webauthn 2.5.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e6487b19f172c0c7e96af23d04e47f91bebd2ef7d20f144f99f85e761a2db86
-  data.tar.gz: 7623405e7cd01708f29897a0d4183fbc8c9b2a3dfb06b9c182646ddaf9c6cb0d
+  metadata.gz: b133f46bd003c9bfb9a8557bb8caeca7239fcd6c185f78e74e0ae578444d576e
+  data.tar.gz: 14a32debc72ddcfe7e752118ebd4db832b8a46a5628ee54830f30eada4159bcf
 SHA512:
-  metadata.gz: d2f8d2137b2ee140a3258fbbff8d62e49264b2eafa80f0726dacc16a742addf75625b9da51696db6f3862a85e63f44ca5fc2b73320b1c256dd1c57f96121de24
-  data.tar.gz: dcb2ea914a14944b4bf7c4682394df12e00ddd4a4b0cc1076a03a7368bf4d563d08b61fbbe27ece3ddcbc05a9ed542d8236c1bfce833669c9b60c5d3387b35b4
+  metadata.gz: 9b4ff5cee18575b517473fef7d8000d7e41f113b178378e64a4d2b9036d248f4295edd846a519ab76036a270c3066020fbe44847019812c2a5758f2b1b428f4c
+  data.tar.gz: f3ab22709cbf537982e163acc60dbe114217f223b18cb4cf681a3d932e2f31276f8286091e49da392356c1958ada7e2c07a5b86b48d57b597f965a57c1bcf63d

data/.github/workflows/build.yml

@@ -16,19 +16,15 @@ jobs:
       fail-fast: false
       matrix:
         ruby:
+          - '3.2'
+          - '3.1'
           - '3.0'
           - '2.7'
           - '2.6'
           - '2.5'
-          - '2.4'
           - truffleruby
-        gemfile:
-          - openssl_2_2
-          - openssl_2_1
-    env:
-      BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby }}

data/.github/workflows/git.yml

@@ -0,0 +1,21 @@
+# Syntax reference:
+# https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions
+name: Git Checks
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  # Fixup commits are OK in pull requests, but should generally be squashed
+  # before merging to master, e.g. using `git rebase -i --autosquash master`.
+  # See https://github.com/marketplace/actions/block-autosquash-commits
+  block-fixup:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Block autosquash commits
+        uses: xt0rted/block-autosquash-commits-action@v2
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}

data/.rubocop.yml

@@ -7,7 +7,7 @@ inherit_mode:
     - AllowedNames
 
 AllCops:
-  TargetRubyVersion: 2.4
+  TargetRubyVersion: 2.5
   DisabledByDefault: true
   NewCops: disable
   Exclude:

data/CHANGELOG.md

@@ -1,11 +1,45 @@
 # Changelog
 
+## [v3.0.0] - 2023-02-15
+
+### Added
+
+- Add the capability of handling appid extension #319 [@santiagorodriguez96]
+- Add support for credential backup flags #378 [@santiagorodriguez96]
+- Update dependencies to make gem compatible with OpenSSL 3.1 ([@bdewater],[@santiagorodriguez96])
+
+## [v3.0.0.alpha2] - 2022-09-12
+
+### Added
+
+- Rebased support for multiple relying parties from v3.0.0.alpha1 on top of v2.5.2, the previous alpha version was based on v2.3.0 ([@bdewater])
+
+### BREAKING CHANGES
+
+- Bumped minimum required Ruby version to 2.5 ([@bdewater])
+
 ## [v3.0.0.alpha1] - 2020-06-27
 
 ### Added
 
 - Ability to define multiple relying parties with the introduction of the `WebAuthn::RelyingParty` class ([@padulafacundo], [@brauliomartinezlm])
 
+## [v2.5.2] - 2022-07-13
+
+### Added
+
+- Updated dependencies to make the gem compatible with openssl-3 [@ClearlyClaire]
+
+## [v2.5.1] - 2022-03-20
+
+### Added
+
+- Updated openssl support to be ~>2.2 [@bdewater]
+
+### Removed
+
+- Removed dependency [secure_compare dependency] (https://rubygems.org/gems/secure_compare/versions/0.0.1) and use OpenSSL#secure_compare instead [@bdewater]
+
 ## [v2.5.0] - 2021-03-14
 
