wherdr 0.0.0-stage → 1.2.0

package/.output/server/node_modules/@simplewebauthn/server/esm/helpers/verifySignature.js

@@ -0,0 +1,35 @@
+import { isoCrypto } from './iso/index.js';
+import { decodeCredentialPublicKey } from './decodeCredentialPublicKey.js';
+import { convertX509PublicKeyToCOSE } from './convertX509PublicKeyToCOSE.js';
+/**
+ * Verify an authenticator's signature
+ */
+export function verifySignature(opts) {
+    const { signature, data, credentialPublicKey, x509Certificate, hashAlgorithm, } = opts;
+    if (!x509Certificate && !credentialPublicKey) {
+        throw new Error('Must declare either "leafCert" or "credentialPublicKey"');
+    }
+    if (x509Certificate && credentialPublicKey) {
+        throw new Error('Must not declare both "leafCert" and "credentialPublicKey"');
+    }
+    let cosePublicKey = new Map();
+    if (credentialPublicKey) {
+        cosePublicKey = decodeCredentialPublicKey(credentialPublicKey);
+    }
+    else if (x509Certificate) {
+        cosePublicKey = convertX509PublicKeyToCOSE(x509Certificate);
+    }
+    return _verifySignatureInternals.stubThis(isoCrypto.verify({
+        cosePublicKey,
+        signature,
+        data,
+        shaHashOverride: hashAlgorithm,
+    }));
+}
+/**
+ * Make it possible to stub the return value during testing
+ * @ignore Don't include this in docs output
+ */
+export const _verifySignatureInternals = {
+    stubThis: (value) => value,
+};

package/.output/server/node_modules/@simplewebauthn/server/esm/index.js

@@ -0,0 +1,8 @@
+export * from './registration/generateRegistrationOptions.js';
+export * from './registration/verifyRegistrationResponse.js';
+export * from './authentication/generateAuthenticationOptions.js';
+export * from './authentication/verifyAuthenticationResponse.js';
+export * from './services/metadataService.js';
+export * from './services/settingsService.js';
+export * from './metadata/mdsTypes.js';
+export * from './types/index.js';

package/.output/server/node_modules/@simplewebauthn/server/esm/metadata/mdsTypes.js

@@ -0,0 +1,17 @@
+const AlgSign = [
+    'secp256r1_ecdsa_sha256_raw',
+    'secp256r1_ecdsa_sha256_der',
+    'rsassa_pss_sha256_raw',
+    'rsassa_pss_sha256_der',
+    'secp256k1_ecdsa_sha256_raw',
+    'secp256k1_ecdsa_sha256_der',
+    'rsassa_pss_sha384_raw',
+    'rsassa_pkcsv15_sha256_raw',
+    'rsassa_pkcsv15_sha384_raw',
+    'rsassa_pkcsv15_sha512_raw',
+    'rsassa_pkcsv15_sha1_raw',
+    'secp384r1_ecdsa_sha384_raw',
+    'secp512r1_ecdsa_sha256_raw',
+    'ed25519_eddsa_sha512_raw',
+];
+export {};

package/.output/server/node_modules/@simplewebauthn/server/esm/metadata/parseJWT.js

@@ -0,0 +1,12 @@
+import { isoBase64URL } from '../helpers/iso/index.js';
+/**
+ * Process a JWT into Javascript-friendly data structures
+ */
+export function parseJWT(jwt) {
+    const parts = jwt.split('.');
+    return [
+        JSON.parse(isoBase64URL.toUTF8String(parts[0])),
+        JSON.parse(isoBase64URL.toUTF8String(parts[1])),
+        parts[2],
+    ];
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/metadata/verifyAttestationWithMetadata.js

@@ -0,0 +1,159 @@
+import { convertCertBufferToPEM } from '../helpers/convertCertBufferToPEM.js';
+import { validateCertificatePath } from '../helpers/validateCertificatePath.js';
+import { decodeCredentialPublicKey } from '../helpers/decodeCredentialPublicKey.js';
+import { COSEKEYS, COSEKTY, isCOSEPublicKeyEC2, } from '../helpers/cose.js';
+/**
+ * Match properties of the authenticator's attestation statement against expected values as
+ * registered with the FIDO Alliance Metadata Service
+ */
+export async function verifyAttestationWithMetadata({ statement, credentialPublicKey, x5c, attestationStatementAlg, }) {
+    const { authenticationAlgorithms, authenticatorGetInfo, attestationRootCertificates, } = statement;
+    // Make sure the alg in the attestation statement matches one of the ones specified in metadata
