Module cpace 

The CPace exchange that hands the credentials of an enrolled device to a new one, reverse engineered from 1Password’s WASM module: the local crypto, and the requests that carry it.

The new device proves it knows the verification code the user reads off the enrolled device, and both sides end up with the same key to move the credential bundle through the server.

Structs

Ad 🔒

The associated data of a CPace message.

MsgA 🔒

The first CPace message, from the enrolled device.

Constants

CREDENTIAL_BUNDLE_AAD 🔒

EXCHANGE_KEY_INFO 🔒

PADDING_LENGTH 🔒

Pads the second hash input through the passcode hash to one 128 byte SHA-512 block.

PASSCODE_ITERATIONS 🔒

TRANSPORT_KEY_ID 🔒

The key id of the exchange key, which also keys the first step of deriving it.

Functions

calculate_auth_a_hash 🔒

The point both sides agree on: ya times the client scalar.

calculate_auth_b_hash 🔒

The session secret, hashed over the whole transcript.

calculate_auth_b_tag_b 🔒

Calculates the shared secret authB and the tagb that proves knowing it.

calculate_first_hash 🔒

Binds the exchange to the user, the sign-in address and the enrollment.

calculate_msg_b 🔒

Calculates msgb, the new device’s answer to msga.

calculate_passcode_hash 🔒

Stretches the verification code, salted by the enrolled device.

calculate_second_hash 🔒

The input of the CPace generator, which binds the passcode to the first hash and the session.

calculate_tag_b 🔒

The MAC of msgb under a key derived from authB.

cpace_endpoint 🔒

The CPace endpoints, under the enrollment’s cpace prefix.

decompress_point 🔒

Fails for anything but the canonical encoding of a point.

decrypt_credentials 🔒

Decrypts the credential bundle the enrolled device shared.

derive_exchange_key 🔒

Derives the key that encrypts the credential bundle in transit from authB.

enrollment_endpoint 🔒

v3/device/enrollments/{enrollmentUuid}/{method}

expect_success 🔒

The server confirms each CPace message with success: 1.

get_tag_a 🔒

Waits for the enrolled device’s taga, which only verify_tag_a looks at.

hmac_sha384 🔒

hmac_sha512 🔒

leb128_prefixed 🔒

Prefixes every field with its length as LEB128, and concatenates them.

multiply_by_client_scalar 🔒

Multiplies by the scalar the client secret reduces to, and compresses the result.

parse_msg_a 🔒

Parses the JSON of msga, after its base64 layer is removed.

perform_cpace 🔒

Runs the whole exchange over rest with a fresh random client secret and returns the credentials the enrolled device shared.

perform_cpace_with_client_secret 🔒

The CPace exchange with the client secret injected so the test vectors can pin it.

post_json_until_result 🔒

POSTs until the endpoint answers a body instead of the empty 200 it sends while the enrolled device has not replied yet. The web frontend retries the same way.

request_encrypted_credentials 🔒

Waits for the credential bundle, still encrypted for the exchange key and so invisible to the server that relays it.

request_msg_a 🔒

Fetches and parses the enrolled device’s first message.

send_msg_b 🔒

Replies with msgb and expects the server to accept it.

send_tag_b 🔒

Replies with tagb and expects the server to accept it.

sha512 🔒

sign_in_body 🔒

The body every CPace request carries besides the messages themselves.

verify_tag_a 🔒

Would check taga, which proves the enrolled device knows the verification code too.

write_leb128_prefixed 🔒

Writes data after its length, as the little endian base 128 varint the WASM module uses.