@blamejs/pki 0.5.2 → 0.5.3

package/lib/webauthn-mds.js

@@ -27,6 +27,8 @@ var jose = require("./jose");
 var rfc3339 = require("./rfc3339");
 var constants = require("./constants");
 var pathValidate = require("./path-validate");
+var signScheme = require("./sign-scheme");
+var edwardsPoint = require("./edwards-point");
 var webcrypto = require("./webcrypto");
 var nodeCrypto = require("crypto");
 
@@ -34,17 +36,85 @@ var WebauthnError = frameworkError.WebauthnError;
 function _err(code, message, cause) { return new WebauthnError(code, message, cause); }
 var C = constants.LIMITS;
 
-// The JWS algorithms a metadata BLOB may be signed with, each with the key family it requires.
+// Which signature schemes each certificate key type may perform, keyed by the SPKI algorithm the
+// x5c leaf carries. Taking the scheme from the token and the key from the chain without checking
+// they agree is the JWS algorithm-confusion class, and the relation is not one-to-one: a
+// PKCS#1-encoded RSA key can do either RSA scheme, while an id-RSASSA-PSS key is restricted BY ITS
+// CERTIFICATE to RSASSA-PSS and must not verify an RS* signature (RFC 4055 sec. 1.2 / 3.1).
+//
+// The Edwards and ML-DSA rows exist because an X.509 SubjectPublicKeyInfo carries those keys
+// perfectly well -- RFC 8410 for Ed25519 / Ed448, RFC 9881 for ML-DSA -- so a JWS algorithm over
+// one is a conformant BLOB signature, not a theoretical one. `EdDSA` names a scheme without fixing
+// a curve (RFC 8037), so for that scheme the certificate decides which of the two it is; every
+// other row's algorithm fixes its own.
+var LEAF_SCHEMES_BY_SPKI_ALG = Object.assign(Object.create(null), {
+  ecPublicKey: { ECDSA: 1 },
+  rsaEncryption: { "RSASSA-PKCS1-v1_5": 1, "RSA-PSS": 1 },
+  rsassaPss: { "RSA-PSS": 1 },
+  Ed25519: { EdDSA: 1 },
+  Ed448: { EdDSA: 1 },
+  "id-ml-dsa-44": { "ML-DSA-44": 1 },
+  "id-ml-dsa-65": { "ML-DSA-65": 1 },
+  "id-ml-dsa-87": { "ML-DSA-87": 1 },
+});
+
+// The sign-scheme resolver's faults arrive as a bare kind; they keep webauthn/* codes here so a
+// BLOB whose leaf pins a hash this toolkit cannot read fails as a webauthn verdict, not a foreign one.
+function _schemeE(kind, message, cause) { return new WebauthnError("webauthn/" + kind, message, cause); }
+
+// The JWS algorithms a metadata BLOB may be signed with, each with the key family it requires and
+// the WebCrypto parameters that import an x5c leaf under it and verify with it.
+//
+// DERIVED, not declared. A second algorithm table maintained beside pki.jose's is how PS256 came
+// to verify as an ACME signature and be refused as a metadata BLOB signature: both tables were
+// correct on the day they were written and only one of them was extended. Deriving means the
+// question "which algorithms does this toolkit accept for a JWS?" has exactly one answer, and a
+// row added there reaches here without anybody remembering to copy it.
+//
+// The derivation is TOTAL over the registry -- every algorithm pki.jose verifies gets a row, and an
+// X.509 SubjectPublicKeyInfo can carry a key of every type in it. EC becomes ECDSA over the curve
+// the alg fixes; RSA with a salt length becomes RSASSA-PSS (RFC 7518 sec. 3.5) and without one
+// RSASSA-PKCS1-v1_5; OKP becomes EdDSA, whose curve the certificate supplies because the algorithm
+// does not name one; AKP becomes the ML-DSA parameter set the algorithm itself fixes.
+//
+// A row's import and verify parameters may therefore depend on the LEAF as well as the alg, which
+// is why they are resolved per-verification rather than frozen into the row: EdDSA over an Ed25519
+// certificate and EdDSA over an Ed448 certificate are the same JWS algorithm and two different
+// WebCrypto algorithms.