+    const keypairCOSEAlgs = new Set();
+    authenticationAlgorithms.forEach((algSign) => {
+        // Map algSign string to { kty, alg, crv }
+        const algSignCOSEINFO = algSignToCOSEInfoMap[algSign];
+        // Keeping this statement here just in case MDS returns something unexpected
+        if (algSignCOSEINFO) {
+            keypairCOSEAlgs.add(algSignCOSEINFO);
+        }
+    });
+    // Extract the public key's COSE info for comparison
+    const decodedPublicKey = decodeCredentialPublicKey(credentialPublicKey);
+    const kty = decodedPublicKey.get(COSEKEYS.kty);
+    const alg = decodedPublicKey.get(COSEKEYS.alg);
+    if (!kty) {
+        throw new Error('Credential public key was missing kty');
+    }
+    if (!alg) {
+        throw new Error('Credential public key was missing alg');
+    }
+    if (!kty) {
+        throw new Error('Credential public key was missing kty');
+    }
+    // Assume everything is a number because these values should be
+    const publicKeyCOSEInfo = { kty, alg };
+    if (isCOSEPublicKeyEC2(decodedPublicKey)) {
+        const crv = decodedPublicKey.get(COSEKEYS.crv);
+        publicKeyCOSEInfo.crv = crv;
+    }
+    /**
+     * Attempt to match the credential public key's algorithm to one specified in the device's
+     * metadata
+     */
+    let foundMatch = false;
+    for (const keypairAlg of keypairCOSEAlgs) {
+        // Make sure algorithm and key type match
+        if (keypairAlg.alg === publicKeyCOSEInfo.alg &&
+            keypairAlg.kty === publicKeyCOSEInfo.kty) {
+            // If not an RSA keypair then make sure curve numbers match too
+            if ((keypairAlg.kty === COSEKTY.EC2 || keypairAlg.kty === COSEKTY.OKP) &&
+                keypairAlg.crv === publicKeyCOSEInfo.crv) {
+                foundMatch = true;
+            }
+            else {
+                // We've matched an RSA public key's properties
+                foundMatch = true;
+            }
+        }
+        if (foundMatch) {
+            break;
+        }
+    }
+    // Make sure the public key is one of the allowed algorithms
+    if (!foundMatch) {
+        /**
+         * Craft some useful error output from the MDS algorithms
+         *
+         * Example:
+         *
+         * ```
+         * [
+         *   'rsassa_pss_sha256_raw' (COSE info: { kty: 3, alg: -37 }),
+         *   'secp256k1_ecdsa_sha256_raw' (COSE info: { kty: 2, alg: -47, crv: 8 })
+         * ]
+         * ```
+         */
+        const debugMDSAlgs = authenticationAlgorithms.map((algSign) => `'${algSign}' (COSE info: ${stringifyCOSEInfo(algSignToCOSEInfoMap[algSign])})`);
+        const strMDSAlgs = JSON.stringify(debugMDSAlgs, null, 2).replace(/"/g, '');
+        /**
+         * Construct useful error output about the public key
+         */
+        const strPubKeyAlg = stringifyCOSEInfo(publicKeyCOSEInfo);
+        throw new Error(`Public key parameters ${strPubKeyAlg} did not match any of the following metadata algorithms:\n${strMDSAlgs}`);
+    }
+    /**
+     * Confirm the attestation statement's algorithm is one supported according to metadata
+     */
+    if (attestationStatementAlg !== undefined &&
+        authenticatorGetInfo?.algorithms !== undefined) {
+        const getInfoAlgs = authenticatorGetInfo.algorithms.map((_alg) => _alg.alg);
+        if (getInfoAlgs.indexOf(attestationStatementAlg) < 0) {
+            throw new Error(`Attestation statement alg ${attestationStatementAlg} did not match one of ${getInfoAlgs}`);
+        }
+    }
+    // Prepare to check the certificate chain
+    const authenticatorCerts = x5c.map(convertCertBufferToPEM);
+    const statementRootCerts = attestationRootCertificates.map(convertCertBufferToPEM);
+    /**
+     * If an authenticator returns exactly one certificate in its x5c, and that cert is found in the
+     * metadata statement then the authenticator is "self-referencing". In this case we forego
+     * certificate chain validation.
