@breakside/jskit 2024.34.0 → 2024.41.0

package/Frameworks/SecurityKit.jsframework/JS/SECHMAC+HTML.js

@@ -38,14 +38,12 @@ SECHMAC.definePropertiesFromExtensions({
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
-        var algorithm = {
-            name: this.htmlAlgorithm.name,
-            hash: this.htmlAlgorithm.hash,
-            length: 256
-        };
+        var algorithm = this.htmlAlgorithm;
         var extractable = true;
         crypto.subtle.generateKey(algorithm, extractable, ["sign"]).then(function(htmlKey){
-            completion.call(target, SECHTMLKey.initWithKey(htmlKey));
+            var key = SECHTMLKey.initWithKey(htmlKey);
+            key.id = JSSHA1Hash(UUID.init().bytes).base64URLStringRepresentation();
+            completion.call(target, key);
         }, function(e){
             completion.call(target, null);
         });
@@ -57,7 +55,10 @@ SECHMAC.definePropertiesFromExtensions({
             completion = Promise.completion(Promise.resolveNonNull);
         }
         var extractable = true;
-        var algorithm = this.htmlAlgorithm;
+        var algorithm = {
+            name: this.htmlAlgorithm.name,
+            hash: this.htmlAlgorithm.hash
+        };
         crypto.subtle.importKey("raw", data, algorithm, extractable, ["sign"]).then(function(htmlKey){
             completion.call(target, SECHTMLKey.initWithKey(htmlKey));
         }, function(e){
@@ -77,7 +78,10 @@ SECHMAC.definePropertiesFromExtensions({
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
-        var algorithm = this.htmlAlgorithm;
+        var algorithm = {
+            name: this.htmlAlgorithm.name,
+            hash: this.htmlAlgorithm.hash
+        };
         var data = JSData.initWithChunks(this.chunks);
         crypto.subtle.sign(algorithm, this.key.htmlKey, data).then(function(computed){
             completion.call(target, JSData.initWithBuffer(computed));
@@ -91,9 +95,9 @@ SECHMAC.definePropertiesFromExtensions({
 
 var htmlAlgorithms = {};
 htmlAlgorithms[SECHMAC.Algorithm.sha1] = { name: 'HMAC', hash: 'SHA-1'};
-htmlAlgorithms[SECHMAC.Algorithm.sha256] = { name: 'HMAC', hash: 'SHA-256'};
-htmlAlgorithms[SECHMAC.Algorithm.sha384] = { name: 'HMAC', hash: 'SHA-384'};
-htmlAlgorithms[SECHMAC.Algorithm.sha512] = { name: 'HMAC', hash: 'SHA-512'};
+htmlAlgorithms[SECHMAC.Algorithm.sha256] = { name: 'HMAC', hash: 'SHA-256', length: 256};
+htmlAlgorithms[SECHMAC.Algorithm.sha384] = { name: 'HMAC', hash: 'SHA-384', length: 384};
+htmlAlgorithms[SECHMAC.Algorithm.sha512] = { name: 'HMAC', hash: 'SHA-512', length: 512};
 
 
 })();

package/Frameworks/SecurityKit.jsframework/JS/SECHMAC+Node.js

@@ -36,11 +36,25 @@ SECHMAC.definePropertiesFromExtensions({
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
-        crypto.randomBytes(32, function(error, keyBytes){
+        var length;
+        switch (this.nodeAlgorithm){
+            case "sha512":
+                length = 512;
+                break;
+            case "sha384":
+                length = 384;
+                break;
+            default:
+                length = 256;
+                break;
+        }
+        crypto.generateKey("hmac", {length: length}, function(error, nodeKeyObject){
             if (error){
                 completion.call(target, null);
             }else{
-                completion.call(target, SECNodeKey.initWithData(JSData.initWithNodeBuffer(keyBytes)));
+                var key = SECNodeKey.initWithNodeKeyObject(nodeKeyObject);
+                key.id = JSSHA1Hash(UUID.init().bytes).base64URLStringRepresentation();
+                completion.call(target, key);
             }
         });
         return completion.promise;
@@ -60,7 +74,7 @@ SECHMAC.definePropertiesFromExtensions({
             throw new Error("SECHMAC must have a key before calling update()");
         }
         if (this.nodeHash === null){
-            this.nodeHash = crypto.createHmac(this.nodeAlgorithm, this.key.keyData);
+            this.nodeHash = crypto.createHmac(this.nodeAlgorithm, this.key.nodeKeyObject);
         }
         this.nodeHash.update(data);
     },