+//
 // Null-prototype: `alg` is attacker-supplied, and an inherited Object member would otherwise
 // resolve to a truthy non-row and read as a recognised algorithm.
-var BLOB_ALGS = Object.assign(Object.create(null), {
-  ES256: { family: "EC", hash: "SHA-256", imp: { name: "ECDSA", namedCurve: "P-256" }, ver: { name: "ECDSA", hash: "SHA-256" } },
-  ES384: { family: "EC", hash: "SHA-384", imp: { name: "ECDSA", namedCurve: "P-384" }, ver: { name: "ECDSA", hash: "SHA-384" } },
-  ES512: { family: "EC", hash: "SHA-512", imp: { name: "ECDSA", namedCurve: "P-521" }, ver: { name: "ECDSA", hash: "SHA-512" } },
-  RS256: { family: "RSA", hash: "SHA-256", imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, ver: { name: "RSASSA-PKCS1-v1_5" } },
-  RS384: { family: "RSA", hash: "SHA-384", imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, ver: { name: "RSASSA-PKCS1-v1_5" } },
-  RS512: { family: "RSA", hash: "SHA-512", imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, ver: { name: "RSASSA-PKCS1-v1_5" } },
-});
+function _deriveBlobAlgs() {
+  var out = Object.create(null);
+  jose.sigAlgs().forEach(function (row) {
+    if (row.kty === "EC") {
+      out[row.alg] = { scheme: "ECDSA", hash: row.hash,
+        imp: { name: "ECDSA", namedCurve: row.crv }, ver: { name: "ECDSA", hash: row.hash } };
+    } else if (row.kty === "RSA" && row.saltLength) {
+      out[row.alg] = { scheme: "RSA-PSS", hash: row.hash,
+        imp: { name: "RSA-PSS", hash: row.hash }, ver: { name: "RSA-PSS", saltLength: row.saltLength } };
+    } else if (row.kty === "RSA") {
+      out[row.alg] = { scheme: "RSASSA-PKCS1-v1_5", hash: row.hash,
+        imp: { name: "RSASSA-PKCS1-v1_5", hash: row.hash }, ver: { name: "RSASSA-PKCS1-v1_5" } };
+    } else if (row.kty === "OKP") {
+      // `fromLeaf` marks a row whose WebCrypto algorithm is the certificate's own key algorithm.
+      out[row.alg] = { scheme: "EdDSA", hash: null, fromLeaf: true };
+    } else if (row.kty === "AKP") {
+      out[row.alg] = { scheme: row.alg, hash: null, imp: { name: row.alg }, ver: { name: row.alg } };
+    }
+  });
+  return out;
+}
+var BLOB_ALGS = _deriveBlobAlgs();
+
+// The WebCrypto import and verify parameters for one verification. Fixed by the algorithm for every
+// scheme that names its own curve or parameter set; taken from the certificate for EdDSA, which
+// does not. The leaf has already been checked to permit this row's scheme, so its algorithm name is
+// one of the two the scheme covers.
+function _blobAlgParams(algRow, leafAlgName) {
+  if (!algRow.fromLeaf) return algRow;
+  return { scheme: algRow.scheme, hash: null, imp: { name: leafAlgName }, ver: { name: leafAlgName } };
+}
 
 // The status values that deny trust (MDS v3.0 sec. 3.1.4). An unknown status is IGNORED for the
 // gate and surfaced raw -- the specification requires that a verifier not fail on a status it does
@@ -78,6 +148,15 @@ function _isPlainObject(v) { return !!v && typeof v === "object" && !Array.isArr
 var _verifiedResults = new WeakSet();
 function isVerifiedResult(v) { return _isPlainObject(v) && _verifiedResults.has(v); }
 
+// Which catalogue each entry came OUT of. Knowing that a supplied catalogue is verified says
+// nothing about whether the entry being judged belongs to it, and a process may hold several: pair
+// an entry from catalogue A with catalogue B and B's statusPolicy and freshness decide about A's
+// status reports. B reading `latest-by-date` can then hand back anchors that A, reading `any`,
+// records as revoked -- and a stale A can be judged current because B is. Keyed on object identity,
+// for the same reason the provenance set is, and holding no strong reference to either side.
