webauthn-slim 3.4.3

data/docs/advanced_configuration.md

@@ -0,0 +1,173 @@
+# Advanced Configuration
+
+## Global vs Instance Based Configuration
+
+Which approach suits best your needs will depend on the architecture of your application and how do your users need to register and authenticate to it.
+
+If you have a multi-tenant application, or any application segmentation, where your users register and authenticate to each of these tenants or segments individually using different hostnames, or with different security needs, you need to go through [Instance Based Configuration](#instance-based-configuration).
+
+However, if your application is served for just one hostname, or else if your users authenticate to only one subdomain (e.g. your application serves www.example.com and admin.example.com but all your users authenticate through auth.example.com) you can still rely on one [Global Configuration](../README.md#configuration).
+
+If you are still not sure, or want to keep your options open, be aware that [Instance Based Configuration](#instance-based-configuration) is also a valid way of defining a single instance configuration and how you share such configuration across your application, it's up to you.
+
+
+## Instance Based Configuration
+
+Instead of the [Global Configuration](../README.md#configuration) you place in `config/initializers/webauthn.rb`,
+ you can now have an on-demand instance of `WebAuthn::RelyingParty` with the same configuration options, that
+ you can build anywhere in your application, in the following way:
+
+```ruby
+  relying_party = WebAuthn::RelyingParty.new(
+    # This value needs to match `window.location.origin` evaluated by
+    # the User Agent during registration and authentication ceremonies.
+    # Multiple origins can be used when needed. Using more than one will imply you MUST configure rp_id explicitely. If you need your credentials to be bound to a single origin but you have more than one tenant, please see [our Advanced Configuration section](https://github.com/cedarcode/webauthn-ruby/blob/master/docs/advanced_configuration.md) instead of adding multiple origins.
+    allowed_origins: ["https://admin.example.com"],
+
+    # Relying Party name for display purposes
+    name: "Admin Site for Example Inc."
+
+    # Optionally configure a client timeout hint, in milliseconds.
+    # This hint specifies how long the browser should wait for any
+    # interaction with the user.
+    # This hint may be overridden by the browser.
+    # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout
+    # credential_options_timeout: 120_000
+
+    # You can optionally specify a different Relying Party ID
+    # (https://www.w3.org/TR/webauthn/#relying-party-identifier)
+    # if it differs from the default one.
+    #
+    # In this case the default would be "admin.example.com", but you can set it to
+    # the suffix "example.com"
+    #
+    # id: "example.com"
+
+    # Configure preferred binary-to-text encoding scheme. This should match the encoding scheme
+    # used in your client-side (user agent) code before sending the credential to the server.
+    # Supported values: `:base64url` (default), `:base64` or `false` to disable all encoding.
+    #
+    # encoding: :base64url
+
+    # Possible values: "ES256", "ES384", "ES512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512", "RS1"
+    # Default: ["ES256", "PS256", "RS256"]
+    #
+    # algorithms: ["ES384"]
+  )
+```
+
+## Instance Based API
+
+The explanation for each ceremony can be found in depth in [Credential Registration](../README.md#credential-registration) and [Credential Authentication](../README.md#credential-authentication) but if you choose this instance based approach to define your WebAuthn configurations and assuming `relying_party` is the result of an instance you get through `WebAuthn::RelyingParty.new(...)` the code in those explanations needs to be updated to:
+
+### Credential Registration
+
+#### Initiation phase
+
+```ruby
+# Generate and store the WebAuthn User ID the first time the user registers a credential
+if !user.webauthn_id
+  user.update!(webauthn_id: WebAuthn.generate_user_id)
+end
+
+options = relying_party.options_for_registration(
+  user: { id: user.webauthn_id, name: user.name },
+  exclude: user.credentials.map { |c| c.external_id }
+)
+
+# Store the newly generated challenge somewhere so you can have it
+# for the verification phase.
+session[:creation_challenge] = options.challenge
+
+# Send `options` back to the browser, so that they can be used
+# to call `navigator.credentials.create({ "publicKey": options })`
+#
+# You can call `options.as_json` to get a ruby hash with a JSON representation if needed.
