module

CrystalCryptoSamples::Ctap2DbusCeremony

Orchestrates the Phase 2 end-to-end D-Bus CTAP2 authenticator ceremony transporting canonical CBOR frames over crystal-dbus-native to a crystal-tpm2-tss + crystal-pqc-constant responder.

Constants

ATTESTATION_CTX = "EVALINUX-CTAP2-DBUS-V1"

Domain-separation context string for PQC attestation signatures.

INTERFACE = "org.evalinux.Ctap2Authenticator1"

D-Bus interface and bus name for the CTAP2 authenticator service.

METHOD_NAME = "MakeCredential"

D-Bus method member for CTAP2 credential creation and attestation.

OBJECT_PATH = "/org/evalinux/Ctap2Authenticator1"

D-Bus object path for the CTAP2 authenticator service.

RP_ID = "evalinux.com"

Relying Party identifier bound into the CTAP2 verification digest.

Class methods

accept_sasl_and_hello(server : UNIXSocket) : Nil

Services and validates the server side of a SASL EXTERNAL, NEGOTIATE_UNIX_FD, and org.freedesktop.DBus.Hello handshake.

Source

encode_request(challenge : Bytes, rp_id : String = RP_ID) : Bytes

Encodes a canonical integer-keyed CBOR MakeCredential request map.

Source

process_make_credential(req_cbor : Bytes, cred_manager : Crystal::Tpm2::Tss::FIDO2CredentialManager, dsa : Crystal::Pqc::Constant::MLDSAKeyPair) : Bytes

Decodes a canonical CBOR MakeCredential request, signs SHA256(rp_id || challenge) with both TPM 2.0 NIST P-256 and ML-DSA-65, and encodes the CBOR response.

Source

run(io : IO = STDOUT) : Nil

Executes the complete D-Bus CTAP2 MakeCredential RPC and dual verification.

Source

verify_response(resp_cbor : Bytes, challenge : Bytes, dsa : Crystal::Pqc::Constant::MLDSAKeyPair, rp_id : String = RP_ID) : Bool

Verifies the canonical CBOR MakeCredential response using the attested NIST P-256 public key coordinates and ML-DSA-65 public key.

Source