FidoU2fAttestationStatementVerifier.java

// Copyright (c) 2018, Yubico AB

// All rights reserved.

//

// Redistribution and use in source and binary forms, with or without

// modification, are permitted provided that the following conditions are met:

//

// 1. Redistributions of source code must retain the above copyright notice, this

//    list of conditions and the following disclaimer.

//

// 2. Redistributions in binary form must reproduce the above copyright notice,

//    this list of conditions and the following disclaimer in the documentation

//    and/or other materials provided with the distribution.

//

// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER

// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,

// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package com.yubico.webauthn;

import static com.yubico.webauthn.Crypto.isP256;

import com.fasterxml.jackson.databind.JsonNode;

import com.yubico.internal.util.ExceptionUtil;

import com.yubico.webauthn.data.AttestationObject;

import com.yubico.webauthn.data.AttestationType;

import com.yubico.webauthn.data.AttestedCredentialData;

import com.yubico.webauthn.data.ByteArray;

import java.io.IOException;

import java.security.NoSuchAlgorithmException;

import java.security.PublicKey;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.security.interfaces.ECPublicKey;

import java.security.spec.InvalidKeySpecException;

import java.util.Optional;

import lombok.extern.slf4j.Slf4j;

    implements AttestationStatementVerifier, X5cAttestationStatementVerifier {

  private X509Certificate getAttestationCertificate(AttestationObject attestationObject)

      throws CertificateException {

            attestationCertificate -> {

              } else {

                    "Attestation certificate for fido-u2f must have an ECDSA P-256 public key.");

              }

            })

            () ->

                    "fido-u2f attestation statement must have an \"x5c\" property set to an array of at least one DER encoded X.509 certificate."));

  }

  private static boolean validSelfSignature(X509Certificate cert) {

    try {

    }

  }

  private static ByteArray getRawUserPublicKey(AttestationObject attestationObject)

      throws IOException {

        attestationObject

    final PublicKey pubkey;

    try {

    final ECPublicKey ecPubkey;

    try {

  }

  @Override

  public AttestationType getAttestationType(AttestationObject attestationObject)

      throws IOException, CertificateException {

    } else {

    }

  }

  @Override

  public boolean verifyAttestationSignature(

      AttestationObject attestationObject, ByteArray clientDataJsonHash) {

    final X509Certificate attestationCertificate;

    try {

              "Failed to parse X.509 certificate from attestation object: %s", attestationObject));

          "Attestation certificate for fido-u2f must have an ECDSA P-256 public key.");

    }

            attestedCredentialData -> {

                    "fido-u2f attestation statement must have a \"sig\" property set to a DER encoded signature.");

              }

                final ByteArray userPublicKey;

                try {

                      new RuntimeException(

                              "Failed to parse public key from attestation data %s",

                              attestedCredentialData),

                          e);

                U2fRawRegisterResponse u2fRegisterResponse;

                try {

                      new U2fRawRegisterResponse(

                          userPublicKey,

                          keyHandle,

                          attestationCertificate,

                      new RuntimeException(

                          "signature.isBinary() was true but signature.binaryValue() failed", e);

              } else {

                    "\"sig\" property of fido-u2f attestation statement must be a CBOR byte array value.");

              }

            })

            () ->

                    "Attestation object for credential creation must have attestation data."));

  }

}

Mutations