+
+# If inside a Rails controller, `render json: options` will just work.
+# I.e. it will encode and convert the options to JSON automatically.
+
+# For your frontend code, you might find @github/webauthn-json npm package useful.
+# Especially for handling the necessary decoding of the options, and sending the
+# `PublicKeyCredential` object back to the server.
+```
+
+#### Verification phase
+
+```ruby
+# Assuming you're using @github/webauthn-json package to send the `PublicKeyCredential` object back
+# in params[:publicKeyCredential]:
+begin
+  webauthn_credential = relying_party.verify_registration(
+    params[:publicKeyCredential],
+    session[:creation_challenge]
+  )
+
+  # Store Credential ID, Credential Public Key and Sign Count for future authentications
+  user.credentials.create!(
+    external_id: webauthn_credential.id,
+    public_key: webauthn_credential.public_key,
+    sign_count: webauthn_credential.sign_count
+  )
+rescue WebAuthn::Error => e
+  # Handle error
+end
+```
+
+### Credential Authentication
+
+#### Initiation phase
+
+```ruby
+options = relying_party.options_for_authentication(allow: user.credentials.map { |c| c.webauthn_id })
+
+# Store the newly generated challenge somewhere so you can have it
+# for the verification phase.
+session[:authentication_challenge] = options.challenge
+
+# Send `options` back to the browser, so that they can be used
+# to call `navigator.credentials.get({ "publicKey": options })`
+
+# You can call `options.as_json` to get a ruby hash with a JSON representation if needed.
+
+# If inside a Rails controller, `render json: options` will just work.
+# I.e. it will encode and convert the options to JSON automatically.
+
+# For your frontend code, you might find @github/webauthn-json npm package useful.
+# Especially for handling the necessary decoding of the options, and sending the
+# `PublicKeyCredential` object back to the server.
+```
+
+#### Verification phase
+
+```ruby
+begin
+  # Assuming you're using @github/webauthn-json package to send the `PublicKeyCredential` object back
+  # in params[:publicKeyCredential]:
+  webauthn_credential, stored_credential = relying_party.verify_authentication(
+    params[:publicKeyCredential],
+    session[:authentication_challenge]
+  ) do |webauthn_credential|
+    # the returned object needs to respond to #public_key and #sign_count
+    user.credentials.find_by(external_id: webauthn_credential.id)
+  end
+
+  # Update the stored credential sign count with the value from `webauthn_credential.sign_count`
+  stored_credential.update!(sign_count: webauthn_credential.sign_count)
+
+  # Continue with successful sign in or 2FA verification...
+
+rescue WebAuthn::SignCountVerificationError => e
+  # Cryptographic verification of the authenticator data succeeded, but the signature counter was less than or equal
+  # to the stored value. This can have several reasons and depending on your risk tolerance you can choose to fail or
+  # pass authentication. For more information see https://www.w3.org/TR/webauthn/#sign-counter
+rescue WebAuthn::Error => e
+  # Handle error
+end
+```
+
+## Moving from Global to Instance Based Configuration
+
+Adding a configuration for a new instance does not mean you need to get rid of your Global configuration. They can co-exist in your application and be both available for the different usages you might have. `WebAuthn.configuration.relying_party` will always return the global one while `WebAuthn::RelyingParty.new`, executed anywhere in your codebase, will allow you to create a different instance as you see the need. They will not collide and instead operate in isolation without any shared state.
+
+The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still be valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is maintained globally at `WebAuthn.configuration.relying_party`.

data/docs/u2f_migration.md

@@ -0,0 +1,90 @@
+# Migrating from U2F to WebAuthn
+
+The Chromium team [recommends](https://groups.google.com/a/chromium.org/forum/#!msg/security-dev/BGWA1d7a6rI/W2avestmBAAJ)
+application developers to switch from the U2F API to the WebAuthn API. This document describes how a Ruby application
+using the [u2f gem by Castle](https://github.com/castle/ruby-u2f) can migrate existing credentials so that their users
+do not experience interruption or need to re-register their security keys.
