Skip to content

Commit 4e118bb

Browse files
sosthene-nitrokeyrobin-nitrokey
authored andcommitted
Update to heapless 0.9 and trussed-core 0.2
1 parent d53f29a commit 4e118bb

13 files changed

Lines changed: 137 additions & 116 deletions

File tree

CHANGELOG.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
66

77
## Unreleased
88

9-
-
9+
- Update dependencies:
10+
- `apdu-app` v0.2
11+
- `cosey` v0.4
12+
- `ctap-types` v0.5
13+
- `ctaphid-app` v0.2
14+
- `heapless` v0.9
15+
- `heapless-bytes` v0.5
16+
- `iso7816` v0.2
17+
- `trussed-chunked` v0.3
18+
- `trussed-core` v0.2
19+
- `trussed-fs-info` v0.3
20+
- `trussed-hkdf` v0.4
1021

1122
## [v0.2.0](https://github.com/trussed-dev/fido-authenticator/releases/tag/v0.2.0) (2025-09-02)
1223

Cargo.toml

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,24 +9,24 @@ documentation = "https://docs.rs/fido-authenticator"
99
description = "FIDO authenticator Trussed app"
1010

1111
[dependencies]
12-
apdu-app = { version = "0.1", optional = true }
12+
apdu-app = { version = "0.2", optional = true }
1313
cbor-smol = "0.5"
14-
cosey = "0.3"
15-
ctap-types = { version = "0.4", features = ["get-info-full", "large-blobs", "third-party-payment"] }
16-
ctaphid-app = { version = "0.1", optional = true }
14+
cosey = "0.4"
15+
ctap-types = { version = "0.5", features = ["get-info-full", "large-blobs", "third-party-payment"] }
16+
ctaphid-app = { version = "0.2", optional = true }
1717
delog = "0.1"
18-
heapless = "0.7"
19-
heapless-bytes = "0.3"
20-
iso7816 = { version = "0.1.2", optional = true }
18+
heapless = "0.9"
19+
heapless-bytes = { version = "0.5", features = ["heapless-0.9"]}
20+
iso7816 = { version = "0.2", optional = true }
2121
littlefs2-core = "0.1"
2222
serde = { version = "1.0", default-features = false }
2323
serde_bytes = { version = "0.11.14", default-features = false }
2424
serde-indexed = "0.1"
2525
sha2 = { version = "0.10", default-features = false }
26-
trussed-chunked = { version = "0.2", optional = true }
27-
trussed-core = { version = "0.1", features = ["aes256-cbc", "certificate-client", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "hmac-sha256", "management-client", "p256", "sha256", "ui-client"] }
28-
trussed-fs-info = "0.2"
29-
trussed-hkdf = "0.3"
26+
trussed-chunked = { version = "0.3", optional = true }
27+
trussed-core = { version = "0.2", features = ["aes256-cbc", "certificate-client", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "hmac-sha256", "management-client", "p256", "sha256", "ui-client"] }
28+
trussed-fs-info = "0.3"
29+
trussed-hkdf = "0.4"
3030

3131
[features]
3232
dispatch = ["apdu-dispatch", "ctaphid-dispatch", "dep:iso7816"]
@@ -46,38 +46,38 @@ log-warn = []
4646
log-error = []
4747

