[EPIC-22] TOTP and one-time recovery tokens #25

New issue

Closed

opened 2026-07-29 10:59:00 +02:00 by elegos · 0 comments

elegos commented

2026-07-29 10:59:00 +02:00

Owner

Summary

EnrollTOTP, GenerateRecoveryTokens, RevokeRecoveryTokens, and RemoveFactor(totp) all return NotSupported (see crates/linux-hello-daemon/src/dbus.rs:117–199). TOTP and recovery tokens are the primary escape hatches for Scenario A failures (biometric unavailable, PIN forgotten) — high priority.

What needs to be implemented

TOTP enrollment via EPIC-21 session flow (generate secret → QR via EnrollStep signal → user confirms first code via SubmitEnrollData → EnrollFinish seals)
TOTP verification in auth pipeline (crates/linux-hello-daemon/src/pipeline.rs)
needs_totp field in PamResponse IPC type + PAM module prompt handling
Recovery token generation: N × 128-bit CSPRNG, stored as argon2id hashes
Recovery token verification as final pipeline fallback (post-all-factors)
needs_recovery_token in PamResponse + PAM module prompt
Anti-replay for TOTP (record used code+window)
Rate limiting for both factors
DB schema: totp_secret and recovery_tokens tables

Design

HLD: docs/lld/totp-recovery.md

Dependencies

Depends on EPIC-21 (#24) for TOTP enrollment session flow.

Before implementation, write the full LLD and update docs/ARCHITECTURE.md implementation status in the dependency graph.

## Summary `EnrollTOTP`, `GenerateRecoveryTokens`, `RevokeRecoveryTokens`, and `RemoveFactor(totp)` all return `NotSupported` (see `crates/linux-hello-daemon/src/dbus.rs:117–199`). TOTP and recovery tokens are the primary escape hatches for Scenario A failures (biometric unavailable, PIN forgotten) — high priority. ## What needs to be implemented - TOTP enrollment via EPIC-21 session flow (generate secret → QR via `EnrollStep` signal → user confirms first code via `SubmitEnrollData` → `EnrollFinish` seals) - TOTP verification in auth pipeline (`crates/linux-hello-daemon/src/pipeline.rs`) - `needs_totp` field in `PamResponse` IPC type + PAM module prompt handling - Recovery token generation: N × 128-bit CSPRNG, stored as `argon2id` hashes - Recovery token verification as final pipeline fallback (post-all-factors) - `needs_recovery_token` in `PamResponse` + PAM module prompt - Anti-replay for TOTP (record used code+window) - Rate limiting for both factors - DB schema: `totp_secret` and `recovery_tokens` tables ## Design HLD: `docs/lld/totp-recovery.md` ## Dependencies Depends on EPIC-21 (#24) for TOTP enrollment session flow. Before implementation, write the full LLD and update `docs/ARCHITECTURE.md` implementation status in the dependency graph.

elegos added this to the Foundation project

2026-07-29 10:59:36 +02:00

elegos removed this from the Foundation project

2026-07-29 10:59:42 +02:00

elegos added this to the Foundation project

2026-07-29 11:00:01 +02:00

elegos added the

epic

area: security

labels

2026-07-29 11:17:10 +02:00

elegos referenced this issue