webauthn-slim 3.4.3

data/lib/webauthn/credential_options.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module WebAuthn
+  class CredentialOptions
+    CHALLENGE_LENGTH = 32
+
+    def challenge
+      @challenge ||= SecureRandom.random_bytes(CHALLENGE_LENGTH)
+    end
+
+    def timeout
+      @timeout = WebAuthn.configuration.credential_options_timeout
+    end
+  end
+end

data/lib/webauthn/credential_request_options.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "webauthn/credential_options"
+
+module WebAuthn
+  def self.credential_request_options
+    warn(
+      "DEPRECATION WARNING: `WebAuthn.credential_request_options` is deprecated."\
+      " Please use `WebAuthn::Credential.options_for_get` instead."
+    )
+
+    CredentialRequestOptions.new.to_h
+  end
+
+  class CredentialRequestOptions < CredentialOptions
+    attr_accessor :allow_credentials, :extensions, :user_verification
+
+    def initialize(allow_credentials: [], extensions: nil, user_verification: nil)
+      super()
+
+      @allow_credentials = allow_credentials
+      @extensions = extensions
+      @user_verification = user_verification
+    end
+
+    def to_h
+      options = {
+        challenge: challenge,
+        timeout: timeout,
+        allowCredentials: allow_credentials
+      }
+
+      if extensions
+        options[:extensions] = extensions
+      end
+
+      if user_verification
+        options[:userVerification] = user_verification
+      end
+
+      options
+    end
+  end
+end

data/lib/webauthn/credential_rp_entity.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require "webauthn/credential_entity"
+
+module WebAuthn
+  class CredentialRPEntity < CredentialEntity
+  end
+end

data/lib/webauthn/credential_user_entity.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require "webauthn/credential_entity"
+
+module WebAuthn
+  class CredentialUserEntity < CredentialEntity
+    attr_reader :id, :display_name
+
+    def initialize(id:, display_name: nil, **keyword_arguments)
+      super(**keyword_arguments)
+
+      @id = id
+      @display_name = display_name || name
+    end
+  end
+end

data/lib/webauthn/encoder.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "webauthn/encoders"
+
+module WebAuthn
+  class Encoder
+    extend Forwardable
+
+    # https://www.w3.org/TR/webauthn-2/#base64url-encoding
+    STANDARD_ENCODING = :base64url
+
+    def_delegators :@encoder_klass, :encode, :decode
+
+    def initialize(encoding = STANDARD_ENCODING)
+      @encoder_klass = Encoders.lookup(encoding)
+    end
+  end
+end

data/lib/webauthn/encoders.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module WebAuthn
+  def self.standard_encoder
+    @standard_encoder ||= Encoders.lookup(Encoder::STANDARD_ENCODING)
+  end
+
+  module Encoders
+    class << self
+      def lookup(encoding)
+        case encoding
+        when :base64
+          Base64Encoder
+        when :base64url
+          Base64UrlEncoder
+        when nil, false
+          NullEncoder
+        else
+          raise "Unsupported or unknown encoding: #{encoding}"
+        end
+      end
+    end
+
+    class Base64Encoder
+      def self.encode(data)
+        [data].pack("m0") # Base64.strict_encode64(data)
+      end
+
+      def self.decode(data)
+        data.unpack1("m0") # Base64.strict_decode64(data)
+      end
+    end
+
+    class Base64UrlEncoder
+      def self.encode(data)
+        data = [data].pack("m0") # Base64.urlsafe_encode64(data, padding: false)
+        data.chomp!("==") or data.chomp!("=")
+        data.tr!("+/", "-_")
+        data
+      end
+
+      def self.decode(data)
+        if !data.end_with?("=") && data.length % 4 != 0 #  Base64.urlsafe_decode64(data)
+          data = data.ljust((data.length + 3) & ~3, "=")
+        end
+
+        data = data.tr("-_", "+/")
+        data.unpack1("m0")
+      end
+    end
+
+    class NullEncoder
+      def self.encode(data)
+        data
+      end
+
+      def self.decode(data)
+        data
+      end
+    end
+  end
+end

data/lib/webauthn/error.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module WebAuthn
+  class Error < StandardError; end
+end