+var _entryOrigin = new WeakMap();
+function _isEntryOf(entry, metadata) { return _entryOrigin.get(entry) === metadata; }
+
 // Provenance alone is not enough: the verified catalogue is handed to the caller, and anything
 // holding a reference could rewrite `allowStale`, a status report, or an entry's registered roots
 // and the object would still pass the identity check. Freezing it means the catalogue that decides
@@ -122,7 +201,7 @@ function _assertLeafSigns(leaf) {
 // public key, so that pair -- not the issuer field, and not the certificate's bytes -- is what
 // decides. The DN comparison is the canonical one, so two spellings of one name still match.
 function _isAnchorItself(cert, anchor) {
-  return guard.name.dnEqual(cert.subject, anchor.subject) &&
+  return guard.name.dnEqual(cert.subject.rdns, anchor.subject.rdns, _err, "webauthn/bad-att-cert", "the anchor subject") &&
     cert.subjectPublicKeyInfo.bytes.equals(anchor.subjectPublicKeyInfo.bytes);
 }
 
@@ -135,6 +214,13 @@ function _isAnchorItself(cert, anchor) {
 // a hand-built object literal satisfies it too and then raises a raw TypeError from deep inside the
 // path validator, which is an untyped throw escaping a public verb.
 function _asCert(v, label) {
+  // A certificate arriving as BYTES arrives in whichever byte form the caller holds -- the same set
+  // every other byte argument in this namespace takes. A DataView or an ArrayBuffer over identical
+  // DER is the identical certificate, and refusing one of them makes the accepted set depend on how
+  // the caller happened to receive the file rather than on what it contains.
+  if (ArrayBuffer.isView(v) || v instanceof ArrayBuffer) {
+    v = guard.bytes.source(v, WebauthnError, "webauthn/bad-input", label);
+  }
   if (v && typeof v === "object" && !Buffer.isBuffer(v) && !(v instanceof Uint8Array) &&
       v.subject && v.subjectPublicKeyInfo && Buffer.isBuffer(v.subjectPublicKeyInfo.bytes) &&
       v.signatureAlgorithm && typeof v.signatureAlgorithm.oid === "string" &&
@@ -197,8 +283,12 @@ function _verifyMetadataBlob(blob, opts) {
   // length is its character count and a BLOB is ASCII base64url + dots, so it bounds the byte count.
   // A byte input is re-viewed through the shared guard, which is where the detached-backing-buffer
   // case is handled once, rather than re-derived here.
-  var raw = (Buffer.isBuffer(blob) || blob instanceof Uint8Array)
-    ? guard.bytes.view(blob, WebauthnError, "webauthn/bad-input", "the metadata BLOB") : null;
+  // Every byte form, not only the two a Buffer-shaped API thinks of. A BLOB is retrieved over the
+  // network, and the ordinary way to hold a fetched body is an ArrayBuffer -- so the form an
+  // operator most naturally arrives with was the one form this refused. `byteLength` is declared by
+  // an ArrayBuffer and by every view over one, so the ceiling below still bites before any copy.
+  var raw = (ArrayBuffer.isView(blob) || blob instanceof ArrayBuffer)
+    ? guard.bytes.source(blob, WebauthnError, "webauthn/bad-input", "the metadata BLOB") : null;
   // A string's `.length` counts UTF-16 code units, not the UTF-8 bytes the conversion produces, so
   // measuring it would let a string of multi-byte characters sit under the ceiling and then expand
   // several-fold past it during the copy -- the allocation the ceiling exists to prevent.
@@ -308,19 +398,46 @@ function _verifyMetadataBlob(blob, opts) {
   // -- and the path validation that follows checks the CHAIN, not the target's application-level
   // usage, so nothing else catches it. An absent keyUsage places no restriction, per that section.
   _assertLeafSigns(leaf);
-  // The alg names a signature scheme; the leaf key must be of the family that scheme uses. Taking
-  // the scheme from the token and the key from the chain without checking they agree is the JWS
-  // algorithm-confusion class.
