@simplewebauthn/server 3.0.0 → 4.3.0

package/dist/helpers/validateCertificatePath.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.js","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":";;;;;AAAA,sDAAsD;AACtD,qDAAqD;AACrD,kBAAkB;AAClB,yCAA4D;AAE5D,oEAA4C;AAE5C,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAI,CAAC;AAExB;;;GAGG;AACY,KAAK,UAAU,uBAAuB,CAAC,YAAsB;IAC1E,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE;QACtD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;KAC3E;IAED,wFAAwF;IACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;QAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAEnC,MAAM,WAAW,GAAG,IAAI,gBAAI,EAAE,CAAC;QAC/B,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE;YAChC,SAAS,GAAG,UAAU,CAAC;SACxB;aAAM;YACL,SAAS,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACjC;QAED,MAAM,UAAU,GAAG,IAAI,gBAAI,EAAE,CAAC;QAC9B,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAElC,mCAAmC;QACnC,MAAM,kBAAkB,GAAG,MAAM,uBAAa,CAAC,WAAW,CAAC,CAAC;QAE5D,IAAI,kBAAkB,EAAE;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;SAClE;QAED,sEAAsE;QACtE,MAAM,SAAS,GAAG,sBAAU,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,sBAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,SAAS,GAAG,GAAG,IAAI,QAAQ,GAAG,GAAG,EAAE;YACrC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;SACzE;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,KAAK,UAAU,CAAC,gBAAgB,EAAE,EAAE;YACnE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;SAC1F;QAED,MAAM,iBAAiB,GAAG,mBAAO,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC;QAExD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEvC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;YACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;SAChE;KACF;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAxDD,0CAwDC"}
+{"version":3,"file":"validateCertificatePath.js","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":";;;;;AAAA,sDAAsD;AACtD,qDAAqD;AACrD,kBAAkB;AAClB,yCAA4D;AAE5D,oEAA4C;AAE5C,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAI,CAAC;AAExB;;;;GAIG;AACY,KAAK,UAAU,uBAAuB,CACnD,YAAsB,EACtB,mBAA6B,EAAE;IAE/B,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE;QACjC,kFAAkF;QAClF,0DAA0D;QAC1D,OAAO,IAAI,CAAC;KACb;IAED,IAAI,4BAA4B,GAAG,KAAK,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE;QACvC,IAAI;YACF,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtD,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YACnC,uEAAuE;YACvE,4BAA4B,GAAG,KAAK,CAAC;YACrC,MAAM;SACP;QAAC,OAAO,GAAG,EAAE;YACZ,IAAI,GAAG,YAAY,uBAAuB,EAAE;gBAC1C,4BAA4B,GAAG,IAAI,CAAC;aACrC;iBAAM;gBACL,MAAM,GAAG,CAAC;aACX;SACF;KACF;IAED,uDAAuD;IACvD,IAAI,4BAA4B,EAAE;QAChC,MAAM,IAAI,uBAAuB,EAAE,CAAC;KACrC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAjCD,0CAiCC;AAED,KAAK,UAAU,aAAa,CAAC,YAAsB;IACjD,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE;QACtD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;KAC3E;IAED,wFAAwF;IACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;QAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAEnC,MAAM,WAAW,GAAG,IAAI,gBAAI,EAAE,CAAC;QAC/B,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE;YAChC,SAAS,GAAG,UAAU,CAAC;SACxB;aAAM;YACL,SAAS,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACjC;QAED,MAAM,UAAU,GAAG,IAAI,gBAAI,EAAE,CAAC;QAC9B,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAElC,mCAAmC;QACnC,MAAM,kBAAkB,GAAG,MAAM,uBAAa,CAAC,WAAW,CAAC,CAAC;QAE5D,IAAI,kBAAkB,EAAE;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;SAClE;QAED,sEAAsE;QACtE,MAAM,SAAS,GAAG,sBAAU,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,sBAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjC,IAAI,SAAS,GAAG,GAAG,IAAI,QAAQ,GAAG,GAAG,EAAE;YACrC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;SACzE;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,KAAK,UAAU,CAAC,gBAAgB,EAAE,EAAE;YACnE,MAAM,IAAI,uBAAuB,EAAE,CAAC;SACrC;QAED,MAAM,iBAAiB,GAAG,mBAAO,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC;QAExD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEvC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;YACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;SAChE;KACF;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+CAA+C;AAC/C,MAAM,uBAAwB,SAAQ,KAAK;IACzC;QACE,MAAM,OAAO,GAAG,6CAA6C,CAAC;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF"}

