authenticator_data.h 4.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_AUTHENTICATOR_DATA_H_
  5. #define DEVICE_FIDO_AUTHENTICATOR_DATA_H_
  6. #include <stdint.h>
  7. #include <array>
  8. #include <string>
  9. #include <vector>
  10. #include "base/component_export.h"
  11. #include "base/containers/span.h"
  12. #include "base/numerics/safe_conversions.h"
  13. #include "components/cbor/values.h"
  14. #include "device/fido/attested_credential_data.h"
  15. #include "device/fido/fido_constants.h"
  16. #include "third_party/abseil-cpp/absl/types/optional.h"
  17. namespace device {
  18. // https://www.w3.org/TR/2017/WD-webauthn-20170505/#sec-authenticator-data.
  19. class COMPONENT_EXPORT(DEVICE_FIDO) AuthenticatorData {
  20. public:
  21. enum class Flag : uint8_t {
  22. kTestOfUserPresence = 1u << 0,
  23. kTestOfUserVerification = 1u << 2,
  24. kAttestation = 1u << 6,
  25. kExtensionDataIncluded = 1u << 7,
  26. };
  27. static absl::optional<AuthenticatorData> DecodeAuthenticatorData(
  28. base::span<const uint8_t> auth_data);
  29. // The attested credential |data| must be specified iff |flags| have
  30. // kAttestation set; and |extensions| must be specified iff |flags| have
  31. // kExtensionDataIncluded set.
  32. AuthenticatorData(base::span<const uint8_t, kRpIdHashLength> rp_id_hash,
  33. uint8_t flags,
  34. base::span<const uint8_t, kSignCounterLength> sign_counter,
  35. absl::optional<AttestedCredentialData> data,
  36. absl::optional<cbor::Value> extensions = absl::nullopt);
  37. // Creates an AuthenticatorData with flags and signature counter encoded
  38. // according to the supplied arguments.
  39. AuthenticatorData(
  40. base::span<const uint8_t, kRpIdHashLength> rp_id_hash,
  41. bool user_present,
  42. bool user_verified,
  43. uint32_t sign_counter,
  44. absl::optional<AttestedCredentialData> attested_credential_data,
  45. absl::optional<cbor::Value> extensions);
  46. AuthenticatorData(AuthenticatorData&& other);
  47. AuthenticatorData& operator=(AuthenticatorData&& other);
  48. AuthenticatorData(const AuthenticatorData&) = delete;
  49. AuthenticatorData& operator=(const AuthenticatorData&) = delete;
  50. ~AuthenticatorData();
  51. // Replaces device AAGUID in attested credential data section with zeros.
  52. // https://w3c.github.io/webauthn/#attested-credential-data
  53. void DeleteDeviceAaguid();
  54. // Produces a byte array consisting of:
  55. // * hash(relying_party_id / appid)
  56. // * flags
  57. // * counter
  58. // * attestation_data.
  59. std::vector<uint8_t> SerializeToByteArray() const;
  60. // Retrieve credential ID from attested credential data section of the
  61. // authenticator data.
  62. std::vector<uint8_t> GetCredentialId() const;
  63. const absl::optional<AttestedCredentialData>& attested_data() const {
  64. return attested_data_;
  65. }
  66. // If a value is returned then the result of calling |is_map()| on it can be
  67. // assumed to be true.
  68. const absl::optional<cbor::Value>& extensions() const { return extensions_; }
  69. const std::array<uint8_t, kRpIdHashLength>& application_parameter() const {
  70. return application_parameter_;
  71. }
  72. bool obtained_user_presence() const {
  73. return flags_ & base::strict_cast<uint8_t>(Flag::kTestOfUserPresence);
  74. }
  75. bool obtained_user_verification() const {
  76. return flags_ & base::strict_cast<uint8_t>(Flag::kTestOfUserVerification);
  77. }
  78. bool attestation_credential_included() const {
  79. return flags_ & base::strict_cast<uint8_t>(Flag::kAttestation);
  80. }
  81. bool extension_data_included() const {
  82. return flags_ & base::strict_cast<uint8_t>(Flag::kExtensionDataIncluded);
  83. }
  84. base::span<const uint8_t, kSignCounterLength> counter() const {
  85. return counter_;
  86. }
  87. private:
  88. // The application parameter: a SHA-256 hash of either the RP ID or the AppID
  89. // associated with the credential.
  90. std::array<uint8_t, kRpIdHashLength> application_parameter_;
  91. // Flags (bit 0 is the least significant bit):
  92. // [ED | AT | RFU | RFU | RFU | RFU | RFU | UP ]
  93. // * Bit 0: Test of User Presence (TUP) result.
  94. // * Bits 1-5: Reserved for future use (RFU).
  95. // * Bit 6: Attestation data included (AT).
  96. // * Bit 7: Extension data included (ED).
  97. uint8_t flags_;
  98. // Signature counter, 32-bit unsigned big-endian integer.
  99. std::array<uint8_t, kSignCounterLength> counter_;
  100. absl::optional<AttestedCredentialData> attested_data_;
  101. // If |extensions_| has a value, then it will be a CBOR map.
  102. absl::optional<cbor::Value> extensions_;
  103. };
  104. } // namespace device
  105. #endif // DEVICE_FIDO_AUTHENTICATOR_DATA_H_