 ### Added
@@ -324,7 +358,11 @@ Note: Both additions should help making it compatible with Chrome for Android 70
   - `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
 - Works with ruby 2.5
 
-[v3.0.0.alpha1]: https://github.com/cedarcode/webauthn-ruby/compare/2-stable...v3.0.0.alpha1/
+[v3.0.0]: https://github.com/cedarcode/webauthn-ruby/compare/2-stable...v3.0.0/
+[v3.0.0.alpha2]: https://github.com/cedarcode/webauthn-ruby/compare/2-stable...v3.0.0.alpha2/
+[v3.0.0.alpha1]: https://github.com/cedarcode/webauthn-ruby/compare/v2.3.0...v3.0.0.alpha1
+[v2.5.2]: https://github.com/cedarcode/webauthn-ruby/compare/v2.5.1...v2.5.2/
+[v2.5.1]: https://github.com/cedarcode/webauthn-ruby/compare/v2.5.0...v2.5.1/
 [v2.5.0]: https://github.com/cedarcode/webauthn-ruby/compare/v2.4.1...v2.5.0/
 [v2.4.1]: https://github.com/cedarcode/webauthn-ruby/compare/v2.4.0...v2.4.1/
 [v2.4.0]: https://github.com/cedarcode/webauthn-ruby/compare/v2.3.0...v2.4.0/
@@ -367,3 +405,6 @@ Note: Both additions should help making it compatible with Chrome for Android 70
 [@lgarron]: https://github.com/lgarron
 [@juanarias93]: https://github.com/juanarias93
 [@kingjan1999]: https://github.com/@kingjan1999
+[@jdongelmans]: https://github.com/jdongelmans
+[@petergoldstein]: https://github.com/petergoldstein
+[@ClearlyClaire]: https://github.com/ClearlyClaire

data/README.md

@@ -16,7 +16,7 @@ Makes your Ruby/Rails web server become a functional [WebAuthn Relying Party](ht
 
 Takes care of the [server-side operations](https://www.w3.org/TR/webauthn/#rp-operations) needed to
 [register](https://www.w3.org/TR/webauthn/#registration) or [authenticate](https://www.w3.org/TR/webauthn/#authentication)
-a user [credential](https://www.w3.org/TR/webauthn/#public-key-credential), including the necessary cryptographic checks.
+a user's [public key credential](https://www.w3.org/TR/webauthn/#public-key-credential) (also called a "passkey"), including the necessary cryptographic checks.
 
 ## Table of Contents
 
@@ -52,7 +52,7 @@ WebAuthn (Web Authentication) is a W3C standard for secure public-key authentica
 
 - WebAuthn [W3C Recommendation](https://www.w3.org/TR/webauthn/) (i.e. "The Standard")
 - [Web Authentication API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) in MDN
-- How to use [WebAuthn in Android apps](https://developers.google.com/identity/fido/android/native-apps)
+- How to use WebAuthn in native [Android](https://developers.google.com/identity/fido/android/native-apps) or [macOS/iOS/iPadOS](https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication) apps.
 - [Security Benefits for WebAuthn Servers (a.k.a Relying Parties)](https://www.w3.org/TR/webauthn/#sctn-rp-benefits)
 
 ## Prerequisites
@@ -89,13 +89,15 @@ Or install it yourself as:
 
 ## Usage
 
-You can find a working example on how to use this gem in a __Rails__ app in [webauthn-rails-demo-app](https://github.com/cedarcode/webauthn-rails-demo-app).
+You can find a working example on how to use this gem in a pasword-less login in a __Rails__ app in [webauthn-rails-demo-app](https://github.com/cedarcode/webauthn-rails-demo-app). If you want to see an example on how to use this gem as a second factor authenticator in a __Rails__ application instead, you can check it in [webauthn-2fa-rails-demo](https://github.com/cedarcode/webauthn-2fa-rails-demo).
 
 If you are migrating an existing application from the legacy FIDO U2F JavaScript API to WebAuthn, also refer to
 [`docs/u2f_migration.md`](docs/u2f_migration.md).
 