+
+Note that the migration is one-way: credentials registered using WebAuthn cannot be made compatible with the U2F API.
+It is recommended to successfully migrate authorization flows before migrating registration flows.
+
+## Migrate registered U2F credentials
+
+Assuming you have a registered credential per the u2f gem readme, base64 urlsafe encoded in a database:
+
+```ruby
+# This domain will be used in all code examples. It's a single-facet app but a multi-facet AppID
+# (e.g. https://example.com/app-id.json) will work as well.
+domain = URI("https://login.example.com")
+
+u2f_registration = U2F::U2F.new(domain.to_s).register!(u2f_challenge, u2f_register_response)
+# => #<U2F::Registration:0x00007fd62f43d688
+#  @certificate=
+#   "MIIBCzCBsgIBATAKBggqhkjOPQQDAjASMRAwDgYDVQQDDAdVMkZUZXN0MB4XDTE5MDUzMDE3MjIwM1oXDTIwMDUyOTE3MjIwM1owEjEQMA4GA1UEAwwHVTJGVGVzdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBMKpejumzlH6NxWIx2Ol+EManS9oX5nguG4RT43rZNkyn/zGjdJEhXksN5zT34rLZgFheBgkDGJCdtTPlhVK10wCgYIKoZIzj0EAwIDSAAwRQIhALYxFcROCeifWpv5+wNZIiaO/bGQg8rFBHCw3aHgehdZAiBJ3xFmQh7+Gjxt6CeAcY/k/VVAYu2vP4sUqXnCQFgJUA==",
+#  @key_handle="mbVMRTgzST5xLumckGztJ9VFW6veObfNIYWSn3sTqIY",
+#  @public_key="BOJQXlFg+ZfZKm48FNq2Ye5vSwOscE1i7YsGRSIjIe3GI0OXrSBDADDn0dQlz2iDzZ7LvCwiHz72U1qhVas3vus=">
+```
+
+The `U2fMigrator` class quacks like `WebAuthn::AuthenticatorAttestationResponse` and can be used similarly as documented
+in the [registration verification phase](https://github.com/cedarcode/webauthn-ruby/blob/master/README.md#verification-phase).
+Of course a `verify` instance method is not implemented, as there is no real interaction with an authenticator.
+
+The migrator can be used to convert credentials in real time during authentication while keeping them stored in the U2F
+format, and in a backfill task to store credentials in the new format, depending on how you are approaching your
+migration.
+
+```ruby
+require "webauthn/u2f_migrator"
+
+migrated_credential = WebAuthn::U2fMigrator.new(
+  app_id: domain,
+  certificate: u2f_registration.certificate,
+  key_handle: u2f_registration.key_handle,
+  public_key: u2f_registration.public_key,
+  counter: u2f_registration.counter
+)
+migrated_credential.credential.id
+# => "\x99\xB5LE83I>q.\xE9\x9C\x90l\xED'\xD5E[\xAB\xDE9\xB7\xCD!\x85\x92\x9F{\x13\xA8\x86"
+migrated_credential.credential.public_key
+# => "\xA5\x03& \x01!X \xE2P^Q`\xF9\x97\xD9*n<\x14\xDA\xB6a\xEEoK\x03\xACpMb\xED\x8B\x06E\"#!\xED\xC6\x01\x02\"X #C\x97\xAD C\x000\xE7\xD1\xD4%\xCFh\x83\xCD\x9E\xCB\xBC,\"\x1F>\xF6SZ\xA1U\xAB7\xBE\xEB"
+migrated_credential.authenticator_data.sign_count
+# => 41
+```
+
+## Authenticate migrated U2F credentials
+
+Following the documentation on the [authentication initiation](https://github.com/cedarcode/webauthn-ruby/blob/master/README.md#initiation-phase-1),
+you need to specify the [FIDO AppID extension](https://www.w3.org/TR/webauthn/#sctn-appid-extension) for U2F migratedq
+credentials. The WebAuthn standard explains:
+
+> The FIDO APIs use an alternative identifier for Relying Parties called an _AppID_, and any credentials created using
+> those APIs will be scoped to that identifier. Without this extension, they would need to be re-registered in order to
+> be scoped to an RP ID.
