Expand description
Managing a post-quantum account’s sign-in factors Managing a post-quantum account’s sign-in factors from an authenticated session: list, add a security key, rename, remove, set the policy, regenerate the recovery codes.
Every change carries a fresh step-up (the account’s factors, proven again, bound to the change) except in a session signed in with a recovery code, which may only add a key and set the policy.
Security keys need the server to name its relying party, with
PqAuthServerSettings::with_security_key_rp_id. With the security-key feature, the client’s
keys are served by SecurityKey::new(prompt).serve() natively, or SecurityKey::new().serve()
in a browser; without it, serve the channel yourself:
let (key, mut touches) = security_key_channel();
// Serve `touches` by running each request's WebAuthn ceremony with the PRF extension, then
// answering.
let step_up = SignInFactors::password("hunter2").with_security_key(key);
let op = SignInManagementOp::AddSecurityKey { label: "YubiKey".into() };
let added = conn.manage_sign_in(op, step_up).await?;