CredLinkCryptoHandler

PKOC step B (phone side): generates a fresh P-256 ephemeral key pair, stores it, and returns the bridge ephemeral public key write payload (TLV tag 0x07).

PKOC step C (phone side): verifies the lock signature, signs the authentication message, and returns the AES-GCM encrypted write payload (IV + ciphertext TLVs).

Builds Legacy credential exchange step-A initiator TLVs: long-term public key (tag 0x01) and time-sync flag (tag 0x09).

First step for Token Unlock flow. This function initiates the Function builds the token-unlock Initiation payload using the keypair persisted in secure enclave linked to the provided phoneKeyAlias. Function also generates transaction ephemeral keys and persists that in session memory for use

Using the TokenUnlockPass, function fetches the access documents for the reader's reader group identifier and builds the encrypted PresentationPresent payload and sends it to the device. Note: Function uses the ephemeral keys as the secure credentials for encryption.

Deletes the persisted token unlock pass persisted at the provided phoneKeyAlias in the bridge's secure enclave, returning a boolean value indicating success

Fetches the persisted Token Unlock pass persisted at the provided phoneKeyAlias in the bridge's secure enclave. Null is returned if no pass is found for the provided phoneKeyAlias Note: Secure access document data is decrypted after fetching

True when a long-term private key is present for phoneKeysAlias (may not be exportable).

PKOC step A (phone side): handler for processing device's ephemeral key bytes

Accepts the encrypted PresentationPayload from the device and decrypts it using the transaction ephemeral keys to get the Token Unlock credential exchange response. Note: Incomplete results are treated as access denied responses.

Shared Crypto Functions

Accepts the secure Token Unlock pass and persists this in the bridge's secure enclave under the provided phoneKeyAlias and returns a boolean value indicating success persisting the pass. Note: Secure access document data is encrypted before storing for security reasons

Verifies the lock's provided reader certificate for the requested reader group and returns the P-256 uncompressed public key for the reader cert. Function also accepts reader group data via TokenUnlockPass. Function returns null if trust cannot be verified with the device / if the reader groups list does not contain device's reader group identifier.