webauthn 1.10.0 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64d44e8b2917b4301f669f4f736814ab42c27e3541d81404169aedcec18f64c3
-  data.tar.gz: aa138c35bdcceaf5d6971ae306c2fb3adb9c0be12ffae3ee2c2ebcb051787521
+  metadata.gz: 368f1cffa77727f2edab0c872a6e9414af8db2871edfbb3623f06273bb71f5ae
+  data.tar.gz: 4b21d7e5cd9ff589bb97f4264d0dbf7f3f04da53aa619893f88a1d831d7c2755
 SHA512:
-  metadata.gz: 18ce684f6613dd5d399ef413f3d9d0c8dae77e97ba8eaa7cafae0e785ce14cdaa5c852cb44ea1e41dc03a7a9cb78841f0038ad0e228f4579f0d904fdd90601fc
-  data.tar.gz: db18d834bbbe2870c8d05db904d4ae2852516b10a786e6c9f7b5b38ea3cbfde9c2cbc7fa9b27b4979e56af892e2fcf019f24821dcc03a13f93e9bf096f1eb198
+  metadata.gz: c88fb415b6141de835c2d1536f8e859b1ba1a146b1e9c13971cf8bb07478bda5efa9c6a85f69c06466b91984b7f00e14f0cf29229cf14bc10f70040659411586
+  data.tar.gz: f94c85b184e96399f71bc7c070b691160640a5de898e381cd23f4bddc2fce139a2c523172cc8aeb682715b66a038f1ad3ed7798893a645d31eef53268784dc08

data/.travis.yml

@@ -3,8 +3,8 @@ language: ruby
 cache: bundler
 rvm:
   - ruby-head
-  - 2.6.1
-  - 2.5.3
+  - 2.6.2
+  - 2.5.4
   - 2.4.5
   - 2.3.8
 matrix:

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [v1.11.0] - 2019-03-15
+
+### Added
+
+- `WebAuthn::AuthenticatorAttestationResponse#verify` supports `android-key` attestation statements. Thank you @bdewater!
+
+### Fixed
+
+- Verify matching AAGUID if needed when verifying `packed` attestation statements. Thank you @bdewater!
+
 ## [v1.10.0] - 2019-03-05
 
 ### Added
@@ -127,6 +137,7 @@ Note: Both additions should help making it compatible with Chrome for Android 70
   - `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
 - Works with ruby 2.5
 
+[v1.11.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.10.0...v1.11.0/
 [v1.10.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.9.0...v1.10.0/
 [v1.9.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.8.0...v1.9.0/
 [v1.8.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.7.0...v1.8.0/

data/README.md

@@ -7,10 +7,11 @@ Easily implement WebAuthn in your ruby/rails app
 
 ## What is WebAuthn?
 
-- [WebAuthn article with Google IO 2018 talk](https://developers.google.com/web/updates/2018/05/webauthn)
-- [Web Authentication API draft article by Mozilla](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API)
 - [WebAuthn W3C Recommendation](https://www.w3.org/TR/webauthn/)
-- [WebAuthn W3C Editor's Draft](https://w3c.github.io/webauthn/)
+- [WebAuthn intro by Yubico](https://www.yubico.com/webauthn/)
+- [WebAuthn in Wikipedia](https://en.wikipedia.org/wiki/WebAuthn)
+- [Web Authentication API in MDN](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API)
+- [WebAuthn article with Google IO 2018 talk](https://developers.google.com/web/updates/2018/05/webauthn)
 
 ## Prerequisites
 

data/lib/webauthn/attestation_statement.rb

@@ -10,6 +10,7 @@ module WebAuthn
     ATTESTATION_FORMAT_FIDO_U2F = "fido-u2f"
     ATTESTATION_FORMAT_PACKED = 'packed'
     ATTESTATION_FORMAT_ANDROID_SAFETYNET = "android-safetynet"
+    ATTESTATION_FORMAT_ANDROID_KEY = "android-key"
 