4848
[dev-dependencies]
49-
admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-nitrokey.20", features = ["migration-tests"] }
49+
admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-nitrokey.21", features = ["migration-tests"] }
5050
aes = "0.8.4"
5151
cbc = { version = "0.1.2", features = ["alloc"] }
5252
ciborium = "0.2.2"
5353
ciborium-io = "0.2.2"
5454
cipher = "0.4.4"
5555
ctaphid = { version = "0.3.1", default-features = false }
56-
ctaphid-dispatch = "0.3"
56+
ctaphid-dispatch = "0.4"
5757
delog = { version = "0.1.6", features = ["std-log"] }
5858
env_logger = "0.11"
5959
hex-literal = "0.4.1"
6060
hmac = "0.12.1"
6161
interchange = "0.3"
6262
itertools = "0.14"
63-
littlefs2 = "0.6"
63+
littlefs2 = "0.7"
6464
log = "0.4.21"
6565
p256 = { version = "0.13.2", features = ["ecdh"] }
6666
rand = "0.8.4"
6767
rand_chacha = "0.3"
6868
sha2 = "0.10"
6969
serde_test = "1.0.176"
70-
trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "024e0eca5fb7dbd2457831f7c7bffe4341e08775", features = ["virt"] }
71-
trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "v0.3.3", features = ["chunked", "hkdf", "virt", "fs-info"] }
72-
trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "504674453c9573a30aa2f155101df49eb2af1ba7", default-features = false, features = ["ctaphid"] }
73-
usbd-ctaphid = "0.3"
70+
trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b", features = ["virt"] }
71+
trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "v0.4.0", features = ["chunked", "hkdf", "virt", "fs-info"] }
72+
trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner.git", rev = "017921df0930707c4af68882ccb1f8b3f1bbf7c5", default-features = false, features = ["ctaphid"] }
73+
usbd-ctaphid = "0.4"
7474
x509-parser = "0.16"
7575

7676
[package.metadata.docs.rs]
7777
features = ["chunked", "dispatch"]
7878

7979
[patch.crates-io]
80-
trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "024e0eca5fb7dbd2457831f7c7bffe4341e08775" }
80+
trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b" }
8181

8282
[profile.test]
8383
opt-level = 2

fuzz/Cargo.toml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ edition = "2021"
88
cargo-fuzz = true
99

1010
[dependencies]
11-
ctap-types = { version = "0.4", features = ["arbitrary"] }
11+
ctap-types = { version = "0.5", features = ["arbitrary"] }
1212
libfuzzer-sys = "0.4"
13-
trussed = { version = "0.1", features = ["clients-1", "certificate-client", "crypto-client", "filesystem-client", "management-client", "aes256-cbc", "ed255", "p256", "sha256"] }
14-
trussed-staging = { version = "0.3.0", features = ["chunked", "hkdf", "virt", "fs-info"] }
13+
trussed = { version = "0.1", features = ["certificate-client", "crypto-client", "filesystem-client", "management-client", "aes256-cbc", "ed255", "p256", "sha256"] }
14+
trussed-staging = { version = "0.4.0", features = ["chunked", "hkdf", "virt", "fs-info"] }
1515

1616
[dependencies.fido-authenticator]
1717
path = ".."
@@ -24,5 +24,5 @@ doc = false
2424
bench = false
2525

2626
[patch.crates-io]
27-
trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "6bba8fde36d05c0227769eb63345744e87d84b2b" }
28-
trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "1e1ca03a3a62ea9b802f4070ea4bce002eeb4bec" }
27+
trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b" }
28+
trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "v0.4.0" }

fuzz/fuzz_targets/ctap.rs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22

33
use ctap_types::{authenticator::Request, ctap1::Authenticator as _, ctap2::Authenticator as _};
44
use fido_authenticator::{Authenticator, Config, Conforming};
5+
use trussed::virt::StoreConfig;
56
use trussed_staging::virt;
67

78
use libfuzzer_sys::fuzz_target;
89

910
fuzz_target!(|requests: Vec<Request<'_>>| {
10-
virt::with_ram_client("fido", |client| {
11+
virt::with_client(StoreConfig::ram(), "fido", |client| {
1112
let mut authenticator = Authenticator::new(
1213
client,
1314
Conforming {},

src/credential.rs

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -202,13 +202,14 @@ impl Credential {
202202
fn deserialize_bytes<E: serde::de::Error, const N: usize>(
203203
s: &[u8],
204204
) -> core::result::Result<Bytes<N>, E> {
205-
Bytes::from_slice(s).map_err(|_| E::invalid_length(s.len(), &"a fixed-size sequence of bytes"))
205+
Bytes::try_from(s).map_err(|_| E::invalid_length(s.len(), &"a fixed-size sequence of bytes"))
206206
}
207207

208208
fn deserialize_str<E: serde::de::Error, const N: usize>(
209209
s: &str,
210210
) -> core::result::Result<String<N>, E> {
211-
Ok(s.into())
211+
s.try_into()
212+
.map_err(|_| E::custom("Serialized string doesn't fit "))
212213
}
213214

