Chrome Release Bot (LUCI) 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
..
aoa 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
bio 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
cable 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
cros 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
hid 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
mac 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
response_data_fuzzer_corpus 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
strings 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
win 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
BUILD.gn 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
DEPS 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
DIR_METADATA 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
OWNERS 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
README.md 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
appid_exclude_probe_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
appid_exclude_probe_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attestation_object.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attestation_object.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attestation_statement.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attestation_statement.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attestation_statement_formats.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attestation_statement_formats.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attestation_statement_formats_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attested_credential_data.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
attested_credential_data.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
auth_token_requester.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
auth_token_requester.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
auth_token_requester_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_data.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_data.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_get_assertion_response.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_get_assertion_response.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_get_info_response.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_get_info_response.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_make_credential_response.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_make_credential_response.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_selection_criteria.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_selection_criteria.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_supported_options.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
authenticator_supported_options.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ble_adapter_manager.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ble_adapter_manager.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ble_adapter_manager_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
cbor_extract.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
cbor_extract.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
cbor_extract_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
credential_management.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
credential_management.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
credential_management_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
credential_management_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
credential_management_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap2_device_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_authenticator_selection_request.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_authenticator_selection_request.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_get_assertion_request.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_get_assertion_request.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_make_credential_request.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_make_credential_request.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_request_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_response_fuzzer.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ctap_response_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
device_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
device_response_converter.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
device_response_converter.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
discoverable_credential_metadata.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
discoverable_credential_metadata.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ed25519_public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
ed25519_public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fake_fido_discovery.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fake_fido_discovery.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fake_fido_discovery_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
features.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
features.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_authenticator.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_authenticator.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_constants.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_constants.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device_authenticator.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device_authenticator.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device_authenticator_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device_discovery.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device_discovery.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_device_discovery_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_discovery_base.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_discovery_base.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_discovery_factory.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_discovery_factory.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_parsing_utils.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_parsing_utils.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_parsing_utils_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_request_handler_base.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_request_handler_base.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_request_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_strings.grd 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_test_data.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_transport_protocol.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_transport_protocol.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
fido_types.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
filter.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
filter.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
filter_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
get_assertion_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
get_assertion_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
get_assertion_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
get_assertion_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
get_assertion_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
get_assertion_task_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
large_blob.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
large_blob.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
large_blob_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
make_credential_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
make_credential_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
make_credential_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
make_credential_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
make_credential_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
make_credential_task_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
mock_fido_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
mock_fido_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
mock_fido_discovery_observer.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
mock_fido_discovery_observer.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
multiple_virtual_fido_device_factory.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
multiple_virtual_fido_device_factory.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
opaque_attestation_statement.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
opaque_attestation_statement.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
p256_public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
p256_public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
pin.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
pin.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
pin_internal.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
pin_internal.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
pin_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
platform_credential_store.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_descriptor.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_descriptor.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_params.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_params.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_rp_entity.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_rp_entity.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_user_entity.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
public_key_credential_user_entity.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
reset_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
reset_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
rsa_public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
rsa_public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
set_pin_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
set_pin_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
test_callback_receiver.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
test_callback_receiver_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_command_constructor.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_command_constructor.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_command_constructor_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_register_operation.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_register_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_register_operation_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_sign_operation.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_sign_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
u2f_sign_operation_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_ctap2_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_ctap2_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_ctap2_device_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device_authenticator.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device_authenticator.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device_authenticator_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device_discovery.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device_discovery.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device_factory.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_fido_device_factory.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_u2f_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_u2f_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago
virtual_u2f_device_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 year ago

README.md

Security Keys

Security keys are physical devices that often connect via USB and have a button. They can generate public keys and sign with them to authenticate a user and are most often used as a second factor for security.

Websites interact with them via two APIs: the older U2F API and the modern W3C Webauthn API. In Chromium, the U2F API is not directly supported but it can be used by using postMessage with an internal extension called cryptotoken. Webauthn is supported by Blink and is part of CredMan.

(Historically cryptotoken contained a complete stack that interacted with USB devices directly. Now, however, it’s a wrapper layer over the Webauthn APIs.)

Several different types of security keys are supported. Older security keys implement the U2F protocol while more modern ones implement CTAP2. These devices can work over USB, Bluetooth Low Energy (BLE), or NFC (not supported). Additionally Chromium contains support for using Touch ID on macOS as a security key as well support for forwarding requests to the native libraries on modern versions of Windows.

Life of a request

This section provides a coarse roadmap for understanding the code involved in security key support by highlighting the path that a login request might take.

Firstly, the CredMan get call ends up in CredentialsContainer::get. CredMan supports several types of credentials but the code dealing with publicKey relates to security key support.

The request is packaged into a Mojo call defined in authenticator.mojom. On Android, that Mojo request is handled by Android-specific code and is forwarded to support libraries in Google Play Services. Otherwise the Mojo interface will be bound to AuthenticatorCommon; specifically it’ll call AuthenticatorCommon::GetAssertion.

AuthenticatorCommon is part of Chromium’s content layer and so calls into the embedder to get a delegate object that allows it to perform actions like showing UI. It also triggers the lower-level code to start the process of finding an authenticator to handle the request. For an assertion request it’ll create a GetAssertionRequestHandler from this directory.

The Handler classes manage a specific user action and their first job is to initiate discovery of possible security keys. The discovery process will find candidate USB, BLE, Touch ID, etc devices, each of which will be fed into DispatchRequest. Different actions may be taken depending on features of the discovered authenticator. For example, an authenticator which cannot handle the request may be asked to wait for a touch so that the user can still select it, even though it’ll cause the request to fail. These per-authenticator operations will be dispatched via the abstract FidoAuthenticator interface.

If a per-authenticator operation is complex and requires several steps it will be handled by a “task”. In this example, a GetAssertionTask will likely be created by a FidoDeviceAuthenticator, the implementation of FidoAuthenticator used by physical devices.

The assertion task knows how to sequence a series of U2F or CTAP2 operations to implement an assertion request. In the case of U2F, there will be another layer of state machines in, e.g., U2fSignOperation because U2F has a historical authenticator model.

If interaction with UI is required, for example to prompt for a PIN, the handler will make calls via the Observer interface, which is implemented by the embedder’s UI objects that were created by AuthenticatorCommon.

Settings

It’s also possible for security key operations to be triggered by actions in the Settings UI: there are several security key actions that can be taken on chrome://settings/securityKeys. In this case, calls from the Javascript that implements the Settings UI end up in SecurityKeysHandler, which then operates in the same way as AuthenticatorCommon, albeit without creating any native UI.

Fuzzers

libFuzzer tests are in *_fuzzer.cc files. They test for bad input from devices, e.g. when parsing responses to register or sign operations.