cryptohome/cryptorecovery/cryptorecovery.proto

syntax = "proto2";

option optimize_for = LITE_RUNTIME;

package cryptohome.cryptorecovery;

// !!! DO NOT MODIFY !!!
// The message structs below are exchanged with the server and must be synced
// with the server/HSM implementation.
// See google3/chromeos/identity/go/cryptorecovery/shared/proto/enums.proto and
// google3/chromeos/identity/proto/cryptorecovery/cryptorecovery.proto

// Request for the current epoch
message CryptoRecoveryEpochRequest {
  optional int32 protocol_version = 1;  // protocol version
}

// Epoch public key response
message CryptoRecoveryEpochResponse {
  optional int32 protocol_version = 1;  // protocol version
  optional bytes epoch_pub_key = 2;     // public key of the current epoch
  optional bytes epoch_meta_data =
      3;  // cbor encoded metadata of current epoch. clients can also treat this
          // as an opaque blob.
}

// Request for a cryptohome recovery
message CryptoRecoveryRpcRequest {
  optional int32 protocol_version = 1;            // protocol version
  optional bytes cbor_cryptorecoveryrequest = 2;  // cbor encoded request
}

// Error codes returned in the recovery response.
enum RecoveryError {
  // No error
  RECOVERY_ERROR_UNSPECIFIED = 0;
  // Fatal error due to invalid payload
  RECOVERY_ERROR_FATAL = 1;
  // Transient error that is retriable
  RECOVERY_ERROR_TRANSIENT = 2;
  // Invalid reauth proof token
  RECOVERY_ERROR_AUTH = 3;
  // Invalid/outdated epoch index was used in the request
  RECOVERY_ERROR_EPOCH = 4;
  // Outdated reauth proof token
  RECOVERY_ERROR_AUTH_EXPIRED = 5;
}

// Result of a cryptohome recovery
message CryptoRecoveryRpcResponse {
  optional int32 protocol_version = 1;  // protocol version
  optional bytes cbor_cryptorecoveryresponse =
      2;  // cbor encoded ResponsePayload
  optional RecoveryError error_code = 3;
}