+  // The alg names a signature scheme; the leaf key must be permitted to perform it.
   var leafAlg = (leaf.subjectPublicKeyInfo.algorithm || {}).name;
-  var leafFamily = leafAlg === "ecPublicKey" ? "EC" : (leafAlg === "rsaEncryption" ? "RSA" : null);
-  if (leafFamily !== algRow.family) {
+  var leafSchemes = typeof leafAlg === "string" ? LEAF_SCHEMES_BY_SPKI_ALG[leafAlg] : undefined;
+  if (!leafSchemes || !leafSchemes[algRow.scheme]) {
     throw _err("webauthn/unsupported-algorithm", "the metadata BLOB alg " + header.alg + " does not match the x5c leaf key type " + JSON.stringify(leafAlg));
   }
+  // An id-RSASSA-PSS certificate MAY narrow the key further, to one hash (RFC 4055 sec. 1.2). The
+  // restriction is the certificate's, so it outranks the alg: a key issued for SHA-256 must not
+  // verify a PS512 signature just because the header asked for one.
+  if (leafAlg === "rsassaPss") {
+    var pinnedHash = signScheme.pssSpkiPinnedHash(leaf, _schemeE);
+    if (pinnedHash && pinnedHash !== algRow.hash) {
+      throw _err("webauthn/unsupported-algorithm", "the metadata BLOB alg " + header.alg + " uses " + algRow.hash + ", but the x5c leaf key is restricted to " + pinnedHash);
+    }
+  }
 
+  // An Edwards leaf key is validated on-curve and full-order BEFORE it is imported. The identity
+  // point and the other low-order points are accepted by the platform and verify a trivial
+  // signature over ANY message, so a leaf carrying one authenticates whatever payload it is shown.
+  // Chaining to the caller's FIDO root is not protection here: the point is malformed, not
+  // unissued, and the certificate that carries it can be perfectly well signed. This is the same
+  // gate every other Edwards key in the toolkit passes -- the attestation path, CMS, the path
+  // validator, sigstore, JOSE -- and a new verification route skipping it is how one key type comes
+  // to be checked everywhere except the newest door.
+  if (leafAlg === "Ed25519" || leafAlg === "Ed448") {
+    edwardsPoint.validateSpki(leaf.subjectPublicKeyInfo.bytes, leafAlg === "Ed25519" ? 6 : 7,
+      WebauthnError, "webauthn/bad-att-cert");
+  }
+  var params = _blobAlgParams(algRow, leafAlg);
   var signingInput = Buffer.from(segs[0] + "." + segs[1], "ascii");
-  return webcrypto.webcrypto.subtle.importKey("spki", leaf.subjectPublicKeyInfo.bytes, algRow.imp, false, ["verify"])
-    .then(function (key) { return webcrypto.webcrypto.subtle.verify(algRow.ver, key, sig, signingInput); },
-      function (e) { throw _err("webauthn/unsupported-algorithm", "the metadata BLOB x5c leaf key could not be imported for " + header.alg, e); })
+  return webcrypto.webcrypto.subtle.importKey("spki", leaf.subjectPublicKeyInfo.bytes, params.imp, false, ["verify"])
+    .then(function (key) {
+      // The VERIFY is wrapped as well as the import. A rejection handler attached to the import
+      // alone leaves anything the verify itself rejects with -- a certificate whose RSASSA-PSS
+      // parameters demand a longer salt than the algorithm supplies imports cleanly and then fails
+      // inside OpenSSL -- to escape as a raw platform Error, out of a verb whose whole contract is
+      // that every failure is a typed webauthn/* verdict.
