web_authn 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: ba07fe60ce73457f0f61ddc7c53dbf2b07886d93
-  data.tar.gz: a9d76ab96805dd91c619551c09e0701a2a7b0795
+SHA256:
+  metadata.gz: f684ad0ab8c4f516d4bb9023db18476bb76daa8a262576867b21debbb746ad19
+  data.tar.gz: 64f0b2c7251de13671401dca713f8c7b2c09a08874bce8cf66b83f2de7d5e6a6
 SHA512:
-  metadata.gz: 4550a5b91a35c2c5e302b58072b2a063b203370a8128d03cc851d7866e8f6bee92eab6d86dda0a41dcc366b47f9c86bfc9a0eef1e6f4a7df24bba18bbf61e32f
-  data.tar.gz: 5aa59a73d18cfd24b6bd86431676c4c570ee6e5ff0e7af5c83fc70767a134ec87a577d1a7ebe0aab187dd92d9e467987b0e0adb085fe244aa57be6d4ac6f9849
+  metadata.gz: 426f5241570eb0030fb0a189930b53b5fb74945fd528dce77c1797de3ddfeabf00bcc1282dadbd5ebd87f09fbd4505f5499247ce19a5791ce341ecc9fdc00856
+  data.tar.gz: 3498f269f7bb8b654d75d377fde1c5e3d02693783eee78c604df51a5e052dfb680e59c6d0812ff2c88d9db015cd89dca17ab4c9e24235e3073a473e504217faf

data/Gemfile.lock

@@ -0,0 +1,71 @@
+PATH
+  remote: .
+  specs:
+    web_authn (0.3.0)
+      activesupport
+      cbor
+      cose-key (>= 0.2.0)
+      json-jwt
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (5.2.1)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    aes_key_wrap (1.0.1)
+    bindata (2.4.4)
+    cbor (0.5.9.3)
+    concurrent-ruby (1.0.5)
+    cose-key (0.2.0)
+      cbor
+    diff-lcs (1.3)
+    docile (1.3.1)
+    i18n (1.1.1)
+      concurrent-ruby (~> 1.0)
+    json (2.1.0)
+    json-jwt (1.9.4)
+      activesupport
+      aes_key_wrap
+      bindata
+    minitest (5.11.3)
+    rake (10.5.0)
+    rspec (3.8.0)
+      rspec-core (~> 3.8.0)
+      rspec-expectations (~> 3.8.0)
+      rspec-mocks (~> 3.8.0)
+    rspec-core (3.8.0)
+      rspec-support (~> 3.8.0)
+    rspec-expectations (3.8.2)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.8.0)
+    rspec-its (1.2.0)
+      rspec-core (>= 3.0.0)
+      rspec-expectations (>= 3.0.0)
+    rspec-mocks (3.8.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.8.0)
+    rspec-support (3.8.0)
+    simplecov (0.16.1)
+      docile (~> 1.1)
+      json (>= 1.8, < 3)
+      simplecov-html (~> 0.10.0)
+    simplecov-html (0.10.2)
+    thread_safe (0.3.6)
+    tzinfo (1.2.5)
+      thread_safe (~> 0.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  rake (~> 10.0)
+  rspec
+  rspec-its
+  simplecov
+  web_authn!
+
+BUNDLED WITH
+   1.17.1

data/VERSION

@@ -1 +1 @@
-0.3.0
+0.4.0

data/lib/web_authn/attestation_object.rb

@@ -16,7 +16,9 @@ module WebAuthn
         nil
       when 'android-safetynet'
         AttestationStatement::AndroidSafetynet.decode att_stmt
-      when 'packed', 'tpm', 'android-key', 'fido-u2f'
+      when 'packed'
+        AttestationStatement::Packed.decode att_stmt
+      when 'tpm', 'android-key', 'fido-u2f'
         raise NotImplementedError, "Unsupported Attestation Format: #{format}"
       else
         raise InvalidContext, 'Unknown Attestation Format'

data/lib/web_authn/attestation_statement.rb

@@ -4,3 +4,4 @@ module WebAuthn
 end
 
 require 'web_authn/attestation_statement/android_safetynet'
+require 'web_authn/attestation_statement/packed'

data/lib/web_authn/attestation_statement/android_safetynet.rb

@@ -18,7 +18,6 @@ module WebAuthn
         verify_signature!
         verify_certificate!
 
-        # TODO: put more ref.) https://www.w3.org/TR/webauthn/#android-safetynet-attestation
         unless response[:ctsProfileMatch]
           raise InvalidAttestation, 'Invalid Android Safetynet Response: ctsProfileMatch'
         end

