ctap_get_assertion_request.h 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_CTAP_GET_ASSERTION_REQUEST_H_
  5. #define DEVICE_FIDO_CTAP_GET_ASSERTION_REQUEST_H_
  6. #include <stdint.h>
  7. #include <array>
  8. #include <string>
  9. #include <vector>
  10. #include "base/component_export.h"
  11. #include "base/containers/span.h"
  12. #include "crypto/sha2.h"
  13. #include "device/fido/cable/cable_discovery_data.h"
  14. #include "device/fido/fido_constants.h"
  15. #include "device/fido/large_blob.h"
  16. #include "device/fido/pin.h"
  17. #include "device/fido/public_key_credential_descriptor.h"
  18. #include "third_party/abseil-cpp/absl/types/optional.h"
  19. namespace cbor {
  20. class Value;
  21. }
  22. namespace device {
  23. // CtapGetAssertionOptions contains values that are pertinent to a
  24. // |GetAssertionTask|, but are not specific to an individual
  25. // authenticatorGetAssertion command, i.e. would not be directly serialised into
  26. // the CBOR.
  27. struct COMPONENT_EXPORT(DEVICE_FIDO) CtapGetAssertionOptions {
  28. CtapGetAssertionOptions();
  29. CtapGetAssertionOptions(const CtapGetAssertionOptions&);
  30. CtapGetAssertionOptions(CtapGetAssertionOptions&&);
  31. ~CtapGetAssertionOptions();
  32. // PRFInput contains salts for the hmac_secret extension, potentially specific
  33. // to a given credential ID.
  34. struct COMPONENT_EXPORT(DEVICE_FIDO) PRFInput {
  35. PRFInput();
  36. PRFInput(const PRFInput&);
  37. PRFInput(PRFInput&&);
  38. ~PRFInput();
  39. absl::optional<std::vector<uint8_t>> credential_id;
  40. std::array<uint8_t, 32> salt1;
  41. absl::optional<std::array<uint8_t, 32>> salt2;
  42. };
  43. absl::optional<pin::KeyAgreementResponse> pin_key_agreement;
  44. // prf_inputs may contain a default PRFInput without a |credential_id|. If so,
  45. // it will be the first element and all others will have |credential_id|s.
  46. // Elements are sorted by |credential_id|s, where present.
  47. std::vector<PRFInput> prf_inputs;
  48. };
  49. // Object that encapsulates request parameters for AuthenticatorGetAssertion as
  50. // specified in the CTAP spec.
  51. // https://fidoalliance.org/specs/fido-v2.0-rd-20161004/fido-client-to-authenticator-protocol-v2.0-rd-20161004.html#authenticatorgetassertion
  52. struct COMPONENT_EXPORT(DEVICE_FIDO) CtapGetAssertionRequest {
  53. public:
  54. using ClientDataHash = std::array<uint8_t, kClientDataHashLength>;
  55. // ParseOpts are optional parameters passed to Parse().
  56. struct ParseOpts {
  57. // reject_all_extensions makes parsing fail if any extensions are present.
  58. bool reject_all_extensions = false;
  59. };
  60. // HMACSecret contains the inputs to the hmac-secret extension:
  61. // https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#sctn-hmac-secret-extension
  62. struct HMACSecret {
  63. HMACSecret(base::span<const uint8_t, kP256X962Length> public_key_x962,
  64. base::span<const uint8_t> encrypted_salts,
  65. base::span<const uint8_t> salts_auth);
  66. HMACSecret(const HMACSecret&);
  67. ~HMACSecret();
  68. HMACSecret& operator=(const HMACSecret&);
  69. std::array<uint8_t, kP256X962Length> public_key_x962;
  70. std::vector<uint8_t> encrypted_salts;
  71. std::vector<uint8_t> salts_auth;
  72. };
  73. // Decodes a CTAP2 authenticatorGetAssertion request message. The request's
  74. // |client_data_json| will be empty and |client_data_hash| will be set.
  75. //
  76. // A |uv| bit of 0 is mapped to UserVerificationRequirement::kDiscouraged.
  77. static absl::optional<CtapGetAssertionRequest> Parse(
  78. const cbor::Value::MapValue& request_map) {
  79. return Parse(request_map, ParseOpts());
  80. }
  81. static absl::optional<CtapGetAssertionRequest> Parse(
  82. const cbor::Value::MapValue& request_map,
  83. const ParseOpts& opts);
  84. CtapGetAssertionRequest(std::string rp_id, std::string client_data_json);
  85. CtapGetAssertionRequest(const CtapGetAssertionRequest& that);
  86. CtapGetAssertionRequest(CtapGetAssertionRequest&& that);
  87. CtapGetAssertionRequest& operator=(const CtapGetAssertionRequest& other);
  88. CtapGetAssertionRequest& operator=(CtapGetAssertionRequest&& other);
  89. ~CtapGetAssertionRequest();
  90. std::string rp_id;
  91. std::string client_data_json;
  92. std::array<uint8_t, kClientDataHashLength> client_data_hash;
  93. UserVerificationRequirement user_verification =
  94. UserVerificationRequirement::kDiscouraged;
  95. bool user_presence_required = true;
  96. std::vector<PublicKeyCredentialDescriptor> allow_list;
  97. absl::optional<std::vector<uint8_t>> pin_auth;
  98. absl::optional<PINUVAuthProtocol> pin_protocol;
  99. absl::optional<std::vector<CableDiscoveryData>> cable_extension;
  100. absl::optional<std::string> app_id;
  101. absl::optional<std::array<uint8_t, crypto::kSHA256Length>>
  102. alternative_application_parameter;
  103. absl::optional<HMACSecret> hmac_secret;
  104. bool large_blob_key = false;
  105. bool large_blob_read = false;
  106. absl::optional<LargeBlob> large_blob_write;
  107. bool get_cred_blob = false;
  108. // Instructs the request handler only to dispatch this request via U2F.
  109. bool is_u2f_only = false;
  110. // Indicates whether the request was created in an off-the-record
  111. // BrowserContext (e.g. Incognito or Guest mode in Chrome).
  112. bool is_off_the_record_context = false;
  113. };
  114. struct CtapGetNextAssertionRequest {};
  115. // Serializes GetAssertion request parameter into CBOR encoded map with
  116. // integer keys and CBOR encoded values as defined by the CTAP spec.
  117. // https://drafts.fidoalliance.org/fido-2/latest/fido-client-to-authenticator-protocol-v2.0-wd-20180305.html#authenticatorGetAssertion
  118. COMPONENT_EXPORT(DEVICE_FIDO)
  119. std::pair<CtapRequestCommand, absl::optional<cbor::Value>>
  120. AsCTAPRequestValuePair(const CtapGetAssertionRequest&);
  121. COMPONENT_EXPORT(DEVICE_FIDO)
  122. std::pair<CtapRequestCommand, absl::optional<cbor::Value>>
  123. AsCTAPRequestValuePair(const CtapGetNextAssertionRequest&);
  124. } // namespace device
  125. #endif // DEVICE_FIDO_CTAP_GET_ASSERTION_REQUEST_H_