package/dist/index.d.ts

@@ -2,14 +2,16 @@
  * @packageDocumentation
  * @module @simplewebauthn/server
  */
-import generateAttestationOptions from './attestation/generateAttestationOptions';
-import verifyAttestationResponse from './attestation/verifyAttestationResponse';
-import generateAssertionOptions from './assertion/generateAssertionOptions';
-import verifyAssertionResponse from './assertion/verifyAssertionResponse';
-import MetadataService from './metadata/metadataService';
-export { generateAttestationOptions, verifyAttestationResponse, generateAssertionOptions, verifyAssertionResponse, MetadataService, };
-import type { GenerateAttestationOptionsOpts } from './attestation/generateAttestationOptions';
-import type { GenerateAssertionOptionsOpts } from './assertion/generateAssertionOptions';
-import type { VerifiedAttestation, VerifyAttestationResponseOpts } from './attestation/verifyAttestationResponse';
-import type { VerifiedAssertion, VerifyAssertionResponseOpts } from './assertion/verifyAssertionResponse';
-export type { GenerateAttestationOptionsOpts, GenerateAssertionOptionsOpts, VerifyAttestationResponseOpts, VerifyAssertionResponseOpts, VerifiedAttestation, VerifiedAssertion, };
+import generateRegistrationOptions from './registration/generateRegistrationOptions';
+import verifyRegistrationResponse from './registration/verifyRegistrationResponse';
+import generateAuthenticationOptions from './authentication/generateAuthenticationOptions';
+import verifyAuthenticationResponse from './authentication/verifyAuthenticationResponse';
+import MetadataService from './services/metadataService';
+import SettingsService from './services/settingsService';
+export { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions as generateAuthenticationOptions, verifyAuthenticationResponse, MetadataService, SettingsService, };
+import type { GenerateRegistrationOptionsOpts } from './registration/generateRegistrationOptions';
+import type { GenerateAuthenticationOptionsOpts } from './authentication/generateAuthenticationOptions';
+import type { MetadataStatement } from './metadata/mdsTypes';
+import type { VerifiedRegistrationResponse, VerifyRegistrationResponseOpts } from './registration/verifyRegistrationResponse';
+import type { VerifiedAuthenticationResponse, VerifyAuthenticationResponseOpts } from './authentication/verifyAuthenticationResponse';
+export type { GenerateRegistrationOptionsOpts, GenerateAuthenticationOptionsOpts, MetadataStatement, VerifyRegistrationResponseOpts, VerifyAuthenticationResponseOpts, VerifiedRegistrationResponse, VerifiedAuthenticationResponse, };

package/dist/index.js

@@ -3,19 +3,21 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MetadataService = exports.verifyAssertionResponse = exports.generateAssertionOptions = exports.verifyAttestationResponse = exports.generateAttestationOptions = void 0;
+exports.SettingsService = exports.MetadataService = exports.verifyAuthenticationResponse = exports.generateAuthenticationOptions = exports.verifyRegistrationResponse = exports.generateRegistrationOptions = void 0;
 /**
  * @packageDocumentation
  * @module @simplewebauthn/server
  */
-const generateAttestationOptions_1 = __importDefault(require("./attestation/generateAttestationOptions"));
-exports.generateAttestationOptions = generateAttestationOptions_1.default;
-const verifyAttestationResponse_1 = __importDefault(require("./attestation/verifyAttestationResponse"));
-exports.verifyAttestationResponse = verifyAttestationResponse_1.default;
-const generateAssertionOptions_1 = __importDefault(require("./assertion/generateAssertionOptions"));
-exports.generateAssertionOptions = generateAssertionOptions_1.default;
-const verifyAssertionResponse_1 = __importDefault(require("./assertion/verifyAssertionResponse"));
-exports.verifyAssertionResponse = verifyAssertionResponse_1.default;
-const metadataService_1 = __importDefault(require("./metadata/metadataService"));
+const generateRegistrationOptions_1 = __importDefault(require("./registration/generateRegistrationOptions"));
+exports.generateRegistrationOptions = generateRegistrationOptions_1.default;
+const verifyRegistrationResponse_1 = __importDefault(require("./registration/verifyRegistrationResponse"));
+exports.verifyRegistrationResponse = verifyRegistrationResponse_1.default;
+const generateAuthenticationOptions_1 = __importDefault(require("./authentication/generateAuthenticationOptions"));
+exports.generateAuthenticationOptions = generateAuthenticationOptions_1.default;
+const verifyAuthenticationResponse_1 = __importDefault(require("./authentication/verifyAuthenticationResponse"));
+exports.verifyAuthenticationResponse = verifyAuthenticationResponse_1.default;
+const metadataService_1 = __importDefault(require("./services/metadataService"));
 exports.MetadataService = metadataService_1.default;
+const settingsService_1 = __importDefault(require("./services/settingsService"));
+exports.SettingsService = settingsService_1.default;
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;AAAA;;;GAGG;AACH,0GAAkF;AAOhF,qCAPK,oCAA0B,CAOL;AAN5B,wGAAgF;AAO9E,oCAPK,mCAAyB,CAOL;AAN3B,oGAA4E;AAO1E,mCAPK,kCAAwB,CAOL;AAN1B,kGAA0E;AAOxE,kCAPK,iCAAuB,CAOL;AANzB,iFAAyD;AAOvD,0BAPK,yBAAe,CAOL"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;AAAA;;;GAGG;AACH,6GAAqF;AAQnF,sCARK,qCAA2B,CAQL;AAP7B,2GAAmF;AAQjF,qCARK,oCAA0B,CAQL;AAP5B,mHAA2F;AAQxD,wCAR5B,uCAA6B,CAQ4B;AAPhE,iHAAyF;AAQvF,uCARK,sCAA4B,CAQL;AAP9B,iFAAyD;AAQvD,0BARK,yBAAe,CAQL;AAPjB,iFAAyD;AAQvD,0BARK,yBAAe,CAQL"}