+
+For the earlier given example `domain` this means:
+- FIDO AppID: `https://login.example.com`
+- Valid RP IDs: `login.example.com` (default) and `example.com`
+
+You can request the use of the `appid` extension by setting the AppID in the configuration, like this:
+
+```ruby
+WebAuthn.configure do |config|
+  config.legacy_u2f_appid = "https://login.example.com"
+end
+```
+
+By doing this, the `appid` extension will be automatically requested when generating the options for get:
+
+```ruby
+options = WebAuthn::Credential.options_for_get
+```
+
+On the frontend, in the resolved value from `navigator.credentials.get({ "publicKey": credentialRequestOptions })` add
+a call to [getClientExtensionResults()](https://www.w3.org/TR/webauthn/#dom-publickeycredential-getclientextensionresults)
+and send its result to your backend alongside the `id`/`rawId` and `response` values. If the authenticator used the AppID
+extension, the returned value will contain `{ "appid": true }`.
+
+During authentication verification phase, if you followed the [verification phase documentation](https://github.com/cedarcode/webauthn-ruby#verification-phase-1) and have set the AppID in the config, the method `PublicKeyCredentialWithAssertion#verify` will be smart enough to determine if it should use the AppID or the RP ID to verify the WebAuthn credential, depending on the output of the `appid` client extension:
+
+> If true, the AppID was used and thus, when verifying an assertion, the Relying Party MUST expect the `rpIdHash` to be
+> the hash of the _AppID_, not the RP ID.

data/lib/webauthn/attestation_object.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "webauthn/cbor"
+require "forwardable"
+require "openssl"
+require "webauthn/attestation_statement"
+require "webauthn/authenticator_data"
+
+module WebAuthn
+  class AttestationObject
+    extend Forwardable
+
+    def self.deserialize(attestation_object, relying_party)
+      from_map(CBOR.decode(attestation_object), relying_party)
+    end
+
+    def self.from_map(map, relying_party)
+      new(
+        authenticator_data: WebAuthn::AuthenticatorData.deserialize(map["authData"]),
+        attestation_statement: WebAuthn::AttestationStatement.from(
+          map["fmt"],
+          map["attStmt"],
+          relying_party: relying_party
+        )
+      )
+    end
+
+    attr_reader :authenticator_data, :attestation_statement, :relying_party
+
+    def initialize(authenticator_data:, attestation_statement:)
+      @authenticator_data = authenticator_data
+      @attestation_statement = attestation_statement
+    end
+
+    def valid_attested_credential?
+      authenticator_data.attested_credential_data_included? &&
+        authenticator_data.attested_credential_data.valid?
+    end
+
+    def valid_attestation_statement?(client_data_hash)
+      attestation_statement.valid?(authenticator_data, client_data_hash)
+    end
+
+    def_delegators :authenticator_data, :credential, :aaguid
+    def_delegators :attestation_statement, :attestation_certificate_key_id
+  end
+end

data/lib/webauthn/attestation_statement/apple.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "webauthn/attestation_statement/base"
+
+module WebAuthn
+  module AttestationStatement
+    class Apple < Base
+      # Source: https://www.apple.com/certificateauthority/private/
+      ROOT_CERTIFICATE =
+        OpenSSL::X509::Certificate.new(<<~PEM)
+          -----BEGIN CERTIFICATE-----
+          MIICEjCCAZmgAwIBAgIQaB0BbHo84wIlpQGUKEdXcTAKBggqhkjOPQQDAzBLMR8w
+          HQYDVQQDDBZBcHBsZSBXZWJBdXRobiBSb290IENBMRMwEQYDVQQKDApBcHBsZSBJ
+          bmMuMRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTIwMDMxODE4MjEzMloXDTQ1MDMx
+          NTAwMDAwMFowSzEfMB0GA1UEAwwWQXBwbGUgV2ViQXV0aG4gUm9vdCBDQTETMBEG
+          A1UECgwKQXBwbGUgSW5jLjETMBEGA1UECAwKQ2FsaWZvcm5pYTB2MBAGByqGSM49
+          AgEGBSuBBAAiA2IABCJCQ2pTVhzjl4Wo6IhHtMSAzO2cv+H9DQKev3//fG59G11k
+          xu9eI0/7o6V5uShBpe1u6l6mS19S1FEh6yGljnZAJ+2GNP1mi/YK2kSXIuTHjxA/
