EPIC-06b: PIN authentication provider (linux-hello-pin) #18

New issue

Closed

opened 2026-07-27 11:24:08 +02:00 by elegos · 0 comments

elegos commented

2026-07-27 11:24:08 +02:00

Owner

Summary

Implement the PIN authentication provider (linux-hello-pin) as a fallback authenticator.

Scope

argon2id hashing and verification (hash.rs)
Per-user PIN hash storage in SQLite (db.rs + migration_pin.sql)
Stateless PinProvider that receives the stored hash from the daemon (provider.rs)
Rate limiting is not in scope for this crate — enforced by the daemon

Trust score

PIN → 40 (lowest non-recovery score, per §2 Trust Model)

Acceptance criteria

hash_pin / verify_pin roundtrip correct for valid PINs
PINs < 4 or > 128 chars rejected at hash and verify time
Wrong PIN returns PinError::WrongPin → AuthError::Failed
store_hash replaces any previous hash (one PIN per user)
All proptest tests pass
impl AuthProvider for PinProvider in place

Dependencies

EPIC-01 (core types)

LLD

docs/lld/pin-provider.md

## Summary Implement the PIN authentication provider (`linux-hello-pin`) as a fallback authenticator. ## Scope - argon2id hashing and verification (`hash.rs`) - Per-user PIN hash storage in SQLite (`db.rs` + `migration_pin.sql`) - Stateless `PinProvider` that receives the stored hash from the daemon (`provider.rs`) - Rate limiting is **not** in scope for this crate — enforced by the daemon ## Trust score PIN → 40 (lowest non-recovery score, per §2 Trust Model) ## Acceptance criteria - [ ] `hash_pin` / `verify_pin` roundtrip correct for valid PINs - [ ] PINs < 4 or > 128 chars rejected at hash and verify time - [ ] Wrong PIN returns `PinError::WrongPin` → `AuthError::Failed` - [ ] `store_hash` replaces any previous hash (one PIN per user) - [ ] All proptest tests pass - [ ] `impl AuthProvider for PinProvider` in place ## Dependencies EPIC-01 (core types) ## LLD `docs/lld/pin-provider.md`

elegos added the

area: providers

epic

labels

2026-07-27 11:24:08 +02:00

elegos closed this issue

2026-07-28 12:22:50 +02:00