package/Frameworks/SecurityKit.jsframework/JS/SECHTMLDeviceAuthentication.js

@@ -13,12 +13,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// #import Foundation
 // #import "SECDeviceAuthentication.js"
 // #import "SECCipher.js"
 // #import "SECSign.js"
 // #import "SECCBOR.js"
 // #import "SECHash.js"
-// #import "SECJSONWebAlgorithms.js"
+// #import "SECCOSE.js"
 // jshint browser: true
 /* global AuthenticatorAttestationResponse */
 'use strict';
@@ -66,12 +67,13 @@ JSClass("SECHTMLDeviceAuthentication", JSObject, {
         // challengeData
         // supportedAlgorithms
         // platform
+        // conditional
         if (!completion){
             completion = Promise.completion();
         }
         if (this.credentialStore === null){
             JSRunLoop.main.schedule(completion, target, null);
-            return;
+            return completion.promise;
         }
         registration = JSCopy(registration);
         if (!registration.providerName){
@@ -98,21 +100,19 @@ JSClass("SECHTMLDeviceAuthentication", JSObject, {
             challenge: registration.challengeData,
             pubKeyCredParams: [],
             authenticatorSelection: {
-                // Browser support for resident keys is spotty:
-                // - Chrome works, requiring the user to set a PIN, but can't share with others
-                // - Safari works, no PIN required, but can't share with others
-                // - Safari will get PIN support in Safari 14
-                // - Firefox doesn't work on macOS, but supposedly works on windows with a PIN
-                // Without a resident key, we need something like a username that the user can
-                // provide so we can lookup allowed key IDs on a server and send them back to
-                // the client before authenticating
-                requireResidentKey: false,
-                residentKey: "discouraged",
-                userVerification: registration.platform ? "required" : "discouraged",
+                // requiring a resident key is necessary for Android to
+                // actually save a passkey.  Apple OSes will save a passkey
+                // regardless of resident key settings
+                requireResidentKey: registration.platform ? true : false,
+                residentKey: registration.platform ? "required" : "discouraged",
+                userVerification: registration.platform && !registration.conditional ? "required" : "discouraged",
                 authenticatorAttachment: registration.platform ? "platform" : "cross-platform"
             },
             attestation: "none",
-            timeout: 10000
+            timeout: 60000,
+            extensions: {
+                credProps: true
+            }
         };
         if (registration.domain !== undefined){
             info.rp.id = registration.domain;
@@ -132,34 +132,43 @@ JSClass("SECHTMLDeviceAuthentication", JSObject, {
             ];
         }
         var credentials = this.credentialStore;
-        this.credentialStore.create({publicKey: info}).then(function(credential){
+        var handleCredential = function(credential){
             if (!credential || credential.type != "public-key"){
                 completion.call(target, null);
                 return;
             }
-            var clientData = JSData.initWithBuffer(credential.response.clientDataJSON);
-            var attestationCBOR = JSData.initWithBuffer(credential.response.attestationObject);
-            var attestationParser = SECCBORParser.initWithData(attestationCBOR);
-            attestationParser.encodeDataAsBase64URL = true;
-            var attestation = attestationParser.parse();
-            var authData = attestation.authData.dataByDecodingBase64URL();
-            var length = (authData[53] << 8) | authData[54];
-            var keyParser = SECCBORParser.initWithData(authData);
-            keyParser.offset = 55 + length;
-            var coseKey = keyParser.readNext();
-            var jwk = jwkForCoseKey(coseKey, credential.id);
+            var jwk = credential.response.getPublicJWK();
+            var webauthn = credential.toJSON();
             var result = {
+                name: credential.jskitName,
                 jwk: jwk,
-                webauthn: {
-                    attestation: attestation,
-                    clientData: clientData.base64URLStringRepresentation()
-                },
-                challenge: registration.challengeData
+                challenge: registration.challengeData,
+                webauthn: webauthn
             };
             completion.call(target, result);
-        }, function(error){
-            completion.call(target, null);
-        });
+        };
+        if (registration.conditional){
+            if (!window.PublicKeyCredential || !window.PublicKeyCredential.getClientCapabilities){
+                JSRunLoop.main.schedule(completion, target, null);
+                return completion.promise;
+            }
+            window.PublicKeyCredential.getClientCapabilities().then(function(capabilities){
+                if (!capabilities || !capabilities.conditionalCreate){
+                    completion.call(target, null);
+                    return;
+                }
+                credentials.create({publicKey: info, mediation: "conditional"}).then(handleCredential,function(error){
+                    completion.call(target, null);
+                });
+            }, function(e){
+                logger.error("failed to getClientCapabilities(): %{error}", e);
+                completion.call(target, null);
+            });
+        }else{
+            credentials.create({publicKey: info}).then(handleCredential, function(error){
+                completion.call(target, null);
+            });
+        }
         return completion.promise;
     },
 
