Struct AttestedResidentKey

pub struct AttestedResidentKey { /* private fields */ }

Available on crate feature resident-key-support only.

An attested resident key belonging to a user. These are a specialisation of AttestedPasskey where the devices in use can be attested. In addition this type enforces keys to be resident on the authenticator.

Since most authenticators have very limited key residence support, this should only be used in tightly controlled enterprise environments where you have strict access over the makes and models of keys in use.

Key residence is not a security property. The general reason for the usage of key residence is to allow the device to identify the user in addition to authenticating them.

These can be safely serialised and deserialised from a database for use.

Implementations

impl AttestedResidentKey

pub fn cred_id(&self) -> &CredentialID

Retrieve a reference to this Resident Key’s credential ID.

pub fn cred_algorithm(&self) -> &COSEAlgorithm

Retrieve the type of cryptographic algorithm used by this key

pub fn attestation(&self) -> &ParsedAttestation

Retrieve a reference to the attestation used during this Credential’s registration. This can tell you information about the manufacturer and what type of credential it is.

pub fn update_credential(&mut self, res: &AuthenticationResult) -> Option<bool>

Post authentication, update this credential’ds properties.

To determine if this is required, you can inspect the result of authentication_result.needs_update(). Generally this will always be true as this class of key will maintain an activation counter which allows (limited) protection against device cloning.

If the credential_id does not match, None is returned. If the cred id matches and the credential is updated, Some(true) is returned. If the cred id matches, but the credential is not changed, Some(false) is returned.

pub fn verify_attestation<'a>( &self, ca_list: &'a AttestationCaList, ) -> Result<&'a AttestationCa, WebauthnError>

Re-verify this Credential’s attestation chain. This re-applies the same process for certificate authority verification that occured at registration. This can be useful if you want to re-assert your credentials match an updated or changed ca_list from the time that registration occured. This can also be useful to re-determine certain properties of your device that may exist.

Trait Implementations

impl Clone for AttestedResidentKey

fn clone(&self) -> AttestedResidentKey

Returns a duplicate of the value.

const fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AttestedResidentKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AttestedResidentKey

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&AttestedResidentKey> for DiscoverableKey

Available on crate feature conditional-ui only.

fn from(k: &AttestedResidentKey) -> Self

Converts to this type from the input type.

impl From<&AttestedResidentKey> for Passkey

fn from(k: &AttestedResidentKey) -> Self

Converts to this type from the input type.

impl From<AttestedResidentKey> for DiscoverableKey

Available on crate feature conditional-ui only.

fn from(k: AttestedResidentKey) -> Self

Converts to this type from the input type.

impl From<AttestedResidentKey> for Passkey

fn from(k: AttestedResidentKey) -> Self

Converts to this type from the input type.

impl PartialEq for AttestedResidentKey

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

const fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AttestedResidentKey

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.