Make Authenticator store its cryptographic backend

Author: Progdrasil

passkey-authenticator/src/authenticator.rs

@@ -1,5 +1,5 @@
 use coset::iana;
-use passkey_crypto::rng::RngBackend;
+use passkey_crypto::{CryptoBackend, rng::RngBackend};
 use passkey_types::{
     ctap2::{Aaguid, Ctap2Error, Flags},
     webauthn,
@@ -68,7 +68,7 @@ impl From<CredentialIdLength> for usize {
 }
 
 /// A virtual authenticator with all the necessary state and information.
-pub struct Authenticator<S, U> {
+pub struct Authenticator<S, U, C> {
     /// The authenticator's AAGUID
     aaguid: Aaguid,
     /// Provides credential storage capabilities
@@ -95,15 +95,19 @@ pub struct Authenticator<S, U> {
 
     /// Supported authenticator extensions
     extensions: Extensions,
+
+    /// The cryptographic backend of the Authenticator
+    crypto: C,
 }
 
-impl<S, U> Authenticator<S, U>
+impl<S, U, C> Authenticator<S, U, C>
 where
     S: CredentialStore,
     U: UserValidationMethod,
+    C: CryptoBackend,
 {
     /// Create an authenticator with a known aaguid, a backing storage and a User verification system.
-    pub fn new(aaguid: Aaguid, store: S, user: U) -> Self {
+    pub fn new(aaguid: Aaguid, store: S, user: U, crypto: C) -> Self {
         Self {
             aaguid,
             store,
@@ -117,6 +121,7 @@ where
             make_credentials_with_signature_counter: false,
             credential_id_length: CredentialIdLength::default(),
             extensions: Extensions::default(),
+            crypto,
         }
     }
 

passkey-authenticator/src/authenticator/extensions.rs

@@ -54,7 +54,7 @@ pub(super) struct GetExtensionOutputs {
     pub unsigned: Option<get_assertion::UnsignedExtensionOutputs>,
 }
 
-impl<S, U> Authenticator<S, U> {
+impl<S, U, C> Authenticator<S, U, C> {
     pub(super) fn make_extensions(
         &self,
         request: Option<make_credential::ExtensionInputs>,

passkey-authenticator/src/authenticator/extensions/hmac_secret.rs

@@ -81,7 +81,7 @@ impl HmacSecretCredentialSupport {
     }
 }
 
-impl<S, U> Authenticator<S, U> {
+impl<S, U, C> Authenticator<S, U, C> {
     pub(super) fn make_hmac_secret(
         &self,
         hmac_secret_request: Option<bool>,

passkey-authenticator/src/authenticator/extensions/hmac_secret/tests.rs

@@ -20,8 +20,13 @@ pub(crate) fn prf_eval_request(eval: Option<Vec<u8>>) -> AuthenticatorPrfInputs
 
 #[test]
 fn hmac_secret_cycle_works() {
-    let auth = Authenticator::new(Aaguid::new_empty(), None, MockUserValidationMethod::new())
-        .hmac_secret(HmacSecretConfig::new_without_uv());
+    let auth = Authenticator::new(
+        Aaguid::new_empty(),
+        None,
+        MockUserValidationMethod::new(),
+        RustCryptoBackend,
+    )
+    .hmac_secret(HmacSecretConfig::new_without_uv());
 
     let ext = auth
         .make_hmac_secret(Some(true))
@@ -99,8 +104,13 @@ fn hmac_secret_cycle_works() {
 
 #[test]
 fn hmac_secret_cycle_works_with_one_cred() {
-    let auth = Authenticator::new(Aaguid::new_empty(), None, MockUserValidationMethod::new())
-        .hmac_secret(HmacSecretConfig::new_with_uv_only());
+    let auth = Authenticator::new(
+        Aaguid::new_empty(),
+        None,
+        MockUserValidationMethod::new(),
+        RustCryptoBackend,
+    )
+    .hmac_secret(HmacSecretConfig::new_with_uv_only());
 
     let ext = auth
         .make_hmac_secret(Some(true))
@@ -156,8 +166,13 @@ fn hmac_secret_cycle_works_with_one_cred() {
 