+          pcoRf7XkOtO4o1qlcaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJtdk
+          2cV4wlpn0afeaxLQG2PxxtcwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2cA
+          MGQCMFrZ+9DsJ1PW9hfNdBywZDsWDbWFp28it1d/5w2RPkRX3Bbn/UbDTNLx7Jr3
+          jAGGiQIwHFj+dJZYUJR786osByBelJYsVZd2GbHQu209b5RCmGQ21gpSAk9QZW4B
+          1bWeT0vT
+          -----END CERTIFICATE-----
+        PEM
+
+      NONCE_EXTENSION_OID = "1.2.840.113635.100.8.2"
+
+      def valid?(authenticator_data, client_data_hash)
+        valid_nonce?(authenticator_data, client_data_hash) &&
+          matching_public_key?(authenticator_data) &&
+          trustworthy? &&
+          [attestation_type, attestation_trust_path]
+      end
+
+      private
+
+      def valid_nonce?(authenticator_data, client_data_hash)
+        extension = cred_cert&.find_extension(NONCE_EXTENSION_OID)
+
+        if extension
+          sequence = OpenSSL::ASN1.decode(extension.value_der)
+
+          sequence.tag == OpenSSL::ASN1::SEQUENCE &&
+            sequence.value.size == 1 &&
+            sequence.value[0].value[0].value ==
+              OpenSSL::Digest::SHA256.digest(authenticator_data.data + client_data_hash)
+        end
+      end
+
+      def attestation_type
+        WebAuthn::AttestationStatement::ATTESTATION_TYPE_ANONCA
+      end
+
+      def cred_cert
+        attestation_certificate
+      end
+
+      def default_root_certificates
+        [ROOT_CERTIFICATE]
+      end
+    end
+  end
+end

data/lib/webauthn/attestation_statement/base.rb

@@ -0,0 +1,175 @@
+# frozen_string_literal: true
+
+require "webauthn/cose"
+require "openssl"
+require "webauthn/authenticator_data/attested_credential_data"
+require "webauthn/error"
+
+module WebAuthn
+  module AttestationStatement
+    class UnsupportedAlgorithm < Error; end
+
+    ATTESTATION_TYPE_NONE = "None"
+    ATTESTATION_TYPE_BASIC = "Basic"
+    ATTESTATION_TYPE_SELF = "Self"
+    ATTESTATION_TYPE_ATTCA = "AttCA"
+    ATTESTATION_TYPE_BASIC_OR_ATTCA = "Basic_or_AttCA"
+    ATTESTATION_TYPE_ANONCA = "AnonCA"
+
+    ATTESTATION_TYPES_WITH_ROOT = [
+      ATTESTATION_TYPE_BASIC,
+      ATTESTATION_TYPE_BASIC_OR_ATTCA,
+      ATTESTATION_TYPE_ATTCA,
+      ATTESTATION_TYPE_ANONCA
+    ].freeze
+
+    class Base
+      AAGUID_EXTENSION_OID = "1.3.6.1.4.1.45724.1.1.4"
+
+      def initialize(statement, relying_party = WebAuthn.configuration.relying_party)
+        @statement = statement
+        @relying_party = relying_party
+      end
+
+      def valid?(_authenticator_data, _client_data_hash)
+        raise NotImplementedError
+      end
+
+      def format
+        WebAuthn::AttestationStatement::FORMAT_TO_CLASS.key(self.class)
+      end
+
+      def attestation_certificate
+        certificates&.first
+      end
+
+      def attestation_certificate_key_id
+        attestation_certificate.subject_key_identifier&.unpack1("H*")
+      end
+
+      private
+
+      attr_reader :statement, :relying_party
+
+      def matching_aaguid?(attested_credential_data_aaguid)
+        extension = attestation_certificate&.find_extension(AAGUID_EXTENSION_OID)
+        if extension
+          aaguid_value = OpenSSL::ASN1.decode(extension.value_der).value
+          aaguid_value == attested_credential_data_aaguid
+        else
+          true
+        end
+      end
+
+      def matching_public_key?(authenticator_data)
+        attestation_certificate.public_key.to_der == authenticator_data.credential.public_key_object.to_der
+      end
+
+      def certificates
+        @certificates ||=
+          raw_certificates&.map do |raw_certificate|
+            OpenSSL::X509::Certificate.new(raw_certificate)
+          end
+      end
+
+      def algorithm
+        statement["alg"]
+      end
+
+      def raw_certificates
+        statement["x5c"]
+      end
+
+      def signature
+        statement["sig"]
+      end
+
+      def attestation_trust_path
+        if certificates&.any?