package/dist/metadata/mdsTypes.d.ts

@@ -0,0 +1,207 @@
+import { Base64URLString } from '@simplewebauthn/typescript-types';
+/**
+ * Metadata Service structures
+ * https://fidoalliance.org/specs/mds/fido-metadata-service-v3.0-ps-20210518.html
+ */
+export declare type MDSJWTHeader = {
+    alg: string;
+    typ: string;
+    x5c: Base64URLString[];
+};
+export declare type MDSJWTPayload = {
+    legalHeader: string;
+    no: number;
+    nextUpdate: string;
+    entries: MetadataBLOBPayloadEntry[];
+};
+export declare type MetadataBLOBPayloadEntry = {
+    aaid?: string;
+    aaguid?: string;
+    attestationCertificateKeyIdentifiers?: string[];
+    metadataStatement?: MetadataStatement;
+    biometricStatusReports?: BiometricStatusReport[];
+    statusReports: StatusReport[];
+    timeOfLastStatusChange: string;
+    rogueListURL?: string;
+    rogueListHash?: string;
+};
+export declare type BiometricStatusReport = {
+    certLevel: number;
+    modality: UserVerify;
+    effectiveDate?: string;
+    certificationDescriptor?: string;
+    certificateNumber?: string;
+    certificationPolicyVersion?: string;
+    certificationRequirementsVersion?: string;
+};
+export declare type StatusReport = {
+    status: AuthenticatorStatus;
+    effectiveDate?: string;
+    authenticatorVersion?: number;
+    certificate?: string;
+    url?: string;
+    certificationDescriptor?: string;
+    certificateNumber?: string;
+    certificationPolicyVersion?: string;
+    certificationRequirementsVersion?: string;
+};
+export declare type AuthenticatorStatus = 'NOT_FIDO_CERTIFIED' | 'FIDO_CERTIFIED' | 'USER_VERIFICATION_BYPASS' | 'ATTESTATION_KEY_COMPROMISE' | 'USER_KEY_REMOTE_COMPROMISE' | 'USER_KEY_PHYSICAL_COMPROMISE' | 'UPDATE_AVAILABLE' | 'REVOKED' | 'SELF_ASSERTION_SUBMITTED' | 'FIDO_CERTIFIED_L1' | 'FIDO_CERTIFIED_L1plus' | 'FIDO_CERTIFIED_L2' | 'FIDO_CERTIFIED_L2plus' | 'FIDO_CERTIFIED_L3' | 'FIDO_CERTIFIED_L3plus';
+/**
+ * Types defined in the FIDO Metadata Statement spec
+ *
+ * See https://fidoalliance.org/specs/mds/fido-metadata-statement-v3.0-ps-20210518.html
+ */
+export declare type CodeAccuracyDescriptor = {
+    base: number;
+    minLength: number;
+    maxRetries?: number;
+    blockSlowdown?: number;
+};
+export declare type BiometricAccuracyDescriptor = {
+    selfAttestedFRR?: number;
+    selfAttestedFAR?: number;
+    maxTemplates?: number;
+    maxRetries?: number;
+    blockSlowdown?: number;
+};
+export declare type PatternAccuracyDescriptor = {
+    minComplexity: number;
+    maxRetries?: number;
+    blockSlowdown?: number;
+};
+export declare type VerificationMethodDescriptor = {
+    userVerificationMethod: UserVerify;
+    caDesc?: CodeAccuracyDescriptor;
+    baDesc?: BiometricAccuracyDescriptor;
+    paDesc?: PatternAccuracyDescriptor;
+};
+export declare type VerificationMethodANDCombinations = VerificationMethodDescriptor[];
+export declare type rgbPaletteEntry = {
+    r: number;
+    g: number;
+    b: number;
+};
+export declare type DisplayPNGCharacteristicsDescriptor = {
+    width: number;
+    height: number;
+    bitDepth: number;
+    colorType: number;
+    compression: number;
+    filter: number;
+    interlace: number;
+    plte?: rgbPaletteEntry[];
+};
+export declare type EcdaaTrustAnchor = {
+    X: string;
+    Y: string;
+    c: string;
+    sx: string;
+    sy: string;
+    G1Curve: string;
+};
+export declare type ExtensionDescriptor = {
+    id: string;
+    tag?: number;
+    data?: string;
+    fail_if_unknown: boolean;
+};
+export declare type AlternativeDescriptions = {
+    [langCode: string]: string;
+};
+export declare type MetadataStatement = {
+    legalHeader?: string;
+    aaid?: string;
+    aaguid?: string;
+    attestationCertificateKeyIdentifiers?: string[];
+    description: string;
+    alternativeDescriptions?: AlternativeDescriptions;
+    authenticatorVersion: number;
+    protocolFamily: string;
+    schema: number;
+    upv: Version[];
+    authenticationAlgorithms: AlgSign[];
+    publicKeyAlgAndEncodings: AlgKey[];
+    attestationTypes: Attestation[];
+    userVerificationDetails: VerificationMethodANDCombinations[];
+    keyProtection: KeyProtection[];
+    isKeyRestricted?: boolean;
+    isFreshUserVerificationRequired?: boolean;
+    matcherProtection: MatcherProtection[];
+    cryptoStrength?: number;
+    attachmentHint?: AttachmentHint[];
+    tcDisplay: TransactionConfirmationDisplay[];
+    tcDisplayContentType?: string;
+    tcDisplayPNGCharacteristics?: DisplayPNGCharacteristicsDescriptor[];
+    attestationRootCertificates: string[];
+    ecdaaTrustAnchors?: EcdaaTrustAnchor[];
+    icon?: string;
+    supportedExtensions?: ExtensionDescriptor[];
+    authenticatorGetInfo?: AuthenticatorGetInfo;
+};
+/**
+ * Types declared in other specs
+ */
+/**
+ * USER_VERIFY
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods
+ */
+export declare type UserVerify = 'presence_internal' | 'fingerprint_internal' | 'passcode_internal' | 'voiceprint_internal' | 'faceprint_internal' | 'location_internal' | 'eyeprint_internal' | 'pattern_internal' | 'handprint_internal' | 'passcode_external' | 'pattern_external' | 'none' | 'all';
+/**
+ * ALG_SIGN
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#authentication-algorithms
+ */
+export declare type AlgSign = 'secp256r1_ecdsa_sha256_raw' | 'secp256r1_ecdsa_sha256_der' | 'rsassa_pss_sha256_raw' | 'rsassa_pss_sha256_der' | 'secp256k1_ecdsa_sha256_raw' | 'secp256k1_ecdsa_sha256_der' | 'sm2_sm3_raw' | 'rsa_emsa_pkcs1_sha256_raw' | 'rsa_emsa_pkcs1_sha256_der' | 'rsassa_pss_sha384_raw' | 'rsassa_pss_sha256_raw' | 'rsassa_pkcsv15_sha256_raw' | 'rsassa_pkcsv15_sha384_raw' | 'rsassa_pkcsv15_sha512_raw' | 'rsassa_pkcsv15_sha1_raw' | 'secp384r1_ecdsa_sha384_raw' | 'secp512r1_ecdsa_sha256_raw' | 'ed25519_eddsa_sha512_raw';
+/**
+ * ALG_KEY
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats
+ */
+export declare type AlgKey = 'ecc_x962_raw' | 'ecc_x962_der' | 'rsa_2048_raw' | 'rsa_2048_der' | 'cose';
+/**
+ * ATTESTATION
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#authenticator-attestation-types
+ */
+export declare type Attestation = 'basic_full' | 'basic_surrogate' | 'ecdaa' | 'attca';
+/**
+ * KEY_PROTECTION
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types
+ */
+export declare type KeyProtection = 'software' | 'hardware' | 'tee' | 'secure_element' | 'remote_handle';
+/**
+ * MATCHER_PROTECTION
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types
+ */
+export declare type MatcherProtection = 'software' | 'tee' | 'on_chip';
+/**
+ * ATTACHMENT_HINT
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#authenticator-attachment-hints
+ */
+export declare type AttachmentHint = 'internal' | 'external' | 'wired' | 'wireless' | 'nfc' | 'bluetooth' | 'network' | 'ready' | 'wifi_direct';
+/**
+ * TRANSACTION_CONFIRMATION_DISPLAY
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#transaction-confirmation-display-types
+ */
+export declare type TransactionConfirmationDisplay = 'any' | 'privileged_software' | 'tee' | 'hardware' | 'remote';
+/**
+ * https://fidoalliance.org/specs/fido-uaf-v1.2-ps-20201020/fido-uaf-protocol-v1.2-ps-20201020.html#version-interface
+ */
+export declare type Version = {
+    major: number;
+    minor: number;
+};
+/**
+ * https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetInfoz
+ */
+export declare type AuthenticatorGetInfo = {
+    versions: ('FIDO_2_0' | 'U2F_V2')[];
+    extensions?: string[];
+    aaguid: string;
+    options?: {
+        plat?: boolean;
+        rk?: boolean;
+        clientPin?: boolean;
+        up?: boolean;
+        uv?: boolean;
+    };
+    maxMsgSize?: number;
+    pinProtocols?: number[];
+};