 #[test]
 fn hmac_secret_cycle_works_with_one_salt() {
-    let auth = Authenticator::new(Aaguid::new_empty(), None, MockUserValidationMethod::new())
-        .hmac_secret(HmacSecretConfig::new_with_uv_only());
+    let auth = Authenticator::new(
+        Aaguid::new_empty(),
+        None,
+        MockUserValidationMethod::new(),
+        RustCryptoBackend,
+    )
+    .hmac_secret(HmacSecretConfig::new_with_uv_only());
 
     let ext = auth
         .make_hmac_secret(Some(true))

passkey-authenticator/src/authenticator/get_assertion.rs

@@ -1,4 +1,5 @@
 use p256::ecdsa::{SigningKey, signature::SignerMut};
+use passkey_crypto::CryptoBackend;
 use passkey_types::{
     Bytes,
     ctap2::{
@@ -15,10 +16,11 @@ use crate::{
     user_validation::UiHint,
 };
 
-impl<S, U> Authenticator<S, U>
+impl<S, U, C> Authenticator<S, U, C>
 where
     S: CredentialStore + Sync,
     U: UserValidationMethod<PasskeyItem = <S as CredentialStore>::PasskeyItem> + Sync,
+    C: CryptoBackend,
 {
     /// This method is used by a host to request cryptographic proof of user authentication as well
     /// as user consent to a given transaction, using a previously generated credential that is

passkey-authenticator/src/authenticator/get_assertion/tests.rs

@@ -53,6 +53,7 @@ async fn get_assertion_returns_no_credentials_found() {
         Aaguid::new_empty(),
         store,
         MockUserValidationMethod::verified_user_with_hint(1, MockUiHint::InformNoCredentialsFound),
+        RustCryptoBackend,
     );
 
     // Act
@@ -78,6 +79,7 @@ async fn get_assertion_increments_signature_counter_when_counter_is_some() {
             1,
             MockUiHint::RequestExistingCredential(passkey),
         ),
+        RustCryptoBackend,
     );
 
     // Act
@@ -100,8 +102,12 @@ async fn unsupported_extension_with_request_gives_no_ext_output() {
     let shared_store = Some(create_passkey(None));
     let user_mock = MockUserValidationMethod::verified_user(1);
 
-    let mut authenticator =
-        Authenticator::new(Aaguid::new_empty(), shared_store.clone(), user_mock);
+    let mut authenticator = Authenticator::new(
+        Aaguid::new_empty(),
+        shared_store.clone(),
+        user_mock,
+        RustCryptoBackend,
+    );
 
     let request = Request {
         extensions: Some(ExtensionInputs {
@@ -125,8 +131,12 @@ async fn unsupported_extension_with_empty_request_gives_no_ext_output() {
     let shared_store = Some(create_passkey(None));
     let user_mock = MockUserValidationMethod::verified_user(1);
 
-    let mut authenticator =
-        Authenticator::new(Aaguid::new_empty(), shared_store.clone(), user_mock);
+    let mut authenticator = Authenticator::new(
+        Aaguid::new_empty(),
+        shared_store.clone(),
+        user_mock,
+        RustCryptoBackend,
+    );
 
     let request = Request {
         extensions: Some(ExtensionInputs::default()),
@@ -147,9 +157,13 @@ async fn supported_extension_with_empty_request_gives_no_ext_output() {
     let shared_store = Some(create_passkey(Some(Rng::random_vec(32))));
     let user_mock = MockUserValidationMethod::verified_user(1);
 
