@simplewebauthn/server 3.0.0 → 4.3.0

package/dist/{attestation → registration}/verifications/tpm/verifyTPM.js

@@ -8,17 +8,18 @@ const asn1_x509_1 = require("@peculiar/asn1-x509");
 const decodeCredentialPublicKey_1 = __importDefault(require("../../../helpers/decodeCredentialPublicKey"));
 const convertCOSEtoPKCS_1 = require("../../../helpers/convertCOSEtoPKCS");
 const toHash_1 = __importDefault(require("../../../helpers/toHash"));
-const convertX509CertToPEM_1 = __importDefault(require("../../../helpers/convertX509CertToPEM"));
+const convertCertBufferToPEM_1 = __importDefault(require("../../../helpers/convertCertBufferToPEM"));
+const validateCertificatePath_1 = __importDefault(require("../../../helpers/validateCertificatePath"));
 const getCertificateInfo_1 = __importDefault(require("../../../helpers/getCertificateInfo"));
 const verifySignature_1 = __importDefault(require("../../../helpers/verifySignature"));
-const metadataService_1 = __importDefault(require("../../../metadata/metadataService"));
+const metadataService_1 = __importDefault(require("../../../services/metadataService"));
 const verifyAttestationWithMetadata_1 = __importDefault(require("../../../metadata/verifyAttestationWithMetadata"));
 const constants_1 = require("./constants");
 const parseCertInfo_1 = __importDefault(require("./parseCertInfo"));
 const parsePubArea_1 = __importDefault(require("./parsePubArea"));
 async function verifyTPM(options) {
     var _a;
-    const { aaguid, attStmt, authData, credentialPublicKey, clientDataHash } = options;
+    const { aaguid, attStmt, authData, credentialPublicKey, clientDataHash, rootCertificates } = options;
     const { ver, sig, alg, x5c, pubArea, certInfo } = attStmt;
     /**
      * Verify structures
@@ -211,9 +212,18 @@ async function verifyTPM(options) {
             throw new Error(`${err.message} (TPM)`);
         }
     }
+    else {
+        try {
+            // Try validating the certificate path using the root certificates set via SettingsService
+            await validateCertificatePath_1.default(x5c.map(convertCertBufferToPEM_1.default), rootCertificates);
+        }
+        catch (err) {
+            throw new Error(`${err.message} (TPM)`);
+        }
+    }
     // Verify signature over certInfo with the public key extracted from AIK certificate.
     // In the wise words of Yuriy Ackermann: "Get Martini friend, you are done!"
-    const leafCertPEM = convertX509CertToPEM_1.default(x5c[0]);
+    const leafCertPEM = convertCertBufferToPEM_1.default(x5c[0]);
     return verifySignature_1.default(sig, certInfo, leafCertPEM, hashAlg);
 }
 exports.default = verifyTPM;