 ### Configuration
 
+If you have a multi-tenant application or just need to configure WebAuthn differently for separate parts of your application (e.g. if your users authenticate to different subdomains in the same application), we strongly recommend you look at this [Advanced Configuration](docs/advanced_configuration.md) section instead of this.
+
 For a Rails application this would go in `config/initializers/webauthn.rb`.
 
 ```ruby

data/docs/advanced_configuration.md

@@ -0,0 +1,174 @@
+# Advanced Configuration
+
+## Global vs Instance Based Configuration
+
+Which approach suits best your needs will depend on the architecture of your application and how do your users need to register and authenticate to it.
+
+If you have a multi-tenant application, or any application segmenation, where your users register and authenticate to each of these tenants or segments individuallly using different hostnames, or with different security needs, you need to go through [Instance Based Configuration](#instance-based-configuration).
+
+However, if your application is served for just one hostname, or else if your users authenticate to only one subdmain (e.g. your application serves www.example.com and admin.example.com but all you users authenticate through auth.example.com) you can still rely on one [Global Configuration](../README.md#configuration).
+
+If you are still not sure, or want to keep your options open, be aware that [Instance Based Configuration](#instance-based-configuration) is also a valid way of defining a single instance configuration and how you share such configuration across your application, it's up to you.
+
+
+## Instance Based Configuration
+
+Intead of the [Global Configuration](../README.md#configuration) you place in `config/initializers/webauthn.rb`,
+ you can now have an on-demand instance of `WebAuthn::RelyingParty` with the same configuration options, that
+ you can build anywhere in you application, in the following way:
+
+```ruby
+  relying_party = WebAuthn::RelyingParty.new(
+    # This value needs to match `window.location.origin` evaluated by
+    # the User Agent during registration and authentication ceremonies.
+    origin: "https://admin.example.com",
+
+    # Relying Party name for display purposes
+    name: "Admin Site for Example Inc."
+
+    # Optionally configure a client timeout hint, in milliseconds.
+    # This hint specifies how long the browser should wait for any
+    # interaction with the user.
+    # This hint may be overridden by the browser.
+    # https://www.w3.org/TR/webauthn/#dom-publickeycredentialcreationoptions-timeout
+    # credential_options_timeout: 120_000
+
+    # You can optionally specify a different Relying Party ID
+    # (https://www.w3.org/TR/webauthn/#relying-party-identifier)
+    # if it differs from the default one.
+    #
+    # In this case the default would be "admin.example.com", but you can set it to
+    # the suffix "example.com"
+    #
+    # id: "example.com"
+
+    # Configure preferred binary-to-text encoding scheme. This should match the encoding scheme
+    # used in your client-side (user agent) code before sending the credential to the server.
+    # Supported values: `:base64url` (default), `:base64` or `false` to disable all encoding.
+    #
+    # encoding: :base64url
+
+    # Possible values: "ES256", "ES384", "ES512", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512", "RS1"
+    # Default: ["ES256", "PS256", "RS256"]
+    #
+    # algorithms: ["ES384"]
+  )
+```
+
+## Instance Based API
+
+**DISCLAIMER: This API was released on version 3.0.0.alpha1 and is still under evaluation. Although it has been throughly tested and it is fully functional it might be changed until the final release of version 3.0.0.**
+
+The explanation for each ceremony can be found in depth in [Credential Registration](../README.md#credential-registration) and [Credential Authentication](../README.md#credential-authentication) but if you choose this instance based approach to define your WebAuthn configurations and assuming `relying_party` is the result of an instance you get through `WebAuthn::RelytingParty.new(...)` the code in those explanations needs to be updated to:
+
+### Credential Registration
+
+#### Initiation phase
+
+```ruby
+# Generate and store the WebAuthn User ID the first time the user registers a credential
