Repository: google/OpenSK
File: src/ctap/storage.rs (Rust)

Code before:
    fn init(&mut self, rng: &mut impl Rng256) {
        if self.store.find_one(&Key::MasterKeys).is_none() {
            let master_encryption_key = rng.gen_uniform_u8x32();
            let master_hmac_key = rng.gen_uniform_u8x32();
            let mut master_keys = Vec::with_capacity(64);
            master_keys.extend_from_slice(&master_encryption_key);
            master_keys.extend_from_slice(&master_hmac_key);
            self.store
                .insert(StoreEntry {
                    tag: MASTER_KEYS,
                    data: &master_keys,
                    sensitive: true,
                })
                .unwrap();
        }
        // TODO(jmichel): remove this when vendor command is in place
        #[cfg(not(any(test, feature = "ram_storage")))]
        self.load_attestation_from_firmware();

        if self.store.find_one(&Key::Aaguid).is_none() {
            self.set_aaguid(key_material::AAGUID).unwrap();
        }
    }

    // TODO(jmichel): remove this function when vendor command is in place.
    #[cfg(not(any(test, feature = "ram_storage")))]
    fn load_attestation_from_firmware(&mut self) {
        // The following 2 entries are meant to be written by vendor-specific commands.
        if self.store.find_one(&Key::AttestationPrivateKey).is_none() {
            self.set_attestation_private_key(key_material::ATTESTATION_PRIVATE_KEY)
                .unwrap();
        }
        if self.store.find_one(&Key::AttestationCertificate).is_none() {
            self.set_attestation_certificate(key_material::ATTESTATION_CERTIFICATE)
                .unwrap();
        }
    }

    pub fn find_credential(
        &self,
        rp_id: &str,
        credential_id: &[u8],
        check_cred_protect: bool,
    ) -> Result<Option<PublicKeyCredentialSource>, Ctap2StatusCode> {
        let key = Key::Credential {
            rp_id: Some(rp_id.into()),
            credential_id: Some(credential_id.into()),
            user_handle: None,
        };
        let entry = match self.store.find_one(&key) {
            None => return Ok(None),

Review comment (suggestion):
Just wondering, but do we still need this `ram_storage` feature? Asking because it uses "testing" code. So we could have a custom module (different from the one we use in testing) if we want to reduce memory footprint.

Code after:
    fn init(&mut self, rng: &mut impl Rng256) {
        if self.store.find_one(&Key::MasterKeys).is_none() {
            let master_encryption_key = rng.gen_uniform_u8x32();
            let master_hmac_key = rng.gen_uniform_u8x32();
            let mut master_keys = Vec::with_capacity(64);
            master_keys.extend_from_slice(&master_encryption_key);
            master_keys.extend_from_slice(&master_hmac_key);
            self.store
                .insert(StoreEntry {
                    tag: MASTER_KEYS,
                    data: &master_keys,
                    sensitive: true,
                })
                .unwrap();
        }
        // TODO(jmichel): remove this when vendor command is in place
        #[cfg(not(test))]
        self.load_attestation_data_from_firmware();

        if self.store.find_one(&Key::Aaguid).is_none() {
            self.set_aaguid(key_material::AAGUID).unwrap();
        }
    }

    // TODO(jmichel): remove this function when vendor command is in place.
    #[cfg(not(test))]
    fn load_attestation_data_from_firmware(&mut self) {
        // The following 2 entries are meant to be written by vendor-specific commands.
        if self.store.find_one(&Key::AttestationPrivateKey).is_none() {
            self.set_attestation_private_key(key_material::ATTESTATION_PRIVATE_KEY)
                .unwrap();
        }
        if self.store.find_one(&Key::AttestationCertificate).is_none() {
            self.set_attestation_certificate(key_material::ATTESTATION_CERTIFICATE)
                .unwrap();
        }
    }

    pub fn find_credential(
        &self,
        rp_id: &str,
        credential_id: &[u8],
        check_cred_protect: bool,
    ) -> Result<Option<PublicKeyCredentialSource>, Ctap2StatusCode> {
        let key = Key::Credential {
            rp_id: Some(rp_id.into()),
            credential_id: Some(credential_id.into()),
            user_handle: None,
        };
        let entry = match self.store.find_one(&key) {
            None => return Ok(None),