webauthn 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae88f2e29c3d4c734f5d7efec59b6dd3824a2976a10c5cb7bc03ff525d79852c
-  data.tar.gz: b62bcde957604db6eb660ccd515c66bdb894178a3e6173a783483a0ee0378ac2
+  metadata.gz: 8dd2e6fbccb0b180e0a36f4980939a1ba3a66d0cc744a7d50b140feb01917a35
+  data.tar.gz: 403281bfe63aa4ca9929bd0ca2e8cc9ff3af4ae66b21251f26118138fb355051
 SHA512:
-  metadata.gz: 6b40ec846092c70e19e79656325e24f1ed43231b911b37fe3fb9be20afbcd276b8d1e46f2e3bd719c92f0f031738f364581514db542c981028369ffbca28afe3
-  data.tar.gz: dd26ac18ca8db8ae98007a9f566e521a7d24998f244583099ff7f7bac4a8776d5ab2fa8f76fc2f2c8d7291d3119b21efcb422d46ee892dea6e83045c51b85878
+  metadata.gz: 4ab428637bed52191bdee14a96a9676df44019170ffab49862bc28e84c59202f3fb8302b36fd0bc29321608352712ea18cdecbe0311dfc02a167da1b2bf1d3b5
+  data.tar.gz: cb98ae9cbfbe66804e2bea396121da2874b667b6e25ee58790195dbfd2a6b6d936cca70e50d7b9d796f2af0928c164cbdd3093987a202171f19e365bbdefd6a1

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [v1.3.0] - 2018-10-11
+
+### Added
+
+- _Registration_ ceremony
+  - `WebAuthn::AuthenticatorAttestationResponse.valid?` supports `packed` attestation statements. Thank you @sorah!
+
 ## [v1.2.0] - 2018-10-08
 
 ### Added
@@ -71,6 +78,7 @@ Note: Both additions should help making it compatible with Chrome for Android 70
   - `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
 - Works with ruby 2.5
 
+[v1.3.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.2.0...v1.3.0/
 [v1.2.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.1.0...v1.2.0/
 [v1.1.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.0.0...v1.1.0/
 [v1.0.0]: https://github.com/cedarcode/webauthn-ruby/compare/v0.2.0...v1.0.0/

data/README.md

@@ -21,7 +21,7 @@ This gem will help your ruby server act as a conforming [_Relying-Party_](https:
 Currently supporting [Web Authentication API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API):
   - [Mozilla Firefox](https://www.mozilla.org/firefox/) 60+
   - [Google Chrome](https://www.google.com/chrome/) 67+
-  - Google Chrome 65 & 66 (Disabled by default, go to chrome://flags to enable Web Authentication API feature)
+  - [Google Chrome for Android Beta](https://play.google.com/store/apps/details?id=com.chrome.beta) 70+
 
 ### A conforming Authenticator
 

data/lib/webauthn/attestation_statement.rb

@@ -2,8 +2,11 @@
 
 module WebAuthn
   module AttestationStatement
+    class FormatNotSupportedError < StandardError; end
+
     ATTESTATION_FORMAT_NONE = "none"
     ATTESTATION_FORMAT_FIDO_U2F = "fido-u2f"
+    ATTESTATION_FORMAT_PACKED = 'packed'
 
     def self.from(format, statement)
       case format
@@ -13,8 +16,11 @@ module WebAuthn
       when ATTESTATION_FORMAT_FIDO_U2F
         require "webauthn/attestation_statement/fido_u2f"
         WebAuthn::AttestationStatement::FidoU2f.new(statement)
+      when ATTESTATION_FORMAT_PACKED
+        require "webauthn/attestation_statement/packed"
+        WebAuthn::AttestationStatement::Packed.new(statement)
       else
-        raise "Unsupported attestation format '#{attestation_format}'"
+        raise FormatNotSupportedError, "Unsupported attestation format '#{format}'"
       end
     end
   end

data/lib/webauthn/attestation_statement/base.rb

@@ -3,11 +3,13 @@
 module WebAuthn
   module AttestationStatement
     class Base
+      class NotSupportedError < StandardError; end
+
       def initialize(statement)
         @statement = statement
       end
 
