Use resident keys (discoverable credentials) so the credential persists on the Titan. Both host and client call get_assertion without a credential ID — the Titan finds the resident key by RP ID. Same Titan + same PIN + same salt = same Iroh node ID on any machine.
- commit
- e6deae6cb6e68bcbce4bfdefafd8442f20c3ce78
- parent
- f52cb66c48dc214321e71edbc1ea15e86136c811
- author
- dami etoile <dami.etoile@gmail.com>
| M | spikes/ | 9 | +++++++++ |
@@ -20,6 +20,7 @@ use ctap_hid_fido2::fidokey::{
2020 get_assertion::get_assertion_params::Assertion,2121 make_credential::Extension as Mext,2222 };23+use ctap_hid_fido2::public_key_credential_user_entity::PublicKeyCredentialUserEntity;2324 use ctap_hid_fido2::{verifier, Cfg, FidoKeyHidFactory};2425 use iroh::{Endpoint, SecretKey, endpoint::presets};2526 use iroh::endpoint::Connection;@@ -98,9 +99,17 @@ fn derive_secret_from_titan() -> Result<[u8; 32]> {
9899 // Step 2: Create a resident credential with hmac-secret99100 eprintln!("[titan] make_credential (TAP TITAN when it blinks)");100101 102+ let user_entity = PublicKeyCredentialUserEntity::new(103+ Some(b"keyhome-user"),104+ Some("keyhome"),105+ Some("Keyhome"),106+ );107+101108 let challenge = verifier::create_challenge();102109 let make_args = MakeCredentialArgsBuilder::new(RPID, &challenge)103110 .pin(&pin)111+ .user_entity(&user_entity)112+ .resident_key()104113 .extensions(&[Mext::HmacSecret(Some(true))])105114 .build();106115