+      return webcrypto.webcrypto.subtle.verify(params.ver, key, sig, signingInput)
+        .catch(function (e) { throw _err("webauthn/verify-error", "the metadata BLOB signature could not be evaluated under its x5c leaf key", e); });
+    }, function (e) { throw _err("webauthn/unsupported-algorithm", "the metadata BLOB x5c leaf key could not be imported for " + header.alg, e); })
     .then(function (ok) {
       if (!ok) throw _err("webauthn/verify-failed", "the metadata BLOB signature does not verify under its x5c leaf key");
       return _chainToAnchor(chain, anchors, at);
@@ -336,8 +453,17 @@ function _verifyMetadataBlob(blob, opts) {
 // The x5c chain must validate to one of the caller's anchors. Every anchor is tried because an
 // operator may hold several across a rotation; the last path verdict is threaded as the cause so a
 // caller can see WHY it did not chain rather than only that it did not.
-function _chainToAnchor(chain, anchors, at, what) {
+//
+// `what` and `code` name the caller's subject and its own refusal code, so every chain in the
+// namespace -- the BLOB's, an attestation's, an android-safetynet service chain -- reaches its
+// anchors through THIS walk while keeping the verdict its own callers already handle. A second copy
+// of the walk is not merely duplication: the anchor-stripping rule is subtle (a terminal
+// certificate that IS the anchor is identified by subject name AND public key, which is what
+// recognises a cross-signed root), and a copy that got it slightly differently would refuse a valid
+// chain in one place and accept a self-validated one in another.
+function _chainToAnchor(chain, anchors, at, what, code) {
   var subject = what || "metadata BLOB certificate chain";
+  var faultCode = code || "webauthn/metadata-untrusted";
   var ordered = chain.slice().reverse();   // path.validate takes anchor-adjacent first
   var lastFault = null;
   return anchors.reduce(function (p, anchor) {
@@ -375,7 +501,7 @@ function _chainToAnchor(chain, anchors, at, what) {
     });
   }, Promise.resolve(false)).then(function (trusted) {
     if (!trusted) {
-      throw _err("webauthn/metadata-untrusted", "the " + subject + " does not validate to any of the roots it must reach", lastFault);
+      throw _err(faultCode, "the " + subject + " does not validate to any of the roots it must reach", lastFault);
     }
   });
 }
@@ -538,8 +664,15 @@ function _parsePayload(seg, at, opts) {
     });
     return out;
   });
+  // The rollback rule leaves a trace, exactly as the freshness rule does either side of it. It runs
+  // only when a caller supplies the sequence number it already holds, so a result that does not say
+  // whether it ran cannot be told apart from one where the check was skipped -- and the whole point
+  // of the rule is that a caller can show its catalogue never went backwards. `previousNo` is the
+  // baseline it was compared against, so the claim is auditable rather than merely asserted.
   var result = { no: payload.no, legalHeader: payload.legalHeader, nextUpdate: payload.nextUpdate,
     stale: stale, allowStale: opts.allowStale === true,
+    rollbackChecked: opts.previousNo !== undefined,
+    previousNo: opts.previousNo === undefined ? null : opts.previousNo,
     entries: entries, byAaguid: byAaguid, byKeyIdentifier: byKeyIdentifier,
     statusPolicy: opts.statusPolicy || "any", rejectUnknownStatus: opts.rejectUnknownStatus === true };
   // Frozen FIRST, then recorded as verified: the mark means "this exact catalogue passed the
@@ -547,6 +680,9 @@ function _parsePayload(seg, at, opts) {
   // be edited afterwards. This is the only place a catalogue can have been through those gates.
   _deepFreeze(result, 0);
   _verifiedResults.add(result);
+  // Recorded AFTER the freeze, alongside the provenance mark and for the same reason: an entry may
+  // only be judged against the catalogue it was read out of.
+  entries.forEach(function (e) { _entryOrigin.set(e, result); });
   return result;
 }
 
@@ -570,12 +706,55 @@ function metadataFor(metadata, identifier) {
   return null;
 }
 
+// The options metadataAnchors recognises. Null-prototype for the same reason every other
+// caller-keyed table in this namespace is: a supplied key must not resolve to an inherited member.
+var _ANCHOR_OPTS = Object.assign(Object.create(null), { metadata: 1, time: 1, certificate: 1 });
+
 // The attestation root certificates an entry's authenticator chains to, decoded on demand. Decoding
 // is deliberately per entry rather than for the whole BLOB: a handful of the certificates in the
 // live metadata do not parse under a strict decoder, and decoding everything up front would let one
 // vendor's malformed root refuse the entire BLOB for every authenticator in it.