+     */
+    let authenticatorIsSelfReferencing = false;
+    if (authenticatorCerts.length === 1 &&
+        statementRootCerts.indexOf(authenticatorCerts[0]) >= 0) {
+        authenticatorIsSelfReferencing = true;
+    }
+    if (!authenticatorIsSelfReferencing) {
+        try {
+            await validateCertificatePath(authenticatorCerts, statementRootCerts);
+        }
+        catch (err) {
+            const _err = err;
+            throw new Error(`Could not validate certificate path with any metadata root certificates: ${_err.message}`);
+        }
+    }
+    return true;
+}
+/**
+ * Convert ALG_SIGN values to COSE info
+ *
+ * Values pulled from `ALG_KEY_COSE` definitions in the FIDO Registry of Predefined Values
+ *
+ * https://fidoalliance.org/specs/common-specs/fido-registry-v2.2-ps-20220523.html#authentication-algorithms
+ */
+export const algSignToCOSEInfoMap = {
+    secp256r1_ecdsa_sha256_raw: { kty: 2, alg: -7, crv: 1 },
+    secp256r1_ecdsa_sha256_der: { kty: 2, alg: -7, crv: 1 },
+    rsassa_pss_sha256_raw: { kty: 3, alg: -37 },
+    rsassa_pss_sha256_der: { kty: 3, alg: -37 },
+    secp256k1_ecdsa_sha256_raw: { kty: 2, alg: -47, crv: 8 },
+    secp256k1_ecdsa_sha256_der: { kty: 2, alg: -47, crv: 8 },
+    rsassa_pss_sha384_raw: { kty: 3, alg: -38 },
+    rsassa_pkcsv15_sha256_raw: { kty: 3, alg: -257 },
+    rsassa_pkcsv15_sha384_raw: { kty: 3, alg: -258 },
+    rsassa_pkcsv15_sha512_raw: { kty: 3, alg: -259 },
+    rsassa_pkcsv15_sha1_raw: { kty: 3, alg: -65535 },
+    secp384r1_ecdsa_sha384_raw: { kty: 2, alg: -35, crv: 2 },
+    secp512r1_ecdsa_sha256_raw: { kty: 2, alg: -36, crv: 3 },
+    ed25519_eddsa_sha512_raw: { kty: 1, alg: -8, crv: 6 },
+};
+/**
+ * A helper to format COSEInfo a little nicer than we can achieve with JSON.stringify()
+ *
+ * Input: `{ "kty": 3, "alg": -257 }`
+ *
+ * Output: `"{ kty: 3, alg: -257 }"`
+ */
+function stringifyCOSEInfo(info) {
+    const { kty, alg, crv } = info;
+    let toReturn = '';
+    if (kty !== COSEKTY.RSA) {
+        toReturn = `{ kty: ${kty}, alg: ${alg}, crv: ${crv} }`;
+    }
+    else {
+        toReturn = `{ kty: ${kty}, alg: ${alg} }`;
+    }
+    return toReturn;
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/metadata/verifyJWT.js

@@ -0,0 +1,42 @@
+import { convertX509PublicKeyToCOSE } from '../helpers/convertX509PublicKeyToCOSE.js';
+import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
+import { COSEKEYS, isCOSEPublicKeyEC2, isCOSEPublicKeyRSA } from '../helpers/cose.js';
+import { mapJWSAlgToCOSEAlg } from '../helpers/mapJWSAlgToCOSEAlg.js';
+import { verifyEC2 } from '../helpers/iso/isoCrypto/verifyEC2.js';
+import { verifyRSA } from '../helpers/iso/isoCrypto/verifyRSA.js';
+/**
+ * Lightweight verification for FIDO MDS JWTs. Supports use of EC2 and RSA.