     ATTESTATION_TYPE_NONE = "None"
     ATTESTATION_TYPE_BASIC = "Basic"
@@ -32,6 +33,9 @@ module WebAuthn
       when ATTESTATION_FORMAT_ANDROID_SAFETYNET
         require "webauthn/attestation_statement/android_safetynet"
         WebAuthn::AttestationStatement::AndroidSafetynet.new(statement)
+      when ATTESTATION_FORMAT_ANDROID_KEY
+        require "webauthn/attestation_statement/android_key"
+        WebAuthn::AttestationStatement::AndroidKey.new(statement)
       else
         raise FormatNotSupportedError, "Unsupported attestation format '#{format}'"
       end

data/lib/webauthn/attestation_statement/android_key.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "webauthn/attestation_statement/base"
+
+module WebAuthn
+  module AttestationStatement
+    class AndroidKey < Base
+      EXTENSION_DATA_OID = "1.3.6.1.4.1.11129.2.1.17"
+
+      # https://developer.android.com/training/articles/security-key-attestation#certificate_schema
+      ATTESTATION_CHALLENGE_INDEX = 4
+      SOFTWARE_ENFORCED_INDEX = 6
+      TEE_ENFORCED_INDEX = 7
+      PURPOSE_TAG = 1
+      ALL_APPLICATIONS_TAG = 600
+      ORIGIN_TAG = 702
+
+      # https://android.googlesource.com/platform/hardware/libhardware/+/master/include/hardware/keymaster_defs.h
+      KM_ORIGIN_GENERATED = 0
+      KM_PURPOSE_SIGN = 2
+
+      def valid?(authenticator_data, client_data_hash)
+        valid_signature?(authenticator_data, client_data_hash) &&
+          matching_public_key?(authenticator_data) &&
+          valid_attestation_challenge?(client_data_hash) &&
+          all_applications_field_not_present? &&
+          valid_authorization_list_origin? &&
+          valid_authorization_list_purpose? &&
+          [WebAuthn::AttestationStatement::ATTESTATION_TYPE_BASIC, attestation_certificate_chain]
+      end
+
+      private
+
+      def valid_signature?(authenticator_data, client_data_hash)
+        attestation_certificate.public_key.verify(
+          OpenSSL::Digest::SHA256.new,
+          signature,
+          authenticator_data.data + client_data_hash
+        )
+      end
+
+      def matching_public_key?(authenticator_data)
+        attestation_certificate.public_key.to_der == authenticator_data.credential.public_key_object.to_der
+      end
+
+      def valid_attestation_challenge?(client_data_hash)
+        WebAuthn::SecurityUtils.secure_compare(key_description[ATTESTATION_CHALLENGE_INDEX].value, client_data_hash)
+      end
+
+      def all_applications_field_not_present?
+        tee_enforced.none? { |data| data.tag == ALL_APPLICATIONS_TAG } &&
+          software_enforced.none? { |data| data.tag == ALL_APPLICATIONS_TAG }
+      end
+
+      def valid_authorization_list_origin?
+        tee_enforced.detect { |data| data.tag == ORIGIN_TAG }&.value&.at(0)&.value == KM_ORIGIN_GENERATED ||
+          software_enforced.detect { |data| data.tag == ORIGIN_TAG }&.value&.at(0)&.value == KM_ORIGIN_GENERATED
+      end
+
+      def valid_authorization_list_purpose?
+        tee_enforced.detect { |data| data.tag == PURPOSE_TAG }&.value&.at(0)&.value&.at(0)&.value == KM_PURPOSE_SIGN ||
+          software_enforced.detect { |data| data.tag == PURPOSE_TAG }&.value&.at(0)&.value&.at(0)&.value ==
+            KM_PURPOSE_SIGN
+      end
+
+      def tee_enforced
+        key_description[SOFTWARE_ENFORCED_INDEX].value
+      end
+
+      def software_enforced
+        key_description[TEE_ENFORCED_INDEX].value
+      end
+
+      def key_description
+        @key_description ||= begin
+          extension_data = attestation_certificate.extensions.detect { |ext| ext.oid == EXTENSION_DATA_OID }
+          raw_key_description = OpenSSL::ASN1.decode(extension_data).value.last
+          OpenSSL::ASN1.decode(raw_key_description.value).value
+        end
+      end
+
+      def attestation_certificate
+        attestation_certificate_chain[0]
+      end
+
+      def attestation_certificate_chain
+        @attestation_certificate_chain ||= raw_attestation_certificates.map do |cert|
+          OpenSSL::X509::Certificate.new(cert)
+        end
+      end
+
+      def raw_attestation_certificates
+        statement["x5c"]
+      end
+
+      def signature
+        statement["sig"]
+      end
+    end
+  end
+end

data/lib/webauthn/attestation_statement/base.rb

@@ -7,6 +7,8 @@ module WebAuthn
     class Base
       class NotSupportedError < Error; end
 
+      AAGUID_EXTENSION_OID = "1.3.6.1.4.1.45724.1.1.4"
+
       def initialize(statement)
         @statement = statement
       end

data/lib/webauthn/attestation_statement/packed.rb

@@ -15,6 +15,7 @@ module WebAuthn
         valid_format? &&
           valid_certificate_chain?(authenticator_data.credential) &&
           meet_certificate_requirement? &&
+          matching_aaguid?(authenticator_data.attested_credential_data.aaguid) &&
           valid_signature?(authenticator_data, client_data_hash) &&
           attestation_type_and_trust_path
       end
@@ -79,6 +80,18 @@ module WebAuthn
         end
       end
 
