credential_management.h 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229
  1. // Copyright 2019 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_CREDENTIAL_MANAGEMENT_H_
  5. #define DEVICE_FIDO_CREDENTIAL_MANAGEMENT_H_
  6. #include "base/component_export.h"
  7. #include "device/fido/fido_constants.h"
  8. #include "device/fido/pin.h"
  9. #include "device/fido/public_key_credential_descriptor.h"
  10. #include "device/fido/public_key_credential_rp_entity.h"
  11. #include "device/fido/public_key_credential_user_entity.h"
  12. #include "third_party/abseil-cpp/absl/types/optional.h"
  13. namespace cbor {
  14. class Value;
  15. }
  16. namespace device {
  17. namespace pin {
  18. struct EmptyResponse;
  19. }
  20. // https://drafts.fidoalliance.org/fido-2/latest/fido-client-to-authenticator-protocol-v2.0-wd-20190409.html#authenticatorCredentialManagement
  21. enum class CredentialManagementRequestKey : uint8_t {
  22. kSubCommand = 0x01,
  23. kSubCommandParams = 0x02,
  24. kPinProtocol = 0x03,
  25. kPinAuth = 0x04,
  26. };
  27. enum class CredentialManagementRequestParamKey : uint8_t {
  28. kRPIDHash = 0x01,
  29. kCredentialID = 0x02,
  30. kUser = 0x03,
  31. };
  32. enum class CredentialManagementResponseKey : uint8_t {
  33. kExistingResidentCredentialsCount = 0x01,
  34. kMaxPossibleRemainingResidentCredentialsCount = 0x02,
  35. kRP = 0x03,
  36. kRPIDHash = 0x04,
  37. kTotalRPs = 0x05,
  38. kUser = 0x06,
  39. kCredentialID = 0x07,
  40. kPublicKey = 0x08,
  41. kTotalCredentials = 0x09,
  42. kCredProtect = 0x0a,
  43. };
  44. enum class CredentialManagementSubCommand : uint8_t {
  45. kGetCredsMetadata = 0x01,
  46. kEnumerateRPsBegin = 0x02,
  47. kEnumerateRPsGetNextRP = 0x03,
  48. kEnumerateCredentialsBegin = 0x04,
  49. kEnumerateCredentialsGetNextCredential = 0x05,
  50. kDeleteCredential = 0x06,
  51. kUpdateUserInformation = 0x07,
  52. };
  53. // CredentialManagementPreviewRequestAdapter wraps any credential management
  54. // request struct in order to replace the authenticatorCredentialManagement
  55. // command byte returned by the static EncodeAsCBOR() method (0x0a) with its
  56. // vendor-specific preview equivalent (0x41).
  57. template <class T>
  58. class CredentialManagementPreviewRequestAdapter {
  59. public:
  60. static std::pair<CtapRequestCommand, absl::optional<cbor::Value>>
  61. EncodeAsCBOR(const CredentialManagementPreviewRequestAdapter<T>& request) {
  62. auto result = T::EncodeAsCBOR(request.wrapped_request_);
  63. DCHECK_EQ(result.first,
  64. CtapRequestCommand::kAuthenticatorCredentialManagement);
  65. result.first =
  66. CtapRequestCommand::kAuthenticatorCredentialManagementPreview;
  67. return result;
  68. }
  69. CredentialManagementPreviewRequestAdapter(T request)
  70. : wrapped_request_(std::move(request)) {}
  71. private:
  72. T wrapped_request_;
  73. };
  74. // CredentialManagementRequest is an authenticatorCredentialManagement(0x0a)
  75. // CTAP2 request. Instances can be obtained via one of the subcommand-specific
  76. // static factory methods.
