fpi_sdcp_claim_get_type ()

GType
fpi_sdcp_claim_get_type (void);

fpi_sdcp_claim_new ()

FpiSdcpClaim *
fpi_sdcp_claim_new (void);

Create an empty FpiSdcpClaim to provide to the base class.

fpi_sdcp_claim_copy ()

FpiSdcpClaim *
fpi_sdcp_claim_copy (FpiSdcpClaim *other);

Create a (shallow) copy of a FpiSdcpClaim.

fpi_sdcp_claim_free ()

void
fpi_sdcp_claim_free (FpiSdcpClaim *claim);

Release the memory used by an FpiSdcpClaim.

fpi_sdcp_device_open_complete ()

void
fpi_sdcp_device_open_complete (FpSdcpDevice *self,
                               GError *error);

Reports completion of open operation. Responsible for triggering SDCP connect or reconnect as necessary.

fpi_sdcp_device_get_connect_data ()

void
fpi_sdcp_device_get_connect_data (FpSdcpDevice *self,
                                  GBytes **host_random,
                                  GBytes **host_public_key);

fpi_sdcp_device_connect_complete ()

void
fpi_sdcp_device_connect_complete (FpSdcpDevice *self,
                                  GBytes *device_random,
                                  FpiSdcpClaim *claim,
                                  GBytes *mac,
                                  GError *error);

Reports completion of connect operation. Responsible for performing SDCP key agreement, deriving secrets necessary for processing all other SDCP-related payloads, and verifying the device connection is trusted.

fpi_sdcp_device_get_reconnect_data ()

void
fpi_sdcp_device_get_reconnect_data (FpSdcpDevice *self,
                                    GBytes **reconnect_random);

fpi_sdcp_device_reconnect_complete ()

void
fpi_sdcp_device_reconnect_complete (FpSdcpDevice *self,
                                    GBytes *mac,
                                    GError *error);

Reports completion of a reconnect (i.e. open) operation.

fpi_sdcp_device_list_complete ()

void
fpi_sdcp_device_list_complete (FpSdcpDevice *self,
                               GPtrArray *ids,
                               GError *error);

Convenience function to create the minimally required FpPrint list for FpSdcpDevice prints using the provided ids , then uses that FpPrint list to report completion of the list operation.

If the device provides additional attributes that should be stored on each FpPrint as part of the list operation, a GPtrArray of FpPrint can instead be created with the additional attributes and fpi_device_list_complete() can be used instead of this function.

Please note that the ids array will be freed using g_ptr_array_unref() and the elements are destroyed automatically. As such, you must use g_ptr_array_new_with_free_func() with (GDestroyNotify) g_bytes_unref as the free func when creating the GPtrArray.

fpi_sdcp_device_enroll_commit ()

void
fpi_sdcp_device_enroll_commit (FpSdcpDevice *self,
                               GBytes *nonce,
                               GError *error);

Called when the print is ready to be committed to device memory. During enrollment, fpi_device_enroll_progress() must be called for each successful stage before the print can be committed. The nonce generated by the device-specific EnrollmentNonce response must be provided in order for the enrollment ID to be generated. The driver's enroll_commit() vfunc will be triggered upon successfully generating the enrollment ID.

fpi_sdcp_device_enroll_commit_complete ()

void
fpi_sdcp_device_enroll_commit_complete
                               (FpSdcpDevice *self,
                                GError *error);

Called when device has committed the given print to memory. This finalizes the enroll operation.

fpi_sdcp_device_get_identify_data ()

void
fpi_sdcp_device_get_identify_data (FpSdcpDevice *self,
                                   GBytes **nonce);

fpi_sdcp_device_set_identify_data ()

void
fpi_sdcp_device_set_identify_data (FpSdcpDevice *self,
                                   GBytes *nonce);

fpi_sdcp_device_identify_retry ()

void
fpi_sdcp_device_identify_retry (FpSdcpDevice *self,
                                GError *error);

Called when the device requires the finger to be presented again. This should not be called for a verified no-match, it should only be called if e.g. the finger was not centered properly or similar.

Effectively this simply raises the error up. This function exists to bridge the difference in semantics that SDPC has from how libfprint works internally.

fpi_sdcp_device_identify_complete ()

void
fpi_sdcp_device_identify_complete (FpSdcpDevice *self,
                                   GBytes *id,
                                   GBytes *mac,
                                   GError *error);

Called when device is done with the identification routine. The returned ID may be NULL if none of the in-device templates matched.

fpi_sdcp_device_get_print_id ()

void
fpi_sdcp_device_get_print_id (FpPrint *print,
                              GBytes **id);

Gets the SDCP enrollment ID from the print data.