package/dist/registration/verifications/tpm/verifyTPM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyTPM.js","sourceRoot":"","sources":["../../../../src/registration/verifications/tpm/verifyTPM.ts"],"names":[],"mappings":";;;;;AAAA,uDAAkD;AAClD,mDAO6B;AAI7B,2GAAmF;AACnF,0EAA2E;AAC3E,qEAA6C;AAC7C,qGAA6E;AAC7E,uGAA+E;AAC/E,6FAAqE;AACrE,uFAA+D;AAC/D,wFAAgE;AAChE,oHAA4F;AAE5F,2CAA+D;AAC/D,oEAA4C;AAC5C,kEAA0C;AAE3B,KAAK,UAAU,SAAS,CAAC,OAAsC;;IAC5E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAAE,GACxF,OAAO,CAAC;IACV,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE1D;;OAEG;IACH,IAAI,GAAG,KAAK,KAAK,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,yBAAyB,CAAC,CAAC;KAClE;IAED,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;KACrF;IAED,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;KACpE;IAED,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;KACvF;IAED,IAAI,CAAC,OAAO,EAAE;QACZ,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;KACxE;IAED,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;KACzE;IAED,MAAM,aAAa,GAAG,sBAAY,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC;IAE5D,yFAAyF;IACzF,2FAA2F;IAC3F,MAAM,aAAa,GAAG,mCAAyB,CAAC,mBAAmB,CAAC,CAAC;IAErE,IAAI,OAAO,KAAK,aAAa,EAAE;QAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,CAAC,CAAC,CAAC;QAExC,IAAI,CAAC,CAAC,EAAE;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;SACxD;QACD,IAAI,CAAC,CAAC,EAAE;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;SACxD;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAW,CAAC,EAAE;YAC/B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;SAChF;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;SACrF;QAED,MAAM,OAAO,GAAG,CAAW,CAAC;QAC5B,8FAA8F;QAC9F,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC;QAEzD,4CAA4C;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,IAAI,eAAe,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,cAAc,eAAe,YAAY,CAAC,CAAC;SAC7F;KACF;SAAM,IAAI,OAAO,KAAK,aAAa,EAAE;QACpC;;;WAGG;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,CAAC,CAAC,CAAC;QAExC,IAAI,CAAC,GAAG,EAAE;YACR,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;SAC1D;QACD,IAAI,CAAC,CAAC,EAAE;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;SACxD;QACD,IAAI,CAAC,CAAC,EAAE;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;SACxD;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAW,EAAE,CAAW,CAAC,CAAC,CAAC,EAAE;YAC7D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;SAC/E;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;SACrF;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QAC9C,MAAM,aAAa,GAAG,yBAAa,CAAE,GAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,cAAc,KAAK,aAAa,EAAE;YACpC,MAAM,IAAI,KAAK,CACb,mCAAmC,aAAa,gBAAgB,cAAc,aAAa,CAC5F,CAAC;SACH;KACF;SAAM;QACL,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,GAAG,CAAC,CAAC;KAC1D;IAED,MAAM,cAAc,GAAG,uBAAa,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC;IAEtE,IAAI,KAAK,KAAK,UAAU,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,gCAAgC,CAAC,CAAC;KACnF;IAED,IAAI,QAAQ,KAAK,uBAAuB,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,2CAA2C,CAAC,CAAC;KAC1F;IAED,mEAAmE;IACnE,MAAM,WAAW,GAAG,gBAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAE9E,uEAAuE;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IAE1E,+DAA+D;IAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;KAC1D;IAED,mEAAmE;IACnE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IAEhE,8FAA8F;IAC9F,MAAM,OAAO,GAAW,+BAAW,CAAC,GAAa,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,gBAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAEzD,gEAAgE;IAChE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;KAC/E;IAED;;OAEG;IACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;KAC/D;IAED,6DAA6D;IAC7D,MAAM,YAAY,GAAG,4BAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC;IAEnF,IAAI,kBAAkB,EAAE;QACtB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;KAC3E;IAED,mEAAmE;IACnE,IAAI,OAAO,KAAK,CAAC,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;KAC7E;IAED,wCAAwC;IACxC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;KAC5D;IAED,4CAA4C;IAC5C,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,SAAS,GAAG,GAAG,EAAE;QACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;KAChF;IAED,yCAAyC;IACzC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,GAAG,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;KAC9E;IAED;;OAEG;IACH,MAAM,UAAU,GAAG,uBAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uBAAW,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,UAAU,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;KAC7D;IAED,IAAI,qBAAyD,CAAC;IAC9D,IAAI,WAAyC,CAAC;IAC9C,UAAU,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,gCAAoB,EAAE;YACvC,qBAAqB,GAAG,uBAAS,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,kCAAsB,CAAC,CAAC;SAChF;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,6BAAiB,EAAE;YAC3C,WAAW,GAAG,uBAAS,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,4BAAgB,CAAC,CAAC;SAChE;IACH,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAI,CAAC,qBAAqB,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;KAC/E;IAED,6FAA6F;IAC7F,SAAS;IACT,IAAI,CAAC,CAAA,MAAA,qBAAqB,CAAC,CAAC,CAAC,CAAC,aAAa,0CAAG,CAAC,EAAE,MAAM,CAAA,EAAE;QACvD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;KACvF;IAED,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,iBAAiB,CAChF,qBAAqB,CAAC,CAAC,CAAC,CAAC,aAAa,CACvC,CAAC;IAEF,IAAI,CAAC,oBAAoB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;KAC/E;IAED,IAAI,CAAC,WAAW,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;KACjF;IAED,yFAAyF;IACzF,IAAI,CAAC,6BAAiB,CAAC,oBAAoB,CAAC,EAAE;QAC5C,MAAM,IAAI,KAAK,CAAC,qCAAqC,oBAAoB,SAAS,CAAC,CAAC;KACrF;IAED,wFAAwF;IACxF,4CAA4C;IAC5C,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE;QACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,WAAW,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;KAC9F;IAED,gGAAgG;IAChG,4DAA4D;IAE5D,wEAAwE;IACxE,MAAM,SAAS,GAAG,MAAM,yBAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,SAAS,EAAE;QACb,IAAI;YACF,MAAM,uCAA6B,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;SAC1D;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC;SACzC;KACF;SAAM;QACL,IAAI;YACF,0FAA0F;YAC1F,MAAM,iCAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAsB,CAAC,EAAE,gBAAgB,CAAC,CAAC;SAClF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC;SACzC;KACF;IAED,qFAAqF;IACrF,4EAA4E;IAC5E,MAAM,WAAW,GAAG,gCAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,yBAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AA9PD,4BA8PC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAU;IAKnC,MAAM,eAAe,GAAG,cAAc,CAAC;IACvC,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,MAAM,UAAU,GAAG,cAAc,CAAC;IAElC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,aAAiC,CAAC;IACtC,IAAI,eAAmC,CAAC;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACrB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACrB,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE;gBACjC,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;aAC9C;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE;gBACjC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;aACvC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE;gBACnC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;aACzC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,aAAa;QACb,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/registration/verifications/verifyAndroidKey.d.ts

@@ -0,0 +1,5 @@
+import type { AttestationFormatVerifierOpts } from '../verifyRegistrationResponse';
+/**
+ * Verify an attestation response with fmt 'android-key'
+ */
+export default function verifyAttestationAndroidKey(options: AttestationFormatVerifierOpts): Promise<boolean>;

