /// this passkey instance. The value MUST be [PKCS#8](https://www.rfc-editor.org/rfc/rfc5958)
62 /// [ASN.1 DER](https://fidoalliance.org/specs/cx/cxf-v1.0-wd-20241003.html#biblio-itu-x690-2008)
63 /// formatted byte string which is then [Base64url encoded](https://www.rfc-editor.org/rfc/rfc4648#section-5).
64 /// The value MUST give the same [public key](https://www.w3.org/TR/webauthn-3/#credential-public-key)
65 /// value that was provided by the original authenticator during [registration](https://www.w3.org/TR/webauthn-3/#registration).
66 pub key: B64Url,
67 /// This member denotes the WebAuthn or CTAP2 extensions that are associated to this passkey
68 /// instance.
69 #[serde(default, skip_serializing_if = "Option::is_none")]
70 pub fido2_extensions: Option<Fido2Extensions>,
71}
72
73#[derive(Clone, Debug, Default, Serialize, Deserialize)]
74#[serde(rename_all = "camelCase")]
75pub struct Fido2Extensions {
76 /// This member holds the information necessary for either the
77 /// [WebAuthn prf extension](https://www.w3.org/TR/webauthn-3/#prf-extension) or the
78 /// [FIDO hmac-secret extension](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#sctn-hmac-secret-extension).
79 #[serde(default, skip_serializing_if = "Option::is_none")]
80 pub hmac_credentials: Option<Fido2HmacCredentials>,
81 /// This member holds the information necessary for the
82 /// [FIDO credential blob extension](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#sctn-credBlob-extension).
83 /// The value is a base64url-encoded byte string of the stored binary blob.
84 #[serde(default, skip_serializing_if = "Option::is_none")]
85 pub cred_blob: Option<B64Url>,
86 /// This member holds the information necessary for the
87 /// [WebAuthN large blob storage extension](https://www.w3.org/TR/webauthn-3/#sctn-large-blob-extension).
88 #[serde(default, skip_serializing_if = "Option::is_none")]
89 pub large_blob: Option<Fido2LargeBlob>,
90 /// This member denotes whether this credential is used for
91 /// [secure-payment-confirmation](https://www.w3.org/TR/secure-payment-confirmation/).
92 #[serde(default, skip_serializing_if = "Option::is_none")]
93 pub payments: Option<bool>,
94}
95
96#[derive(Clone, Debug, Serialize, Deserialize)]
97#[serde(rename_all = "camelCase")]
98pub struct Fido2HmacCredentials {
99 pub algorithm: Fido2HmacCredentialAlgorithm,
100 #[serde(rename = "credWithUV")]
101 pub cred_with_uv: B64Url,
102 #[serde(rename = "credWithoutUV")]
103 pub cred_without_uv: B64Url,
104}
105
106#[derive(Clone, Debug, Serialize, Deserialize)]
107#[serde(rename_all = "kebab-case")]
108pub enum Fido2HmacCredentialAlgorithm {
109 HmacSha256,
110 #[serde(untagged)]
111 Other(String),
112}
113
114#[derive(Clone, Debug, Serialize, Deserialize)]
115#[serde(rename_all = "camelCase")]
116pub struct Fido2LargeBlob {
117 pub uncompressed_size: u64,
118 pub data: B64Url,
119}