data/lib/web_authn/attestation_statement/packed.rb

@@ -0,0 +1,54 @@
+module WebAuthn
+  class AttestationStatement
+    class Packed < AttestationStatement
+      attr_accessor :alg, :sig, :x5c, :ecdaa_key_id
+
+      def initialize(alg:, sig:, x5c:, ecdaa_key_id:)
+        self.alg = alg
+        self.sig = sig
+        self.x5c = Array(x5c)
+        self.ecdaa_key_id = ecdaa_key_id
+      end
+
+      def verify!(authenticator_data, client_data_json)
+        verify_signature! authenticator_data, client_data_json
+      end
+
+      private
+
+      def self_issued?
+        [x5c, ecdaa_key_id].all?(&:blank?)
+      end
+
+      def verify_signature!(authenticator_data, client_data_json)
+        signature_base_string = [
+          authenticator_data.raw,
+          OpenSSL::Digest::SHA256.digest(client_data_json.raw)
+        ].join
+
+        if self_issued? && authenticator_data.attested_credential_data.anonymous?
+          public_cose_key = authenticator_data.attested_credential_data.public_cose_key
+          unless alg == public_cose_key.alg
+            raise InvalidAttestation, 'Invalid Packed Self Attestation: alg'
+          end
+          unless public_cose_key.verify sig, signature_base_string
+            raise InvalidAttestation, 'Invalid Packed Self Attestation: signature'
+          end
+        else
+          raise NotImplementedError, "Unsupported Attestation Format: packed"
+        end
+      end
+
+      class << self
+        def decode(att_stmt)
+          new(
+            alg: att_stmt[:alg],
+            sig: att_stmt[:sig],
+            x5c: att_stmt[:x5c],
+            ecdaa_key_id: att_stmt[:ecdaaKeyId]
+          )
+        end
+      end
+    end
+  end
+end

data/lib/web_authn/attested_credential_data.rb

@@ -9,6 +9,10 @@ module WebAuthn
       self.public_cose_key = public_cose_key
     end
 
+    def anonymous?
+      aaguid == 'AAAAAAAAAAAAAAAAAAAAAA' # NOTE: equals to `Base64.urlsafe_encode64("\0" * 16, padding: false)``
+    end
+
     class << self
       def decode(attested_credential_data)
         length = (

data/spec/context/registration_spec.rb

@@ -44,6 +44,51 @@ RSpec.describe WebAuthn::Context::Registration do
     end
     its(:sign_count) { should == sign_count }
 
+    context 'when packed attestation given' do
+      let(:context) do
+        {
+          origin: 'https://web-authn.self-issued.app',
+          challenge: 'random-string-generated-by-rp-server'
+        }
+      end
+      let(:client_data_json) do
+        'eyJjaGFsbGVuZ2UiOiJjbUZ1Wkc5dExYTjBjbWx1WnkxblpXNWxjbUYwWldRdFlua3RjbkF0YzJWeWRtVnkiLCJvcmlnaW4iOiJodHRwczovL3dlYi1hdXRobi5zZWxmLWlzc3VlZC5hcHAiLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0'
+      end
+
+      context 'when self-attestation' do
+        let(:attestation_object) do
+          'o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEYwRAIgOprGUE_GZMIbRBAPLPw6IiNdSk4dxFb4cRbqDgVfFXQCIHnRdm64FfnShyIhq1Z2qfn3ygp0auT32gy-eL35Uo6YaGF1dGhEYXRhWMQyy4DcrMPDUkYssB87_jAt5vNxLzD9IOzRnDuluFiUlUVb2_sTAAAAAAAAAAAAAAAAAAAAAABAAKUVEhUfjXl7S9MbcWXRfXltc39Spl6yuLxOuUtQJ-y-5DkR61Ge8riwY7dRXZFNSaWhsw9LfsknL57eZEB1gKUBAgMmIAEhWCCfkZcOMoafdVwFi4cNNPQlJS1JNUkq34sJ5fKhDODsfyJYIKD89fXxjNhcX6gDxsTwH3VL_TG7HAHdKFgUjAFumfmr'
+        end
+
+        it do
+          expect do
+            subject
+          end.not_to raise_error
+        end
+
+        context 'when client_data_json is invalid' do
+          let(:client_data_json) do
+            Base64.urlsafe_encode64({
+              type: "webauthn.create",
+              challenge: "cmFuZG9tLXN0cmluZy1nZW5lcmF0ZWQtYnktcnAtc2VydmVy",
+              origin: "https://web-authn.self-issued.app",
+              malformed: 'malformed'
+            }.to_json, padding: false)
+          end
+
+          it do
+            expect do
+              subject
+            end.to raise_error WebAuthn::InvalidAttestation, 'Invalid Packed Self Attestation: signature'
+          end
+        end
+      end
+
+      context 'otherwise' do
+        it :TODO
+      end
+    end
+
     context 'when android-safetynet attestation given' do
       let(:context) do
         {

data/web_authn.gemspec

@@ -14,7 +14,7 @@ Gem::Specification.new do |gem|
   gem.required_ruby_version = '>= 2.3'
   gem.add_runtime_dependency 'activesupport'
   gem.add_runtime_dependency 'cbor'
-  gem.add_runtime_dependency 'cose-key'
+  gem.add_runtime_dependency 'cose-key', '>= 0.2.0'
   gem.add_runtime_dependency 'json-jwt'
   gem.add_development_dependency 'rake', '~> 10.0'
   gem.add_development_dependency 'simplecov'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: web_authn
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-09-12 00:00:00.000000000 Z
+date: 2018-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: json-jwt
   requirement: !ruby/object:Gem::Requirement
@@ -134,6 +134,7 @@ files:
 - ".rspec"
 - ".travis.yml"
 - Gemfile
+- Gemfile.lock
 - LICENSE.txt
 - README.md
 - Rakefile
@@ -144,6 +145,7 @@ files:
 - lib/web_authn/attestation_object.rb
 - lib/web_authn/attestation_statement.rb
 - lib/web_authn/attestation_statement/android_safetynet.rb
+- lib/web_authn/attestation_statement/packed.rb
 - lib/web_authn/attested_credential_data.rb
 - lib/web_authn/authenticator_data.rb
 - lib/web_authn/authenticator_data/flags.rb
@@ -181,7 +183,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: WebAuthn RP library