@@ -178,9 +187,9 @@ JSClass("SECHTMLDeviceAuthentication", JSObject, {
         }
         var info = {
             challenge: request.challengeData,
-            userVerification: "discouraged",
-            timeout: 10000,
-            allowCredentials: []
+            userVerification: request.platform ? "required" : "discouraged",
+            timeout: 60000,
+            allowCredentials: [],
         };
         if (request.domain){
             info.rpId = request.domain;
@@ -198,7 +207,7 @@ JSClass("SECHTMLDeviceAuthentication", JSObject, {
                         id: request.allowedKeyIDs[i].dataByDecodingBase64URL()
                     };
                     if (request.platform){
-                        allowedCredential.transports = ["internal"];
+                        allowedCredential.transports = ["internal", "hybrid"];
                     }
                     info.allowCredentials.push(allowedCredential);
                 }catch (e){
@@ -212,15 +221,10 @@ JSClass("SECHTMLDeviceAuthentication", JSObject, {
                 completion.call(target, null);
                 return;
             }
-            var clientData = JSData.initWithBuffer(credential.response.clientDataJSON);
-            var authData = JSData.initWithBuffer(credential.response.authenticatorData);
-            var hash = SECHash.initWithAlgorithm(SECHash.Algorithm.sha256);
+            var webauthn = credential.toJSON();
             var result = {
                 kid: credential.id,
-                webauthn: {
-                    authData: authData.base64URLStringRepresentation(),
-                    clientData: clientData.base64URLStringRepresentation()
-                },
+                webauthn: webauthn,
                 challenge: request.challengeData,
                 signature: JSData.initWithBuffer(credential.response.signature)
             };
@@ -245,86 +249,168 @@ Object.defineProperties(SECDeviceAuthentication, {
 });
 
 var coseAlgorithmsBySignAlgorithm = {};
-coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.rsaSHA256] = -257;
-coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.rsaSHA384] = -258;
-coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.rsaSHA512] = -259;
-coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.ellipticCurveSHA256] = -7;
-coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.ellipticCurveSHA384] = -35;
-coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.ellipticCurveSHA512] = -36;
+coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.rsaSHA256] = SECCOSE.Algorithm.rsaSHA256;
+coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.rsaSHA384] = SECCOSE.Algorithm.rsaSHA384;
+coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.rsaSHA512] = SECCOSE.Algorithm.rsaSHA512;
+coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.ellipticCurveSHA256] = SECCOSE.Algorithm.ellipticCurveSHA256;
+coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.ellipticCurveSHA384] = SECCOSE.Algorithm.ellipticCurveSHA384;
+coseAlgorithmsBySignAlgorithm[SECSign.Algorithm.ellipticCurveSHA512] = SECCOSE.Algorithm.ellipticCurveSHA512;
+
+if (window.PublicKeyCredential){
 