+if !user.webauthn_id
+  user.update!(webauthn_id: WebAuthn.generate_user_id)
+end
+
+options = relying_party.options_for_registration(
+  user: { id: user.webauthn_id, name: user.name },
+  exclude: user.credentials.map { |c| c.webauthn_id }
+)
+
+# Store the newly generated challenge somewhere so you can have it
+# for the verification phase.
+session[:creation_challenge] = options.challenge
+
+# Send `options` back to the browser, so that they can be used
+# to call `navigator.credentials.create({ "publicKey": options })`
+#
+# You can call `options.as_json` to get a ruby hash with a JSON representation if needed.
+
+# If inside a Rails controller, `render json: options` will just work.
+# I.e. it will encode and convert the options to JSON automatically.
+
+# For your frontend code, you might find @github/webauthn-json npm package useful.
+# Especially for handling the necessary decoding of the options, and sending the
+# `PublicKeyCredential` object back to the server.
+```
+
+#### Verification phase
+
+```ruby
+# Assuming you're using @github/webauthn-json package to send the `PublicKeyCredential` object back
+# in params[:publicKeyCredential]:
+begin
+  webauthn_credential = relying_party.verify_registration(
+    params[:publicKeyCredential],
+    params[:create_challenge]
+  )
+
+  # Store Credential ID, Credential Public Key and Sign Count for future authentications
+  user.credentials.create!(
+    webauthn_id: webauthn_credential.id,
+    public_key: webauthn_credential.public_key,
+    sign_count: webauthn_credential.sign_count
+  )
+rescue WebAuthn::Error => e
+  # Handle error
+end
+```
+
+### Credential Authentication
+
+#### Initiation phase
+
+```ruby
+options = relying_party.options_for_get(allow: user.credentials.map { |c| c.webauthn_id })
+
+# Store the newly generated challenge somewhere so you can have it
+# for the verification phase.
+session[:authentication_challenge] = options.challenge
+
+# Send `options` back to the browser, so that they can be used
+# to call `navigator.credentials.get({ "publicKey": options })`
+
+# You can call `options.as_json` to get a ruby hash with a JSON representation if needed.
+
+# If inside a Rails controller, `render json: options` will just work.
+# I.e. it will encode and convert the options to JSON automatically.
+
+# For your frontend code, you might find @github/webauthn-json npm package useful.
+# Especially for handling the necessary decoding of the options, and sending the
+# `PublicKeyCredential` object back to the server.
+```
+
+#### Verification phase
+
+```ruby
+begin
+  # Assuming you're using @github/webauthn-json package to send the `PublicKeyCredential` object back
+  # in params[:publicKeyCredential]:
+  webauthn_credential, stored_credential = relying_party.verify_authentication(
+    params[:publicKeyCredential],
+    session[:authentication_challenge]
+  ) do
+    # the returned object needs to respond to #public_key and #sign_count
+    user.credentials.find_by(webauthn_id: webauthn_credential.id)
+  end
+
+  # Update the stored credential sign count with the value from `webauthn_credential.sign_count`
+  stored_credential.update!(sign_count: webauthn_credential.sign_count)
+
+  # Continue with successful sign in or 2FA verification...
+
+rescue WebAuthn::SignCountVerificationError => e
+  # Cryptographic verification of the authenticator data succeeded, but the signature counter was less then or equal
+  # to the stored value. This can have several reasons and depending on your risk tolerance you can choose to fail or
+  # pass authentication. For more information see https://www.w3.org/TR/webauthn/#sign-counter
+rescue WebAuthn::Error => e
+  # Handle error
+end
+```
+
+## Moving from Global to Instance Based Configuration
+
+Adding a configuration for a new instance does not mean you need to get rid of your Global configuration. They can co-exist in your application and be both available for the different usages you might have. `WebAuthn.configuration.relying_party` will always return the global one while `WebAuthn::RelyingParty.new`, executed anywhere in your codebase, will allow you to create a different instance as you see the need. They will not collide and instead operate in isolation without any shared state.
+