+          certificates
+        end
+      end
+
+      def trustworthy?(aaguid: nil, attestation_certificate_key_id: nil)
+        if ATTESTATION_TYPES_WITH_ROOT.include?(attestation_type)
+          relying_party.acceptable_attestation_types.include?(attestation_type) &&
+            valid_certificate_chain?(aaguid: aaguid, attestation_certificate_key_id: attestation_certificate_key_id)
+        else
+          relying_party.acceptable_attestation_types.include?(attestation_type)
+        end
+      end
+
+      def valid_certificate_chain?(aaguid: nil, attestation_certificate_key_id: nil)
+        root_certificates = root_certificates(
+          aaguid: aaguid,
+          attestation_certificate_key_id: attestation_certificate_key_id
+        )
+
+        if certificates&.one? && root_certificates.include?(attestation_certificate)
+          return true
+        end
+
+        attestation_root_certificates_store(
+          aaguid: aaguid,
+          attestation_certificate_key_id: attestation_certificate_key_id
+        ).verify(attestation_certificate, attestation_trust_path)
+      end
+
+      def attestation_root_certificates_store(aaguid: nil, attestation_certificate_key_id: nil)
+        OpenSSL::X509::Store.new.tap do |store|
+          root_certificates(
+            aaguid: aaguid,
+            attestation_certificate_key_id: attestation_certificate_key_id
+          ).each do |cert|
+            store.add_cert(cert)
+          end
+        end
+      end
+
+      def root_certificates(aaguid: nil, attestation_certificate_key_id: nil)
+        root_certificates =
+          relying_party.attestation_root_certificates_finders.reduce([]) do |certs, finder|
+            if certs.empty?
+              finder.find(
+                attestation_format: format,
+                aaguid: aaguid,
+                attestation_certificate_key_id: attestation_certificate_key_id
+              ) || []
+            else
+              certs
+            end
+          end
+
+        if root_certificates.empty? && respond_to?(:default_root_certificates, true)
+          default_root_certificates
+        else
+          root_certificates
+        end
+      end
+
+      def valid_signature?(authenticator_data, client_data_hash, public_key = attestation_certificate.public_key)
+        raise("Incompatible algorithm and key") unless cose_algorithm.compatible_key?(public_key)
+
+        cose_algorithm.verify(
+          public_key,
+          signature,
+          verification_data(authenticator_data, client_data_hash)
+        )
+      rescue COSE::Error
+        false
+      end
+
+      def verification_data(authenticator_data, client_data_hash)
+        authenticator_data.data + client_data_hash
+      end
+
+      def cose_algorithm
+        @cose_algorithm ||=
+          COSE::Algorithm.find(algorithm).tap do |alg|
+            alg && relying_party.algorithms.include?(alg.name) ||
+              raise(UnsupportedAlgorithm, "Unsupported algorithm #{algorithm}")
+          end
+      end
+    end
+  end
+end

data/lib/webauthn/attestation_statement/fido_u2f/public_key.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "webauthn/cose"
+require "webauthn/attestation_statement/base"
+
+module WebAuthn
+  module AttestationStatement
+    class FidoU2f < Base
+      class PublicKey
+        COORDINATE_LENGTH = 32
+        UNCOMPRESSED_FORM_INDICATOR = "\x04"
+
+        def self.uncompressed_point?(data)
+          data.size &&
+            data.length == UNCOMPRESSED_FORM_INDICATOR.length + COORDINATE_LENGTH * 2 &&
+            data[0] == UNCOMPRESSED_FORM_INDICATOR
+        end
+
+        def initialize(data)
+          @data = data
+        end
+
+        def valid?
