webauthn 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: ff393d6958f8ac6c87687e9182713174b06c242e
-  data.tar.gz: 516c577085fd3cf07f2e52cb0f6055ba54dfcfa0
+SHA256:
+  metadata.gz: 25e0a04470e52f5f6640aacc66c9653792ea8b5dc9fc7639d6d876b0fdd8921a
+  data.tar.gz: 4291b2831b3cee590445af283f7979b98d0da02950e5ffd161f14aad9754b4e1
 SHA512:
-  metadata.gz: 14ce284002cc748da915fa332e3fd99085c58a1a09b8b7d1f2a0866b9c224fe1975351b05e1221f1f4c40336f13141b1a03dfec8d374d53036c0d1c197e55032
-  data.tar.gz: aeb41c15771cdd16bd2654fd3ef1380b34c88e5f060c71eede3246cdc3576ae794f5b84860715e98ff528337dfbca0887a13134a3d8b4421ae11bb6107577970
+  metadata.gz: 3681ac63ac7bab1629e23010e93641fc3f522ada0ee2b5259f933465bb3dd6b8bdfa4b726bb803759fbb452e137c6624bad4bd52b4e86c31f9fd789edde6537c
+  data.tar.gz: bf4aa5c49e3421b7f112de0ce638d0fe18465040ebf258e51b12c7d379ba624e2f72d3ad4400cf1f782e440a6605f60180622be8a01c74b3ab8658f16293152f

data/.rspec

@@ -1,3 +1,2 @@
 --format documentation
 --color
---require spec_helper

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [v1.6.0] - 2018-11-01
+
+### Added
+
+- `FakeAuthenticator` object is now exposed to help you test your WebAuthn implementation
+
 ## [v1.5.0] - 2018-10-23
 
 ### Added
@@ -91,6 +97,7 @@ Note: Both additions should help making it compatible with Chrome for Android 70
   - `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
 - Works with ruby 2.5
 
+[v1.6.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.5.0...v1.6.0/
 [v1.5.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.4.0...v1.5.0/
 [v1.4.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.3.0...v1.4.0/
 [v1.3.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.2.0...v1.3.0/

data/lib/webauthn/fake_authenticator.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+require "cbor"
+require "openssl"
+require "securerandom"
+
+module WebAuthn
+  class FakeAuthenticator
+    class Base
+      def initialize(challenge: fake_challenge, rp_id: "localhost", sign_count: 0, context: {})
+        @challenge = challenge
+        @rp_id = rp_id
+        @sign_count = sign_count
+        @context = context
+      end
+
+      def authenticator_data
+        @authenticator_data ||= rp_id_hash + raw_flags + raw_sign_count + attested_credential_data
+      end
+
+      def client_data_json
+        @client_data_json ||= { challenge: encode(challenge), origin: origin, type: type }.to_json
+      end
+
+      def credential_key
+        @credential_key ||= OpenSSL::PKey::EC.new("prime256v1").generate_key
+      end
+
+      def credential_id
+        @credential_id ||= SecureRandom.random_bytes(16)
+      end
+
+      def rp_id_hash
+        OpenSSL::Digest::SHA256.digest(rp_id)
+      end
+
+      private
+
+      attr_reader :challenge, :context, :rp_id
+
+      def raw_flags
+        ["#{bit(:user_present)}0#{bit(:user_verified)}000#{attested_credential_data_present_bit}0"].pack("b*")
+      end
+
+      def attested_credential_data_present_bit
+        if attested_credential_data.empty?
+          "0"
+        else
+          "1"
+        end
+      end
+
+      def attested_credential_data
+        ""
+      end
+
+      def raw_sign_count
+        [@sign_count].pack('L>')
+      end
+
+      def bit(flag)
+        if context[flag].nil? || context[flag]
+          "1"
+        else
+          "0"
+        end
+      end
+
+      def origin
+        @origin ||= context[:origin] || fake_origin
+      end
+
+      def encode(bytes)
+        Base64.urlsafe_encode64(bytes, padding: false)
+      end
+
+      def fake_challenge
+        SecureRandom.random_bytes(32)
+      end
+
+      def fake_origin
+        "http://localhost"
+      end
+    end
+
+    class Create < Base
+      def attestation_object
+        CBOR.encode(
+          "fmt" => "none",
+          "attStmt" => {},
+          "authData" => authenticator_data
+        )
+      end
+
+      private
+
+      def attested_credential_data
+        aaguid + [credential_id.length].pack("n*") + credential_id + cose_credential_public_key
+      end
+
+      def aaguid
+        @aaguid ||= SecureRandom.random_bytes(16)
+      end
+
+      def cose_credential_public_key
+        fake_cose_credential_key(
+          x_coordinate: key_bytes(credential_key.public_key)[1..32],
+          y_coordinate: key_bytes(credential_key.public_key)[33..64]
+        )
+      end
+
+      def type
+        "webauthn.create"
+      end
+
+      def fake_cose_credential_key(algorithm: nil, x_coordinate: nil, y_coordinate: nil)
+        kty_label = 1
+        alg_label = 3
+        crv_label = -1
+        x_label = -2
+        y_label = -3
+
+        kty_ec2 = 2
+        alg_es256 = -7
+        crv_p256 = 1
+
+        CBOR.encode(
+          kty_label => kty_ec2,
+          alg_label => algorithm || alg_es256,
+          crv_label => crv_p256,
+          x_label => x_coordinate || SecureRandom.random_bytes(32),
+          y_label => y_coordinate || SecureRandom.random_bytes(32)
+        )
+      end
+
+      def key_bytes(public_key)
+        public_key.to_bn.to_s(2)
+      end
+    end
+
+    class Get < Base
+      def signature
+        @signature ||= credential_key.sign(
+          "SHA256",
+          authenticator_data + OpenSSL::Digest::SHA256.digest(client_data_json)
+        )
+      end
+
+      private
+
+      def type
+        "webauthn.get"
+      end
+    end
+  end
+end

data/lib/webauthn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WebAuthn
-  VERSION = "1.5.0"
+  VERSION = "1.6.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: webauthn
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Gonzalo Rodriguez
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-10-23 00:00:00.000000000 Z
+date: 2018-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cbor
@@ -177,6 +177,7 @@ files:
 - lib/webauthn/authenticator_data/attested_credential_data/public_key_u2f.rb
 - lib/webauthn/authenticator_response.rb
 - lib/webauthn/client_data.rb
+- lib/webauthn/fake_authenticator.rb
 - lib/webauthn/version.rb
 - webauthn.gemspec
 homepage: https://github.com/cedarcode/webauthn-ruby
@@ -202,7 +203,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2.3
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: WebAuthn in ruby ― Ruby implementation of a WebAuthn Relying Party