214215
#[derive(Clone, Copy, Debug, PartialEq)]
@@ -794,20 +795,20 @@ mod test {
794795
fn credential_data() -> CredentialData {
795796
CredentialData {
796797
rp: Rp::new(PublicKeyCredentialRpEntity {
797-
id: String::from("John Doe"),
798+
id: String::try_from("John Doe").unwrap(),
798799
name: None,
799800
icon: None,
800801
}),
801802
user: User::new(PublicKeyCredentialUserEntity {
802-
id: Bytes::from_slice(&[1, 2, 3]).unwrap(),
803+
id: Bytes::from(&[1, 2, 3]),
803804
icon: None,
804805
name: None,
805806
display_name: None,
806807
}),
807808
creation_time: 123,
808809
use_counter: false,
809810
algorithm: -7,
810-
key: Key::WrappedKey(Bytes::from_slice(&[1, 2, 3]).unwrap()),
811+
key: Key::WrappedKey(Bytes::from(&[1, 2, 3])),
811812
hmac_secret: Some(false),
812813
cred_protect: None,
813814
use_short_id: Some(true),
@@ -821,15 +822,15 @@ mod test {
821822
rp: Rp {
822823
format: SerializationFormat::Long,
823824
inner: PublicKeyCredentialRpEntity {
824-
id: String::from("John Doe"),
825+
id: String::try_from("John Doe").unwrap(),
825826
name: None,
826827
icon: None,
827828
},
828829
},
829830
user: User {
830831
format: SerializationFormat::Long,
831832
inner: PublicKeyCredentialUserEntity {
832-
id: Bytes::from_slice(&[1, 2, 3]).unwrap(),
833+
id: Bytes::from(&[1, 2, 3]),
833834
icon: None,
834835
name: None,
835836
display_name: None,
@@ -838,7 +839,7 @@ mod test {
838839
creation_time: 123,
839840
use_counter: false,
840841
algorithm: -7,
841-
key: Key::WrappedKey(Bytes::from_slice(&[1, 2, 3]).unwrap()),
842+
key: Key::WrappedKey(Bytes::from(&[1, 2, 3])),
842843
hmac_secret: Some(false),
843844
cred_protect: None,
844845
use_short_id: None,
@@ -865,7 +866,7 @@ mod test {
865866
let between = Uniform::from(0..(N + 1));
866867
let n = between.sample(&mut OsRng);
867868

868-
bytes.resize_default(n).unwrap();
869+
bytes.resize_zero(n).unwrap();
869870

870871
OsRng.fill_bytes(&mut bytes);
871872
bytes
@@ -1079,7 +1080,7 @@ mod test {
10791080
#[test]
10801081
fn max_credential_id() {
10811082
let rp_id: String<256> = core::iter::repeat_n('?', 256).collect();
1082-
let key = Bytes::from_slice(&[u8::MAX; 128]).unwrap();
1083+
let key = Bytes::from(&[u8::MAX; 128]);
10831084
let credential = StrippedCredential {
10841085
ctap: CtapVersion::Fido21Pre,
10851086
creation_time: u32::MAX,
@@ -1160,8 +1161,8 @@ mod test {
11601161

11611162
fn inner(&self) -> PublicKeyCredentialRpEntity {
11621163
PublicKeyCredentialRpEntity {
1163-
id: self.id.into(),
1164-
name: self.name.map(From::from),
1164+
id: self.id.try_into().unwrap(),
1165+
name: self.name.map(|n| n.try_into().unwrap()),
11651166
icon: None,
11661167
}
11671168
}
@@ -1225,10 +1226,10 @@ mod test {
12251226

