[PM-26177] Derive rotateable key set from PRF (3/3) #487
Conversation
|
Great job! No new security vulnerabilities introduced in this pull request |
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## km/PM-26177/rotateable-key-set #487 +/- ##
==================================================================
- Coverage 78.39% 78.38% -0.02%
==================================================================
Files 283 284 +1
Lines 27800 27845 +45
==================================================================
+ Hits 21793 21825 +32
- Misses 6007 6020 +13 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| /// Generates a PRF-protected user key from the provided PRF secret. The result can be stored | ||
| /// and later used to initialize another client instance by using the PRF and the PRF key | ||
| /// with `initialize_user_crypto`. | ||
| pub fn derive_prf_key(&self, prf: B64) -> Result<RotateableKeySet, CryptoClientError> { |
There was a problem hiding this comment.
| pub fn derive_prf_key(&self, prf: B64) -> Result<RotateableKeySet, CryptoClientError> { | |
| pub fn derive_prf_rotateable_keyset_for_user(&self, prf: B64) -> Result<RotateableKeySet, CryptoClientError> { |
My suggestion here is very verbose, but "PRF key" alone suggests the "external key" (prf key) not the entire keyset.
There was a problem hiding this comment.
Yes, that's clearer. (I'll tweak the docs to be clearer too.)
If we wanted it shorter, we could establish a convention that keyset refers to a rotateable key set and name it derive_prf_user_keyset(), which means a user [rotateable] key set protected by PRF, just like derive_pin_user_key() above refers to a user key protected by a PIN. Thoughts?
|
Converting to draft pending further discussion with KM team. |
🎟️ Tracking
PM-26177
📔 Objective
In order to set up PRF passkeys on mobile clients, this adds a method to the SDK that derives the rotateable key set from a PRF value received by a passkey.
⏰ Reminders before review
team
🦮 Reviewer guidelines
:+1:) or similar for great changes:memo:) or ℹ️ (:information_source:) for notes or general info:question:) for questions:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmedissue and could potentially benefit from discussion
:art:) for suggestions / improvements:x:) or:warning:) for more significant problems or concerns needing attention:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt:pick:) for minor or nitpick changes