FIDO_DEV_ENABLE_ENTATTEST(3)

💖 FIDO_DEV_ENABLE_ENTATTEST(3) 💖

okay bestie, so this is a section 3 page from the Library Functions Manual, and it's literally the group chat for the CTAP 2.1 configuration authenticator API. five functions, one vibe, let's go 🎀

🌸 NAME 🌸

fido_dev_enable_entattest, fido_dev_toggle_always_uv, fido_dev_force_pin_change, fido_dev_set_pin_minlen, fido_dev_set_pin_minlen_rpid — CTAP 2.1 configuration authenticator API

like. that's the whole squad. they configure your authenticator, no cap.

✨ SYNOPSIS ✨

#include <fido.h>
#include <fido/config.h>

int
fido_dev_enable_entattest(fido_dev_t *dev, const char *pin);

int
fido_dev_toggle_always_uv(fido_dev_t *dev, const char *pin);

int
fido_dev_force_pin_change(fido_dev_t *dev, const char *pin);

int
fido_dev_set_pin_minlen(fido_dev_t *dev, size_t len, const char *pin);

int
fido_dev_set_pin_minlen_rpid(fido_dev_t *dev, const char * const *rpid,
    size_t n, const char *pin);

🦋 DESCRIPTION 🦋

so basically these functions let you configure a CTAP 2.1 authenticator. that's it, that's the plot 💅

fido_dev_enable_entattest() turns on the Enterprise Attestation feature on dev. and what does Enterprise Attestation do? it tells the authenticator to sneak uniquely identifying info into all the attestation statements that come after. yes ma'am, it's giving "i know exactly who you are" energy 👀 the pin parameter can be NULL if dev doesn't have a PIN set.

fido_dev_toggle_always_uv() toggles the “user verification always” feature on dev. when it's set, this toggle enforces user verification at the authenticator level for all known credentials. lowkey strict, highkey necessary. here's the tea though: if dev supports U2F (CTAP1) and the user verification methods the authenticator supports don't allow protection of U2F credentials, then the U2F subsystem gets disabled by the authenticator. so that's a whole thing. the pin parameter can be NULL if dev doesn't have a PIN set.

fido_dev_force_pin_change() tells dev to require a PIN change. after this, every PIN authentication attempt against dev will fail until its PIN is actually changed. it's a glow-up mandate, periodt 😌

fido_dev_set_pin_minlen() sets the minimum PIN length of dev to len. important: minimum PIN lengths may only be increased. no take-backs, no shrinking, the bar only goes up 📈

fido_dev_set_pin_minlen_rpid() sets the list of relying party identifiers (RP IDs) that are allowed to obtain the minimum PIN length of dev through the CTAP 2.1 FIDO_EXT_MINPINLEN extension. that list of RP identifiers is called rpid, and it's a vector of n NUL-terminated UTF-8 strings. a copy of rpid gets made, and no reference to it or its contents is kept — so you can free your stuff, she's independent now 🫶 the maximum value of n that the authenticator supports can be obtained using fido_cbor_info_maxrpid_minpinlen(3).

and a little ✨ lore drop ✨: configuration settings show up in the payload the authenticator returns in response to a fido_dev_get_cbor_info(3) call. so if you wanna vibe check your changes, that's where to look 🔍

👑 RETURN VALUES 👑

the error codes returned by fido_dev_enable_entattest(), fido_dev_toggle_always_uv(), fido_dev_force_pin_change(), fido_dev_set_pin_minlen(), and fido_dev_set_pin_minlen_rpid() are defined in <fido/err.h>. on success, FIDO_OK is returned. slay 💚

🌈 SEE ALSO 🌈

• fido_cbor_info_maxrpid_minpinlen(3)
• fido_cred_pin_minlen(3)
• fido_dev_get_cbor_info(3)
• fido_dev_reset(3)

and that's the whole page bestie!! 💖✨

this one shipped from Debian and it's dated March 30, 2022, and yeah the page header/name situation is FIDO_DEV_ENABLE_ENTATTEST(3) (the header line up top spells it FIDO_DEV_ENABLE_ENTATTES without the final T, which… we don't talk about 🙈).

mwah, go configure something iconic 🎀💅