webauthn 2.1.0 → 3.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. checksums.yaml +4 -4
  2. data/.github/dependabot.yml +6 -0
  3. data/.github/workflows/build.yml +50 -0
  4. data/.github/workflows/git.yml +21 -0
  5. data/.rubocop.yml +121 -13
  6. data/CHANGELOG.md +169 -0
  7. data/CONTRIBUTING.md +0 -5
  8. data/README.md +80 -14
  9. data/SECURITY.md +7 -4
  10. data/docs/advanced_configuration.md +174 -0
  11. data/docs/u2f_migration.md +14 -20
  12. data/lib/cose/rsapkcs1_algorithm.rb +50 -0
  13. data/lib/webauthn/attestation_object.rb +47 -0
  14. data/lib/webauthn/attestation_statement/android_key.rb +27 -33
  15. data/lib/webauthn/attestation_statement/android_safetynet.rb +27 -11
  16. data/lib/webauthn/attestation_statement/apple.rb +65 -0
  17. data/lib/webauthn/attestation_statement/base.rb +114 -21
  18. data/lib/webauthn/attestation_statement/fido_u2f.rb +8 -6
  19. data/lib/webauthn/attestation_statement/none.rb +7 -1
  20. data/lib/webauthn/attestation_statement/packed.rb +14 -42
  21. data/lib/webauthn/attestation_statement/tpm.rb +38 -75
  22. data/lib/webauthn/attestation_statement.rb +24 -21
  23. data/lib/webauthn/authenticator_assertion_response.rb +22 -11
  24. data/lib/webauthn/authenticator_attestation_response.rb +31 -92
  25. data/lib/webauthn/authenticator_data/attested_credential_data.rb +33 -49
  26. data/lib/webauthn/authenticator_data.rb +59 -51
  27. data/lib/webauthn/authenticator_response.rb +24 -11
  28. data/lib/webauthn/client_data.rb +4 -6
  29. data/lib/webauthn/configuration.rb +38 -40
  30. data/lib/webauthn/credential.rb +4 -4
  31. data/lib/webauthn/credential_creation_options.rb +2 -0
  32. data/lib/webauthn/credential_request_options.rb +2 -0
  33. data/lib/webauthn/encoder.rb +13 -4
  34. data/lib/webauthn/fake_authenticator/attestation_object.rb +25 -4
  35. data/lib/webauthn/fake_authenticator/authenticator_data.rb +25 -10
  36. data/lib/webauthn/fake_authenticator.rb +49 -8
  37. data/lib/webauthn/fake_client.rb +41 -8
  38. data/lib/webauthn/json_serializer.rb +45 -0
  39. data/lib/webauthn/public_key.rb +21 -2
  40. data/lib/webauthn/public_key_credential/creation_options.rb +3 -3
  41. data/lib/webauthn/public_key_credential/entity.rb +5 -28
  42. data/lib/webauthn/public_key_credential/options.rb +11 -32
  43. data/lib/webauthn/public_key_credential/request_options.rb +11 -1
  44. data/lib/webauthn/public_key_credential.rb +52 -8
  45. data/lib/webauthn/public_key_credential_with_assertion.rb +16 -2
  46. data/lib/webauthn/public_key_credential_with_attestation.rb +2 -2
  47. data/lib/webauthn/relying_party.rb +137 -0
  48. data/lib/webauthn/u2f_migrator.rb +8 -4
  49. data/lib/webauthn/version.rb +1 -1
  50. data/lib/webauthn.rb +1 -0
  51. data/webauthn.gemspec +15 -12
  52. metadata +56 -60
  53. data/.travis.yml +0 -36
  54. data/Appraisals +0 -17
  55. data/gemfiles/cose_head.gemfile +0 -7
  56. data/gemfiles/openssl_2_0.gemfile +0 -7
  57. data/gemfiles/openssl_2_1.gemfile +0 -7
  58. data/gemfiles/openssl_head.gemfile +0 -7
