1/*
2 * Copyright (C) 2019 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
14 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
15 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
17 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
18 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
23 * THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "config.h"
27#include "WebAuthenticationUtils.h"
28
29#if ENABLE(WEB_AUTHN)
30
31#include "CBORWriter.h"
32#include "WebAuthenticationConstants.h"
33#include <pal/crypto/CryptoDigest.h>
34#include <wtf/text/WTFString.h>
35
36namespace WebCore {
37
38Vector<uint8_t> convertBytesToVector(const uint8_t byteArray[], const size_t length)
39{
40 Vector<uint8_t> result;
41 result.append(byteArray, length);
42 return result;
43}
44
45Vector<uint8_t> produceRpIdHash(const String& rpId)
46{
47 auto crypto = PAL::CryptoDigest::create(PAL::CryptoDigest::Algorithm::SHA_256);
48 auto rpIdUtf8 = rpId.utf8();
49 crypto->addBytes(rpIdUtf8.data(), rpIdUtf8.length());
50 return crypto->computeHash();
51}
52
53Vector<uint8_t> encodeES256PublicKeyAsCBOR(Vector<uint8_t>&& x, Vector<uint8_t>&& y)
54{
55 cbor::CBORValue::MapValue publicKeyMap;
56 publicKeyMap[cbor::CBORValue(COSE::kty)] = cbor::CBORValue(COSE::EC2);
57 publicKeyMap[cbor::CBORValue(COSE::alg)] = cbor::CBORValue(COSE::ES256);
58 publicKeyMap[cbor::CBORValue(COSE::crv)] = cbor::CBORValue(COSE::P_256);
59 publicKeyMap[cbor::CBORValue(COSE::x)] = cbor::CBORValue(WTFMove(x));
60 publicKeyMap[cbor::CBORValue(COSE::y)] = cbor::CBORValue(WTFMove(y));
61
62 auto cosePublicKey = cbor::CBORWriter::write(cbor::CBORValue(WTFMove(publicKeyMap)));
63 ASSERT(cosePublicKey);
64 return *cosePublicKey;
65}
66
67Vector<uint8_t> buildAttestedCredentialData(const Vector<uint8_t>& aaguid, const Vector<uint8_t>& credentialId, const Vector<uint8_t>& coseKey)
68{
69 Vector<uint8_t> attestedCredentialData;
70 attestedCredentialData.reserveInitialCapacity(aaguidLength + credentialIdLengthLength + credentialId.size() + coseKey.size());
71
72 // aaguid
73 ASSERT(aaguid.size() == aaguidLength);
74 attestedCredentialData.appendVector(aaguid);
75
76 // credentialIdLength
77 ASSERT(credentialId.size() <= std::numeric_limits<uint16_t>::max());
78 attestedCredentialData.append(credentialId.size() >> 8 & 0xff);
79 attestedCredentialData.append(credentialId.size() & 0xff);
80
81 // credentialId
82 attestedCredentialData.appendVector(credentialId);
83
84 // credentialPublicKey
85 attestedCredentialData.appendVector(coseKey);
86
87 return attestedCredentialData;
88}
89
90Vector<uint8_t> buildAuthData(const String& rpId, const uint8_t flags, const uint32_t counter, const Vector<uint8_t>& optionalAttestedCredentialData)
91{
92 Vector<uint8_t> authData;
93 authData.reserveInitialCapacity(rpIdHashLength + flagsLength + signCounterLength + optionalAttestedCredentialData.size());
94
95 // RP ID hash
96 authData.appendVector(produceRpIdHash(rpId));
97
98 // FLAGS
99 authData.append(flags);
100
101 // COUNTER
102 authData.append(counter >> 24 & 0xff);
103 authData.append(counter >> 16 & 0xff);
104 authData.append(counter >> 8 & 0xff);
105 authData.append(counter & 0xff);
106
107 // ATTESTED CRED. DATA
108 authData.appendVector(optionalAttestedCredentialData);
109
110 return authData;
111}
112
113Vector<uint8_t> buildAttestationObject(Vector<uint8_t>&& authData, String&& format, cbor::CBORValue::MapValue&& statementMap)
114{
115 cbor::CBORValue::MapValue attestationObjectMap;
116 attestationObjectMap[cbor::CBORValue("authData")] = cbor::CBORValue(WTFMove(authData));
117 attestationObjectMap[cbor::CBORValue("fmt")] = cbor::CBORValue(WTFMove(format));
118 attestationObjectMap[cbor::CBORValue("attStmt")] = cbor::CBORValue(WTFMove(statementMap));
119
120 auto attestationObject = cbor::CBORWriter::write(cbor::CBORValue(WTFMove(attestationObjectMap)));
121 ASSERT(attestationObject);
122 return *attestationObject;
123}
124
125
126} // namespace WebCore
127
128#endif // ENABLE(WEB_AUTHN)
129