+      def matching_aaguid?(attested_credential_data_aaguid)
+        extension = attestation_certificate&.extensions&.detect { |ext| ext.oid == AAGUID_EXTENSION_OID }
+        if extension
+          # `extension.value` mangles data into ASCII, so we must manually compare bytes
+          # see https://github.com/ruby/openssl/pull/234
+          extension.to_der[-WebAuthn::AuthenticatorData::AttestedCredentialData::AAGUID_LENGTH..-1] ==
+            attested_credential_data_aaguid
+        else
+          true
+        end
+      end
+
       def valid_signature?(authenticator_data, client_data_hash)
         (attestation_certificate&.public_key || authenticator_data.credential.public_key_object).verify(
           "SHA256",

data/lib/webauthn/authenticator_data/attested_credential_data.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "webauthn/authenticator_data/attested_credential_data/public_key_u2f"
+require "webauthn/authenticator_data/attested_credential_data/public_key"
 
 module WebAuthn
   class AuthenticatorData
@@ -33,6 +33,10 @@ module WebAuthn
         data.length >= AAGUID_LENGTH + ID_LENGTH_LENGTH && public_key.valid?
       end
 
+      def aaguid
+        data_at(0, AAGUID_LENGTH)
+      end
+
       def credential
         @credential ||=
           if id
@@ -57,7 +61,7 @@ module WebAuthn
       end
 
       def public_key
-        @public_key ||= PublicKeyU2f.new(data_at(public_key_position, public_key_length))
+        @public_key ||= PublicKey.new(data_at(public_key_position, public_key_length))
       end
 
       def id_position

data/lib/webauthn/authenticator_data/attested_credential_data/{public_key_u2f.rb → public_key.rb}

@@ -6,7 +6,7 @@ require "cose/key/ec2"
 module WebAuthn
   class AuthenticatorData
     class AttestedCredentialData
-      class PublicKeyU2f
+      class PublicKey
         COORDINATE_LENGTH = 32
 
         def initialize(data)
@@ -29,7 +29,7 @@ module WebAuthn
         attr_reader :data
 
         def cose_key
-          @cose_key ||= COSE::Key::EC2.from_cbor(data)
+          @cose_key ||= COSE::Key::EC2.deserialize(data)
         end
       end
     end

data/lib/webauthn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WebAuthn
-  VERSION = "1.10.0"
+  VERSION = "1.11.0"
 end

data/webauthn.gemspec

@@ -29,8 +29,8 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = ">= 2.3"
 
-  spec.add_dependency "cbor", "~> 0.5.9.2"
-  spec.add_dependency "cose", "~> 0.1.0"
+  spec.add_dependency "cbor", "~> 0.5.9"
+  spec.add_dependency "cose", "~> 0.4.1"
   spec.add_dependency "jwt", [">= 1.5", "< 3.0"]
   spec.add_dependency "openssl", "~> 2.0"
   spec.add_dependency "securecompare", "~> 1.0"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: webauthn
 version: !ruby/object:Gem::Version
-  version: 1.10.0
+  version: 1.11.0
 platform: ruby
 authors:
 - Gonzalo Rodriguez
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-03-05 00:00:00.000000000 Z
+date: 2019-03-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cbor
@@ -17,28 +17,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.9.2
+        version: 0.5.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.9.2
+        version: 0.5.9
 - !ruby/object:Gem::Dependency
   name: cose
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.4.1
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
@@ -185,6 +185,7 @@ files:
 - lib/cose/ecdsa.rb
 - lib/webauthn.rb
 - lib/webauthn/attestation_statement.rb
+- lib/webauthn/attestation_statement/android_key.rb
 - lib/webauthn/attestation_statement/android_safetynet.rb
 - lib/webauthn/attestation_statement/base.rb
 - lib/webauthn/attestation_statement/fido_u2f.rb
@@ -194,7 +195,7 @@ files:
 - lib/webauthn/authenticator_attestation_response.rb
 - lib/webauthn/authenticator_data.rb
 - lib/webauthn/authenticator_data/attested_credential_data.rb
-- lib/webauthn/authenticator_data/attested_credential_data/public_key_u2f.rb
+- lib/webauthn/authenticator_data/attested_credential_data/public_key.rb
 - lib/webauthn/authenticator_response.rb
 - lib/webauthn/client_data.rb
 - lib/webauthn/error.rb