-var remap = function(dictionary, keyMap){
-    var copy = {};
-    for (var k in dictionary){
-        copy[keyMap[k] || k] = dictionary[k];
+    if (!window.PublicKeyCredential.prototype.toJSON){
+        window.PublicKeyCredential.prototype.toJSON = function PublicKeyCredential_toJSON(){
+            var dictionary = {};
+            dictionary.id = this.id;
+            dictionary.rawId = JSData.initWithBuffer(this.rawId).base64URLStringRepresentation();
+            dictionary.authenticatorAttachment = this.authenticatorAttachment || "";
+            dictionary.type = this.type || "public-key";
+            dictionary.clientExtensionResults = this.getClientExtensionResults();
+            dictionary.response = this.response.toJSON ? this.response.toJSON() : {};
+            return dictionary;
+        };
     }
-    return copy;
-};
 
-var jwkForCoseKey = function(coseKey, kid){
-    coseKey = remap(coseKey, {
-        "1": "kty",
-        "2": "kid",
-        "3": "alg",
-        "-1": "crv",
-        "-2": "x",
-        "-3": "y",
-        "-4": "d"
-    });
-    var jwk = {
-        kid: kid,
-        key_ops: ["verify"]
-    };
-    if (coseKey.kty == 2){
-        jwk.kty = SECJSONWebAlgorithms.KeyType.ellipticCurve;
-        switch (coseKey.alg){
-            case -7:
-                jwk.alg = SECJSONWebAlgorithms.Algorithm.ellipticCurveSHA256;
-                break;
-            case -35:
-                jwk.alg = SECJSONWebAlgorithms.Algorithm.ellipticCurveSHA384;
-                break;
-            case -36:
-                jwk.alg = SECJSONWebAlgorithms.Algorithm.ellipticCurveSHA512;
-                break;
-            default:
-                return null;
-        }
-        switch (coseKey.crv){
-            case 1:
-                jwk.crv = "P-256";
-                break;
-            case 2:
-                jwk.crv = "P-384";
-                break;
-            case 3:
-                jwk.crv = "P-512";
-                break;
-            default:
-                return null;
-        }
-        jwk.x = coseKey.x.base64URLStringRepresentation();
-        jwk.y = coseKey.y.base64URLStringRepresentation();
-        return jwk;
+    if (!window.PublicKeyCredential.prototype.getClientExtensionResults){
+        window.PublicKeyCredential.prototype.getClientExtensionResults = function PublicKeyCredential_getClientExtensionResults(){
+            if (this._clientExtensionResults === undefined){
+                var authData = JSData.initWithBuffer(this.getAuthenticatorData());
+                var idLength = (authData[53] << 8) | authData[54];
+                var offset = 55 + idLength;
+                var cbor = SECCBORParser.initWithData(authData.subdataInRange(JSRange(offset, authData.length - offset)));
+                var coseKey = cbor.readNext(); // ingored, only reading to arrive at the extensions start location
+                this._clientExtensionResults = cbor.readNext() || {};
+            }
+            return this._clientExtensionResults;
+        };
     }
-    if (coseKey.kty == 0){ // RSA
-        jwk.kty = SECJSONWebAlgorithms.KeyType.rsa;
-        switch (coseKey.alg){
-            case -257:
-                jwk.alg = SECJSONWebAlgorithms.Algorithm.rsaSHA256;
-                break;
-            case -258:
-                jwk.alg = SECJSONWebAlgorithms.Algorithm.rsaSHA384;
-                break;
-            case -259:
-                jwk.alg = SECJSONWebAlgorithms.Algorithm.rsaSHA512;
-                break;
-            default:
-                return null;
+
+    Object.defineProperties(window.PublicKeyCredential.prototype, {
+        jskitName: {
+            enumerable: false,
+            configurable: false,
+            get: function PublicKeyCredential_getJSKitName(){
+                var extensions = this.getClientExtensionResults();
+                if (extensions.credProps){
+                    if (extensions.credProps.authenticatorDisplayName){
+                        return extensions.credProps.authenticatorDisplayName;
+                    }
+                }
+                var ua = JSHTMLUserAgent.initWithString(navigator.userAgent);
+                var apple = ua.containsComment("Macintosh") || ua.containsComment("iPhone") || ua.containsComment("iPad");
+                var windows = ua.containsComment("Win64") || ua.containsComment("Windows NT 10.0");
+                var linux = ua.containsComment("Linux");
+                var android = false;
+                if (linux){
+                    var i, l;
+                    for (i = 0, l = ua.comments.length; i < l; ++i){
+                        if (ua.comments[i].startsWith("Android")){
+                            android = true;
+                            break;
+                        }
+                    }
+                }
+                if (apple){
+                    return "iCloud Keychain";
+                }
+                if (android){
+                    return "Google Password Manager";