package/dist/{attestation → registration}/verifications/verifyAndroidKey.js

@@ -25,14 +25,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const asn1_schema_1 = require("@peculiar/asn1-schema");
 const asn1_x509_1 = require("@peculiar/asn1-x509");
 const asn1_android_1 = require("@peculiar/asn1-android");
-const convertX509CertToPEM_1 = __importDefault(require("../../helpers/convertX509CertToPEM"));
+const convertCertBufferToPEM_1 = __importDefault(require("../../helpers/convertCertBufferToPEM"));
+const validateCertificatePath_1 = __importDefault(require("../../helpers/validateCertificatePath"));
 const verifySignature_1 = __importDefault(require("../../helpers/verifySignature"));
 const convertCOSEtoPKCS_1 = __importStar(require("../../helpers/convertCOSEtoPKCS"));
-const metadataService_1 = __importDefault(require("../../metadata/metadataService"));
+const metadataService_1 = __importDefault(require("../../services/metadataService"));
 const verifyAttestationWithMetadata_1 = __importDefault(require("../../metadata/verifyAttestationWithMetadata"));
+/**
+ * Verify an attestation response with fmt 'android-key'
+ */
 async function verifyAttestationAndroidKey(options) {
     var _a;
-    const { authData, clientDataHash, attStmt, credentialPublicKey, aaguid } = options;
+    const { authData, clientDataHash, attStmt, credentialPublicKey, aaguid, rootCertificates } = options;
     const { x5c, sig, alg } = attStmt;
     if (!x5c) {
         throw new Error('No attestation certificate provided in attestation statement (AndroidKey)');
@@ -71,12 +75,6 @@ async function verifyAttestationAndroidKey(options) {
     if (softwareEnforced.allApplications !== undefined) {
         throw new Error('teeEnforced contained "allApplications [600]" tag (AndroidKey)');
     }
-    // TODO: Confirm that the root certificate is an expected certificate
-    // const rootCertPEM = convertX509CertToPEM(x5c[x5c.length - 1]);
-    // console.log(rootCertPEM);
-    // if (rootCertPEM !== expectedRootCert) {
-    //   throw new Error('Root certificate was not expected certificate (AndroidKey)');
-    // }
     const statement = await metadataService_1.default.getStatement(aaguid);
     if (statement) {
         try {
@@ -86,12 +84,19 @@ async function verifyAttestationAndroidKey(options) {
             throw new Error(`${err.message} (AndroidKey)`);
         }
     }
+    else {
+        try {
+            // Try validating the certificate path using the root certificates set via SettingsService
+            await validateCertificatePath_1.default(x5c.map(convertCertBufferToPEM_1.default), rootCertificates);
+        }
+        catch (err) {
+            throw new Error(`${err.message} (AndroidKey)`);
+        }
+    }
     const signatureBase = Buffer.concat([authData, clientDataHash]);
-    const leafCertPEM = convertX509CertToPEM_1.default(x5c[0]);
+    const leafCertPEM = convertCertBufferToPEM_1.default(x5c[0]);
     const hashAlg = convertCOSEtoPKCS_1.COSEALGHASH[alg];
     return verifySignature_1.default(sig, signatureBase, leafCertPEM, hashAlg);
 }
 exports.default = verifyAttestationAndroidKey;
-// TODO: Find the most up-to-date expected root cert, the one from Yuriy's article doesn't match
-const expectedRootCert = ``;
 //# sourceMappingURL=verifyAndroidKey.js.map

package/dist/registration/verifications/verifyAndroidKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAndroidKey.js","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAndroidKey.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,uDAAkD;AAClD,mDAAkD;AAClD,yDAA8E;AAI9E,kGAA0E;AAC1E,oGAA4E;AAC5E,oFAA4D;AAC5D,qFAAiF;AACjF,qFAA6D;AAC7D,iHAAyF;AAEzF;;GAEG;AACY,KAAK,UAAU,2BAA2B,CACvD,OAAsC;;IAEtC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,GACxF,OAAO,CAAC;IACV,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAElC,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;KAC9F;IAED,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;KAC5F;IAED,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;KAC3E;IAED,uFAAuF;IACvF,kDAAkD;IAClD,MAAM,UAAU,GAAG,uBAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uBAAW,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAClC,UAAU,CAAC,cAAc,CAAC,oBAAoB,CAAC,gBAAgB,CAChE,CAAC;IAEF,0CAA0C;IAC1C,MAAM,cAAc,GAAG,2BAAiB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE;QAC5C,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;KAC3F;IAED,4DAA4D;IAC5D,MAAM,WAAW,GAAG,MAAA,UAAU,CAAC,cAAc,CAAC,UAAU,0CAAE,IAAI,CAC5D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,mCAAoB,CAC3C,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;KACzE;IAED,MAAM,iBAAiB,GAAG,uBAAS,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,6BAAc,CAAC,CAAC;IAEjF,4BAA4B;IAC5B,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,CAAC;IAElF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;QACpE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;KACzF;IAED,4FAA4F;IAC5F,aAAa;IACb,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE;QAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;KACnF;IAED,IAAI,gBAAgB,CAAC,eAAe,KAAK,SAAS,EAAE;QAClD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;KACnF;IAED,MAAM,SAAS,GAAG,MAAM,yBAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,SAAS,EAAE;QACb,IAAI;YACF,MAAM,uCAA6B,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;SAC1D;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC;SAChD;KACF;SAAM;QACL,IAAI;YACF,0FAA0F;YAC1F,MAAM,iCAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAsB,CAAC,EAAE,gBAAgB,CAAC,CAAC;SAClF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC;SAChD;KACF;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,gCAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,+BAAW,CAAC,GAAa,CAAC,CAAC;IAE3C,OAAO,yBAAe,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAlFD,8CAkFC"}

package/dist/registration/verifications/verifyAndroidSafetyNet.d.ts

@@ -0,0 +1,5 @@
+import type { AttestationFormatVerifierOpts } from '../verifyRegistrationResponse';
+/**
+ * Verify an attestation response with fmt 'android-safetynet'
+ */
+export default function verifyAttestationAndroidSafetyNet(options: AttestationFormatVerifierOpts): Promise<boolean>;

package/dist/{attestation → registration}/verifications/verifyAndroidSafetyNet.js

