fido2 library
Library to parse FIDO2 request / response and interactive with FIDO2 authenticators.
Classes
- AttestationResult
- Verified attestation evidence. A valid signature does not establish trust in the authenticator vendor. Validate trustPath against application trust anchors/metadata before relying on device identity.
- AttestedCredentialData
-
Data parsed from the
attestedCredentialDatablock of anauthenticatorDatabuffer. This contains the credential information. - AuthenticationResult
- Verified state to persist atomically after successful authentication.
- AuthenticatorData
-
A structured representation of the
authenticatorDatabuffer returned by an authenticator. - AuthenticatorInfo
- CTAP2 authenticatorGetInfo response structure (spec §6.4).
- ClientPin
- ClientPinRequest
- CTAP2 authenticatorClientPIN (0x06) request (spec §6.5.5).
- ClientPinResponse
- CTAP2 authenticatorClientPIN (0x06) response (spec §6.5.5).
- CmCredential
- CmCredentialMetadata
- Credential fields returned by metadata-only enumeration.
- CmMetadata
- CmRp
- CoseConfiguration
- CoseKey
- Parsing checks structure. validate checks mathematical validity in Rust.
- CredentialManagement
- CredentialManagementRequest
- CTAP2 authenticatorCredentialManagement (0x0A) request (spec §6.8).
- CredentialManagementResponse
- CTAP2 authenticatorCredentialManagement (0x0A) response (spec §6.8).
- Ctap2
- CtapDevice
-
CtapResponse<
T> - EcdhEsHkdf256
- Ed25519
- EdDSA
- EncapsulateResult
- ES256
- Fido2Config
- Fido2Server
- WebAuthn server ceremonies. Callers must store challenges server-side, bind them to the user/session, expire them, and atomically consume them once. Registration verifies none/packed attestation and the credential public key. Certificate trust is delegated to Fido2Config.attestationVerifier.
- GetAssertionRequest
- CTAP2 authenticatorGetAssertion (0x02) request (spec §6.2).
- GetAssertionResponse
- CTAP2 authenticatorGetAssertion (0x02) response (spec §6.2).
- GetInfoRequest
- CTAP2 authenticatorGetInfo (0x04) request.
- MakeCredentialRequest
- CTAP2 authenticatorMakeCredential (0x01) request (spec §6.1).
- MakeCredentialResponse
- CTAP2 authenticatorMakeCredential (0x01) response (spec §6.1).
- MLDSA
- MLDSA44
- MLDSA65
- MLDSA87
- PinProtocol
- PinProtocolV1
- PinProtocolV2
- PublicKeyCredentialDescriptor
- Identifies a specific credential (spec §5.8.3). Used to hint which credentials to create or allow during operations.
- PublicKeyCredentialRpEntity
- WebAuthn Relying Party (RP) parameters used during credential creation (see spec §5.4.2). Contains the RP identifier.
- PublicKeyCredentialUserEntity
- WebAuthn user account parameters for credential creation (spec §5.4.3). Includes an opaque user handle and human-readable names.
- RegisteredCredential
- RegistrationRequest
- RegistrationResult
- The result of a successful registration verification.
- RustCrypto
- All cryptographic operations use the shared Rust native/WASM core.
- SM2
- Sm2Configuration
- Explicit EC2 compatibility profile: SM2 has no IANA COSE allocation.
- UnsupportedKey
- VerificationResult
- The result of a successful assertion (verification).
Enums
- AttestationConveyancePreference
- WebAuthn attestation conveyance preference sent to the client.
- AttestationType
- The kind of proof verified during registration, independent of trust.
- ClientPinPermission
- ClientPinSubCommand
- CredentialManagementSubCommand
- CredentialManagementSubCommandParams
- Ctap2Commands
- CtapStatusCode
- Status code in CTAP responses
- EnterpriseAttestationMode
- SignatureAlgorithm
- SignatureEncoding
Typedefs
- AttestationVerifier = bool Function(AttestationResult attestation)
- Optional synchronous application policy, called after protocol and signature validation for every registration (including none/self). Return false to reject. For basic attestation, the application owns certificate path, validity, revocation and metadata trust checks.
Exceptions / Errors
- CryptoException
- CtapError
- Represents an error retuned by CTAP device