From a6eb149bd194635b93cbc6f8bcf1adc52161c4d5 Mon Sep 17 00:00:00 2001
From: Pol Henarejos <pol.henarejos@cttc.es>
Date: Fri, 26 Jun 2026 11:03:51 +0200
Subject: [PATCH] Add support for only-non-resident credentials.

It disables, optionally, resident credentials.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
---
 src/fido/cbor_config.c          | 3 +++
 src/fido/cbor_get_info.c        | 2 +-
 src/fido/cbor_make_credential.c | 3 +++
 src/fido/ctap.h                 | 1 +
 src/fido/fido.h                 | 1 +
 5 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/fido/cbor_config.c b/src/fido/cbor_config.c
index c5a61c1..4173a6c 100644
--- a/src/fido/cbor_config.c
+++ b/src/fido/cbor_config.c
@@ -208,6 +208,9 @@ int cbor_config(const uint8_t *data, size_t len) {
             }
             flash_commit();
         }
+        else if (vendorCommandId == CTAP_CONFIG_NORK) {
+            set_opts(get_opts() ^ FIDO2_OPT_NORK);
+        }
         else {
             CBOR_ERROR(CTAP2_ERR_INVALID_SUBCOMMAND);
         }
diff --git a/src/fido/cbor_get_info.c b/src/fido/cbor_get_info.c
index be580ea..2dd84b5 100644
--- a/src/fido/cbor_get_info.c
+++ b/src/fido/cbor_get_info.c
@@ -74,7 +74,7 @@ int cbor_get_info(void) {
         CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, true));
     }
     CBOR_CHECK(cbor_encode_text_stringz(&arrayEncoder, "rk"));
-    CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, true));
+    CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, !(get_opts() & FIDO2_OPT_NORK)));
     CBOR_CHECK(cbor_encode_text_stringz(&arrayEncoder, "alwaysUv"));
     if (file_has_data(ef_pin) && (get_opts() & FIDO2_OPT_AUV || !getUserVerifiedFlagValue())) {
         CBOR_CHECK(cbor_encode_boolean(&arrayEncoder, true));
diff --git a/src/fido/cbor_make_credential.c b/src/fido/cbor_make_credential.c
index 730a249..dae66ba 100644
--- a/src/fido/cbor_make_credential.c
+++ b/src/fido/cbor_make_credential.c
@@ -312,6 +312,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
         if (options.uv == ptrue) { //5.3
             CBOR_ERROR(CTAP2_ERR_INVALID_OPTION);
         }
+        if (options.rk == ptrue && (get_opts() & FIDO2_OPT_NORK)) { //5.4
+            CBOR_ERROR(CTAP2_ERR_INVALID_OPTION);
+        }
         if (options.up == pfalse) { //5.6
             CBOR_ERROR(CTAP2_ERR_INVALID_OPTION);
         }
diff --git a/src/fido/ctap.h b/src/fido/ctap.h
index a7dfa03..92e9e8c 100644
--- a/src/fido/ctap.h
+++ b/src/fido/ctap.h
@@ -116,6 +116,7 @@ typedef struct {
 #define CTAP_CONFIG_AUT_DISABLE     0x1831a40f04a25ed9
 #define CTAP_CONFIG_EA_UPLOAD       0x66f2a674c29a8dcf
 #define CTAP_CONFIG_PIN_POLICY      0x6c07d70fe96c3897
+#define CTAP_CONFIG_NORK            0x7bc52b41f53590d3
 #ifndef ENABLE_EMULATION
 #define CTAP_CONFIG_PHY_VIDPID      0x6fcb19b0cbe3acfa
 #define CTAP_CONFIG_PHY_LED_BTNESS  0x76a85945985d02fd
diff --git a/src/fido/fido.h b/src/fido/fido.h
index 2c215d3..f264822 100644
--- a/src/fido/fido.h
+++ b/src/fido/fido.h
@@ -86,6 +86,7 @@ extern int ecdh(uint8_t protocol, const mbedtls_ecp_point *Q, uint8_t *sharedSec
 
 #define FIDO2_OPT_EA            0x01 // Enterprise Attestation
 #define FIDO2_OPT_AUV           0x02 // User Verification
+#define FIDO2_OPT_NORK          0x04 // No Resident Key
 
 #define MAX_PIN_RETRIES 8
 extern bool getUserPresentFlagValue(void);