browser

Documentation

Index

• Constants
• func EnrollPasskey(opts EnrollOptions) error
• func PasskeyEnrolled() bool
• func RevokePasskey() error
• func UnlockWithPasskey() error
• type EnrollOptions
• type KEKRecord
• type Provider
  • func New() *Provider
  • func (p *Provider) Delete(service, key string) error
  • func (p *Provider) DeleteAll(service string) error
  • func (p *Provider) Get(service, key string) (string, error)
  • func (p *Provider) Set(service, key, value string) error
• type SecretRecord

Constants

const (
	ErrPasskeyUnsupported keyring.Error = "keyring: authenticator does not support the prf extension"
	ErrPasskeyNotEnrolled keyring.Error = "keyring: no passkey enrolled for this keyring"
)

Functions

func EnrollPasskey

func EnrollPasskey(opts EnrollOptions) error

EnrollPasskey registers a passkey as an additional unlock method for this keyring: a WebAuthn registration ceremony, a check that the prf extension is enabled, then an assertion ceremony whose PRF output becomes a key-encryption key wrapping the existing data key.

It blocks and MUST be called from a goroutine started by a user-gesture handler. Returns ErrPasskeyUnsupported when the authenticator has no prf.

func PasskeyEnrolled

func PasskeyEnrolled() bool

PasskeyEnrolled reports whether a passkey KEK exists in this database.

func RevokePasskey

func RevokePasskey() error

RevokePasskey deletes the passkey KEK record. The device KEK still unwraps the data key, so no secret is lost.

func UnlockWithPasskey

func UnlockWithPasskey() error

UnlockWithPasskey runs an assertion ceremony and unwraps the data key from the passkey KEK. Call it once per session before Get/Set when the caller wants user-verified access; without it, the device KEK is used.

Blocks, and must be called from a goroutine started by a user gesture.

Types

type EnrollOptions

type EnrollOptions struct {
	RPID     string // the origin's domain, e.g. "app.example.com"
	RPName   string // shown in the authenticator UI
	UserName string // shown in the account picker
}

EnrollOptions describes the passkey to register as an unlock method.

type KEKRecord

type KEKRecord struct {
	ID         string
	Key        js.Value
	WrappedDEK []byte
	HKDFSalt   []byte
	// CredentialID and RPID are set on the "passkey" record only: unlocking
	// needs to name the credential to the authenticator, and the relying party
	// id is part of that request. The passkey KEK itself is never stored — it
	// is re-derived from the authenticator's PRF output on every unlock.
	CredentialID []byte
	RPID         string
}

type Provider

type Provider struct{}

func New

func New() *Provider

func (*Provider) Delete

func (p *Provider) Delete(service, key string) error

func (*Provider) DeleteAll

func (p *Provider) DeleteAll(service string) error

func (*Provider) Get

func (p *Provider) Get(service, key string) (string, error)

func (*Provider) Set

func (p *Provider) Set(service, key, value string) error

type SecretRecord

type SecretRecord struct {
	// contains filtered or unexported fields
}