Dynamic factor keys for crypto4

[romanstrobl]

Description

Implement changes related to dynamic factor keys for crypto4:

• password change endpoint /pa/v4/password/change
• biometry setup endoint /pa/v4/biometry/add
• biometry remove endpoint /pa/v4/biometry/remove

Acceptance criteria

Dynamic factor keys endpoints are implemented.

Technical specification

Password change

• /pa/v4/password/change endpoint

  • Signed with "possession_knowledge"
  • E2EE, activation scope, sh1="/pa/password/change"
  • Request body (before encryption):

    {
      "sharedSecretRequest": {
        "algorithm": "EC_P384_ML_L3",
        "ecdhe": "Base64",
        "mlkem": "Base64"
      }
    }

  • Response body (before encryption):

    {
      "sharedSecretResponse": {
        "ecdhe": "Base64",
        "mlkem": "Base64"
      }
    }

  • The result of shared secret calculation is a new factor key stored to knowledge_factor_key_next on the server side.

• /pa/v4/biometry/add

  • Signed with "possession_knowledge"
  • E2EE, activation scope, sh1="/pa/biometry/add"
  • Request body (before encryption):

    {
      "sharedSecretRequest": {
        "algorithm": "EC_P384_ML_L3",
        "ecdhe": "Base64",
        "mlkem": "Base64"
      }
    }

  • Response body (before encryption):

    {
      "sharedSecretResponse": {
        "ecdhe": "Base64",
        "mlkem": "Base64"
      }
    }

    • The result of shared secret calculation is a new factor key stored to biometric_factor_key_next on the server side.

• /pa/v4/biometry/remove

  • Signed with "possession"
  • Request body

    {}

  • Response body

    {}

QA specification

Tested by end-to-end tests.