The returned id may be NULL if the data was not set or in the wrong format.

fpi_sdcp_device_set_print_id ()

void
fpi_sdcp_device_set_print_id (FpPrint *print,
                              GBytes *id);

Sets the SDCP enrollment ID in the print data.

struct FpiSdcpClaim

struct FpiSdcpClaim {
  const char *master_secret_label;
  const char *application_keys_label;
  const char *connect_label;
  const char *reconnect_label;
  const char *enroll_label;
  const char *identify_label;
  const char *sample_label;

  GBytes     *model_certificate;   /* cert_m */
  GBytes     *device_public_key;   /* pk_d   */
  GBytes     *firmware_public_key; /* pk_f   */
  GBytes     *firmware_hash;       /* h_f    */
  GBytes     *model_signature;     /* s_m    */
  GBytes     *device_signature;    /* s_d    */
};

Structure to hold the claim as produced by the device during a secure connect. See the SDCP specification for more details.

Note all of these may simply be memory views into a larger GBytes created using g_bytes_new_from_bytes().

enum FpiDeviceSdcpVerificationFlags

Bitfield of SDCP verification flags for a device.

FpSdcpDeviceClass

typedef struct {
  FpDeviceClass                  parent_class;

  FpiDeviceSdcpVerificationFlags verification_flags;

  void                           (*open)          (FpSdcpDevice *sdcp_device);
  void                           (*connect)       (FpSdcpDevice *sdcp_device);
  void                           (*reconnect)     (FpSdcpDevice *sdcp_device);
  void                           (*list)          (FpSdcpDevice *sdcp_device);
  void                           (*enroll)        (FpSdcpDevice *sdcp_device);
  void                           (*enroll_commit) (FpSdcpDevice *sdcp_device,
                                                   GBytes       *id);
  void                           (*identify)      (FpSdcpDevice *sdcp_device);
} FpSdcpDeviceClass;

These are the main entry points for drivers implementing SDCP.

Drivers *must* eventually call the corresponding function to finish the operation.

The following FpDeviceClass entry points are also compatible and can be set on the FpDeviceClass if supported for a given device:

Drivers *must* also handle cancellation properly for any long running operation (i.e. any operation that requires capturing). It is entirely fine to ignore cancellation requests for short operations (e.g. open/close).

This API is solely intended for drivers. It is purely internal and neither API nor ABI stable.

FPI_SDCP_RANDOM_SIZE

#define FPI_SDCP_RANDOM_SIZE 32

FPI_SDCP_APPLICATION_SECRET_SIZE

#define FPI_SDCP_APPLICATION_SECRET_SIZE 32

FPI_SDCP_ENROLLMENT_ID_SIZE

#define FPI_SDCP_ENROLLMENT_ID_SIZE 32

FPI_SDCP_NONCE_SIZE

#define FPI_SDCP_NONCE_SIZE 32

FPI_SDCP_MAC_SIZE

#define FPI_SDCP_MAC_SIZE 32

FPI_SDCP_DIGEST_SIZE

#define FPI_SDCP_DIGEST_SIZE 32           /* SHA256 */

FPI_SDCP_CURVE_FIELD_SIZE

#define FPI_SDCP_CURVE_FIELD_SIZE 32      /* P256 */

FPI_SDCP_PUBLIC_KEY_SIZE

#define FPI_SDCP_PUBLIC_KEY_SIZE 65       /* 0x04||x||y */

FPI_SDCP_PRIVATE_KEY_SIZE

#define FPI_SDCP_PRIVATE_KEY_SIZE 32      /* log_2(n)/8 */

FPI_SDCP_SIGNATURE_SIZE

#define FPI_SDCP_SIGNATURE_SIZE 64        /* r||s */

FPI_SDCP_ENCRYPTION_BLOCK_SIZE

#define FPI_SDCP_ENCRYPTION_BLOCK_SIZE 16 /* AES */

FPI_SDCP_ENCRYPTION_KEY_SIZE

#define FPI_SDCP_ENCRYPTION_KEY_SIZE 32   /* AES256 */

FPI_SDCP_DEFAULT_LABEL_MASTER_SECRET

#define FPI_SDCP_DEFAULT_LABEL_MASTER_SECRET "master secret"

FPI_SDCP_DEFAULT_LABEL_APPLICATION_KEYS

#define FPI_SDCP_DEFAULT_LABEL_APPLICATION_KEYS "application keys"

FPI_SDCP_DEFAULT_LABEL_CONNECT

#define FPI_SDCP_DEFAULT_LABEL_CONNECT "connect"

FPI_SDCP_DEFAULT_LABEL_RECONNECT

#define FPI_SDCP_DEFAULT_LABEL_RECONNECT "reconnect"

FPI_SDCP_DEFAULT_LABEL_SAMPLE

#define FPI_SDCP_DEFAULT_LABEL_SAMPLE "sample"

FPI_SDCP_DEFAULT_LABEL_ENROLL

#define FPI_SDCP_DEFAULT_LABEL_ENROLL "enroll"

FPI_SDCP_DEFAULT_LABEL_IDENTIFY

#define FPI_SDCP_DEFAULT_LABEL_IDENTIFY "identify"