@@ -8,14 +8,14 @@ const toHash_1 = __importDefault(require("../../helpers/toHash"));
 const verifySignature_1 = __importDefault(require("../../helpers/verifySignature"));
 const getCertificateInfo_1 = __importDefault(require("../../helpers/getCertificateInfo"));
 const validateCertificatePath_1 = __importDefault(require("../../helpers/validateCertificatePath"));
-const convertX509CertToPEM_1 = __importDefault(require("../../helpers/convertX509CertToPEM"));
-const metadataService_1 = __importDefault(require("../../metadata/metadataService"));
+const convertCertBufferToPEM_1 = __importDefault(require("../../helpers/convertCertBufferToPEM"));
+const metadataService_1 = __importDefault(require("../../services/metadataService"));
 const verifyAttestationWithMetadata_1 = __importDefault(require("../../metadata/verifyAttestationWithMetadata"));
 /**
  * Verify an attestation response with fmt 'android-safetynet'
  */
 async function verifyAttestationAndroidSafetyNet(options) {
-    const { attStmt, clientDataHash, authData, aaguid, verifyTimestampMS = true } = options;
+    const { attStmt, clientDataHash, authData, aaguid, rootCertificates, verifyTimestampMS = true, } = options;
     const { response, ver } = attStmt;
     if (!ver) {
         throw new Error('No ver value in attestation (SafetyNet)');
@@ -81,10 +81,9 @@ async function verifyAttestationAndroidSafetyNet(options) {
         }
     }
     else {
-        // Validate certificate path using a fixed global root cert
-        const path = HEADER.x5c.concat([GlobalSignRootCAR2]).map(convertX509CertToPEM_1.default);
         try {
-            await validateCertificatePath_1.default(path);
+            // Try validating the certificate path using the root certificates set via SettingsService
+            await validateCertificatePath_1.default(HEADER.x5c.map(convertCertBufferToPEM_1.default), rootCertificates);
         }
         catch (err) {
             throw new Error(`${err.message} (SafetyNet)`);
@@ -98,7 +97,7 @@ async function verifyAttestationAndroidSafetyNet(options) {
      */
     const signatureBaseBuffer = Buffer.from(`${jwtParts[0]}.${jwtParts[1]}`);
     const signatureBuffer = base64url_1.default.toBuffer(SIGNATURE);
-    const leafCertPEM = convertX509CertToPEM_1.default(leafCertBuffer);
+    const leafCertPEM = convertCertBufferToPEM_1.default(leafCertBuffer);
     const verified = verifySignature_1.default(signatureBuffer, signatureBaseBuffer, leafCertPEM);
     /**
      * END Verify Signature
@@ -106,24 +105,4 @@ async function verifyAttestationAndroidSafetyNet(options) {
     return verified;
 }
 exports.default = verifyAttestationAndroidSafetyNet;
-/**
- * This "GS Root R2" root certificate was downloaded from https://pki.goog/gsr2/GSR2.crt
- * on 08/10/2019 and then run through `base64url.encode()` to get this representation.
- *
- * The certificate is valid until Dec 15, 2021
- */
-const GlobalSignRootCAR2 = 'MIIDujCCAqKgAwIBAgILBAAAAAABD4Ym5g0wDQYJKoZIhvcNAQEFBQAwTDEgMB4GA1UEC' +
-    'xMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhc' +
-    'NMDYxMjE1MDgwMDAwWhcNMjExMjE1MDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEGA' +
-    '1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKb' +
-    'PJA6-Lm8omUVCxKs-IVSbC9N_hHD6ErPLv4dfxn-G07IwXNb9rfF73OX4YJYJkhD10FPe-3t-c4isUoh7SqbKSaZeqKeMW' +
-    'hG8eoLrvozps6yWJQeXSpkqBy-0Hne_ig-1AnwblrjFuTosvNYSuetZfeLQBoZfXklqtTleiDTsvHgMCJiEbKjNS7SgfQx' +
-    '5TfC4LcshytVsW33hoCmEofnTlEnLJGKRILzdC9XZzPnqJworc5HGnRusyMvo4KD0L5CLTfuwNhv2GXqF4G3yYROIXJ_gk' +
-    'wpRl4pazq-r1feqCapgvdzZX99yqWATXgAByUr6P6TqBwMhAo6CygPCm48CAwEAAaOBnDCBmTAOBgNVHQ8BAf8EBAMCAQY' +
-    'wDwYDVR0TAQH_BAUwAwEB_zAdBgNVHQ4EFgQUm-IHV2ccHsBqBt5ZtJot39wZhi4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0c' +
-    'DovL2NybC5nbG9iYWxzaWduLm5ldC9yb290LXIyLmNybDAfBgNVHSMEGDAWgBSb4gdXZxwewGoG3lm0mi3f3BmGLjANBgk' +
-    'qhkiG9w0BAQUFAAOCAQEAmYFThxxol4aR7OBKuEQLq4GsJ0_WwbgcQ3izDJr86iw8bmEbTUsp9Z8FHSbBuOmDAGJFtqkIk' +
-    '7mpM0sYmsL4h4hO291xNBrBVNpGP-DTKqttVCL1OmLNIG-6KYnX3ZHu01yiPqFbQfXf5WRDLenVOavSot-3i9DAgBkcRcA' +
-    'tjOj4LaR0VknFBbVPFd5uRHg5h6h-u_N5GJG79G-dwfCMNYxdAfvDbbnvRG15RjF-Cv6pgsH_76tuIMRQyV-dTZsXjAzlA' +
-    'cmgQWpzU_qlULRuJQ_7TBj0_VLZjmmx6BEP3ojY-x1J96relc8geMJgEtslQIxq_H5COEBkEveegeGTLg';
 //# sourceMappingURL=verifyAndroidSafetyNet.js.map