package/dist/metadata/mdsTypes.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=mdsTypes.js.map

package/dist/metadata/mdsTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mdsTypes.js","sourceRoot":"","sources":["../../src/metadata/mdsTypes.ts"],"names":[],"mappings":""}

package/dist/metadata/verifyAttestationWithMetadata.d.ts

@@ -1,4 +1,8 @@
 /// <reference types="node" />
 import { Base64URLString } from '@simplewebauthn/typescript-types';
-import { MetadataStatement } from './metadataService';
+import { MetadataStatement } from '../metadata/mdsTypes';
+/**
+ * Match properties of the authenticator's attestation statement against expected values as
+ * registered with the FIDO Alliance Metadata Service
+ */
 export default function verifyAttestationWithMetadata(statement: MetadataStatement, alg: number, x5c: Buffer[] | Base64URLString[]): Promise<boolean>;

package/dist/metadata/verifyAttestationWithMetadata.js

@@ -3,40 +3,74 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const constants_1 = require("../helpers/constants");
-const convertX509CertToPEM_1 = __importDefault(require("../helpers/convertX509CertToPEM"));
+const convertCertBufferToPEM_1 = __importDefault(require("../helpers/convertCertBufferToPEM"));
 const validateCertificatePath_1 = __importDefault(require("../helpers/validateCertificatePath"));
+/**
+ * Match properties of the authenticator's attestation statement against expected values as
+ * registered with the FIDO Alliance Metadata Service
+ */
 async function verifyAttestationWithMetadata(statement, alg, x5c) {
-    // Make sure the alg in the attestation statement matches the one specified in the metadata
-    const metaCOSE = constants_1.FIDO_METADATA_AUTH_ALG_TO_COSE[statement.authenticationAlgorithm];
-    if (metaCOSE.alg !== alg) {
-        throw new Error(`Attestation alg "${alg}" did not match metadata auth alg "${metaCOSE.alg}"`);
-    }
-    // Make a copy of x5c so we don't modify the original
-    const path = [...x5c].map(convertX509CertToPEM_1.default);
-    // Try to validate the chain with each metadata root cert until we find one that works
-    let foundValidPath = false;
-    for (const rootCert of statement.attestationRootCertificates) {
-        try {
-            // Push the root cert to the cert path and try to validate it
-            path.push(convertX509CertToPEM_1.default(rootCert));
-            foundValidPath = await validateCertificatePath_1.default(path);
-        }
-        catch (err) {
-            // Swallow the error for now
-            foundValidPath = false;
-            // Remove the root cert before we try again with another
-            path.splice(path.length - 1, 1);
-        }
-        // Don't continue if we've validated a full path
-        if (foundValidPath) {
-            break;
+    // Make sure the alg in the attestation statement matches one of the ones specified in metadata
+    const statementCOSEAlgs = new Set();
+    statement.authenticationAlgorithms.forEach(algSign => {
+        // Convert algSign string to { kty, alg, crv }
+        const algSignCOSEINFO = algSignToCOSEInfo(algSign);
+        if (algSignCOSEINFO) {
+            statementCOSEAlgs.add(algSignCOSEINFO.alg);
         }
+    });
+    if (!statementCOSEAlgs.has(alg)) {
+        const debugAlgs = Array.from(statementCOSEAlgs).join(', ');
+        throw new Error(`Attestation alg "${alg}" did not match metadata auth algs [${debugAlgs}]`);
     }
-    if (!foundValidPath) {
+    try {
+        await validateCertificatePath_1.default(x5c.map(convertCertBufferToPEM_1.default), statement.attestationRootCertificates.map(convertCertBufferToPEM_1.default));
+    }
+    catch (err) {
         throw new Error(`Could not validate certificate path with any metadata root certificates`);
     }
     return true;
 }
 exports.default = verifyAttestationWithMetadata;
+/**
+ * Convert ALG_SIGN values to COSE info
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#authentication-algorithms
+ */
+function algSignToCOSEInfo(algSign) {
+    switch (algSign) {
+        case 'secp256r1_ecdsa_sha256_raw':
+        case 'secp256r1_ecdsa_sha256_der':
+            return { kty: 2, alg: -7, crv: 1 };
+        case 'rsassa_pss_sha256_raw':
+        case 'rsassa_pss_sha256_der':
+            return { kty: 3, alg: -37 };