+          data.size >= COORDINATE_LENGTH * 2 &&
+            cose_key.x.length == COORDINATE_LENGTH &&
+            cose_key.y.length == COORDINATE_LENGTH &&
+            cose_key.alg == COSE::Algorithm.by_name("ES256").id
+        end
+
+        def to_uncompressed_point
+          UNCOMPRESSED_FORM_INDICATOR + cose_key.x + cose_key.y
+        end
+
+        private
+
+        attr_reader :data
+
+        def cose_key
+          @cose_key ||= COSE::Key::EC2.deserialize(data)
+        end
+      end
+    end
+  end
+end

data/lib/webauthn/attestation_statement/fido_u2f.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "webauthn/cose"
+require "openssl"
+require "webauthn/attestation_statement/base"
+require "webauthn/attestation_statement/fido_u2f/public_key"
+
+module WebAuthn
+  module AttestationStatement
+    class FidoU2f < Base
+      VALID_ATTESTATION_CERTIFICATE_COUNT = 1
+      VALID_ATTESTATION_CERTIFICATE_ALGORITHM = COSE::Algorithm.by_name("ES256")
+      VALID_ATTESTATION_CERTIFICATE_KEY_CURVE = COSE::Key::Curve.by_name("P-256")
+
+      def valid?(authenticator_data, client_data_hash)
+        valid_format? &&
+          valid_certificate_public_key? &&
+          valid_credential_public_key?(authenticator_data.credential.public_key) &&
+          valid_aaguid?(authenticator_data.attested_credential_data.raw_aaguid) &&
+          valid_signature?(authenticator_data, client_data_hash) &&
+          trustworthy?(attestation_certificate_key_id: attestation_certificate_key_id) &&
+          [attestation_type, attestation_trust_path]
+      end
+
+      private
+
+      def valid_format?
+        !!(raw_certificates && signature) &&
+          raw_certificates.length == VALID_ATTESTATION_CERTIFICATE_COUNT
+      end
+
+      def valid_certificate_public_key?
+        certificate_public_key.is_a?(OpenSSL::PKey::EC) &&
+          certificate_public_key.group.curve_name == VALID_ATTESTATION_CERTIFICATE_KEY_CURVE.pkey_name &&
+          certificate_public_key.check_key
+      end
+
+      def valid_credential_public_key?(public_key_bytes)
+        public_key_u2f(public_key_bytes).valid?
+      end
+
+      def certificate_public_key
+        attestation_certificate.public_key
+      end
+
+      def valid_aaguid?(attested_credential_data_aaguid)
+        attested_credential_data_aaguid == WebAuthn::AuthenticatorData::AttestedCredentialData::ZEROED_AAGUID
+      end
+
+      def algorithm
+        VALID_ATTESTATION_CERTIFICATE_ALGORITHM.id
+      end
+
+      def verification_data(authenticator_data, client_data_hash)
+        "\x00" +
+          authenticator_data.rp_id_hash +
+          client_data_hash +
+          authenticator_data.credential.id +
+          public_key_u2f(authenticator_data.credential.public_key).to_uncompressed_point
+      end
+
+      def public_key_u2f(cose_key_data)
+        PublicKey.new(cose_key_data)
+      end
+
+      def attestation_type
+        WebAuthn::AttestationStatement::ATTESTATION_TYPE_BASIC_OR_ATTCA
+      end
+    end
+  end
+end