data/lib/webauthn/fake_authenticator/attestation_object.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "webauthn/cbor"
+require "webauthn/fake_authenticator/authenticator_data"
+
+module WebAuthn
+  class FakeAuthenticator
+    class AttestationObject
+      def initialize(
+        client_data_hash:,
+        rp_id_hash:,
+        credential_id:,
+        credential_key:,
+        user_present: true,
+        user_verified: false,
+        backup_eligibility: false,
+        backup_state: false,
+        attested_credential_data: true,
+        sign_count: 0,
+        extensions: nil
+      )
+        @client_data_hash = client_data_hash
+        @rp_id_hash = rp_id_hash
+        @credential_id = credential_id
+        @credential_key = credential_key
+        @user_present = user_present
+        @user_verified = user_verified
+        @backup_eligibility = backup_eligibility
+        @backup_state = backup_state
+        @attested_credential_data = attested_credential_data
+        @sign_count = sign_count
+        @extensions = extensions
+      end
+
+      def serialize
+        CBOR.encode(
+          "fmt" => "none",
+          "attStmt" => {},
+          "authData" => authenticator_data.serialize
+        )
+      end
+
+      private
+
+      attr_reader(
+        :client_data_hash,
+        :rp_id_hash,
+        :credential_id,
+        :credential_key,
+        :user_present,
+        :user_verified,
+        :backup_eligibility,
+        :backup_state,
+        :attested_credential_data,
+        :sign_count,
+        :extensions
+      )
+
+      def authenticator_data
+        @authenticator_data ||=
+          begin
+            credential_data =
+              if attested_credential_data
+                { id: credential_id, public_key: credential_public_key }
+              end
+
+            AuthenticatorData.new(
+              rp_id_hash: rp_id_hash,
+              credential: credential_data,
+              user_present: user_present,
+              user_verified: user_verified,
+              backup_eligibility: backup_eligibility,
+              backup_state: backup_state,
+              sign_count: 0,
+              extensions: extensions
+            )
+          end
+      end
+
+      def credential_public_key
+        case credential_key
+        when OpenSSL::PKey::RSA, OpenSSL::PKey::EC
+          credential_key.public_key
+        when OpenSSL::PKey::PKey
+          OpenSSL::PKey.read(credential_key.public_to_der)
+        end
+      end
+    end
+  end
+end

data/lib/webauthn/fake_authenticator/authenticator_data.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+require "webauthn/cose"
+require "webauthn/cbor"
+require "securerandom"
+
+module WebAuthn
+  class FakeAuthenticator
+    class AuthenticatorData
+      AAGUID = SecureRandom.random_bytes(16)
+
+      attr_reader :sign_count
+
+      def initialize(
+        rp_id_hash:,
+        credential: {
+          id: SecureRandom.random_bytes(16),
+          public_key: OpenSSL::PKey::EC.generate("prime256v1").public_key
+        },
+        sign_count: 0,
+        user_present: true,
+        user_verified: !user_present,
+        backup_eligibility: false,
+        backup_state: false,
+        aaguid: AAGUID,
+        extensions: { "fakeExtension" => "fakeExtensionValue" }
+      )
+        @rp_id_hash = rp_id_hash
+        @credential = credential
+        @sign_count = sign_count
+        @user_present = user_present
+        @user_verified = user_verified
+        @backup_eligibility = backup_eligibility
+        @backup_state = backup_state
+        @aaguid = aaguid
+        @extensions = extensions
+      end
+
+      def serialize
+        rp_id_hash + flags + serialized_sign_count + attested_credential_data + extension_data
+      end
+
+      private
+
+      attr_reader :rp_id_hash,
+                  :credential,
+                  :user_present,
+                  :user_verified,
+                  :extensions,
+                  :backup_eligibility,
+                  :backup_state
+
+      def flags
+        [
+          [
+            bit(:user_present),
+            reserved_for_future_use_bit,
+            bit(:user_verified),
+            bit(:backup_eligibility),
+            bit(:backup_state),
+            reserved_for_future_use_bit,
+            attested_credential_data_included_bit,
+            extension_data_included_bit
+          ].join
+        ].pack("b*")
+      end
+
+      def serialized_sign_count
+        [sign_count].pack('L>')
+      end
+
+      def attested_credential_data
+        @attested_credential_data ||=
+          if credential
+            @aaguid +
+              [credential[:id].length].pack("n*") +
+              credential[:id] +
+              cose_credential_public_key
+          else
+            ""
+          end
+      end
+
+      def extension_data
+        if extensions
+          CBOR.encode(extensions)
+        else
+          ""
+        end
+      end
+
+      def bit(flag)
+        if context[flag]
+          "1"
+        else
+          "0"
+        end
+      end
+
+      def attested_credential_data_included_bit
+        if attested_credential_data.empty?
+          "0"
+        else
+          "1"
+        end
+      end
+
+      def extension_data_included_bit
+        if extension_data.empty?
+          "0"
+        else
+          "1"
+        end
+      end
+
+      def reserved_for_future_use_bit
+        "0"
+      end
+
+      def context
+        {
+          user_present: user_present,
+          user_verified: user_verified,
+          backup_eligibility: backup_eligibility,
+          backup_state: backup_state
+        }
+      end
+
+      def cose_credential_public_key
+        case credential[:public_key]
+        when OpenSSL::PKey::RSA
+          key = COSE::Key::RSA.from_pkey(credential[:public_key])
+          key.alg = -257
+        when OpenSSL::PKey::EC::Point
+          alg = {
+            COSE::Key::Curve.by_name("P-256").id => -7,
+            COSE::Key::Curve.by_name("P-384").id => -35,
+            COSE::Key::Curve.by_name("P-521").id => -36
+          }
+
+          key = COSE::Key::EC2.from_pkey(credential[:public_key])
+          key.alg = alg[key.crv]
+        when OpenSSL::PKey::PKey
+          key = COSE::Key::OKP.from_pkey(credential[:public_key])
+          key.alg = -8
+        end
+
+        key.serialize
+      end
+
+      def key_bytes(public_key)
+        public_key.to_bn.to_s(2)
+      end
+    end
+  end
+end