+ *
+ * If this ever needs to support more JWS algorithms, here's the list of them:
+ *
+ * https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1
+ *
+ * (Pulled from https://www.rfc-editor.org/rfc/rfc7515#section-4.1.1)
+ */
+export function verifyJWT(jwt, leafCert) {
+    const [header, payload, signature] = jwt.split('.');
+    const certCOSE = convertX509PublicKeyToCOSE(leafCert);
+    const data = isoUint8Array.fromUTF8String(`${header}.${payload}`);
+    const signatureBytes = isoBase64URL.toBuffer(signature);
+    // We just need the `alg` from the header, so only partially define the shape of it
+    const headerJSON = JSON.parse(isoBase64URL.toUTF8String(header));
+    const jwtHeaderHashAlgCOSE = mapJWSAlgToCOSEAlg(headerJSON.alg);
+    if (isCOSEPublicKeyEC2(certCOSE)) {
+        return verifyEC2({
+            data,
+            signature: signatureBytes,
+            cosePublicKey: certCOSE,
+            shaHashOverride: jwtHeaderHashAlgCOSE,
+        });
+    }
+    else if (isCOSEPublicKeyRSA(certCOSE)) {
+        return verifyRSA({
+            data,
+            signature: signatureBytes,
+            cosePublicKey: certCOSE,
+            shaHashOverride: jwtHeaderHashAlgCOSE,
+        });
+    }
+    const kty = certCOSE.get(COSEKEYS.kty);
+    throw new Error(`JWT verification with public key of kty ${kty} is not supported by this method`);
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/metadata/verifyMDSBlob.js

@@ -0,0 +1,59 @@
+import { parseJWT } from './parseJWT.js';
+import { verifyJWT } from './verifyJWT.js';
+import { validateCertificatePath } from '../helpers/validateCertificatePath.js';
+import { convertCertBufferToPEM } from '../helpers/convertCertBufferToPEM.js';
+import { convertPEMToBytes } from '../helpers/convertPEMToBytes.js';
+import { SettingsService } from '../services/settingsService.js';
+/**
+ * Perform authenticity and integrity verification of a
+ * [FIDO Metadata Service (MDS)](https://fidoalliance.org/metadata/)-compatible blob, and then
+ * extract the FIDO2 metadata statements included within. This method will make network requests
+ * for things like CRL checks.
+ *
+ * @param blob - A JWT downloaded from an MDS server (e.g. https://mds3.fidoalliance.org)
+ */
+export async function verifyMDSBlob(blob) {
+    // Parse the JWT
+    const parsedJWT = parseJWT(blob);
+    const header = parsedJWT[0];
+    const payload = parsedJWT[1];
+    const headerCertsPEM = header.x5c.map(convertCertBufferToPEM);
+    try {
+        // Validate the certificate chain
+        const rootCerts = SettingsService.getRootCertificates({
+            identifier: 'mds',
+        });
+        await validateCertificatePath(headerCertsPEM, rootCerts);
+    }
+    catch (error) {
+        const _error = error;
+        // From FIDO MDS docs: "ignore the file if the chain cannot be verified or if one of the
+        // chain certificates is revoked"
+        throw new Error('BLOB certificate path could not be validated', { cause: _error });
+    }
+    // Verify the BLOB JWT signature
+    const leafCert = headerCertsPEM[0];
+    const verified = await verifyJWT(blob, convertPEMToBytes(leafCert));
+    if (!verified) {
+        // From FIDO MDS docs: "The FIDO Server SHOULD ignore the file if the signature is invalid."
