Skip to content

Drop the DERIVE_*_REQ_PRESS opcodes; press_required is now ignored #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
0c-coder wants to merge 2 commits into
base: heroku-deploy
Choose a base branch
from
Open

Drop the DERIVE_*_REQ_PRESS opcodes; press_required is now ignored #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
61f4c70
Drop the DERIVE_*_REQ_PRESS opcodes; press_required is now ignored
claude Sep 10, 2026
740f1c9
Remove the dead history module
claude Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 0 additions & 114 deletions src/lib/history.js
View file
Open in desktop

This file was deleted.

24 changes: 16 additions & 8 deletions src/onlykey-fido2/onlykey/onlykey-3rd-party.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,11 +47,21 @@ module.exports = function(imports, onlykeyApi) {
CURVE25519: 3
};

// 3 and 4 (DERIVE_*_REQ_PRESS) were removed from the firmware and the
// numbers are burned, not reused - sending either now gets
// CTAP2_ERR_EXTENSION_NOT_SUPPORTED rather than being reinterpreted.
//
// The `press_required` argument these mapped to is now IGNORED, and kept
// only so existing callers still parse. Presence is decided by the device
// from what is being asked for: deriving a public key never prompts,
// deriving a shared secret always does, with no setting to turn it off.
// The suffix had also quietly become a second key domain (the firmware set
// additional_data[0] = 1 for it, changing the HKDF salt), which is how
// vault.js ended up fetching its public key in one domain and doing its
// ECDH in the other. One label now means one key.
var KEYACTION = {
DERIVE_PUBLIC_KEY: 1,
DERIVE_SHARED_SECRET: 2,
DERIVE_PUBLIC_KEY_REQ_PRESS: 3,
DERIVE_SHARED_SECRET_REQ_PRESS: 4
DERIVE_SHARED_SECRET: 2
};

// Uint8Array.from() is NOT a string encoder. Given a string it treats it as
Expand Down Expand Up @@ -312,7 +322,7 @@ module.exports = function(imports, onlykeyApi) {
}
Array.prototype.push.apply(message, dataHash);

var keyAction = press_required ? KEYACTION.DERIVE_PUBLIC_KEY_REQ_PRESS : KEYACTION.DERIVE_PUBLIC_KEY;
var keyAction = KEYACTION.DERIVE_PUBLIC_KEY; // press_required ignored, see KEYACTION

var enc_resp = 1;
await onlykeyApi.ctaphid_via_webauthn(cmd, keyAction, keytype, enc_resp, message, 60000).then(async(response) => {
Expand Down Expand Up @@ -413,7 +423,7 @@ module.exports = function(imports, onlykeyApi) {
//msg("input pubkey -> " + pubkey)
//msg("full message -> " + message)

var keyAction = press_required ? KEYACTION.DERIVE_SHARED_SECRET_REQ_PRESS : KEYACTION.DERIVE_SHARED_SECRET;
var keyAction = KEYACTION.DERIVE_SHARED_SECRET; // press_required ignored; the device always prompts

var enc_resp = 1;
await onlykeyApi.ctaphid_via_webauthn(cmd, keyAction, keytype, enc_resp, message, 60000).then(async(response) => {
Expand Down Expand Up @@ -523,9 +533,7 @@ module.exports = function(imports, onlykeyApi) {
Array.prototype.push.apply(message, labelHash);
if (ctX) Array.prototype.push.apply(message, Array.from(ctX));

var keyAction = ctX
? (press_required ? KEYACTION.DERIVE_SHARED_SECRET_REQ_PRESS : KEYACTION.DERIVE_SHARED_SECRET)
: (press_required ? KEYACTION.DERIVE_PUBLIC_KEY_REQ_PRESS : KEYACTION.DERIVE_PUBLIC_KEY);
var keyAction = ctX ? KEYACTION.DERIVE_SHARED_SECRET : KEYACTION.DERIVE_PUBLIC_KEY;

// If the OnlyKey is set to "Challenge Code" for web derived keys
// (webderivemode 0), a shared-secret derive makes the device wait
Expand Down
1 change: 0 additions & 1 deletion src/plugins-devel.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ module.exports.push(require("./plugins/console/console_debug.js"));
module.exports.push(require("./plugins/chat/chat.js"));

/* for encrypted data to for onlykey devices */
module.exports.push(require("./lib/history.js"));


module.exports.push(require("./plugins/password-generator/password-generator.js"));
Expand Down