mirror of
https://github.com/trezor/trezor-firmware.git
synced 2024-11-15 20:19:23 +00:00
b1e4246b46
This is what the spec recommends and it has been the case before workflow-restarts, when `apps.webauthn.fido2` was imported exactly once per lifetime. With workflow-restarts, `fido2` is being imported repeatedly and the keys regenerated. This does not seem to be a problem per the spec -- a FIDO workflow will retain the same keys, and non-FIDO workflows can be seen as unplugs/replugs as far as the FIDO functionality is concerned. However, regenerating the keys is slow, which is a problem for the hardware-based unit tests. We can avoid the slowness by returning to the spec-mandated behavior and generating once per power-up.
13 lines
784 B
Python
13 lines
784 B
Python
# FIDO2 keys that should be generated once per power-up
|
|
# https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticator-power-up-configuration
|
|
# While we could safely generate these keys per-wipe and save them in sessionless cache,
|
|
# this drags down the performance of our test suite.
|
|
|
|
# We want to avoid importing `trezor.crypto.curve` because that would needlessly pollute
|
|
# our RAM space, while in the end importing the symbol from `trezorcrypto` directly anyway
|
|
from trezorcrypto import nist256p1
|
|
|
|
# the authenticatorKeyAgreementKey used for ECDH in authenticatorClientPIN getKeyAgreement.
|
|
KEY_AGREEMENT_PRIVKEY = nist256p1.generate_secret()
|
|
KEY_AGREEMENT_PUBKEY = nist256p1.publickey(KEY_AGREEMENT_PRIVKEY, False)
|