+        throw new Error('BLOB signature could not be verified');
+    }
+    // Cache statements for FIDO2 devices
+    const statements = [];
+    for (const entry of payload.entries) {
+        // Only cache entries with an `aaguid`
+        if (entry.aaguid && entry.metadataStatement) {
+            statements.push(entry.metadataStatement);
+        }
+    }
+    // Convert the nextUpdate property into a Date so we can determine when to re-download
+    const [year, month, day] = payload.nextUpdate.split('-');
+    const parsedNextUpdate = new Date(parseInt(year, 10), 
+    // Months need to be zero-indexed
+    parseInt(month, 10) - 1, parseInt(day, 10));
+    return {
+        statements,
+        parsedNextUpdate,
+        payload,
+    };
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/registration/generateRegistrationOptions.js

@@ -0,0 +1,181 @@
+import { generateChallenge } from '../helpers/generateChallenge.js';
+import { generateUserID } from '../helpers/generateUserID.js';
+import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
+/**
+ * Supported crypto algo identifiers
+ * See https://w3c.github.io/webauthn/#sctn-alg-identifier
+ * and https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ */
+export const supportedCOSEAlgorithmIdentifiers = [
+    // EdDSA (In first position to encourage authenticators to use this over ES256)
+    -8,
+    // ECDSA w/ SHA-256
+    -7,
+    // ECDSA w/ SHA-512
+    -36,
+    // RSASSA-PSS w/ SHA-256
+    -37,
+    // RSASSA-PSS w/ SHA-384
+    -38,
+    // RSASSA-PSS w/ SHA-512
+    -39,
+    // RSASSA-PKCS1-v1_5 w/ SHA-256
+    -257,
+    // RSASSA-PKCS1-v1_5 w/ SHA-384
+    -258,
+    // RSASSA-PKCS1-v1_5 w/ SHA-512
+    -259,
+    // RSASSA-PKCS1-v1_5 w/ SHA-1 (Deprecated; here for legacy support)
+    -65535,
+];
+/**
+ * Set up some default authenticator selection options as per the latest spec:
+ * https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria
+ *
+ * Helps with some older platforms (e.g. Android 7.0 Nougat) that may not be aware of these
+ * defaults.
+ */
+const defaultAuthenticatorSelection = {
+    residentKey: 'preferred',
+    userVerification: 'preferred',
+};
+/**
+ * Use the most commonly-supported algorithms
+ * See the following:
+ *   - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+ *   - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
+ */
+const defaultSupportedAlgorithmIDs = [-8, -7, -257];
+/**
+ * Prepare a value to pass into navigator.credentials.create(...) for authenticator registration
+ *
+ * **Options:**
+ *
+ * @param rpName - User-visible, "friendly" website/service name
+ * @param rpID - Valid domain name (after `https://`)
+ * @param userName - User's website-specific username (email, etc...)
+ * @param userID **(Optional)** - User's website-specific unique ID. Defaults to generating a random identifier
+ * @param challenge **(Optional)** - Random value the authenticator needs to sign and pass back. Defaults to generating a random value
+ * @param userDisplayName **(Optional)** - User's actual name. Defaults to `""`
+ * @param timeout **(Optional)** - How long (in ms) the user can take to complete attestation. Defaults to `60000`
+ * @param attestationType **(Optional)** - Specific attestation statement. Defaults to `"none"`
+ * @param excludeCredentials **(Optional)** - Authenticators registered by the user so the user can't register the same credential multiple times. Defaults to `[]`
+ * @param authenticatorSelection **(Optional)** - Advanced criteria for restricting the types of authenticators that may be used. Defaults to `{ residentKey: 'preferred', userVerification: 'preferred' }`
+ * @param extensions **(Optional)** - Additional plugins the authenticator or browser should use during attestation
+ * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to `[-8, -7, -257]`
+ * @param preferredAuthenticatorType **(Optional)** - Encourage the browser to prompt the user to register a specific type of authenticator
+ */
+export async function generateRegistrationOptions(options) {
+    const { rpName, rpID, userName, userID, challenge = await generateChallenge(), userDisplayName = '', timeout = 60000, attestationType = 'none', excludeCredentials = [], authenticatorSelection = defaultAuthenticatorSelection, extensions, supportedAlgorithmIDs = defaultSupportedAlgorithmIDs, preferredAuthenticatorType, } = options;
+    /**
+     * Prepare pubKeyCredParams from the array of algorithm ID's
+     */
+    const pubKeyCredParams = supportedAlgorithmIDs.map((id) => ({
+        alg: id,
+        type: 'public-key',
+    }));
+    /**
+     * Capture some of the nuances of how `residentKey` and `requireResidentKey` how either is set
+     * depending on when either is defined in the options
+     */
+    if (authenticatorSelection.residentKey === undefined) {
+        /**
+         * `residentKey`: "If no value is given then the effective value is `required` if
+         * requireResidentKey is true or `discouraged` if it is false or absent."
