simplicity_client 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 35ccb4c05970e3765687119f1761b0c1ff47965ab6311f5e86e5fb321b8e87fd
-  data.tar.gz: dfc4d51cf8d179a2901c62aaa576828193ddf6ef87a9aba6793da75da6825737
+  metadata.gz: 3283578b786c0a520eeaee6b46290f1459e9075925f8fdf172534ac533270e33
+  data.tar.gz: cee5f3f5ac077c4cea0bc246d7f1a4b2ea03a23db7ad21795485730685ba3959
 SHA512:
-  metadata.gz: 6ef0ea4b00d2ae9ae5deaaf317759fe595e7221fbfe46175c48747355e388ab4faaf4f0b272ccd6c57ec7c11fc7f06037dd35b6f9e76998c8258d36a6c406dfb
-  data.tar.gz: 6c7618d98c48fc47adfa19931cb68a1fe67d612cc17e1e51c0a6cfdd7d708cffedf7dffd3ff96e425a890990c2b56d629541184edb033de49e2634d49f1e5be4
+  metadata.gz: 2ddd8ee90c05b00ba4ed232846f5c2e546e087c93c7e2c3a58965c74480640fe04823bea6d94c9b3b0f58e64f41cd738b8b157420b71d5864846cb74e0600185
+  data.tar.gz: fbf5d020b63bae7fd804154b34513d95e9991afa39023877905072e69df66879b4afd3e7028251204e314720c4ca472860dc9e81d86d4a90e521202791dd7bbe

data/lib/fido2_client.rb

@@ -0,0 +1,91 @@
+require "json"
+require "digest"
+require "openssl"
+require "base64"
+
+module Fido2Client
+  Passkey = Data.define(:credentialId, :keyAlgorithm, :keyCurve, :keyValue, :userHandle)
+  Assertion = Data.define(:authenticator_data, :client_data_json, :credential_id, :user_handle, :signature)
+
+  class Client
+    def initialize
+      @origin = "https://app.simplicity.kiwi"
+      @rp_id = "simplicity.kiwi"
+    end
+
+    def get_assertion(passkey, challenge)
+      collected_client_data = {
+        type: "webauthn.get",
+        challenge: challenge,
+        origin: @origin,
+        crossOrigin: false,
+      }
+      client_data_json = JSON.dump(collected_client_data)
+      client_data_hash = Digest::SHA256.digest(client_data_json)
+
+      # Assertion
+      auth_data = generate_auth_data
+      private_key = parse_private_key(passkey.keyAlgorithm, passkey.keyCurve, passkey.keyValue)
+      signature = generate_signature(auth_data, client_data_hash, private_key)
+
+      Assertion.new(
+        authenticator_data: Base64.urlsafe_encode64(auth_data.pack("c*"), padding: false),
+        client_data_json: Base64.urlsafe_encode64(client_data_json, padding: false),
+        credential_id: Base64.urlsafe_encode64(guid_to_raw_format(passkey.credentialId), padding: false),
+        user_handle: passkey.userHandle,
+        signature: Base64.urlsafe_encode64(signature, padding: false),
+      )
+    end
+
+    private
+
+    def box(tag, lines)
+      lines.unshift "-----BEGIN #{tag}-----"
+      lines.push "-----END #{tag}-----"
+      lines.join("\n")
+    end
+
+    def der_to_pem(tag, der)
+      box tag, Base64.strict_encode64(der).scan(/.{1,64}/)
+    end
+
+    def parse_private_key(key_algorithm, key_curve, key_value)
+      raise "Unsupported key algorithm: #{key_algorithm}" unless key_algorithm == "ECDSA"
+      raise "Unsupported key curve: #{key_curve}" unless key_curve == "P-256"
+
+      # Decode the Base64 key value
+      key_value_bin = Base64.urlsafe_decode64(key_value)
+
+      pem = der_to_pem("PRIVATE KEY", key_value_bin)
+      OpenSSL::PKey::EC.new(pem)
+    end
+
+    def generate_signature(auth_data, client_data_hash, private_key)
+      sig_base = [*auth_data, *client_data_hash.bytes]
+      digest = OpenSSL::Digest.new("SHA256")
+      private_key.sign(digest, sig_base.pack("c*"))
+    end
+
+    def generate_auth_data
+      auth_data = []
+      rp_id_hash = Digest::SHA256.digest(@rp_id)
+      auth_data += rp_id_hash.bytes
+
+      # Flags asserted: Backup eligibility, Backup State, User Verification, User Presence
+      flags = 0x1D
+      auth_data.push(flags)
+
+      # Counter
+      auth_data += [0, 0, 0, 0]
+
+      auth_data
+    end
+
+    def guid_to_raw_format(guid)
+      raise TypeError, "GUID parameter is invalid" unless guid.match?(/\A[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\z/)
+
+      # Remove the hyphens and pack the string into raw binary
+      [guid.delete("-")].pack("H*")
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: simplicity_client
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - George Dewar
@@ -101,6 +101,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- lib/fido2_client.rb
 - lib/simplicity_client.rb
 homepage: https://github.com/GeorgeDewar/simplicity_client
 licenses: