Add PIN and reset service helpers to pc-hid-runner

Author: rainzhang05

pc-hid-runner/Cargo.toml

@@ -21,6 +21,7 @@ trussed = { version = "0.1", default-features = false, features = ["log-all", "v
 authenticator = { path = "../authenticator" }
 daemonize = "0.4"
 rand = { version = "0.8", features = ["std"] }
+sha2 = "0.10"
 
 [features]
 default = ["uhid-backend"]

pc-hid-runner/src/service.rs

@@ -4,7 +4,10 @@ use std::{
 };
 
 use authenticator::ctap::CtapApp;
-use transport_core::state::{IdentityConfig, PersistentStore};
+use sha2::{Digest, Sha256};
+use transport_core::state::{
+    reset_state_dir, IdentityConfig, PersistentStore, StoredPinState, DEFAULT_PIN_RETRIES,
+};
 use transport_core::{set_waiting, Apps as TrussedApps, Builder, Options, Platform, Syscall};
 use trussed::{
     backend::{CoreOnly, NoId},
@@ -163,3 +166,137 @@ pub fn default_identity() -> IdentityStrings {
 pub fn ensure_state_dir(path: &Path) -> io::Result<()> {
     transport_core::state::ensure_state_dir(path)
 }
+
+/// Minimum PIN length enforced by the CTAP layer.
+const MIN_PIN_LENGTH: usize = 4;
+/// Maximum PIN length permitted by CTAP (63 byte UTF-8 string max).
+const MAX_PIN_LENGTH: usize = 63;
+
+fn validate_pin(pin: &str) -> io::Result<()> {
+    let bytes = pin.as_bytes();
+    if bytes.len() < MIN_PIN_LENGTH {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("PIN must be at least {MIN_PIN_LENGTH} bytes"),
+        ));
+    }
+    if bytes.len() > MAX_PIN_LENGTH {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("PIN must be at most {MAX_PIN_LENGTH} bytes"),
+        ));
+    }
+    Ok(())
+}
+
+fn hash_pin(pin: &str) -> [u8; 16] {
+    let digest = Sha256::digest(pin.as_bytes());
+    let mut out = [0u8; 16];
+    out.copy_from_slice(&digest[..16]);
+    out
+}
+
+/// Summary view of the persistent PIN state for the `pin status` CLI.
+pub struct PinInfo {
+    pub is_set: bool,
+    pub retries: u8,
+    pub blocked: bool,
+}
+
+/// Read the persistent PIN summary for the CLI.
+pub fn pin_info(state_dir: &Path) -> io::Result<PinInfo> {
+    let store = PersistentStore::new(state_dir)?;
+    let state = store.read_pin_state()?;
+    Ok(PinInfo {
+        is_set: state.pin_hash.is_some(),
+        retries: state.pin_retries,
+        blocked: state.pin_auth_blocked,
+    })
+}
+
+/// Persist a brand-new PIN.  Fails if a PIN is already set.
+pub fn pin_set(state_dir: &Path, new_pin: &str) -> io::Result<()> {
+    validate_pin(new_pin)?;
+    let store = PersistentStore::new(state_dir)?;
+    let existing = store.read_pin_state()?;
+    if existing.pin_hash.is_some() {
+        return Err(io::Error::new(
+            io::ErrorKind::AlreadyExists,
+            "a PIN is already set; use 'pin change' instead",
+        ));
+    }
+    let updated = StoredPinState {
+        pin_hash: Some(hash_pin(new_pin)),
+        pin_retries: DEFAULT_PIN_RETRIES,
+        consecutive_failures: 0,
+        pin_auth_blocked: false,
+    };
+    store.write_pin_state(&updated)
+}
+
+/// Persist a replacement PIN after verifying the current one.
+pub fn pin_change(state_dir: &Path, current_pin: &str, new_pin: &str) -> io::Result<()> {
+    validate_pin(new_pin)?;
+    let store = PersistentStore::new(state_dir)?;
+    let mut state = store.read_pin_state()?;
+    verify_current_pin(&mut state, current_pin)?;
+    state.pin_hash = Some(hash_pin(new_pin));
+    state.pin_retries = DEFAULT_PIN_RETRIES;
+    state.consecutive_failures = 0;
+    state.pin_auth_blocked = false;
+    store.write_pin_state(&state)
+}
+
+/// Clear the PIN after verifying the current one.
+pub fn pin_remove(state_dir: &Path, current_pin: &str) -> io::Result<()> {
+    let store = PersistentStore::new(state_dir)?;
+    let mut state = store.read_pin_state()?;
+    verify_current_pin(&mut state, current_pin)?;
+    state.pin_hash = None;
+    state.pin_retries = DEFAULT_PIN_RETRIES;
+    state.consecutive_failures = 0;
+    state.pin_auth_blocked = false;
+    store.write_pin_state(&state)
+}
+
+/// Wipe credentials and reset PIN state.  Equivalent to a factory reset.
+pub fn reset_state(state_dir: &Path) -> io::Result<()> {
+    reset_state_dir(state_dir)
+}
+
+fn verify_current_pin(state: &mut StoredPinState, candidate: &str) -> io::Result<()> {
+    let stored = state.pin_hash.ok_or_else(|| {
+        io::Error::new(io::ErrorKind::PermissionDenied, "no PIN is currently set")
+    })?;
+    if state.pin_auth_blocked {
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            "PIN is blocked until the authenticator is reset",
+        ));
+    }
+    let provided = hash_pin(candidate);
+    let mut diff = 0u8;
+    for (a, b) in stored.iter().zip(provided.iter()) {
+        diff |= a ^ b;
+    }
+    if diff == 0 {
+        state.pin_retries = DEFAULT_PIN_RETRIES;
+        state.consecutive_failures = 0;
+        Ok(())
+    } else {
+        if state.pin_retries > 0 {
+            state.pin_retries -= 1;
+        }
+        state.consecutive_failures = state.consecutive_failures.saturating_add(1);
+        if state.pin_retries == 0 {
+            state.pin_auth_blocked = true;
+        }
+        Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!(
+                "PIN is incorrect ({} retries remaining)",
+                state.pin_retries
+            ),
+        ))
+    }
+}