+         *
+         * See https://www.w3.org/TR/webauthn-2/#dom-authenticatorselectioncriteria-residentkey
+         */
+        if (authenticatorSelection.requireResidentKey) {
+            authenticatorSelection.residentKey = 'required';
+        }
+        else {
+            /**
+             * FIDO Conformance v1.7.2 fails the first test if we do this, even though this is
+             * technically compatible with the WebAuthn L2 spec...
+             */
+            // authenticatorSelection.residentKey = 'discouraged';
+        }
+    }
+    else {
+        /**
+         * `requireResidentKey`: "Relying Parties SHOULD set it to true if, and only if, residentKey is
+         * set to "required""
+         *
+         * Spec says this property defaults to `false` so we should still be okay to assign `false` too
+         *
+         * See https://www.w3.org/TR/webauthn-2/#dom-authenticatorselectioncriteria-requireresidentkey
+         */
+        authenticatorSelection.requireResidentKey = authenticatorSelection.residentKey === 'required';
+    }
+    /**
+     * Preserve ability to specify `string` values for challenges
+     */
+    let _challenge = challenge;
+    if (typeof _challenge === 'string') {
+        _challenge = isoUint8Array.fromUTF8String(_challenge);
+    }
+    /**
+     * Explicitly disallow use of strings for userID anymore because `isoBase64URL.fromBuffer()` below
+     * will return an empty string if one gets through!
+     */
+    if (typeof userID === 'string') {
+        throw new Error(`String values for \`userID\` are no longer supported. See https://simplewebauthn.dev/docs/advanced/server/custom-user-ids`);
+    }
+    /**
+     * Generate a user ID if one is not provided
+     */
+    let _userID = userID;
+    if (!_userID) {
+        _userID = await generateUserID();
+    }
+    /**
+     * Map authenticator preference to hints. Map to authenticatorAttachment as well for
+     * backwards-compatibility.
+     */
+    const hints = [];
+    if (preferredAuthenticatorType) {
+        if (preferredAuthenticatorType === 'securityKey') {
+            hints.push('security-key');
+            authenticatorSelection.authenticatorAttachment = 'cross-platform';
+        }
+        else if (preferredAuthenticatorType === 'localDevice') {
+            hints.push('client-device');
+            authenticatorSelection.authenticatorAttachment = 'platform';
+        }
+        else if (preferredAuthenticatorType === 'remoteDevice') {
+            hints.push('hybrid');
+            authenticatorSelection.authenticatorAttachment = 'cross-platform';
+        }
+    }
+    return {
+        challenge: isoBase64URL.fromBuffer(_challenge),
+        rp: {
+            name: rpName,
+            id: rpID,
+        },
+        user: {
+            id: isoBase64URL.fromBuffer(_userID),
+            name: userName,
+            displayName: userDisplayName,
