From 6e00fb163427ca093e145c45fe448a52c6e3fa50 Mon Sep 17 00:00:00 2001 From: Ludvig Michaelsson Date: Wed, 21 Aug 2024 13:42:14 +0200 Subject: [PATCH] examples: add cred -a toggle To request enterprise attestation. --- examples/README.adoc | 3 ++- examples/cred.c | 13 ++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/examples/README.adoc b/examples/README.adoc index 4c43e4d3..bfe65212 100644 --- a/examples/README.adoc +++ b/examples/README.adoc @@ -64,7 +64,8 @@ The following examples are provided: The -T option may be used to enforce a timeout of . If the option -b is specified, the credential's "largeBlob" key is stored in . If the option -c is specified the the generated credential - will be bound by the specified protection policy. + will be bound by the specified protection policy. If the option -a is + specified, enterprise attestation will be requested. - assert [-t es256|es384|rs256|eddsa] [-a cred_id] [-h hmac_secret] [-P pin] [-s hmac_salt] [-T seconds] [-b blobkey] [-puv] diff --git a/examples/cred.c b/examples/cred.c index 2dc607ec..719c6a7b 100644 --- a/examples/cred.c +++ b/examples/cred.c @@ -36,7 +36,8 @@ static void usage(void) { fprintf(stderr, "usage: cred [-t es256|es384|rs256|eddsa] [-k pubkey] " - "[-ei cred_id] [-P pin] [-T seconds] [-b blobkey] [-c prot] [-hruv] " + "[-ei cred_id] [-P pin] [-T seconds] [-b blobkey] [-c prot] " + "[-a mode] [-hruv] " "\n"); exit(EXIT_FAILURE); } @@ -165,6 +166,7 @@ main(int argc, char **argv) int ch; int r; long long prot = 0; + long long ea = 0; if ((cred = fido_cred_new()) == NULL) errx(1, "fido_cred_new"); @@ -181,6 +183,12 @@ main(int argc, char **argv) errx(1, "-T: %s must be in (0,30]", optarg); ms *= 1000; /* seconds to milliseconds */ break; + case 'a': + if (base10(optarg, &ea) < 0) + errx(1, "base10: %s", optarg); + if (ea <= 0 || ea > 2) + errx(1, "-a: %s must be in (0,2]", optarg); + break; case 'b': ext |= FIDO_EXT_LARGEBLOB_KEY; blobkey_out = optarg; @@ -291,6 +299,9 @@ main(int argc, char **argv) /* credProt */ if (prot != 0 && (r = fido_cred_set_prot(cred, (int)prot)) != FIDO_OK) errx(1, "fido_cred_set_prot: %s (0x%x)", fido_strerr(r), r); + + if (ea != 0 && (r = fido_cred_set_entattest(cred, (int)ea)) != FIDO_OK) + errx(1, "fido_cred_set_entattest: %s (0x%x)", fido_strerr(r), r); /* timeout */ if (ms != 0 && (r = fido_dev_set_timeout(dev, (int)ms)) != FIDO_OK)