+                }
+                if (windows){
+                    return "Windows Hello";
+                }
+                return "";
+            }
         }
-        // TODO: jwk.n, jwk.e
-        return jwk;
+    });
+
+}
+
+if (window.AuthenticatorAttestationResponse){
+
+    if (!window.AuthenticatorAttestationResponse.prototype.getAuthenticatorData){
+        window.AuthenticatorAttestationResponse.prototype.getAuthenticatorData = function AuthenticatorAttestationResponse_getAuthenticatorData(){
+            if (this._jskitAuthDataBuffer === undefined){
+                var attestationCBOR = JSData.initWithBuffer(this.attestationObject);
+                var attestationParser = SECCBORParser.initWithData(attestationCBOR);
+                var attestation = attestationParser.parse();
+                var data = attestation.authData;
+                this._authDataBuffer = data.buffer.slice(data.byteOffset, data.byteOffset + data.length);
+            }
+            return this._authDataBuffer;
+        };
+    }
+
+    if (!window.AuthenticatorAttestationResponse.prototype.jskitGetCOSE){
+        window.AuthenticatorAttestationResponse.prototype.jskitGetCOSE = function jskitGuthenticatorAttestationResponse_getCOSEDictionary(){
+            if (this._jskitCOSE === undefined){
+                var authData = JSData.initWithBuffer(this.getAuthenticatorData());
+                var idLength = (authData[53] << 8) | authData[54];
+                var offset = 55 + idLength;
+                this._jskitCOSE = SECCOSE.initWithData(authData.subdataInRange(JSRange(offset, authData.length - offset)));
+            }
+            return this._jskitCOSE;
+        };
+    }
+
+    if (!window.AuthenticatorAttestationResponse.prototype.getPublicKeyAlgorithm){
+        window.AuthenticatorAttestationResponse.prototype.getPublicKeyAlgorithm = function AuthenticatorAttestationResponse_getPublicKeyAlgorithm(){
+            var cose = this.jskitGetCOSE();
+            return cose[SECCOSE.Attribute.alg];
+        };
+    }
+
+    if (!window.AuthenticatorAttestationResponse.prototype.getPublicKey){
+        window.AuthenticatorAttestationResponse.prototype.getPublicKey = function AuthenticatorAttestationResponse_getPublicKey(){
+            var cose = this.jskitGetCOSE();
+            var derData = cose.derRepresentation();
+            return derData.buffer.slice(derData.byteOffset, derData.byteOffset + derData.length);
+        };
+    }
+
+    if (!window.AuthenticatorAttestationResponse.prototype.getPublicJWK){
+        window.AuthenticatorAttestationResponse.prototype.getPublicJWK = function AuthenticatorAttestationResponse_getPublicJWK(){
+            var cose = this.jskitGetCOSE();
+            var jwk = cose.jwkRepresentation();
+            var authData = JSData.initWithBuffer(this.getAuthenticatorData());
+            var idLength = (authData[53] << 8) | authData[54];
+            var idData = authData.subdataInRange(JSRange(55, idLength));
+            jwk.kid = idData.base64URLStringRepresentation();
+            jwk.key_ops = ["verify"];
+            return jwk;
+        };
+    }
+
+    if (!window.AuthenticatorAttestationResponse.prototype.toJSON){
+        window.AuthenticatorAttestationResponse.prototype.toJSON = function AuthenticatorAttestationResponse_toJSON(){
+            var attestationObjectData = JSData.initWithBuffer(this.attestationObject);
+            var authData = JSData.initWithBuffer(this.getAuthenticatorData());
+            var dictionary = {};
+            dictionary.clientDataJSON = JSData.initWithBuffer(this.clientDataJSON).base64URLStringRepresentation();
+            dictionary.authenticatorData = authData.base64URLStringRepresentation();
+            dictionary.transports = this.getTransports ? this.getTransports() : [];
+            dictionary.publicKey = JSData.initWithBuffer(this.getPublicKey()).base64URLStringRepresentation();
+            dictionary.publicKeyAlgorithm = this.getPublicKeyAlgorithm();
+            dictionary.attestationObject = attestationObjectData.base64URLStringRepresentation();
+            return dictionary;
+        };
     }
-    return null;
-};
+
+}
+
+if (window.AuthenticatorAssertionResponse){
+
+    if (!window.AuthenticatorAssertionResponse.prototype.toJSON){
+        window.AuthenticatorAssertionResponse.prototype.toJSON = function AuthenticatorAssertionResponse_toJSON(){
+            var dictionary = {};
+            dictionary.clientDataJSON = JSData.initWithBuffer(this.clientDataJSON).base64URLStringRepresentation();
+            dictionary.authenticatorData = JSData.initWithBuffer(this.authenticatorData).base64URLStringRepresentation();
+            dictionary.signature = JSData.initWithBuffer(this.signature).base64URLStringRepresentation();
+            dictionary.userHandle = this.userHandle ? JSData.initWithBuffer(this.userHandle).base64URLStringRepresentation() : null;
+            return dictionary;
+        };
+    }
+
+}
 
