web_authn 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89d25f455fdd1323936c0c32072be162f888df15e7ddd86fb65549e9f37736fb
-  data.tar.gz: ecb31a66853aeaca039da91aeb66ca5a24b5ee9f103153ed76ae6593fc1071ea
+  metadata.gz: 07b7a1b06a7ad5f04c3d303de0f8f099c0ce71038e78934268bf99243600d86c
+  data.tar.gz: 60a474a75148dff57396fc3e939fc94a83a58496ef95bca71f5a29747674651b
 SHA512:
-  metadata.gz: dee33babaf79b1ba80f86321223206c56e59c7c3e5adc113bb8a4f51d8d9c185d5eb1b62219a408e98130265d75e9ee1fa648794d3db8f60ab32551cbd5c83bb
-  data.tar.gz: 70fdbe9c79f25a5044eea4ac2b06815d6f5c128e0db61c03f930577cba78dc2d5e6fcf46324823fefa9dcefab2b76ccd648e3e769a12020f123f7f0d128b7798
+  metadata.gz: 5876b9449153f9309057f48632121f0302b3a7fb663d968b441a374b40c09f9b88447b64101d44e92c2b1be6287e2f11c0373b44ca2c2532aa96d1b658d7899d
+  data.tar.gz: b598691bcb6d42ef76f72ae650931d47888cf573f5ad45759d2d834c3174256f69521f9496a101caf206386d366b9f476efe99864100e8bc9ad78cee7d4be7ae

data/VERSION

@@ -1 +1 @@
-0.1.1
+0.2.0

data/lib/web_authn/attestation_object.rb

@@ -5,7 +5,7 @@ module WebAuthn
     alias_method :att_stmt,  :attestation_statement
     alias_method :auth_data, :authenticator_data
 
-    %i(credential_id rp_id_hash flags public_key sign_count).each do |method|
+    %i(credential_id rp_id_hash flags public_key public_cose_key sign_count).each do |method|
       delegate method, to: :authenticator_data
     end
 

data/lib/web_authn/attested_credential_data.rb

@@ -1,11 +1,12 @@
 module WebAuthn
   class AttestedCredentialData
-    attr_accessor :aaguid, :credential_id, :public_key
+    attr_accessor :aaguid, :credential_id, :public_key, :public_cose_key
 
-    def initialize(aaguid:, credential_id:, public_key:)
+    def initialize(aaguid:, credential_id:, public_key:, public_cose_key:)
       self.aaguid = aaguid
       self.credential_id = credential_id
       self.public_key = public_key
+      self.public_cose_key = public_cose_key
     end
 
     class << self
@@ -21,10 +22,12 @@ module WebAuthn
           attested_credential_data.byteslice(18...(18 + length)),
           attested_credential_data.byteslice((18 + length)..-1),
         ]
+        cose_key = COSE::Key.decode(cose_key_cbor)
         new(
           aaguid: Base64.urlsafe_encode64(aaguid, padding: false),
           credential_id: Base64.urlsafe_encode64(credential_id, padding: false),
-          public_key: COSE::Key.decode(cose_key_cbor).to_key
+          public_key: cose_key.to_key,
+          public_cose_key: cose_key
         )
       end
     end

data/lib/web_authn/authenticator_data.rb

@@ -2,7 +2,7 @@ module WebAuthn
   class AuthenticatorData
     attr_accessor :rp_id_hash, :flags, :sign_count, :attested_credential_data, :raw
 
-    %i(credential_id public_key).each do |method|
+    %i(credential_id public_key public_cose_key).each do |method|
       delegate method, to: :attested_credential_data, allow_nil: true
     end
 

data/lib/web_authn/context/authentication.rb

@@ -12,13 +12,17 @@ module WebAuthn
         true
       end
 
-      def verify!(encoded_authenticator_data, public_key:, sign_count:, signature:)
+      def verify!(encoded_authenticator_data, sign_count:, signature:, public_key: nil, public_cose_key: nil, digest: OpenSSL::Digest::SHA256.new)
+        unless public_key || public_cose_key
+          raise ArgumentError, 'missing keyword: public_key or public_cose_key'
+        end
+
         self.authenticator_data = AuthenticatorData.decode(
           Base64.urlsafe_decode64 encoded_authenticator_data
         )
         verify_flags!
         verify_sign_count!(sign_count)
-        verify_signature!(public_key, signature)
+        verify_signature!(public_key, public_cose_key, signature, digest)
         self
       end
 
@@ -39,16 +43,23 @@ module WebAuthn
         end
       end
 
-      def verify_signature!(public_key, signature)
-        # TODO:
-        #  needs to handle digest size based on COSE key algorithm.
-        #  how to get COSE key alg header at this point?
+      def verify_signature!(public_key, public_cose_key, signature, digest)
         signature_base_string = [
           authenticator_data.raw,
           OpenSSL::Digest::SHA256.digest(client_data_json.raw)
         ].join
-        result = public_key.verify(
-          OpenSSL::Digest::SHA256.new,
+        if public_cose_key
+          public_key, digest = [public_cose_key, public_cose_key.digest]
+        end
+        verification_method = case public_key
+        when OpenSSL::PKey::RSA
+          :verify_pss
+        when OpenSSL::PKey::EC
+          :verify
+        end
+        result = public_key.send(
+          verification_method,
+          digest,
           Base64.urlsafe_decode64(signature),
           signature_base_string
         )

data/lib/web_authn/context/registration.rb

@@ -4,7 +4,7 @@ module WebAuthn
       attr_accessor :attestation_object
 
       # TODO: will need more methods, or let developers access deep methods by themselves.
-      %i(credential_id rp_id_hash flags public_key sign_count).each do |method|
+      %i(credential_id rp_id_hash flags public_key public_cose_key sign_count).each do |method|
         delegate method, to: :attestation_object
       end
 

data/samples/authentication_response.rb

@@ -30,7 +30,12 @@ raise unless context.authentication?
 
 context.verify!(
   authenticator_data,
+  # NOTE:
+  #  either 'public_key' or 'public_cose_key' is required.
+  #  if `public_key` is given, you can also specify `digest` (default: `OpenSSL::Digest::SHA256.new`).
+  #  if `public_cose_key` is given, it includes digest size information, so no `digest` is required.
   public_key: public_key,
+  # public_cose_key: public_cose_key,
   sign_count: sign_count,
   signature: signature
 )

data/samples/registration_response.rb

@@ -36,6 +36,9 @@ ex: #{context.flags.ex}
 # Public Key
 #{context.public_key.to_pem}
 
+# Public COSE Key
+#{context.public_cose_key.raw}
+
 # Sign Count
 #{context.sign_count}
 OUT

data/spec/context/registration_spec.rb

@@ -38,6 +38,7 @@ RSpec.describe WebAuthn::Context::Registration do
     its(:rp_id_hash) { should == rp_id_hash }
     its(:flags) { should == flags }
     its(:public_key) { should be_instance_of OpenSSL::PKey::EC }
+    its(:public_cose_key) { should be_instance_of COSE::Key::EC2 }
     its(:public_key_pem) do
       subject.public_key.to_pem.should == public_key_pem
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: web_authn
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-09-08 00:00:00.000000000 Z
+date: 2018-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport