web_authn 0.0.5 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA256:
-  metadata.gz: 784513f8a1a80761ffa9558612eab5eacaef353b57b6776dcb5f0032f4419258
-  data.tar.gz: a5c88010f0994e656368cc728e1adc275252df6f4e7bbc52ff66f077102789f9
+SHA1:
+  metadata.gz: f927ccba375bfe84ed554363fbfed46e00de82ec
+  data.tar.gz: 1bd39fa9d390134bb1e454de1c416d42b48bce02
 SHA512:
-  metadata.gz: bd1c7a275db5675cc95bb2f3c8bbda9316dbcdd16a4d8c20ba0f1deb6ff2cc9e9f7ccf6227cf8ffe40f6c8e6a0aef59bbb938ab7b9c2986ef8dd126e702cb3bf
-  data.tar.gz: 10fcb7862d202e0e8b920386d5d07ec444690cd22e8c6a76bbf579d27cea92c0a856ade5d0dee951ebdce8654e7690ac3bccfef7c696f16e7d49377c997ac042
+  metadata.gz: 89142065e44b732f310c51405b50b93fbb22b5399897aee01e0912ea7b1ebf8612bae025e85703dbbc49ac29fc93fdfd74c1961178cb18dad08050389be9eaa1
+  data.tar.gz: 68277376ecc0fe3b03ed44b898e66235727381837d2ec001788555d18669229b94f98d99feb3822b5b839faf9e9ee575a3097fb910343526d1dbf49617d8e1d3

data/VERSION

@@ -1 +1 @@
-0.0.5
+0.0.6

data/lib/web_authn/authenticator_data.rb

@@ -1,15 +1,16 @@
 module WebAuthn
   class AuthenticatorData
-    attr_accessor :rp_id_hash, :flags, :sign_count, :attested_credential_data
+    attr_accessor :rp_id_hash, :flags, :sign_count, :attested_credential_data, :raw
 
     %i(credential_id public_key).each do |method|
       delegate method, to: :attested_credential_data, allow_nil: true
     end
 
-    def initialize(rp_id_hash:, flags:, sign_count:, attested_credential_data: nil)
+    def initialize(rp_id_hash:, flags:, sign_count:, raw:, attested_credential_data: nil)
       self.rp_id_hash = rp_id_hash
       self.flags = flags
       self.sign_count = sign_count
+      self.raw = raw
       self.attested_credential_data = attested_credential_data
     end
 
@@ -37,7 +38,8 @@ module WebAuthn
           rp_id_hash: Base64.urlsafe_encode64(rp_id_hash, padding: false),
           flags: flags,
           sign_count: sign_count.unpack('N1').first,
-          attested_credential_data: attested_credential_data
+          attested_credential_data: attested_credential_data,
+          raw: auth_data
         )
       end
     end

data/lib/web_authn/context/authentication.rb

@@ -13,31 +13,36 @@ module WebAuthn
       end
 
       def verify!(encoded_authenticator_data, public_key:, sign_count:, signature:)
-        raw_authenticator_data = Base64.urlsafe_decode64 encoded_authenticator_data
         self.authenticator_data = AuthenticatorData.decode(
-          raw_authenticator_data
+          Base64.urlsafe_decode64 encoded_authenticator_data
         )
-        verify_sign_count!(sign_count, authenticator_data.sign_count)
-        verify_signature!(raw_authenticator_data, client_data_json.raw, public_key, signature)
+        verify_flags!
+        verify_sign_count!(sign_count)
+        verify_signature!(public_key, signature)
         self
       end
 
       private
 
-      def verify_sign_count!(before, current)
-        if before == 0 && current == 0
+      def verify_flags!
+        super
+        raise InvalidAssertion, 'Unexpected Flag: "at"' if flags.at?
+      end
+
+      def verify_sign_count!(before)
+        if before == 0 && sign_count == 0
           self # NOTE: no counter supported on the authenticator
-        elsif before < current
+        elsif before < sign_count
           self
         else
           raise InvalidAssertion, 'Invalid Sign Count'
         end
       end
 
-      def verify_signature!(raw_authenticator_data, raw_client_data_json, public_key, signature)
+      def verify_signature!(public_key, signature)
         signature_base_string = [
-          raw_authenticator_data,
-          OpenSSL::Digest::SHA256.digest(raw_client_data_json)
+          authenticator_data.raw,
+          OpenSSL::Digest::SHA256.digest(client_data_json.raw)
         ].join
         result = public_key.verify(
           OpenSSL::Digest::SHA256.new,

data/lib/web_authn/context/registration.rb

@@ -16,8 +16,16 @@ module WebAuthn
         self.attestation_object = AttestationObject.decode(
           encoded_attestation_object
         )
+        verify_flags!
         self
       end
+
+      private
+
+      def verify_flags!
+        super
+        raise InvalidAssertion, 'Missing Flag: "at"' unless flags.at?
+      end
     end
   end
 end

data/lib/web_authn/context.rb

@@ -24,6 +24,12 @@ module WebAuthn
       false
     end
 
+    def verify_flags!
+      unless flags.uv? || flags.up?
+        raise InvalidAssertion, 'Missing Flag: uv" nor "up"'
+      end
+    end
+
     class << self
       def for(encoded_client_data_json, origin:, challenge:)
         client_data_json = ClientDataJSON.decode encoded_client_data_json

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: web_authn
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors:
 - nov matake
@@ -162,7 +162,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: W3C WebAuthn (a.k.a. FIDO2) RP library in Ruby