-    let mut authenticator =
-        Authenticator::new(Aaguid::new_empty(), shared_store.clone(), user_mock)
-            .hmac_secret(extensions::HmacSecretConfig::new_with_uv_only());
+    let mut authenticator = Authenticator::new(
+        Aaguid::new_empty(),
+        shared_store.clone(),
+        user_mock,
+        RustCryptoBackend,
+    )
+    .hmac_secret(extensions::HmacSecretConfig::new_with_uv_only());
 
     let request = Request {
         extensions: Some(ExtensionInputs::default()),
@@ -170,9 +184,13 @@ async fn supported_extension_without_extension_request_gives_no_ext_output() {
     let shared_store = Some(create_passkey(Some(Rng::random_vec(32))));
     let user_mock = MockUserValidationMethod::verified_user(1);
 
-    let mut authenticator =
-        Authenticator::new(Aaguid::new_empty(), shared_store.clone(), user_mock)
-            .hmac_secret(extensions::HmacSecretConfig::new_with_uv_only());
+    let mut authenticator = Authenticator::new(
+        Aaguid::new_empty(),
+        shared_store.clone(),
+        user_mock,
+        RustCryptoBackend,
+    )
+    .hmac_secret(extensions::HmacSecretConfig::new_with_uv_only());
 
     let request = good_request();
 
@@ -190,9 +208,13 @@ async fn supported_extension_with_request_gives_output() {
     let shared_store = Some(create_passkey(Some(Rng::random_vec(32))));
     let user_mock = MockUserValidationMethod::verified_user(1);
 
-    let mut authenticator =
-        Authenticator::new(Aaguid::new_empty(), shared_store.clone(), user_mock)
-            .hmac_secret(extensions::HmacSecretConfig::new_with_uv_only());
+    let mut authenticator = Authenticator::new(
+        Aaguid::new_empty(),
+        shared_store.clone(),
+        user_mock,
+        RustCryptoBackend,
+    )
+    .hmac_secret(extensions::HmacSecretConfig::new_with_uv_only());
 
     let request = Request {
         extensions: Some(ExtensionInputs {

passkey-authenticator/src/authenticator/get_info.rs

@@ -1,3 +1,4 @@
+use passkey_crypto::CryptoBackend;
 use passkey_types::{
     ctap2::get_info::{Options, Response, Version},
     webauthn::PublicKeyCredentialParameters,
@@ -7,7 +8,12 @@ use crate::{
     Authenticator, CredentialStore, UserValidationMethod, credential_store::DiscoverabilitySupport,
 };
 
-impl<S: CredentialStore, U: UserValidationMethod> Authenticator<S, U> {
+impl<S, U, C> Authenticator<S, U, C>
+where
+    S: CredentialStore,
+    U: UserValidationMethod,
+    C: CryptoBackend,
+{
     /// Using this method, the host can request that the authenticator report a list of all
     /// supported protocol versions, supported extensions, AAGUID of the device, and its capabilities.
     pub async fn get_info(&self) -> Box<Response> {

passkey-authenticator/src/authenticator/make_credential.rs

@@ -1,5 +1,8 @@
 use p256::SecretKey;
-use passkey_crypto::rng::{Rng, RngBackend};
+use passkey_crypto::{
+    CryptoBackend,
+    rng::{Rng, RngBackend},
+};
 use passkey_types::{
     Passkey,
     ctap2::{
@@ -10,10 +13,11 @@ use passkey_types::{
 
 use crate::{Authenticator, CoseKeyPair, CredentialStore, UiHint, UserValidationMethod};
 
-impl<S, U> Authenticator<S, U>
+impl<S, U, C> Authenticator<S, U, C>
 where
     S: CredentialStore + Sync,
     U: UserValidationMethod<PasskeyItem = <S as CredentialStore>::PasskeyItem> + Sync,
+    C: CryptoBackend,
 {
     /// This method is invoked by the host to request generation of a new credential in the authenticator.
     pub async fn make_credential(&mut self, input: Request) -> Result<Response, StatusCode> {