package/dist/registration/verifications/verifyAndroidSafetyNet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAndroidSafetyNet.js","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAndroidSafetyNet.ts"],"names":[],"mappings":";;;;;AAAA,0DAAkC;AAIlC,kEAA0C;AAC1C,oFAA4D;AAC5D,0FAAkE;AAClE,oGAA4E;AAC5E,kGAA0E;AAC1E,qFAA6D;AAC7D,iHAAyF;AAEzF;;GAEG;AACY,KAAK,UAAU,iCAAiC,CAC7D,OAAsC;IAEtC,MAAM,EACJ,OAAO,EACP,cAAc,EACd,QAAQ,EACR,MAAM,EACN,gBAAgB,EAChB,iBAAiB,GAAG,IAAI,GACzB,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAElC,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;KAC5D;IAED,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;KACrF;IAED,0BAA0B;IAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAuB,IAAI,CAAC,KAAK,CAAC,mBAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAwB,IAAI,CAAC,KAAK,CAAC,mBAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAA0B,QAAQ,CAAC,CAAC,CAAC,CAAC;IAErD;;OAEG;IACH,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAExD,IAAI,iBAAiB,EAAE;QACrB,qCAAqC;QACrC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,WAAW,qBAAqB,GAAG,eAAe,CAAC,CAAC;SAC3F;QAED,+EAA+E;QAC/E,MAAM,kBAAkB,GAAG,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC;QACnD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,IAAI,kBAAkB,GAAG,GAAG,EAAE;YAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,kBAAkB,2BAA2B,CAAC,CAAC;SACtF;KACF;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,gBAAM,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErD,IAAI,KAAK,KAAK,aAAa,EAAE;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;KAC/D;IAED,IAAI,CAAC,eAAe,EAAE;QACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;KAClE;IACD;;OAEG;IAEH;;OAEG;IACH,MAAM,cAAc,GAAG,mBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,4BAAkB,CAAC,cAAc,CAAC,CAAC;IAExD,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;IAEjC,qDAAqD;IACrD,+FAA+F;IAC/F,IAAI,OAAO,CAAC,EAAE,KAAK,oBAAoB,EAAE;QACvC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;KACrF;IAED,MAAM,SAAS,GAAG,MAAM,yBAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,SAAS,EAAE;QACb,IAAI;YACF,6DAA6D;YAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnD,MAAM,uCAA6B,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;SACjE;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,IAAI;YACF,0FAA0F;YAC1F,MAAM,iCAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAsB,CAAC,EAAE,gBAAgB,CAAC,CAAC;SACzF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC;SAC/C;KACF;IACD;;OAEG;IAEH;;OAEG;IACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,mBAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,gCAAsB,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,yBAAe,CAAC,eAAe,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;IACpF;;OAEG;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAhHD,oDAgHC"}

package/dist/registration/verifications/verifyApple.d.ts

@@ -0,0 +1,2 @@
+import type { AttestationFormatVerifierOpts } from '../verifyRegistrationResponse';
+export default function verifyApple(options: AttestationFormatVerifierOpts): Promise<boolean>;

package/dist/{attestation → registration}/verifications/verifyApple.js

@@ -6,11 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const asn1_schema_1 = require("@peculiar/asn1-schema");
 const asn1_x509_1 = require("@peculiar/asn1-x509");
 const validateCertificatePath_1 = __importDefault(require("../../helpers/validateCertificatePath"));
-const convertX509CertToPEM_1 = __importDefault(require("../../helpers/convertX509CertToPEM"));
+const convertCertBufferToPEM_1 = __importDefault(require("../../helpers/convertCertBufferToPEM"));
 const toHash_1 = __importDefault(require("../../helpers/toHash"));
 const convertCOSEtoPKCS_1 = __importDefault(require("../../helpers/convertCOSEtoPKCS"));
 async function verifyApple(options) {
-    const { attStmt, authData, clientDataHash, credentialPublicKey } = options;
+    const { attStmt, authData, clientDataHash, credentialPublicKey, rootCertificates } = options;
     const { x5c } = attStmt;
     if (!x5c) {
         throw new Error('No attestation certificate provided in attestation statement (Apple)');
@@ -18,10 +18,8 @@ async function verifyApple(options) {
     /**
      * Verify certificate path
      */
-    const certPath = x5c.map(convertX509CertToPEM_1.default);
-    certPath.push(AppleWebAuthnRootCertificate);
     try {
-        await validateCertificatePath_1.default(certPath);
+        await validateCertificatePath_1.default(x5c.map(convertCertBufferToPEM_1.default), rootCertificates);
     }
     catch (err) {
         throw new Error(`${err.message} (Apple)`);
@@ -62,25 +60,4 @@ async function verifyApple(options) {
     return true;
 }
 exports.default = verifyApple;
-/**
- * Apple WebAuthn Root CA PEM
- *
- * Downloaded from https://www.apple.com/certificateauthority/Apple_WebAuthn_Root_CA.pem
- *
- * Valid until 03/14/2045 @ 5:00 PM PST
- */
-const AppleWebAuthnRootCertificate = `-----BEGIN CERTIFICATE-----
-MIICEjCCAZmgAwIBAgIQaB0BbHo84wIlpQGUKEdXcTAKBggqhkjOPQQDAzBLMR8w
-HQYDVQQDDBZBcHBsZSBXZWJBdXRobiBSb290IENBMRMwEQYDVQQKDApBcHBsZSBJ
-bmMuMRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTIwMDMxODE4MjEzMloXDTQ1MDMx
-NTAwMDAwMFowSzEfMB0GA1UEAwwWQXBwbGUgV2ViQXV0aG4gUm9vdCBDQTETMBEG
-A1UECgwKQXBwbGUgSW5jLjETMBEGA1UECAwKQ2FsaWZvcm5pYTB2MBAGByqGSM49
-AgEGBSuBBAAiA2IABCJCQ2pTVhzjl4Wo6IhHtMSAzO2cv+H9DQKev3//fG59G11k
-xu9eI0/7o6V5uShBpe1u6l6mS19S1FEh6yGljnZAJ+2GNP1mi/YK2kSXIuTHjxA/
-pcoRf7XkOtO4o1qlcaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJtdk
-2cV4wlpn0afeaxLQG2PxxtcwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2cA
-MGQCMFrZ+9DsJ1PW9hfNdBywZDsWDbWFp28it1d/5w2RPkRX3Bbn/UbDTNLx7Jr3
-jAGGiQIwHFj+dJZYUJR786osByBelJYsVZd2GbHQu209b5RCmGQ21gpSAk9QZW4B
-1bWeT0vT
------END CERTIFICATE-----`;
 //# sourceMappingURL=verifyApple.js.map