+        },
+        pubKeyCredParams,
+        timeout,
+        attestation: attestationType,
+        excludeCredentials: excludeCredentials.map((cred) => {
+            if (!isoBase64URL.isBase64URL(cred.id)) {
+                throw new Error(`excludeCredential id "${cred.id}" is not a valid base64url string`);
+            }
+            return {
+                ...cred,
+                id: isoBase64URL.trimPadding(cred.id),
+                type: 'public-key',
+            };
+        }),
+        authenticatorSelection,
+        extensions: {
+            ...extensions,
+            credProps: true,
+        },
+        hints,
+    };
+}

package/.output/server/node_modules/@simplewebauthn/server/esm/registration/verifications/tpm/constants.js

@@ -0,0 +1,137 @@
+// deno-lint-ignore-file no-dupe-keys
+/**
+ * A whole lotta domain knowledge is captured here, with hazy connections to source
+ * documents. Good places to start searching for more info on these values are the
+ * following Trusted Computing Group TPM Library docs linked in the WebAuthn API:
+ *
+ * - https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf
+ * - https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
+ * - https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf
+ */
+/**
+ * 6.9 TPM_ST (Structure Tags)
+ */
+export const TPM_ST = {
+    0x00c4: 'TPM_ST_RSP_COMMAND',
+    0x8000: 'TPM_ST_NULL',
+    0x8001: 'TPM_ST_NO_SESSIONS',
+    0x8002: 'TPM_ST_SESSIONS',
+    0x8014: 'TPM_ST_ATTEST_NV',
+    0x8015: 'TPM_ST_ATTEST_COMMAND_AUDIT',
+    0x8016: 'TPM_ST_ATTEST_SESSION_AUDIT',
+    0x8017: 'TPM_ST_ATTEST_CERTIFY',
+    0x8018: 'TPM_ST_ATTEST_QUOTE',
+    0x8019: 'TPM_ST_ATTEST_TIME',
+    0x801a: 'TPM_ST_ATTEST_CREATION',
+    0x8021: 'TPM_ST_CREATION',
+    0x8022: 'TPM_ST_VERIFIED',
+    0x8023: 'TPM_ST_AUTH_SECRET',
+    0x8024: 'TPM_ST_HASHCHECK',
+    0x8025: 'TPM_ST_AUTH_SIGNED',
+    0x8029: 'TPM_ST_FU_MANIFEST',
+};
+/**
+ * 6.3 TPM_ALG_ID
+ */
+export const TPM_ALG = {
+    0x0000: 'TPM_ALG_ERROR',
+    0x0001: 'TPM_ALG_RSA',
+    0x0004: 'TPM_ALG_SHA',
+    // @ts-ignore 2300
+    0x0004: 'TPM_ALG_SHA1',
+    0x0005: 'TPM_ALG_HMAC',
+    0x0006: 'TPM_ALG_AES',
+    0x0007: 'TPM_ALG_MGF1',
+    0x0008: 'TPM_ALG_KEYEDHASH',
+    0x000a: 'TPM_ALG_XOR',
+    0x000b: 'TPM_ALG_SHA256',
+    0x000c: 'TPM_ALG_SHA384',
+    0x000d: 'TPM_ALG_SHA512',
+    0x0010: 'TPM_ALG_NULL',
+    0x0012: 'TPM_ALG_SM3_256',
+    0x0013: 'TPM_ALG_SM4',
+    0x0014: 'TPM_ALG_RSASSA',
+    0x0015: 'TPM_ALG_RSAES',
+    0x0016: 'TPM_ALG_RSAPSS',
+    0x0017: 'TPM_ALG_OAEP',
+    0x0018: 'TPM_ALG_ECDSA',
+    0x0019: 'TPM_ALG_ECDH',
+    0x001a: 'TPM_ALG_ECDAA',
+    0x001b: 'TPM_ALG_SM2',
+    0x001c: 'TPM_ALG_ECSCHNORR',
+    0x001d: 'TPM_ALG_ECMQV',
+    0x0020: 'TPM_ALG_KDF1_SP800_56A',
+    0x0021: 'TPM_ALG_KDF2',
+    0x0022: 'TPM_ALG_KDF1_SP800_108',
+    0x0023: 'TPM_ALG_ECC',