  77. struct CredentialManagementRequest {
  78. static std::pair<CtapRequestCommand, absl::optional<cbor::Value>>
  79. EncodeAsCBOR(const CredentialManagementRequest&);
  80. enum Version {
  81. kDefault,
  82. kPreview,
  83. };
  84. static CredentialManagementRequest ForGetCredsMetadata(
  85. Version version,
  86. const pin::TokenResponse& token);
  87. static CredentialManagementRequest ForEnumerateRPsBegin(
  88. Version version,
  89. const pin::TokenResponse& token);
  90. static CredentialManagementRequest ForEnumerateRPsGetNext(Version version);
  91. static CredentialManagementRequest ForEnumerateCredentialsBegin(
  92. Version version,
  93. const pin::TokenResponse& token,
  94. std::array<uint8_t, kRpIdHashLength> rp_id_hash);
  95. static CredentialManagementRequest ForEnumerateCredentialsGetNext(
  96. Version version);
  97. static CredentialManagementRequest ForDeleteCredential(
  98. Version version,
  99. const pin::TokenResponse& token,
  100. const PublicKeyCredentialDescriptor& credential_id);
  101. static CredentialManagementRequest ForUpdateUserInformation(
  102. Version version,
  103. const pin::TokenResponse& token,
  104. const PublicKeyCredentialDescriptor& credential_id,
  105. const PublicKeyCredentialUserEntity& updated_user);
  106. CredentialManagementRequest(Version version,
  107. CredentialManagementSubCommand subcommand,
  108. absl::optional<cbor::Value::MapValue> params);
  109. CredentialManagementRequest(CredentialManagementRequest&&);
  110. CredentialManagementRequest& operator=(CredentialManagementRequest&&);
  111. CredentialManagementRequest(const CredentialManagementRequest&) = delete;
  112. CredentialManagementRequest& operator=(const CredentialManagementRequest&) =
  113. delete;
  114. ~CredentialManagementRequest();
  115. Version version;
  116. CredentialManagementSubCommand subcommand;
  117. absl::optional<cbor::Value::MapValue> params;
  118. absl::optional<PINUVAuthProtocol> pin_protocol;
  119. absl::optional<std::vector<uint8_t>> pin_auth;
  120. };
  121. struct CredentialsMetadataResponse {
  122. static absl::optional<CredentialsMetadataResponse> Parse(
  123. const absl::optional<cbor::Value>& cbor_response);
  124. size_t num_existing_credentials;
  125. size_t num_estimated_remaining_credentials;
  126. private:
  127. CredentialsMetadataResponse() = default;
  128. };
  129. struct EnumerateRPsResponse {
  130. static absl::optional<EnumerateRPsResponse> Parse(
  131. bool expect_rp_count,
  132. const absl::optional<cbor::Value>& cbor_response);
  133. // StringFixupPredicate indicates which fields of an EnumerateRPsResponse may
  134. // contain truncated UTF-8 strings. See
  135. // |Ctap2DeviceOperation::CBORPathPredicate|.
  136. static bool StringFixupPredicate(const std::vector<const cbor::Value*>& path);
  137. EnumerateRPsResponse(EnumerateRPsResponse&&);
  138. EnumerateRPsResponse& operator=(EnumerateRPsResponse&&);
  139. ~EnumerateRPsResponse();
  140. absl::optional<PublicKeyCredentialRpEntity> rp;
  141. absl::optional<std::array<uint8_t, kRpIdHashLength>> rp_id_hash;
  142. size_t rp_count;
  143. private:
  144. EnumerateRPsResponse(
  145. absl::optional<PublicKeyCredentialRpEntity> rp,
  146. absl::optional<std::array<uint8_t, kRpIdHashLength>> rp_id_hash,
  147. size_t rp_count);
  148. EnumerateRPsResponse(const EnumerateRPsResponse&) = delete;
  149. EnumerateRPsResponse& operator=(const EnumerateRPsResponse&) = delete;
  150. };
  151. struct EnumerateCredentialsResponse {
  152. static absl::optional<EnumerateCredentialsResponse> Parse(
  153. bool expect_credential_count,
  154. const absl::optional<cbor::Value>& cbor_response);
  155. // StringFixupPredicate indicates which fields of an
  156. // EnumerateCredentialsResponse may contain truncated UTF-8 strings. See
  157. // |Ctap2DeviceOperation::CBORPathPredicate|.
  158. static bool StringFixupPredicate(const std::vector<const cbor::Value*>& path);
  159. EnumerateCredentialsResponse(EnumerateCredentialsResponse&&);
  160. EnumerateCredentialsResponse& operator=(EnumerateCredentialsResponse&&);
  161. ~EnumerateCredentialsResponse();
  162. PublicKeyCredentialUserEntity user;
  163. PublicKeyCredentialDescriptor credential_id;
  164. size_t credential_count;
  165. private:
  166. EnumerateCredentialsResponse(PublicKeyCredentialUserEntity user,
  167. PublicKeyCredentialDescriptor credential_id,
  168. size_t credential_count);
  169. EnumerateCredentialsResponse(const EnumerateCredentialsResponse&) = delete;
  170. EnumerateCredentialsResponse& operator=(EnumerateCredentialsResponse&) =
  171. delete;
  172. };
  173. struct COMPONENT_EXPORT(DEVICE_FIDO) AggregatedEnumerateCredentialsResponse {
  174. AggregatedEnumerateCredentialsResponse(PublicKeyCredentialRpEntity rp);
  175. AggregatedEnumerateCredentialsResponse(
  176. AggregatedEnumerateCredentialsResponse&&);
  177. AggregatedEnumerateCredentialsResponse& operator=(
  178. AggregatedEnumerateCredentialsResponse&&);
  179. ~AggregatedEnumerateCredentialsResponse();
  180. PublicKeyCredentialRpEntity rp;
  181. std::vector<EnumerateCredentialsResponse> credentials;
  182. private:
  183. AggregatedEnumerateCredentialsResponse(
  184. const AggregatedEnumerateCredentialsResponse&) = delete;
  185. };
  186. using DeleteCredentialResponse = pin::EmptyResponse;
  187. using UpdateUserInformationResponse = pin::EmptyResponse;
  188. std::pair<CtapRequestCommand, absl::optional<cbor::Value>>
  189. AsCTAPRequestValuePair(const CredentialManagementRequest&);
  190. } // namespace device
  191. #endif // DEVICE_FIDO_CREDENTIAL_MANAGEMENT_H_