12261227
fn inner(&self) -> PublicKeyCredentialUserEntity {
12271228
PublicKeyCredentialUserEntity {
1228-
id: Bytes::from_slice(self.id).unwrap(),
1229-
icon: self.icon.map(From::from),
1230-
name: self.name.map(From::from),
1231-
display_name: self.display_name.map(From::from),
1229+
id: Bytes::try_from(self.id).unwrap(),
1230+
icon: self.icon.map(|v| v.try_into().unwrap()),
1231+
name: self.name.map(|v| v.try_into().unwrap()),
1232+
display_name: self.display_name.map(|v| v.try_into().unwrap()),
12321233
}
12331234
}
12341235
}
@@ -1300,7 +1301,7 @@ mod test {
13001301
"
13011302
);
13021303

1303-
let credential = FullCredential::deserialize(&Bytes::from_slice(&data).unwrap()).unwrap();
1304+
let credential = FullCredential::deserialize(&Bytes::from(&data)).unwrap();
13041305
assert!(matches!(credential.ctap, CtapVersion::Fido21Pre));
13051306
assert_eq!(credential.nonce, &hex!("F62CA01ED181A3D03D561FC7"));
13061307
assert_eq!(
@@ -1309,17 +1310,17 @@ mod test {
13091310
rp: Rp {
13101311
format: SerializationFormat::Long,
13111312
inner: PublicKeyCredentialRpEntity {
1312-
id: "webauthn.io".into(),
1313+
id: "webauthn.io".try_into().unwrap(),
13131314
name: None,
13141315
icon: None,
13151316
},
13161317
},
13171318
user: User {
13181319
format: SerializationFormat::Long,
13191320
inner: PublicKeyCredentialUserEntity {
1320-
id: Bytes::from_slice(&hex!("6447567A644445")).unwrap(),
1321+
id: Bytes::from(&hex!("6447567A644445")),
13211322
icon: None,
1322-
name: Some("test1".into()),
1323+
name: Some("test1".try_into().unwrap()),
13231324
display_name: None,
13241325
},
13251326
},

src/ctap1.rs

Lines changed: 21 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
//! The `ctap_types::ctap1::Authenticator` implementation.
22
3-
use ctap_types::{
4-
ctap1::{authenticate, register, Authenticator, ControlByte, Error, Result},
5-
heapless_bytes::Bytes,
6-
};
3+
use ctap_types::ctap1::{authenticate, register, Authenticator, ControlByte, Error, Result};
4+
use heapless_bytes::Bytes;
75
use serde_bytes::ByteArray;
86

97
use trussed_core::{
@@ -71,9 +69,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
7169
syscall!(self.trussed.delete(private_key));
7270

7371
let key = Key::WrappedKey(
74-
wrapped_key
75-
.to_bytes()
76-
.map_err(|_| Error::UnspecifiedCheckingError)?,
72+
Bytes::try_from(&*wrapped_key).map_err(|_| Error::UnspecifiedCheckingError)?,
7773
);
7874
let nonce = ByteArray::new(self.nonce());
7975

@@ -124,14 +120,15 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
124120
(Some((key, cert)), _aaguid) => {
125121
info!("aaguid: {}", hex_str!(&_aaguid));
126122
(
127-
syscall!(self.trussed.sign(
128-
Mechanism::P256,
129-
key,
130-
&commitment,
131-
SignatureSerialization::Asn1Der
132-
))
133-
.signature
134-
.to_bytes()
123+
Bytes::try_from(
124+
&*syscall!(self.trussed.sign(
125+
Mechanism::P256,
126+
key,
127+
&commitment,
128+
SignatureSerialization::Asn1Der
129+
))
130+
.signature,
131+
)
135132
.unwrap(),
136133
cert,
137134
)
@@ -226,14 +223,15 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
226223
.unwrap();
227224
commitment.extend_from_slice(auth.challenge).unwrap();
228225

229-
let signature = syscall!(self.trussed.sign(
230-
Mechanism::P256,
231-
key,
232-
&commitment,
233-
SignatureSerialization::Asn1Der
234-
))
235-
.signature
236-
.to_bytes()
226+
let signature = Bytes::try_from(
227+
&*syscall!(self.trussed.sign(
228+
Mechanism::P256,
229+
key,
230+
&commitment,
231+
SignatureSerialization::Asn1Der
232+
))
233+
.signature,
234+
)
237235
.unwrap();
238236

239237
Ok(authenticate::Response {

0 commit comments

Comments
 (0)