1*0afa8e06SEd Maste.\" Copyright (c) 2020 Yubico AB. All rights reserved. 2*0afa8e06SEd Maste.\" Use of this source code is governed by a BSD-style 3*0afa8e06SEd Maste.\" license that can be found in the LICENSE file. 4*0afa8e06SEd Maste.\" 5*0afa8e06SEd Maste.Dd $Mdocdate: September 22 2020 $ 6*0afa8e06SEd Maste.Dt FIDO_DEV_ENABLE_ENTATTEST 3 7*0afa8e06SEd Maste.Os 8*0afa8e06SEd Maste.Sh NAME 9*0afa8e06SEd Maste.Nm fido_dev_enable_entattest , 10*0afa8e06SEd Maste.Nm fido_dev_toggle_always_uv , 11*0afa8e06SEd Maste.Nm fido_dev_force_pin_change , 12*0afa8e06SEd Maste.Nm fido_dev_set_pin_minlen 13*0afa8e06SEd Maste.Nd FIDO 2.1 configuration authenticator API 14*0afa8e06SEd Maste.Sh SYNOPSIS 15*0afa8e06SEd Maste.In fido.h 16*0afa8e06SEd Maste.In fido/config.h 17*0afa8e06SEd Maste.Ft int 18*0afa8e06SEd Maste.Fn fido_dev_enable_entattest "fido_dev_t *dev" "const char *pin" 19*0afa8e06SEd Maste.Ft int 20*0afa8e06SEd Maste.Fn fido_dev_toggle_always_uv "fido_dev_t *dev" "const char *pin" 21*0afa8e06SEd Maste.Ft int 22*0afa8e06SEd Maste.Fn fido_dev_force_pin_change "fido_dev_t *dev" "const char *pin" 23*0afa8e06SEd Maste.Ft int 24*0afa8e06SEd Maste.Fn fido_dev_set_pin_minlen "fido_dev_t *dev" "size_t len" "const char *pin" 25*0afa8e06SEd Maste.Sh DESCRIPTION 26*0afa8e06SEd MasteThe functions described in this page allow configuration of a 27*0afa8e06SEd MasteFIDO 2.1 authenticator. 28*0afa8e06SEd Maste.Pp 29*0afa8e06SEd MasteThe 30*0afa8e06SEd Maste.Fn fido_dev_enable_entattest 31*0afa8e06SEd Mastefunction enables the 32*0afa8e06SEd Maste.Em Enterprise Attestation 33*0afa8e06SEd Mastefeature on 34*0afa8e06SEd Maste.Fa dev . 35*0afa8e06SEd Maste.Em Enterprise Attestation 36*0afa8e06SEd Masteinstructs the authenticator to include uniquely identifying 37*0afa8e06SEd Masteinformation in subsequent attestation statements. 38*0afa8e06SEd MasteThe 39*0afa8e06SEd Maste.Fa pin 40*0afa8e06SEd Masteparameter may be NULL if 41*0afa8e06SEd Maste.Fa dev 42*0afa8e06SEd Mastedoes not have a PIN set. 43*0afa8e06SEd Maste.Pp 44*0afa8e06SEd MasteThe 45*0afa8e06SEd Maste.Fn fido_dev_toggle_always_uv 46*0afa8e06SEd Mastefunction toggles the 47*0afa8e06SEd Maste.Dq user verification always 48*0afa8e06SEd Mastefeature on 49*0afa8e06SEd Maste.Fa dev . 50*0afa8e06SEd MasteWhen set, this toggle enforces user verification at the 51*0afa8e06SEd Masteauthenticator level for all known credentials. 52*0afa8e06SEd MasteIf 53*0afa8e06SEd Maste.Fa dev 54*0afa8e06SEd Mastesupports U2F (CTAP1) and the user verification methods supported by 55*0afa8e06SEd Mastethe authenticator do not allow protection of U2F credentials, the 56*0afa8e06SEd MasteU2F subsystem will be disabled by the authenticator. 57*0afa8e06SEd MasteThe 58*0afa8e06SEd Maste.Fa pin 59*0afa8e06SEd Masteparameter may be NULL if 60*0afa8e06SEd Maste.Fa dev 61*0afa8e06SEd Mastedoes not have a PIN set. 62*0afa8e06SEd Maste.Pp 63*0afa8e06SEd MasteThe 64*0afa8e06SEd Maste.Fn fido_dev_force_pin_change 65*0afa8e06SEd Masteinstructs 66*0afa8e06SEd Maste.Fa dev 67*0afa8e06SEd Masteto require a PIN change. 68*0afa8e06SEd MasteSubsequent PIN authentication attempts against 69*0afa8e06SEd Maste.Fa dev 70*0afa8e06SEd Mastewill fail until its PIN is changed. 71*0afa8e06SEd Maste.Pp 72*0afa8e06SEd MasteThe 73*0afa8e06SEd Maste.Fn fido_dev_set_pin_minlen 74*0afa8e06SEd Mastefunction sets the minimum PIN length of 75*0afa8e06SEd Maste.Fa dev 76*0afa8e06SEd Masteto 77*0afa8e06SEd Maste.Fa len . 78*0afa8e06SEd MasteMinimum PIN lengths may only be increased. 79*0afa8e06SEd Maste.Pp 80*0afa8e06SEd MasteConfiguration settings are reflected in the payload returned by the 81*0afa8e06SEd Masteauthenticator in response to a 82*0afa8e06SEd Maste.Xr fido_dev_get_cbor_info 3 83*0afa8e06SEd Mastecall. 84*0afa8e06SEd Maste.Sh RETURN VALUES 85*0afa8e06SEd MasteThe error codes returned by 86*0afa8e06SEd Maste.Fn fido_dev_enable_entattest , 87*0afa8e06SEd Maste.Fn fido_dev_toggle_always_uv , 88*0afa8e06SEd Maste.Fn fido_dev_force_pin_change , 89*0afa8e06SEd Masteand 90*0afa8e06SEd Maste.Fn fido_dev_set_pin_minlen 91*0afa8e06SEd Masteare defined in 92*0afa8e06SEd Maste.In fido/err.h . 93*0afa8e06SEd MasteOn success, 94*0afa8e06SEd Maste.Dv FIDO_OK 95*0afa8e06SEd Masteis returned. 96*0afa8e06SEd Maste.Sh SEE ALSO 97*0afa8e06SEd Maste.Xr fido_dev_get_cbor_info 3 , 98*0afa8e06SEd Maste.Xr fido_dev_reset 3 99