  59. data/lib/android_safetynet/attestation_response.rb +0 -116
  60. data/lib/cose/rsassa_algorithm.rb +0 -10
  61. data/lib/tpm/constants.rb +0 -44
  62. data/lib/tpm/s_attest/s_certify_info.rb +0 -14
  63. data/lib/tpm/s_attest.rb +0 -26
  64. data/lib/tpm/sized_buffer.rb +0 -13
  65. data/lib/tpm/t_public/s_ecc_parms.rb +0 -17
  66. data/lib/tpm/t_public/s_rsa_parms.rb +0 -17
  67. data/lib/tpm/t_public.rb +0 -32
  68. data/lib/webauthn/attestation_statement/android_key/authorization_list.rb +0 -39
  69. data/lib/webauthn/attestation_statement/android_key/key_description.rb +0 -37
  70. data/lib/webauthn/attestation_statement/tpm/cert_info.rb +0 -44
  71. data/lib/webauthn/attestation_statement/tpm/pub_area.rb +0 -85
  72. data/lib/webauthn/security_utils.rb +0 -20
  73. data/lib/webauthn/signature_verifier.rb +0 -77
data/lib/webauthn/signature_verifier.rb DELETED
@@ -1,77 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- require "cose"
4
- require "cose/rsassa_algorithm"
5
- require "openssl"
6
- require "webauthn/error"
7
-
8
- module WebAuthn
9
- class SignatureVerifier
10
- class UnsupportedAlgorithm < Error; end
11
-
12
- # This logic contained in this map constant is a candidate to be moved to cose gem domain
13
- KTY_MAP = {
14
- COSE::Key::EC2::KTY_EC2 => [OpenSSL::PKey::EC, OpenSSL::PKey::EC::Point],
15
- COSE::Key::RSA::KTY_RSA => [OpenSSL::PKey::RSA]
16
- }.freeze
17
-
18
- def initialize(algorithm, public_key)
19
- @algorithm = algorithm
20
- @public_key = public_key
21
-
22
- validate
23
- end
24
-
25
- def verify(signature, verification_data, rsa_pss_salt_length: :digest)
26
- if rsa_pss?
27
- public_key.verify_pss(cose_algorithm.hash_function, signature, verification_data,
28
- salt_length: rsa_pss_salt_length, mgf1_hash: cose_algorithm.hash_function)
29
- else
30
- public_key.verify(cose_algorithm.hash_function, signature, verification_data)
31
- end
32
- end
33
-
34
- private
35
-
36
- attr_reader :algorithm, :public_key
37
-
38
- def cose_algorithm
39
- case algorithm
40
- when COSE::Algorithm::Base
41
- algorithm
42
- else
43
- COSE::Algorithm.find(algorithm)
44
- end
45
- end
46
-
47
- # This logic is a candidate to be moved to cose gem domain
48
- def cose_key_type
49
- case cose_algorithm
50
- when COSE::Algorithm::ECDSA
51
- COSE::Key::EC2::KTY_EC2
52
- when COSE::Algorithm::RSAPSS, RSASSAAlgorithm
53
- COSE::Key::RSA::KTY_RSA
54
- else
55
- raise UnsupportedAlgorithm, "Unsupported algorithm #{algorithm}"
56
- end
57
- end
58
-
59
- def rsa_pss?
60
- cose_algorithm.name.start_with?("PS")
61
- end
62
-
63
- def validate
64
- if !cose_algorithm
65
- raise UnsupportedAlgorithm, "Unsupported algorithm #{algorithm}"
66
- elsif !supported_algorithms.include?(cose_algorithm.name)
67
- raise UnsupportedAlgorithm, "Unsupported algorithm #{algorithm}"
68
- elsif !KTY_MAP[cose_key_type].include?(public_key.class)
69
- raise("Incompatible algorithm and key")
70
- end
71
- end
72
-
73
- def supported_algorithms
74
- WebAuthn.configuration.algorithms
75
- end
76
- end
77
- end