package/dist/registration/verifications/verifyApple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyApple.js","sourceRoot":"","sources":["../../../src/registration/verifications/verifyApple.ts"],"names":[],"mappings":";;;;;AAAA,uDAAkD;AAClD,mDAAkD;AAIlD,oGAA4E;AAC5E,kGAA0E;AAC1E,kEAA0C;AAC1C,wFAAgE;AAEjD,KAAK,UAAU,WAAW,CACvC,OAAsC;IAEtC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7F,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAExB,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;KACzF;IAED;;OAEG;IACH,IAAI;QACF,MAAM,iCAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAsB,CAAC,EAAE,gBAAgB,CAAC,CAAC;KAClF;IAAC,OAAO,GAAG,EAAE;QACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC;KAC3C;IAED;;OAEG;IACH,MAAM,cAAc,GAAG,uBAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uBAAW,CAAC,CAAC;IAC5D,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC;IAE3E,IAAI,CAAC,UAAU,EAAE;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;KACxD;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,wBAAwB,CAAC,CAAC;IAErF,IAAI,CAAC,YAAY,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;KAChF;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,gBAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAErE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;KAClE;IAED;;OAEG;IACH,MAAM,cAAc,GAAG,2BAAiB,CAAC,mBAAmB,CAAC,CAAC;IAC9D,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAEpF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE;QACpD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;KACrF;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AA7DD,8BA6DC"}

package/dist/registration/verifications/verifyFIDOU2F.d.ts

@@ -0,0 +1,5 @@
+import type { AttestationFormatVerifierOpts } from '../verifyRegistrationResponse';
+/**
+ * Verify an attestation response with fmt 'fido-u2f'
+ */
+export default function verifyAttestationFIDOU2F(options: AttestationFormatVerifierOpts): Promise<boolean>;

package/dist/{attestation → registration}/verifications/verifyFIDOU2F.js

@@ -4,13 +4,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const convertCOSEtoPKCS_1 = __importDefault(require("../../helpers/convertCOSEtoPKCS"));
-const convertX509CertToPEM_1 = __importDefault(require("../../helpers/convertX509CertToPEM"));
+const convertCertBufferToPEM_1 = __importDefault(require("../../helpers/convertCertBufferToPEM"));
+const validateCertificatePath_1 = __importDefault(require("../../helpers/validateCertificatePath"));
 const verifySignature_1 = __importDefault(require("../../helpers/verifySignature"));
 /**
  * Verify an attestation response with fmt 'fido-u2f'
  */
-function verifyAttestationFIDOU2F(options) {
-    const { attStmt, clientDataHash, rpIdHash, credentialID, credentialPublicKey, aaguid = '', } = options;
+async function verifyAttestationFIDOU2F(options) {
+    const { attStmt, clientDataHash, rpIdHash, credentialID, credentialPublicKey, aaguid = '', rootCertificates, } = options;
     const reservedByte = Buffer.from([0x00]);
     const publicKey = convertCOSEtoPKCS_1.default(credentialPublicKey);
     const signatureBase = Buffer.concat([
@@ -32,7 +33,14 @@ function verifyAttestationFIDOU2F(options) {
     if (aaguidToHex !== 0x00) {
         throw new Error(`AAGUID "${aaguidToHex}" was not expected value`);
     }
-    const leafCertPEM = convertX509CertToPEM_1.default(x5c[0]);
+    try {
+        // Try validating the certificate path using the root certificates set via SettingsService
+        await validateCertificatePath_1.default(x5c.map(convertCertBufferToPEM_1.default), rootCertificates);
+    }
+    catch (err) {
+        throw new Error(`${err.message} (FIDOU2F)`);
+    }
+    const leafCertPEM = convertCertBufferToPEM_1.default(x5c[0]);
     return verifySignature_1.default(sig, signatureBase, leafCertPEM);
 }
 exports.default = verifyAttestationFIDOU2F;

package/dist/registration/verifications/verifyFIDOU2F.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyFIDOU2F.js","sourceRoot":"","sources":["../../../src/registration/verifications/verifyFIDOU2F.ts"],"names":[],"mappings":";;;;;AAEA,wFAAgE;AAChE,kGAA0E;AAC1E,oGAA4E;AAC5E,oFAA4D;AAE5D;;GAEG;AACY,KAAK,UAAU,wBAAwB,CACpD,OAAsC;IAEtC,MAAM,EACJ,OAAO,EACP,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,mBAAmB,EACnB,MAAM,GAAG,EAAE,EACX,gBAAgB,GACjB,GAAG,OAAO,CAAC;IAEZ,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,2BAAiB,CAAC,mBAAmB,CAAC,CAAC;IAEzD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QAClC,YAAY;QACZ,QAAQ;QACR,cAAc;QACd,YAAY;QACZ,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAE7B,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;KAC3F;IAED,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;KACzF;IAED,gEAAgE;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,WAAW,KAAK,IAAI,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,0BAA0B,CAAC,CAAC;KACnE;IAED,IAAI;QACF,0FAA0F;QAC1F,MAAM,iCAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAsB,CAAC,EAAE,gBAAgB,CAAC,CAAC;KAClF;IAAC,OAAO,GAAG,EAAE;QACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC;KAC7C;IAED,MAAM,WAAW,GAAG,gCAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,OAAO,yBAAe,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAlDD,2CAkDC"}

package/dist/registration/verifications/verifyPacked.d.ts

@@ -0,0 +1,5 @@
+import type { AttestationFormatVerifierOpts } from '../verifyRegistrationResponse';
+/**
+ * Verify an attestation response with fmt 'packed'
+ */
+export default function verifyAttestationPacked(options: AttestationFormatVerifierOpts): Promise<boolean>;