-function metadataAnchors(entry) {
+function metadataAnchors(entry, opts) {
   if (!entry || typeof entry !== "object") throw _err("webauthn/bad-input", "metadataAnchors expects a metadata entry");
+  opts = opts || {};
+  if (typeof opts !== "object" || Array.isArray(opts)) throw _err("webauthn/bad-input", "metadataAnchors opts must be an object");
+  guard.identifier.assertKnownKeys(opts, _ANCHOR_OPTS, _err, "webauthn/bad-input", "metadataAnchors opts has an unknown key ");
+  // ONE read of the caller's object: the status gate below decides on these values, and a value
+  // read twice is a value that can differ between the check and the use.
+  opts = Object.assign({}, opts);
+  if (opts.time !== undefined) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
+  // Provenance, the same rule metadataFor applies: only a catalogue this module actually verified
+  // may govern which anchors are handed out. Accepting any object carrying a `statusPolicy` would
+  // let a caller supply a predicate that denies nothing and defeat the gate on the next line --
+  // and the gate's whole purpose is that a disqualified model registers no anchors.
+  if (opts.metadata !== undefined) {
+    if (!isVerifiedResult(opts.metadata)) {
+      throw _err("webauthn/bad-input", "metadataAnchors opts.metadata expects a verifyMetadataBlob result -- an object that merely resembles one has not been through the signature and chain checks");
+    }
+    // ...and the entry must be one of THAT catalogue's. Verified provenance says the supplied
+    // catalogue is real; it does not say this entry came from it, and a process holding two would
+    // otherwise judge one catalogue's status reports under the other's policy and freshness.
+    if (!_isEntryOf(entry, opts.metadata)) {
+      throw _err("webauthn/bad-input", "metadataAnchors was given an entry from a different catalogue than opts.metadata, so the status reports would be judged under a policy and freshness that are not theirs");
+    }
+  }
+  // A model whose status reports deny trust has no anchors to offer. This is the ROUTE an operator
+  // follows to anchor an attestation themselves -- metadataFor, then these anchors, then
+  // pki.path.validate -- and nothing along it consulted the status reports, so a REVOKED
+  // authenticator's registered roots were handed over and the path validated against them. The
+  // catalogue's whole purpose is to say which models are still trusted; handing out the roots of
+  // one it has disqualified is answering a different question than the caller asked.
+  //
+  // Judged with the same inputs the attestation path uses, so the two readings cannot diverge: the
+  // caller's own statusPolicy when the verified result is supplied, the instant being judged, and
+  // the attestation certificate actually presented (so a report naming a single certificate is
+  // judged against that one rather than denying every device the entry covers). With none of them,
+  // the strictest reading applies -- any disqualifying report, judged now.
+  var at = opts.time === undefined ? new Date() : opts.time;
+  if (opts.metadata !== undefined) assertFresh(opts.metadata, at, "metadataAnchors");
+  if (statusDenied(entry, opts.metadata, opts.certificate, at)) {
+    throw _err("webauthn/metadata-status", "the metadata entry for this authenticator carries a disqualifying status report, so it registers no anchors to trust");
+  }
   var st = entry.metadataStatement;
   var list = st && Array.isArray(st.attestationRootCertificates) ? st.attestationRootCertificates : [];
   if (list.length > C.MDS_MAX_ANCHORS_PER_ENTRY) {
@@ -750,4 +929,9 @@ module.exports = {
   ZERO_AAGUID: ZERO_AAGUID,
   certKeyIdentifier: certKeyIdentifier,
   DISQUALIFYING: DISQUALIFYING,
+  // @internal -- the derived JWS algorithm table, exposed so a conformance vector can assert the
+  // derivation is TOTAL over pki.jose's registry: every algorithm the toolkit verifies has a row
+  // here, carrying the WebCrypto parameters its key type needs, or saying that the certificate
+  // supplies them where the algorithm alone does not fix a curve.
+  BLOB_ALGS: BLOB_ALGS,
 };