Add support for only-non-resident credentials.

It disables, optionally, resident credentials.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>

src/fido/cbor_config.c

@@ -208,6 +208,9 @@ int cbor_config(const uint8_t *data, size_t len) {
             }
             flash_commit();
         }
+        else if (vendorCommandId == CTAP_CONFIG_NORK) {
+            set_opts(get_opts() ^ FIDO2_OPT_NORK);
+        }
         else {
             CBOR_ERROR(CTAP2_ERR_INVALID_SUBCOMMAND);
         }

src/fido/cbor_get_info.c

@@ -74,7 +74,7 @@ int cbor_get_info(void) {
         CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, true));
     }
     CBOR_CHECK(cbor_encode_text_stringz(&arrayEncoder, "rk"));
-    CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, true));
+    CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, !(get_opts() & FIDO2_OPT_NORK)));
     CBOR_CHECK(cbor_encode_text_stringz(&arrayEncoder, "alwaysUv"));
     if (file_has_data(ef_pin) && (get_opts() & FIDO2_OPT_AUV || !getUserVerifiedFlagValue())) {
         CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, true));

src/fido/cbor_make_credential.c

@@ -312,6 +312,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
         if (options.uv == ptrue) { //5.3
             CBOR_ERROR(CTAP2_ERR_INVALID_OPTION);
         }
+        if (options.rk == ptrue && (get_opts() & FIDO2_OPT_NORK)) { //5.4
+            CBOR_ERROR(CTAP2_ERR_INVALID_OPTION);
+        }
         if (options.up == pfalse) { //5.6
             CBOR_ERROR(CTAP2_ERR_INVALID_OPTION);
         }

src/fido/ctap.h

@@ -116,6 +116,7 @@ typedef struct {
 #define CTAP_CONFIG_AUT_DISABLE     0x1831a40f04a25ed9
 #define CTAP_CONFIG_EA_UPLOAD       0x66f2a674c29a8dcf
 #define CTAP_CONFIG_PIN_POLICY      0x6c07d70fe96c3897
+#define CTAP_CONFIG_NORK            0x7bc52b41f53590d3
 #ifndef ENABLE_EMULATION
 #define CTAP_CONFIG_PHY_VIDPID      0x6fcb19b0cbe3acfa
 #define CTAP_CONFIG_PHY_LED_BTNESS  0x76a85945985d02fd

src/fido/fido.h

@@ -86,6 +86,7 @@ extern int ecdh(uint8_t protocol, const mbedtls_ecp_point *Q, uint8_t *sharedSec
 
 #define FIDO2_OPT_EA            0x01 // Enterprise Attestation
 #define FIDO2_OPT_AUV           0x02 // User Verification
+#define FIDO2_OPT_NORK          0x04 // No Resident Key
 
 #define MAX_PIN_RETRIES 8
 extern bool getUserPresentFlagValue(void);