package/dist/{attestation → registration}/verifications/verifyPacked.js

@@ -25,19 +25,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const elliptic_1 = __importDefault(require("elliptic"));
 const node_rsa_1 = __importDefault(require("node-rsa"));
 const convertCOSEtoPKCS_1 = __importStar(require("../../helpers/convertCOSEtoPKCS"));
-const constants_1 = require("../../helpers/constants");
 const toHash_1 = __importDefault(require("../../helpers/toHash"));
-const convertX509CertToPEM_1 = __importDefault(require("../../helpers/convertX509CertToPEM"));
+const convertCertBufferToPEM_1 = __importDefault(require("../../helpers/convertCertBufferToPEM"));
+const validateCertificatePath_1 = __importDefault(require("../../helpers/validateCertificatePath"));
 const getCertificateInfo_1 = __importDefault(require("../../helpers/getCertificateInfo"));
 const verifySignature_1 = __importDefault(require("../../helpers/verifySignature"));
 const decodeCredentialPublicKey_1 = __importDefault(require("../../helpers/decodeCredentialPublicKey"));
-const metadataService_1 = __importDefault(require("../../metadata/metadataService"));
+const metadataService_1 = __importDefault(require("../../services/metadataService"));
 const verifyAttestationWithMetadata_1 = __importDefault(require("../../metadata/verifyAttestationWithMetadata"));
 /**
  * Verify an attestation response with fmt 'packed'
  */
 async function verifyAttestationPacked(options) {
-    const { attStmt, clientDataHash, authData, credentialPublicKey, aaguid } = options;
+    const { attStmt, clientDataHash, authData, credentialPublicKey, aaguid, rootCertificates } = options;
     const { sig, x5c, alg } = attStmt;
     if (!sig) {
         throw new Error('No attestation signature provided in attestation statement (Packed)');
@@ -49,7 +49,7 @@ async function verifyAttestationPacked(options) {
     let verified = false;
     const pkcsPublicKey = convertCOSEtoPKCS_1.default(credentialPublicKey);
     if (x5c) {
-        const leafCert = convertX509CertToPEM_1.default(x5c[0]);
+        const leafCert = convertCertBufferToPEM_1.default(x5c[0]);
         const { subject, basicConstraintsCA, version, notBefore, notAfter } = getCertificateInfo_1.default(x5c[0]);
         const { OU, CN, O, C } = subject;
         if (OU !== 'Authenticator Attestation') {
@@ -85,8 +85,7 @@ async function verifyAttestationPacked(options) {
         if (statement) {
             // The presence of x5c means this is a full attestation. Check to see if attestationTypes
             // includes packed attestations.
-            if (statement.attestationTypes.indexOf(constants_1.FIDO_METADATA_ATTESTATION_TYPES.ATTESTATION_BASIC_FULL) <
-                0) {
+            if (statement.attestationTypes.indexOf('basic_full') < 0) {
                 throw new Error('Metadata does not indicate support for full attestations (Packed|Full)');
             }
             try {
@@ -96,6 +95,15 @@ async function verifyAttestationPacked(options) {
                 throw new Error(`${err.message} (Packed|Full)`);
             }
         }
+        else {
+            try {
+                // Try validating the certificate path using the root certificates set via SettingsService
+                await validateCertificatePath_1.default(x5c.map(convertCertBufferToPEM_1.default), rootCertificates);
+            }
+            catch (err) {
+                throw new Error(`${err.message} (Packed|Full)`);
+            }
+        }
         verified = verifySignature_1.default(sig, signatureBase, leafCert);
     }
     else {

