Release PassVault v0.4.3 experimental FIDO2 support

[lordbuffcloud]

Summary

• adds a clean-room FIDO 2.0 authenticator with CTAPHID, CTAP2, and ES256
• keeps FIDO credentials encrypted and separate from the password vault
• requires physical Approve/Deny user presence
• restores the previous USB configuration on exit
• improves the new-entry and Inject navigation flow
• adds operating, recovery, and security documentation

Physical verification

• native CTAP2 registration completed in 3.003 seconds after approval
• Chromium WebAuthn registration and authentication passed
• ES256 assertion signature and signature counter verified
• browser-created credential authenticated after a FIDO-mode restart
• serial USB returned and FIDO HID disappeared after exit

Build verification

• strict CTAPHID and CTAP2 host tests passed
• runtime lifecycle and navigation contracts passed
• uFBT compile/link and APPCHK passed for target 7 / API 87.1
• final FAP: 44,544 bytes
• SHA-256: 251790b4401e455d56cb84268898d7dd295eb9f168e473bec9fc14a9176bd417

Security scope

Experimental and unaudited. Flipper Zero has no secure element. Client PIN, resident credentials, and user verification are unsupported. Users must retain a backup authenticator and recovery method.

Summary by CodeRabbit

• New Features

  • Added experimental FIDO2 security-key support through CTAPHID and CTAP2.
  • Added WebAuthn credential creation and assertion flows using ES256 credentials.
  • Added encrypted credential storage, persistence, recovery, allow-listing, and signature counters.
  • Added physical-presence approval, cancellation handling, and USB-mode restoration.
  • Improved vault navigation and entry interaction flows.

• Documentation

  • Added FIDO2 setup, capabilities, limitations, security notes, and validation details.

• Bug Fixes

  • Updated the application version to 0.4.3.

• Tests

  • Added coverage for FIDO2 operations, USB transport, runtime behavior, storage recovery, and navigation.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8492d96b-df76-4350-9637-17344da43384

📥 Commits

Reviewing files that changed from the base of the PR and between c8cdfda and eb4660c.

📒 Files selected for processing (25)

• FIDO2_PROGRESS.md
• README.md
• application.fam
• changelog.md
• ck42x_ctap2.c
• ck42x_ctap2.h
• ck42x_fido2.c
• ck42x_fido2.h
• ck42x_fido2_service.c
• ck42x_fido2_service.h
• ck42x_passvault.c
• ck42x_sha256.c
• ck42x_sha256.h
• test_fido2_core.c
• test_fido2_hid.c
• test_fido2_runtime_contract.py
• test_navigation_contract.py
• vendor/micro-ecc/LICENSE.txt
• vendor/micro-ecc/README.ck42x
• vendor/micro-ecc/curve-specific.inc
• vendor/micro-ecc/platform-specific.inc
• vendor/micro-ecc/types.h
• vendor/micro-ecc/uECC.c
• vendor/micro-ecc/uECC.h
• vendor/micro-ecc/uECC_vli.h

---

📝 Walkthrough

Walkthrough

The pull request adds an experimental FIDO2 security-key runtime. It implements CTAP2, CTAPHID, P-256 cryptography, encrypted credential storage, USB integration, presence approval, application navigation, tests, and release documentation.

Changes

FIDO2 security-key runtime

Layer / File(s)	Summary
Cryptography and Micro-ECC foundation ck42x_sha256.*, vendor/micro-ecc/*	Adds SHA-256, secure memory clearing, portable P-256 ECDSA, RNG support, and Micro-ECC configuration.
CTAP2 authenticator operations ck42x_ctap2.*, test_fido2_core.c	Adds bounded CBOR handling, credential serialization, MakeCredential, GetAssertion, GetInfo, presence checks, counters, signing, and CTAP2 tests.
CTAPHID transport and command dispatch ck42x_fido2.*, test_fido2_hid.c	Adds HID report parsing, encoding, channel handling, INIT, PING, CBOR, CANCEL, protocol errors, and framing tests.
Encrypted storage, USB service, and application controls ck42x_fido2_service.*, ck42x_passvault.c	Adds encrypted credential persistence, recovery files, worker-thread dispatch, USB restoration, presence dialogs, lifecycle handling, and security-key navigation.
Runtime validation and release materials test_fido2_runtime_contract.py, test_navigation_contract.py, README.md, FIDO2_PROGRESS.md, application.fam, changelog.md	Adds source-shape validation, navigation checks, version 0.4.3, usage and security documentation, progress evidence, and release notes.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant WebAuthnClient
  participant USBHID
  participant CkFido2Service
  participant CkCtap2
  participant PassVaultUI
  participant CredentialStore
  WebAuthnClient->>USBHID: Send CTAPHID reports
  USBHID->>CkFido2Service: Deliver HID reports
  CkFido2Service->>CkCtap2: Dispatch CTAP2 request
  CkCtap2->>PassVaultUI: Request physical presence
  PassVaultUI-->>CkFido2Service: Approve or deny request
  CkCtap2->>CredentialStore: Load or save encrypted credential
  CkCtap2-->>CkFido2Service: Return CTAP2 response
  CkFido2Service-->>USBHID: Encode response reports
  USBHID-->>WebAuthnClient: Return CTAPHID reports

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/clean-room-fido2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}