+The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is maintain globally at `WebAuthn.configuration.relying_party`.

data/docs/u2f_migration.md

@@ -53,7 +53,7 @@ migrated_credential.authenticator_data.sign_count
 
 ## Authenticate migrated U2F credentials
 
-Following the documentation on the [authentication initiation](https://github.com/cedarcode/webauthn-ruby/blob/master/README.md#authentication),
+Following the documentation on the [authentication initiation](https://github.com/cedarcode/webauthn-ruby/blob/master/README.md#initiation-phase-1),
 you need to specify the [FIDO AppID extension](https://www.w3.org/TR/webauthn/#sctn-appid-extension) for U2F migratedq
 credentials. The WebAuthn standard explains:
 
@@ -65,32 +65,26 @@ For the earlier given example `domain` this means:
 - FIDO AppID: `https://login.example.com`
 - Valid RP IDs: `login.example.com` (default) and `example.com`
 
+You can request the use of the `appid` extension by setting the AppID in the configuration, like this:
+
+```ruby
+WebAuthn.configure do |config|
+  config.legacy_u2f_appid = "https://login.example.com"
+end
+```
+
+By doing this, the `appid` extension will be automatically requested when generating the options for get:
+
 ```ruby
-credential_request_options = WebAuthn.credential_request_options
-credential_request_options[:extensions] = { appid: domain.to_s }
+options = WebAuthn::Credential.options_for_get
 ```
 
 On the frontend, in the resolved value from `navigator.credentials.get({ "publicKey": credentialRequestOptions })` add
 a call to [getClientExtensionResults()](https://www.w3.org/TR/webauthn/#dom-publickeycredential-getclientextensionresults)
 and send its result to your backend alongside the `id`/`rawId` and `response` values. If the authenticator used the AppID
-extension, the returned value will contain `{ "appid": true }`. In the example below, we use `clientExtensionResults`.
+extension, the returned value will contain `{ "appid": true }`.
 
-During authentication verification phase, you must pass either the original AppID or the RP ID as the `rp_id` argument:
+During authentication verification phase, if you followed the [verification phase documentation](https://github.com/cedarcode/webauthn-ruby#verification-phase-1) and have set the AppID in the config, the method `PublicKeyCredentialWithAssertion#verify` will be smart enough to determine if it should use the AppID or the RP ID to verify the WebAuthn credential, depending on the output of the `appid` client extension:
 
 > If true, the AppID was used and thus, when verifying an assertion, the Relying Party MUST expect the `rpIdHash` to be
 > the hash of the _AppID_, not the RP ID.
-
-```ruby
-assertion_response = WebAuthn::AuthenticatorAssertionResponse.new(
-  credential_id: params[:id],
-  authenticator_data: params[:response][:authenticatorData],
-  client_data_json: params[:response][:clientDataJSON],
-  signature: params[:response][:signature],
-)
-
-assertion_response.verify(
-  expected_challenge,
-  allowed_credentials: [credential],
-  rp_id: params[:clientExtensionResults][:appid] ? domain.to_s : domain.host,
-)
-```

data/lib/webauthn/attestation_object.rb

@@ -10,18 +10,22 @@ module WebAuthn
   class AttestationObject
     extend Forwardable
 
-    def self.deserialize(attestation_object)
-      from_map(CBOR.decode(attestation_object))
+    def self.deserialize(attestation_object, relying_party)
+      from_map(CBOR.decode(attestation_object), relying_party)
     end
 
-    def self.from_map(map)
+    def self.from_map(map, relying_party)
       new(
         authenticator_data: WebAuthn::AuthenticatorData.deserialize(map["authData"]),
-        attestation_statement: WebAuthn::AttestationStatement.from(map["fmt"], map["attStmt"])
+        attestation_statement: WebAuthn::AttestationStatement.from(
+          map["fmt"],
+          map["attStmt"],
+          relying_party: relying_party
+        )
       )
     end
 
-    attr_reader :authenticator_data, :attestation_statement
+    attr_reader :authenticator_data, :attestation_statement, :relying_party
 
     def initialize(authenticator_data:, attestation_statement:)
       @authenticator_data = authenticator_data

data/lib/webauthn/attestation_statement/apple.rb

@@ -37,10 +37,10 @@ module WebAuthn
       private
 
       def valid_nonce?(authenticator_data, client_data_hash)