-      def valid?(*_args)
+      def valid?(_authenticator_data, _client_data_hash)
         raise NotImpelementedError
       end
 

data/lib/webauthn/attestation_statement/packed.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "webauthn/attestation_statement/base"
+
+module WebAuthn
+  # Implements https://www.w3.org/TR/2018/CR-webauthn-20180807/#packed-attestation
+  # ECDAA attestation is unsupported.
+  module AttestationStatement
+    class Packed < Base
+      # Follows "Verification procedure"
+      def valid?(authenticator_data, client_data_hash)
+        check_unsupported_feature
+
+        valid_format? &&
+          valid_certificate_chain?(authenticator_data.credential) &&
+          meet_certificate_requirement? &&
+          valid_signature?(authenticator_data, client_data_hash)
+      end
+
+      private
+
+      def algorithm
+        statement["alg"]
+      end
+
+      def signature
+        statement["sig"]
+      end
+
+      def raw_attestation_certificates
+        statement["x5c"]
+      end
+
+      def raw_ecdaa_key_id
+        statement["ecdaaKeyId"]
+      end
+
+      def valid_format?
+        algorithm && signature && (
+          [raw_attestation_certificates, raw_ecdaa_key_id].compact.size < 2
+        )
+      end
+
+      def check_unsupported_feature
+        if raw_ecdaa_key_id
+          raise NotSupportedError, "ecdaaKeyId of the packed attestation format is not implemented yet"
+        end
+      end
+
+      def attestation_certificate_chain
+        @attestation_certificate_chain ||= raw_attestation_certificates&.map do |cert|
+          OpenSSL::X509::Certificate.new(cert)
+        end
+      end
+
+      def attestation_certificate
+        attestation_certificate_chain&.first
+      end
+
+      def valid_certificate_chain?(credential)
+        public_keys = attestation_certificate_chain&.map(&:public_key) || [credential.public_key_object]
+        public_keys.all? do |public_key|
+          public_key.is_a?(OpenSSL::PKey::EC) && public_key.check_key
+        end
+      end
+
+      # Check https://www.w3.org/TR/2018/CR-webauthn-20180807/#packed-attestation-cert-requirements
+      def meet_certificate_requirement?
+        return true unless attestation_certificate
+        subject = attestation_certificate.subject.to_a
+
+        attestation_certificate.version == 2 &&
+          subject.assoc('OU')&.at(1) == "Authenticator Attestation" &&
+          attestation_certificate.extensions.find { |ext| ext.oid == 'basicConstraints' }&.value == 'CA:FALSE'
+      end
+
+      def valid_signature?(authenticator_data, client_data_hash)
+        (attestation_certificate&.public_key || authenticator_data.credential.public_key_object).verify(
+          "SHA256",
+          signature,
+          verification_data(authenticator_data, client_data_hash)
+        )
+      end
+
+      def verification_data(authenticator_data, client_data_hash)
+        authenticator_data.data + client_data_hash
+      end
+    end
+  end
+end

data/lib/webauthn/authenticator_data/attested_credential_data.rb

@@ -12,7 +12,18 @@ module WebAuthn
       UINT16_BIG_ENDIAN_FORMAT = "n*"
 
       # FIXME: use keyword_init when we dropped Ruby 2.4 support
-      Credential = Struct.new(:id, :public_key)
+      Credential = Struct.new(:id, :public_key) do
+        def public_key_object
+          group = OpenSSL::PKey::EC::Group.new("prime256v1")
+          key = OpenSSL::PKey::EC.new(group)
+
+          bn = OpenSSL::BN.new(public_key, 2)
+          point = OpenSSL::PKey::EC::Point.new(group, bn)
+          key.public_key = point
+
+          key
+        end
+      end
 
       def initialize(data)
         @data = data

data/lib/webauthn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WebAuthn
-  VERSION = "1.2.0"
+  VERSION = "1.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: webauthn
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Gonzalo Rodriguez
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-10-08 00:00:00.000000000 Z
+date: 2018-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cbor
@@ -134,6 +134,7 @@ files:
 - lib/webauthn/attestation_statement/base.rb
 - lib/webauthn/attestation_statement/fido_u2f.rb
 - lib/webauthn/attestation_statement/none.rb
+- lib/webauthn/attestation_statement/packed.rb
 - lib/webauthn/authenticator_assertion_response.rb
 - lib/webauthn/authenticator_attestation_response.rb
 - lib/webauthn/authenticator_data.rb