+        case 'secp256k1_ecdsa_sha256_raw':
+        case 'secp256k1_ecdsa_sha256_der':
+            return { kty: 2, alg: -7, crv: 8 };
+        case 'rsassa_pss_sha384_raw':
+            return { kty: 3, alg: -38 };
+        case 'rsassa_pkcsv15_sha256_raw':
+            return { kty: 3, alg: -257 };
+        case 'rsassa_pkcsv15_sha384_raw':
+            return { kty: 3, alg: -258 };
+        case 'rsassa_pkcsv15_sha512_raw':
+            return { kty: 3, alg: -259 };
+        case 'rsassa_pkcsv15_sha1_raw':
+            return { kty: 3, alg: -65535 };
+        case 'secp384r1_ecdsa_sha384_raw':
+            return { kty: 2, alg: -35, crv: 2 };
+        case 'secp512r1_ecdsa_sha256_raw':
+            return { kty: 2, alg: -36, crv: 3 };
+        case 'ed25519_eddsa_sha512_raw':
+            return { kty: 1, alg: -8, crv: 6 };
+        // TODO: COSE info in FIDO Registry v2.1 isn't readily available for these, these seem rare...
+        // case 'sm2_sm3_raw':
+        //   return {};
+        // case 'rsa_emsa_pkcs1_sha256_raw':
+        // case 'rsa_emsa_pkcs1_sha256_der':
+        //   return {};
+        default:
+            return undefined;
+    }
+}
 //# sourceMappingURL=verifyAttestationWithMetadata.js.map

package/dist/metadata/verifyAttestationWithMetadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationWithMetadata.js","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":";;;;;AAGA,oDAAsE;AACtE,2FAAmE;AACnE,iGAAyE;AAE1D,KAAK,UAAU,6BAA6B,CACzD,SAA4B,EAC5B,GAAW,EACX,GAAiC;IAEjC,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,0CAA8B,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,sCAAsC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;KAC/F;IAED,qDAAqD;IACrD,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,8BAAoB,CAAC,CAAC;IAEhD,sFAAsF;IACtF,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,2BAA2B,EAAE;QAC5D,IAAI;YACF,6DAA6D;YAC7D,IAAI,CAAC,IAAI,CAAC,8BAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,cAAc,GAAG,MAAM,iCAAuB,CAAC,IAAI,CAAC,CAAC;SACtD;QAAC,OAAO,GAAG,EAAE;YACZ,4BAA4B;YAC5B,cAAc,GAAG,KAAK,CAAC;YACvB,wDAAwD;YACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;SACjC;QAED,gDAAgD;QAChD,IAAI,cAAc,EAAE;YAClB,MAAM;SACP;KACF;IAED,IAAI,CAAC,cAAc,EAAE;QACnB,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;KAC5F;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAvCD,gDAuCC"}
+{"version":3,"file":"verifyAttestationWithMetadata.js","sourceRoot":"","sources":["../../src/metadata/verifyAttestationWithMetadata.ts"],"names":[],"mappings":";;;;;AAGA,+FAAuE;AACvE,iGAAyE;AAEzE;;;GAGG;AACY,KAAK,UAAU,6BAA6B,CACzD,SAA4B,EAC5B,GAAW,EACX,GAAiC;IAEjC,+FAA+F;IAC/F,MAAM,iBAAiB,GAAgB,IAAI,GAAG,EAAE,CAAC;IACjD,SAAS,CAAC,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACnD,8CAA8C;QAC9C,MAAM,eAAe,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,eAAe,EAAE;YACnB,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;SAC5C;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,uCAAuC,SAAS,GAAG,CAAC,CAAC;KAC7F;IAED,IAAI;QACF,MAAM,iCAAuB,CAC3B,GAAG,CAAC,GAAG,CAAC,gCAAsB,CAAC,EAC/B,SAAS,CAAC,2BAA2B,CAAC,GAAG,CAAC,gCAAsB,CAAC,CAClE,CAAC;KACH;IAAC,OAAO,GAAG,EAAE;QACZ,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;KAC5F;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AA/BD,gDA+BC;AAQD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,QAAQ,OAAO,EAAE;QACf,KAAK,4BAA4B,CAAC;QAClC,KAAK,4BAA4B;YAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACrC,KAAK,uBAAuB,CAAC;QAC7B,KAAK,uBAAuB;YAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,KAAK,4BAA4B,CAAC;QAClC,KAAK,4BAA4B;YAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACrC,KAAK,uBAAuB;YAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,KAAK,2BAA2B;YAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,2BAA2B;YAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,2BAA2B;YAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,yBAAyB;YAC5B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QACjC,KAAK,4BAA4B;YAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtC,KAAK,4BAA4B;YAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtC,KAAK,0BAA0B;YAC7B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACrC,8FAA8F;QAC9F,sBAAsB;QACtB,eAAe;QACf,oCAAoC;QACpC,oCAAoC;QACpC,eAAe;QACf;YACE,OAAO,SAAS,CAAC;KACpB;AACH,CAAC"}