-        extension = cred_cert&.extensions&.detect { |ext| ext.oid == NONCE_EXTENSION_OID }
+        extension = cred_cert&.find_extension(NONCE_EXTENSION_OID)
 
         if extension
-          sequence = OpenSSL::ASN1.decode(OpenSSL::ASN1.decode(extension.to_der).value[1].value)
+          sequence = OpenSSL::ASN1.decode(extension.value_der)
 
           sequence.tag == OpenSSL::ASN1::SEQUENCE &&
             sequence.value.size == 1 &&

data/lib/webauthn/attestation_statement/base.rb

@@ -28,8 +28,9 @@ module WebAuthn
     class Base
       AAGUID_EXTENSION_OID = "1.3.6.1.4.1.45724.1.1.4"
 
-      def initialize(statement)
+      def initialize(statement, relying_party = WebAuthn.configuration.relying_party)
         @statement = statement
+        @relying_party = relying_party
       end
 
       def valid?(_authenticator_data, _client_data_hash)
@@ -45,20 +46,18 @@ module WebAuthn
       end
 
       def attestation_certificate_key_id
-        raw_subject_key_identifier&.unpack("H*")&.[](0)
+        attestation_certificate.subject_key_identifier&.unpack("H*")&.[](0)
       end
 
       private
 
-      attr_reader :statement
+      attr_reader :statement, :relying_party
 
       def matching_aaguid?(attested_credential_data_aaguid)
-        extension = attestation_certificate&.extensions&.detect { |ext| ext.oid == AAGUID_EXTENSION_OID }
+        extension = attestation_certificate&.find_extension(AAGUID_EXTENSION_OID)
         if extension
-          # `extension.value` mangles data into ASCII, so we must manually compare bytes
-          # see https://github.com/ruby/openssl/pull/234
-          extension.to_der[-WebAuthn::AuthenticatorData::AttestedCredentialData::AAGUID_LENGTH..-1] ==
-            attested_credential_data_aaguid
+          aaguid_value = OpenSSL::ASN1.decode(extension.value_der).value
+          aaguid_value == attested_credential_data_aaguid
         else
           true
         end
@@ -95,10 +94,10 @@ module WebAuthn
 
       def trustworthy?(aaguid: nil, attestation_certificate_key_id: nil)
         if ATTESTATION_TYPES_WITH_ROOT.include?(attestation_type)
-          configuration.acceptable_attestation_types.include?(attestation_type) &&
+          relying_party.acceptable_attestation_types.include?(attestation_type) &&
             valid_certificate_chain?(aaguid: aaguid, attestation_certificate_key_id: attestation_certificate_key_id)
         else
-          configuration.acceptable_attestation_types.include?(attestation_type)
+          relying_party.acceptable_attestation_types.include?(attestation_type)
         end
       end
 
@@ -122,7 +121,7 @@ module WebAuthn
 
       def root_certificates(aaguid: nil, attestation_certificate_key_id: nil)
         root_certificates =
-          configuration.attestation_root_certificates_finders.reduce([]) do |certs, finder|
+          relying_party.attestation_root_certificates_finders.reduce([]) do |certs, finder|
             if certs.empty?
               finder.find(
                 attestation_format: format,
@@ -141,15 +140,6 @@ module WebAuthn
         end
       end
 
-      def raw_subject_key_identifier
-        extension = attestation_certificate.extensions.detect { |ext| ext.oid == "subjectKeyIdentifier" }
-        return unless extension
-
-        ext_asn1 = OpenSSL::ASN1.decode(extension.to_der)
-        ext_value = ext_asn1.value.last
-        OpenSSL::ASN1.decode(ext_value.value).value
-      end
-
       def valid_signature?(authenticator_data, client_data_hash, public_key = attestation_certificate.public_key)
         raise("Incompatible algorithm and key") unless cose_algorithm.compatible_key?(public_key)
 
@@ -169,14 +159,10 @@ module WebAuthn
       def cose_algorithm
         @cose_algorithm ||=
           COSE::Algorithm.find(algorithm).tap do |alg|
-            alg && configuration.algorithms.include?(alg.name) ||
+            alg && relying_party.algorithms.include?(alg.name) ||
               raise(UnsupportedAlgorithm, "Unsupported algorithm #{algorithm}")
           end
       end
-
-      def configuration
-        WebAuthn.configuration
-      end
     end
   end
 end

data/lib/webauthn/attestation_statement/packed.rb

@@ -46,7 +46,7 @@ module WebAuthn
 
           attestation_certificate.version == 2 &&
             subject.assoc('OU')&.at(1) == "Authenticator Attestation" &&