package/dist/registration/verifications/verifyPacked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyPacked.js","sourceRoot":"","sources":["../../../src/registration/verifications/verifyPacked.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,wDAAgC;AAChC,wDAA+B;AAI/B,qFAMyC;AACzC,kEAA0C;AAC1C,kGAA0E;AAC1E,oGAA4E;AAC5E,0FAAkE;AAClE,oFAA4D;AAC5D,wGAAgF;AAChF,qFAA6D;AAC7D,iHAAyF;AAEzF;;GAEG;AACY,KAAK,UAAU,uBAAuB,CACnD,OAAsC;IAEtC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,GACxF,OAAO,CAAC;IAEV,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAElC,IAAI,CAAC,GAAG,EAAE;QACR,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;KACxF;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;QAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,4BAA4B,CAAC,CAAC;KAChF;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IAEhE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,aAAa,GAAG,2BAAiB,CAAC,mBAAmB,CAAC,CAAC;IAE7D,IAAI,GAAG,EAAE;QACP,MAAM,QAAQ,GAAG,gCAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,4BAAkB,CACtF,GAAG,CAAC,CAAC,CAAC,CACP,CAAC;QAEF,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC;QAEjC,IAAI,EAAE,KAAK,2BAA2B,EAAE;YACtC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;SACrF;QAED,IAAI,CAAC,EAAE,EAAE;YACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;SAC3D;QAED,IAAI,CAAC,CAAC,EAAE;YACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;SAC1D;QAED,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;SACpF;QAED,IAAI,kBAAkB,EAAE;YACtB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;SACnF;QAED,IAAI,OAAO,KAAK,CAAC,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;SACrF;QAED,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,SAAS,GAAG,GAAG,EAAE;YACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;SACxF;QAED,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACjB,IAAI,QAAQ,GAAG,GAAG,EAAE;YAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;SACtF;QAED,gGAAgG;QAChG,4DAA4D;QAE5D,qFAAqF;QACrF,MAAM,SAAS,GAAG,MAAM,yBAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE;YACb,yFAAyF;YACzF,gCAAgC;YAChC,IAAI,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBACxD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;aAC3F;YAED,IAAI;gBACF,MAAM,uCAA6B,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;aAC1D;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC;aACjD;SACF;aAAM;YACL,IAAI;gBACF,0FAA0F;gBAC1F,MAAM,iCAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAsB,CAAC,EAAE,gBAAgB,CAAC,CAAC;aAClF;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC;aACjD;SACF;QAED,QAAQ,GAAG,yBAAe,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;KAC1D;SAAM;QACL,MAAM,aAAa,GAAG,mCAAyB,CAAC,mBAAmB,CAAC,CAAC;QAErE,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,GAAG,CAAC,CAAC;QAE5C,IAAI,CAAC,GAAG,EAAE;YACR,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;SAClE;QAED,MAAM,OAAO,GAAW,+BAAW,CAAC,GAAa,CAAC,CAAC;QAEnD,IAAI,GAAG,KAAK,2BAAO,CAAC,GAAG,EAAE;YACvB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,CAAC,GAAG,EAAE;gBACR,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;aACrE;YAED,MAAM,iBAAiB,GAAG,gBAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAEzD;;;;;;;;eAQG;YACH,MAAM,EAAE,GAAG,IAAI,kBAAQ,CAAC,EAAE,CAAC,2BAAO,CAAC,GAAa,CAAC,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAE5C,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;SAC/C;aAAM,IAAI,GAAG,KAAK,2BAAO,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,CAAC,CAAC,CAAC;YAExC,IAAI,CAAC,CAAC,EAAE;gBACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;aAC/D;YAED,MAAM,aAAa,GAAG,iCAAa,CAAC,GAAa,CAAC,CAAC;YAEnD,0BAA0B;YAC1B,MAAM,GAAG,GAAG,IAAI,kBAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC,SAAS,CACX;gBACE,CAAC,EAAE,CAAW;gBACd,CAAC,EAAE,KAAK;aACT,EACD,mBAAmB,CACpB,CAAC;YAEF,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;SAC3C;aAAM,IAAI,GAAG,KAAK,2BAAO,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,4BAAQ,CAAC,CAAC,CAAC,CAAC;YAExC,IAAI,CAAC,CAAC,EAAE;gBACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;aAC/D;YAED,MAAM,iBAAiB,GAAG,gBAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAEzD,MAAM,GAAG,GAAG,IAAI,kBAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1C,GAAG,CAAC,aAAa,CAAC,CAAW,CAAC,CAAC;YAE/B,mCAAmC;YACnC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;SAC9D;KACF;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAlKD,0CAkKC"}

package/dist/registration/verifyRegistrationResponse.d.ts

@@ -0,0 +1,71 @@
+/// <reference types="node" />
+import { RegistrationCredentialJSON, COSEAlgorithmIdentifier } from '@simplewebauthn/typescript-types';
+import { AttestationFormat, AttestationStatement } from '../helpers/decodeAttestationObject';
+export declare type VerifyRegistrationResponseOpts = {
+    credential: RegistrationCredentialJSON;
+    expectedChallenge: string | ChallengeVerifier;
+    expectedOrigin: string | string[];
+    expectedRPID?: string | string[];
+    requireUserVerification?: boolean;
+    supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
+};
+export declare type ChallengeVerifier = (challenge: string) => boolean;
+/**
+ * Verify that the user has legitimately completed the registration process
+ *
+ * **Options:**
+ *
+ * @param credential Authenticator credential returned by browser's `startAuthentication()`
+ * @param expectedChallenge The base64url-encoded `options.challenge` returned by
+ * `generateRegistrationOptions()`
+ * @param expectedOrigin Website URL (or array of URLs) that the registration should have occurred on
+ * @param expectedRPID RP ID (or array of IDs) that was specified in the registration options
+ * @param requireUserVerification (Optional) Enforce user verification by the authenticator
+ * (via PIN, fingerprint, etc...)
+ * @param supportedAlgorithmIDs Array of numeric COSE algorithm identifiers supported for
+ * attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ */
+export default function verifyRegistrationResponse(options: VerifyRegistrationResponseOpts): Promise<VerifiedRegistrationResponse>;
+/**
+ * Result of registration verification
+ *
+ * @param verified If the assertion response could be verified
+ * @param registrationInfo.fmt Type of attestation
+ * @param registrationInfo.counter The number of times the authenticator reported it has been used.
+ * Should be kept in a DB for later reference to help prevent replay attacks
+ * @param registrationInfo.aaguid Authenticator's Attestation GUID indicating the type of the
+ * authenticator
+ * @param registrationInfo.credentialPublicKey The credential's public key
+ * @param registrationInfo.credentialID The credential's credential ID for the public key above
+ * @param registrationInfo.credentialType The type of the credential returned by the browser
+ * @param registrationInfo.userVerified Whether the user was uniquely identified during attestation
+ * @param registrationInfo.attestationObject The raw `response.attestationObject` Buffer returned by
+ * the authenticator
+ */
+export declare type VerifiedRegistrationResponse = {
+    verified: boolean;
+    registrationInfo?: {
+        fmt: AttestationFormat;
+        counter: number;
+        aaguid: string;
+        credentialPublicKey: Buffer;
+        credentialID: Buffer;
+        credentialType: string;
+        userVerified: boolean;
+        attestationObject: Buffer;
+    };
+};
+/**
+ * Values passed to all attestation format verifiers, from which they are free to use as they please
+ */
+export declare type AttestationFormatVerifierOpts = {
+    aaguid: Buffer;
+    attStmt: AttestationStatement;
+    authData: Buffer;
+    clientDataHash: Buffer;
+    credentialID: Buffer;
+    credentialPublicKey: Buffer;
+    rootCertificates: string[];
+    rpIdHash: Buffer;
+    verifyTimestampMS?: boolean;
+};