data/lib/webauthn/fake_authenticator.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+require "webauthn/cbor"
+require "openssl"
+require "securerandom"
+require "webauthn/fake_authenticator/attestation_object"
+require "webauthn/fake_authenticator/authenticator_data"
+
+module WebAuthn
+  class FakeAuthenticator
+    def initialize
+      @credentials = {}
+    end
+
+    def make_credential(
+      rp_id:,
+      client_data_hash:,
+      user_present: true,
+      user_verified: false,
+      backup_eligibility: false,
+      backup_state: false,
+      attested_credential_data: true,
+      algorithm: nil,
+      sign_count: nil,
+      extensions: nil
+    )
+      credential_id, credential_key, credential_sign_count = new_credential(algorithm)
+      sign_count ||= credential_sign_count
+
+      credentials[rp_id] ||= {}
+      credentials[rp_id][credential_id] = {
+        credential_key: credential_key,
+        sign_count: sign_count + 1
+      }
+
+      AttestationObject.new(
+        client_data_hash: client_data_hash,
+        rp_id_hash: hashed(rp_id),
+        credential_id: credential_id,
+        credential_key: credential_key,
+        user_present: user_present,
+        user_verified: user_verified,
+        backup_eligibility: backup_eligibility,
+        backup_state: backup_state,
+        attested_credential_data: attested_credential_data,
+        sign_count: sign_count,
+        extensions: extensions
+      ).serialize
+    end
+
+    def get_assertion(
+      rp_id:,
+      client_data_hash:,
+      user_present: true,
+      user_verified: false,
+      backup_eligibility: false,
+      backup_state: false,
+      aaguid: AuthenticatorData::AAGUID,
+      sign_count: nil,
+      extensions: nil,
+      allow_credentials: nil
+    )
+      credential_options = credentials[rp_id]
+
+      if credential_options
+        allow_credentials ||= credential_options.keys
+        credential_id = (credential_options.keys & allow_credentials).first
+        unless credential_id
+          raise "No matching credentials (allowed=#{allow_credentials}) " \
+                "found for RP #{rp_id} among credentials=#{credential_options}"
+        end
+
+        credential = credential_options[credential_id]
+        credential_key = credential[:credential_key]
+        credential_sign_count = credential[:sign_count]
+
+        authenticator_data = AuthenticatorData.new(
+          rp_id_hash: hashed(rp_id),
+          user_present: user_present,
+          user_verified: user_verified,
+          backup_eligibility: backup_eligibility,
+          backup_state: backup_state,
+          aaguid: aaguid,
+          credential: nil,
+          sign_count: sign_count || credential_sign_count,
+          extensions: extensions
+        ).serialize
+
+        signature_digest_algorithm =
+          case credential_key
+          when OpenSSL::PKey::RSA, OpenSSL::PKey::EC
+            'SHA256'
+          when OpenSSL::PKey::PKey
+            nil
+          end
+        signature = credential_key.sign(signature_digest_algorithm, authenticator_data + client_data_hash)
+        credential[:sign_count] += 1
+
+        {
+          credential_id: credential_id,
+          authenticator_data: authenticator_data,
+          signature: signature
+        }
+      else
+        raise "No credentials found for RP #{rp_id}"
+      end
+    end
+
+    private
+
+    attr_reader :credentials
+
+    def new_credential(algorithm)
+      algorithm ||= 'ES256'
+      credential_key =
+        case algorithm
+        when 'ES256'
+          OpenSSL::PKey::EC.generate('prime256v1')
+        when 'RS256'
+          OpenSSL::PKey::RSA.new(2048)
+        when 'EdDSA'
+          OpenSSL::PKey.generate_key("ED25519")
+        else
+          raise "Unsupported algorithm #{algorithm}"
+        end
+
+      [SecureRandom.random_bytes(16), credential_key, 0]
+    end
+
+    def hashed(target)
+      OpenSSL::Digest::SHA256.digest(target)
+    end
+  end
+end