-            attestation_certificate.extensions.find { |ext| ext.oid == 'basicConstraints' }&.value == 'CA:FALSE'
+            attestation_certificate.find_extension('basicConstraints')&.value == 'CA:FALSE'
         else
           true
         end

data/lib/webauthn/attestation_statement/tpm.rb

@@ -42,7 +42,7 @@ module WebAuthn
             OpenSSL::Digest.digest(cose_algorithm.hash_function, certified_extra_data),
             signature_algorithm: tpm_algorithm[:signature],
             hash_algorithm: tpm_algorithm[:hash],
-            root_certificates: root_certificates(aaguid: aaguid)
+            trusted_certificates: root_certificates(aaguid: aaguid)
           )
 
         key_attestation.valid? && key_attestation.key && key_attestation.key.to_pem == key.to_pem
@@ -54,7 +54,7 @@ module WebAuthn
       end
 
       def default_root_certificates
-        ::TPM::KeyAttestation::ROOT_CERTIFICATES
+        ::TPM::KeyAttestation::TRUSTED_CERTIFICATES
       end
 
       def tpm_algorithm

data/lib/webauthn/attestation_statement.rb

@@ -31,11 +31,11 @@ module WebAuthn
       ATTESTATION_FORMAT_APPLE => WebAuthn::AttestationStatement::Apple
     }.freeze
 
-    def self.from(format, statement)
+    def self.from(format, statement, relying_party: WebAuthn.configuration.relying_party)
       klass = FORMAT_TO_CLASS[format]
 
       if klass
-        klass.new(statement)
+        klass.new(statement, relying_party)
       else
         raise(FormatNotSupportedError, "Unsupported attestation format '#{format}'")
       end

data/lib/webauthn/authenticator_assertion_response.rb

@@ -10,8 +10,8 @@ module WebAuthn
   class SignCountVerificationError < VerificationError; end
 
   class AuthenticatorAssertionResponse < AuthenticatorResponse
-    def self.from_client(response)
-      encoder = WebAuthn.configuration.encoder
+    def self.from_client(response, relying_party: WebAuthn.configuration.relying_party)
+      encoder = relying_party.encoder
 
       user_handle =
         if response["userHandle"]
@@ -22,7 +22,8 @@ module WebAuthn
         authenticator_data: encoder.decode(response["authenticatorData"]),
         client_data_json: encoder.decode(response["clientDataJSON"]),
         signature: encoder.decode(response["signature"]),
-        user_handle: user_handle
+        user_handle: user_handle,
+        relying_party: relying_party
       )
     end
 

data/lib/webauthn/authenticator_attestation_response.rb

@@ -18,12 +18,13 @@ module WebAuthn
   class AuthenticatorAttestationResponse < AuthenticatorResponse
     extend Forwardable
 
-    def self.from_client(response)
-      encoder = WebAuthn.configuration.encoder
+    def self.from_client(response, relying_party: WebAuthn.configuration.relying_party)
+      encoder = relying_party.encoder
 
       new(
         attestation_object: encoder.decode(response["attestationObject"]),
-        client_data_json: encoder.decode(response["clientDataJSON"])
+        client_data_json: encoder.decode(response["clientDataJSON"]),
+        relying_party: relying_party
       )
     end
 
@@ -33,13 +34,14 @@ module WebAuthn
       super(**options)
 
       @attestation_object_bytes = attestation_object
+      @relying_party = relying_party
     end
 
     def verify(expected_challenge, expected_origin = nil, user_verification: nil, rp_id: nil)
       super
 
       verify_item(:attested_credential)
-      if WebAuthn.configuration.verify_attestation_statement
+      if relying_party.verify_attestation_statement
         verify_item(:attestation_statement)
       end
 
@@ -47,7 +49,7 @@ module WebAuthn
     end
 
     def attestation_object
-      @attestation_object ||= WebAuthn::AttestationObject.deserialize(attestation_object_bytes)
+      @attestation_object ||= WebAuthn::AttestationObject.deserialize(attestation_object_bytes, relying_party)
     end
 
     def_delegators(
@@ -63,14 +65,15 @@ module WebAuthn
 
     private
 
-    attr_reader :attestation_object_bytes
+    attr_reader :attestation_object_bytes, :relying_party
 
     def type
       WebAuthn::TYPES[:create]
     end
 
     def valid_attested_credential?
-      attestation_object.valid_attested_credential?
+      attestation_object.valid_attested_credential? &&
+        relying_party.algorithms.include?(authenticator_data.credential.algorithm)
     end
 
     def valid_attestation_statement?