+    0x0025: 'TPM_ALG_SYMCIPHER',
+    0x0026: 'TPM_ALG_CAMELLIA',
+    0x0040: 'TPM_ALG_CTR',
+    0x0041: 'TPM_ALG_OFB',
+    0x0042: 'TPM_ALG_CBC',
+    0x0043: 'TPM_ALG_CFB',
+    0x0044: 'TPM_ALG_ECB',
+};
+/**
+ * 6.4 TPM_ECC_CURVE
+ */
+export const TPM_ECC_CURVE = {
+    0x0000: 'TPM_ECC_NONE',
+    0x0001: 'TPM_ECC_NIST_P192',
+    0x0002: 'TPM_ECC_NIST_P224',
+    0x0003: 'TPM_ECC_NIST_P256',
+    0x0004: 'TPM_ECC_NIST_P384',
+    0x0005: 'TPM_ECC_NIST_P521',
+    0x0010: 'TPM_ECC_BN_P256',
+    0x0011: 'TPM_ECC_BN_P638',
+    0x0020: 'TPM_ECC_SM2_P256',
+};
+/**
+ * Sourced from https://trustedcomputinggroup.org/resource/vendor-id-registry/
+ *
+ * Latest version:
+ * https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-Vendor-ID-Registry-Version-1.02-Revision-1.00.pdf
+ */
+export const TPM_MANUFACTURERS = {
+    'id:414D4400': { name: 'AMD', id: 'AMD' },
+    'id:414E5400': { name: 'Ant Group', id: 'ANT' },
+    'id:41544D4C': { name: 'Atmel', id: 'ATML' },
+    'id:4252434D': { name: 'Broadcom', id: 'BRCM' },
+    'id:4353434F': { name: 'Cisco', id: 'CSCO' },
+    'id:464C5953': { name: 'Flyslice Technologies', id: 'FLYS' },
+    'id:524F4343': { name: 'Fuzhou Rockchip', id: 'ROCC' },
+    'id:474F4F47': { name: 'Google', id: 'GOOG' },
+    'id:48504900': { name: 'HPI', id: 'HPI' },
+    'id:48504500': { name: 'HPE', id: 'HPE' },
+    'id:48495349': { name: 'Huawei', id: 'HISI' },
+    'id:49424d00': { name: 'IBM', id: 'IBM' },
+    'id:49424D00': { name: 'IBM', id: 'IBM' }, // Same ID for IBM as above, except the "D" is capitalized as per TPM spec
+    'id:49465800': { name: 'Infineon', id: 'IFX' },
+    'id:494E5443': { name: 'Intel', id: 'INTC' },
+    'id:4C454E00': { name: 'Lenovo', id: 'LEN' },
+    'id:4D534654': { name: 'Microsoft', id: 'MSFT' },
+    'id:4E534D20': { name: 'National Semiconductor', id: 'NSM' },
+    'id:4E545A00': { name: 'Nationz', id: 'NTZ' },
+    'id:4E534700': { name: 'NSING', id: 'NSG' },
+    'id:4E544300': { name: 'Nuvoton Technology', id: 'NTC' },
+    'id:51434F4D': { name: 'Qualcomm', id: 'QCOM' },
+    'id:534D534E': { name: 'Samsung', id: 'SMSN' },
+    'id:53454345': { name: 'SecEdge', id: 'SECE' },
+    'id:534E5300': { name: 'Sinosun', id: 'SNS' },
+    'id:534D5343': { name: 'SMSC', id: 'SMSC' },
+    'id:53544D20': { name: 'STMicroelectronics', id: 'STM' },
+    'id:54584E00': { name: 'Texas Instruments', id: 'TXN' },
+    'id:57454300': { name: 'Winbond', id: 'WEC' },
+    'id:5345414C': { name: 'Wisekey', id: 'SEAL' },
+    'id:FFFFF1D0': { name: 'FIDO Alliance', id: 'FIDO' }, // FIDO Conformance
+};
+/**
+ * Match TPM public area curve ID's to `crv` numbers used in COSE public keys
+ */
+export const TPM_ECC_CURVE_COSE_CRV_MAP = {
+    TPM_ECC_NIST_P256: 1, // p256
+    TPM_ECC_NIST_P384: 2, // p384
+    TPM_ECC_NIST_P521: 3, // p521
+    TPM_ECC_BN_P256: 1, // p256
+    TPM_ECC_SM2_P256: 1, // p256
+};