 })();

package/Frameworks/SecurityKit.jsframework/JS/SECHTMLKey.js

@@ -24,6 +24,7 @@ JSClass("SECHTMLKey", SECKey, {
 
     initWithKey: function(htmlKey){
         this.htmlKey = htmlKey;
+        this.type = htmlKey.type;
     },
 
     getData: function(completion, target){
@@ -36,6 +37,22 @@ JSClass("SECHTMLKey", SECKey, {
             completion.call(target, null);
         });
         return completion.promise;
+    },
+
+    getJWK: function(completion, target){
+        if (!completion){
+            completion = Promise.completion(Promise.resolveNonNull);
+        }
+        var kid = this.id;
+        crypto.subtle.exportKey("jwk", this.htmlKey).then(function(jwk){
+            if (kid !== null){
+                jwk.kid = kid;
+            }
+            completion.call(target, jwk);
+        }, function(){
+            completion.call(target, null);
+        });
+        return completion.promise;
     }
 
 });

package/Frameworks/SecurityKit.jsframework/JS/SECHash.js

@@ -30,6 +30,7 @@ JSClass("SECHash", JSObject, {
 });
 
 SECHash.Algorithm = {
+    sha1: "sha1",
     sha256: "sha256",
     sha384: "sha384",
     sha512: "sha512",

package/Frameworks/SecurityKit.jsframework/JS/SECJSONWebAlgorithms.js

@@ -23,6 +23,7 @@ JSClass("SECJSONWebAlgorithms", JSObject, {
 SECJSONWebAlgorithms.Algorithm = {
 
     none: 'none',
+    direct: "dir",
     hmacSHA256: "HS256",
     hmacSHA384: "HS384",
     hmacSHA512: "HS512",
@@ -32,7 +33,14 @@ SECJSONWebAlgorithms.Algorithm = {
     ellipticCurveSHA256: "ES256",
     ellipticCurveSHA384: "ES384",
     ellipticCurveSHA512: "ES512",
-
+    aesGCM128: "A128GCM",
+    aesGCM192: "A192GCM",
+    aesGCM256: "A256GCM",
+    aesCBC128HS256: "A128CBC-HS256",
+    aesCBC192HS384: "A192CBC-HS384",
+    aesCBC256HS512: "A256CBC-HS512",
+    rsaOAEP: "RSA-OAEP",
+    ecdhES: "ECDH-ES"
 };
 
 SECJSONWebAlgorithms.KeyType = {