package/dist/{attestation/generateAttestationOptions.d.ts → registration/generateRegistrationOptions.d.ts}

@@ -1,6 +1,6 @@
 /// <reference types="node" />
 import type { AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticatorSelectionCriteria, COSEAlgorithmIdentifier, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialDescriptor } from '@simplewebauthn/typescript-types';
-export declare type GenerateAttestationOptionsOpts = {
+export declare type GenerateRegistrationOptionsOpts = {
     rpName: string;
     rpID: string;
     userID: string;
@@ -41,4 +41,4 @@ export declare const supportedCOSEAlgorithmIdentifiers: COSEAlgorithmIdentifier[
  * @param supportedAlgorithmIDs Array of numeric COSE algorithm identifiers supported for
  * attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms
  */
-export default function generateAttestationOptions(options: GenerateAttestationOptionsOpts): PublicKeyCredentialCreationOptionsJSON;
+export default function generateRegistrationOptions(options: GenerateRegistrationOptionsOpts): PublicKeyCredentialCreationOptionsJSON;

package/dist/{attestation/generateAttestationOptions.js → registration/generateRegistrationOptions.js}

@@ -70,7 +70,7 @@ const defaultSupportedAlgorithmIDs = exports.supportedCOSEAlgorithmIdentifiers.f
  * @param supportedAlgorithmIDs Array of numeric COSE algorithm identifiers supported for
  * attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms
  */
-function generateAttestationOptions(options) {
+function generateRegistrationOptions(options) {
     const { rpName, rpID, userID, userName, challenge = generateChallenge_1.default(), userDisplayName = userName, timeout = 60000, attestationType = 'none', excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs, } = options;
     /**
      * Prepare pubKeyCredParams from the array of algorithm ID's
@@ -113,5 +113,5 @@ function generateAttestationOptions(options) {
         extensions,
     };
 }
-exports.default = generateAttestationOptions;
-//# sourceMappingURL=generateAttestationOptions.js.map
+exports.default = generateRegistrationOptions;
+//# sourceMappingURL=generateRegistrationOptions.js.map

package/dist/registration/generateRegistrationOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateRegistrationOptions.js","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":";;;;;;AASA,0DAAkC;AAElC,qFAA6D;AAiB7D;;;;GAIG;AACU,QAAA,iCAAiC,GAA8B;IAC1E,mBAAmB;IACnB,CAAC,CAAC;IACF,QAAQ;IACR,CAAC,CAAC;IACF,mBAAmB;IACnB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,+BAA+B;IAC/B,CAAC,GAAG;IACJ,+BAA+B;IAC/B,CAAC,GAAG;IACJ,+BAA+B;IAC/B,CAAC,GAAG;IACJ,mEAAmE;IACnE,CAAC,KAAK;CACP,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAmC;IACpE,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,WAAW;CAC9B,CAAC;AAEF;;;GAGG;AACH,MAAM,4BAA4B,GAAG,yCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAwB,2BAA2B,CACjD,OAAwC;IAExC,MAAM,EACJ,MAAM,EACN,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,GAAG,2BAAiB,EAAE,EAC/B,eAAe,GAAG,QAAQ,EAC1B,OAAO,GAAG,KAAK,EACf,eAAe,GAAG,MAAM,EACxB,kBAAkB,GAAG,EAAE,EACvB,sBAAsB,GAAG,6BAA6B,EACtD,UAAU,EACV,qBAAqB,GAAG,4BAA4B,GACrD,GAAG,OAAO,CAAC;IAEZ;;OAEG;IACH,MAAM,gBAAgB,GAAoC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,GAAG,EAAE,EAAE;QACP,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC,CAAC;IAEJ;;;;;OAKG;IACH,IAAI,sBAAsB,CAAC,WAAW,KAAK,UAAU,EAAE;QACrD,sBAAsB,CAAC,kBAAkB,GAAG,IAAI,CAAC;KAClD;SAAM;QACL,sBAAsB,CAAC,kBAAkB,GAAG,KAAK,CAAC;KACnD;IAED,OAAO;QACL,SAAS,EAAE,mBAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QACtC,EAAE,EAAE;YACF,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,IAAI;SACT;QACD,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,eAAe;SAC7B;QACD,gBAAgB;QAChB,OAAO;QACP,WAAW,EAAE,eAAe;QAC5B,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,GAAG,IAAI;YACP,EAAE,EAAE,mBAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAY,CAAC;SACxC,CAAC,CAAC;QACH,sBAAsB;QACtB,UAAU;KACX,CAAC;AACJ,CAAC;AA3DD,8CA2DC"}

package/dist/registration/verifications/tpm/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/constants.ts"],"names":[],"mappings":";;;AAAA,sDAAsD;AACzC,QAAA,MAAM,GAA8B;IAC/C,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,6BAA6B;IACrC,MAAM,EAAE,6BAA6B;IACrC,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB;CAC7B,CAAC;AAEW,QAAA,OAAO,GAA8B;IAChD,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,kBAAkB;IAClB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;CACtB,CAAC;AAEW,QAAA,aAAa,GAA8B;IACtD,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,kBAAkB;CAC3B,CAAC;AAOW,QAAA,iBAAiB,GAAwC;IACpE,aAAa,EAAE;QACb,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,OAAO;QACb,EAAE,EAAE,MAAM;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,MAAM;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,OAAO;QACb,EAAE,EAAE,MAAM;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,wBAAwB;QAC9B,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,oBAAoB;QAC1B,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,MAAM;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,MAAM;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,qBAAqB;QAC3B,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,MAAM;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,mBAAmB;QACzB,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,KAAK;KACV;IACD,aAAa,EAAE;QACb,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,MAAM;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,eAAe;QACrB,EAAE,EAAE,MAAM;KACX;CACF,CAAC"}

package/dist/registration/verifications/tpm/parseCertInfo.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const constants_1 = require("./constants");
+/**
+ * Cut up a TPM attestation's certInfo into intelligible chunks
+ */
+function parseCertInfo(certInfo) {
+    let pointer = 0;
+    // Get a magic constant
+    const magic = certInfo.slice(pointer, (pointer += 4)).readUInt32BE(0);
+    // Determine the algorithm used for attestation
+    const typeBuffer = certInfo.slice(pointer, (pointer += 2));
+    const type = constants_1.TPM_ST[typeBuffer.readUInt16BE(0)];
+    // The name of a parent entity, can be ignored
+    const qualifiedSignerLength = certInfo.slice(pointer, (pointer += 2)).readUInt16BE(0);
+    const qualifiedSigner = certInfo.slice(pointer, (pointer += qualifiedSignerLength));
+    // Get the expected hash of `attsToBeSigned`
+    const extraDataLength = certInfo.slice(pointer, (pointer += 2)).readUInt16BE(0);
+    const extraData = certInfo.slice(pointer, (pointer += extraDataLength));
+    // Information about the TPM device's internal clock, can be ignored
+    const clockInfoBuffer = certInfo.slice(pointer, (pointer += 17));
+    const clockInfo = {
+        clock: clockInfoBuffer.slice(0, 8),
+        resetCount: clockInfoBuffer.slice(8, 12).readUInt32BE(0),
+        restartCount: clockInfoBuffer.slice(12, 16).readUInt32BE(0),
+        safe: !!clockInfoBuffer[16],
+    };
+    // TPM device firmware version
+    const firmwareVersion = certInfo.slice(pointer, (pointer += 8));
+    // Attested Name
+    const attestedNameLength = certInfo.slice(pointer, (pointer += 2)).readUInt16BE(0);
+    const attestedName = certInfo.slice(pointer, (pointer += attestedNameLength));
+    // Attested qualified name, can be ignored
+    const qualifiedNameLength = certInfo.slice(pointer, (pointer += 2)).readUInt16BE(0);
+    const qualifiedName = certInfo.slice(pointer, (pointer += qualifiedNameLength));
+    const attested = {
+        nameAlg: constants_1.TPM_ALG[attestedName.slice(0, 2).readUInt16BE(0)],
+        nameAlgBuffer: attestedName.slice(0, 2),
+        name: attestedName,
+        qualifiedName,
+    };
+    return {
+        magic,
+        type,
+        qualifiedSigner,
+        extraData,
+        clockInfo,
+        firmwareVersion,
+        attested,
+    };
+}
+exports.default = parseCertInfo;
+//# sourceMappingURL=parseCertInfo.js.map

package/dist/registration/verifications/tpm/parseCertInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseCertInfo.js","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/parseCertInfo.ts"],"names":[],"mappings":";;AAAA,2CAA8C;AAE9C;;GAEG;AACH,SAAwB,aAAa,CAAC,QAAgB;IACpD,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,uBAAuB;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEtE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,kBAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,8CAA8C;IAC9C,MAAM,qBAAqB,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,CAAC;IAEpF,4CAA4C;IAC5C,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC;IAExE,oEAAoE;IACpE,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG;QAChB,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;KAC5B,CAAC;IAEF,8BAA8B;IAC9B,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAEhE,gBAAgB;IAChB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,kBAAkB,CAAC,CAAC,CAAC;IAE9E,0CAA0C;IAC1C,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,mBAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1D,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,EAAE,YAAY;QAClB,aAAa;KACd,CAAC;IAEF,OAAO;QACL,KAAK;QACL,IAAI;QACJ,eAAe;QACf,SAAS;QACT,SAAS;QACT,eAAe;QACf,QAAQ;KACT,CAAC;AACJ,CAAC;AAtDD,gCAsDC"}

package/dist/{attestation → registration}/verifications/tpm/parsePubArea.js

@@ -5,16 +5,13 @@ const constants_1 = require("./constants");
  * Break apart a TPM attestation's pubArea buffer
  */
 function parsePubArea(pubArea) {
-    let pubBuffer = pubArea;
-    const typeBuffer = pubBuffer.slice(0, 2);
-    pubBuffer = pubBuffer.slice(2);
+    let pointer = 0;
+    const typeBuffer = pubArea.slice(pointer, (pointer += 2));
     const type = constants_1.TPM_ALG[typeBuffer.readUInt16BE(0)];
-    const nameAlgBuffer = pubBuffer.slice(0, 2);
-    pubBuffer = pubBuffer.slice(2);
+    const nameAlgBuffer = pubArea.slice(pointer, (pointer += 2));
     const nameAlg = constants_1.TPM_ALG[nameAlgBuffer.readUInt16BE(0)];
     // Get some authenticator attributes(?)
-    const objectAttributesInt = pubBuffer.slice(0, 4).readUInt32BE(0);
-    pubBuffer = pubBuffer.slice(4);
+    const objectAttributesInt = pubArea.slice(pointer, (pointer += 4)).readUInt32BE(0);
     const objectAttributes = {
         fixedTPM: !!(objectAttributesInt & 1),
         stClear: !!(objectAttributesInt & 2),
@@ -29,15 +26,12 @@ function parsePubArea(pubArea) {
         signOrEncrypt: !!(objectAttributesInt & 131072),
     };
     // Slice out the authPolicy of dynamic length
-    const authPolicyLength = pubBuffer.slice(0, 2).readUInt16BE(0);
-    pubBuffer = pubBuffer.slice(2);
-    const authPolicy = pubBuffer.slice(0, authPolicyLength);
-    pubBuffer = pubBuffer.slice(authPolicyLength);
+    const authPolicyLength = pubArea.slice(pointer, (pointer += 2)).readUInt16BE(0);
+    const authPolicy = pubArea.slice(pointer, (pointer += authPolicyLength));
     // Extract additional curve params according to type
     const parameters = {};
     if (type === 'TPM_ALG_RSA') {
-        const rsaBuffer = pubBuffer.slice(0, 10);
-        pubBuffer = pubBuffer.slice(10);
+        const rsaBuffer = pubArea.slice(pointer, (pointer += 10));
         parameters.rsa = {
             symmetric: constants_1.TPM_ALG[rsaBuffer.slice(0, 2).readUInt16BE(0)],
             scheme: constants_1.TPM_ALG[rsaBuffer.slice(2, 4).readUInt16BE(0)],
@@ -46,8 +40,7 @@ function parsePubArea(pubArea) {
         };
     }
     else if (type === 'TPM_ALG_ECC') {
-        const eccBuffer = pubBuffer.slice(0, 8);
-        pubBuffer = pubBuffer.slice(8);
+        const eccBuffer = pubArea.slice(pointer, (pointer += 8));
         parameters.ecc = {
             symmetric: constants_1.TPM_ALG[eccBuffer.slice(0, 2).readUInt16BE(0)],
             scheme: constants_1.TPM_ALG[eccBuffer.slice(2, 4).readUInt16BE(0)],
@@ -59,10 +52,8 @@ function parsePubArea(pubArea) {
         throw new Error(`Unexpected type "${type}" (TPM)`);
     }
     // Slice out unique of dynamic length
-    const uniqueLength = pubBuffer.slice(0, 2).readUInt16BE(0);
-    pubBuffer = pubBuffer.slice(2);
-    const unique = pubBuffer.slice(0, uniqueLength);
-    pubBuffer = pubBuffer.slice(uniqueLength);
+    const uniqueLength = pubArea.slice(pointer, (pointer += 2)).readUInt16BE(0);
+    const unique = pubArea.slice(pointer, (pointer += uniqueLength));
     return {
         type,
         nameAlg,

package/dist/registration/verifications/tpm/parsePubArea.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsePubArea.js","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/parsePubArea.ts"],"names":[],"mappings":";;AAAA,2CAAqD;AAErD;;GAEG;AACH,SAAwB,YAAY,CAAC,OAAe;IAClD,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,mBAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,mBAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvD,uCAAuC;IACvC,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,gBAAgB,GAAG;QACvB,QAAQ,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC;QACpC,WAAW,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC;QACxC,mBAAmB,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,EAAE,CAAC;QACjD,YAAY,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,GAAG,CAAC;QACnC,oBAAoB,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAC;QACpD,UAAU,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,KAAK,CAAC;QAC3C,OAAO,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACxC,aAAa,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,MAAM,CAAC;KAChD,CAAC;IAEF,6CAA6C;IAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC;IAEzE,oDAAoD;IACpD,MAAM,UAAU,GAAiD,EAAE,CAAC;IACpE,IAAI,IAAI,KAAK,aAAa,EAAE;QAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QAE1D,UAAU,CAAC,GAAG,GAAG;YACf,SAAS,EAAE,mBAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,mBAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9C,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;SACjD,CAAC;KACH;SAAM,IAAI,IAAI,KAAK,aAAa,EAAE;QACjC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzD,UAAU,CAAC,GAAG,GAAG;YACf,SAAS,EAAE,mBAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,mBAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,yBAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC7D,GAAG,EAAE,mBAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;SACpD,CAAC;KACH;SAAM;QACL,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,SAAS,CAAC,CAAC;KACpD;IAED,qCAAqC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC;IAEjE,OAAO;QACL,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,UAAU;QACV,UAAU;QACV,MAAM;KACP,CAAC;AACJ,CAAC;AAjED,+BAiEC"}

package/dist/registration/verifications/tpm/verifyTPM.d.ts

@@ -0,0 +1,2 @@
+import type { AttestationFormatVerifierOpts } from '../../verifyRegistrationResponse';
+export default function verifyTPM(options: AttestationFormatVerifierOpts): Promise<boolean>;