ctap_make_credential_request.h 8.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_CTAP_MAKE_CREDENTIAL_REQUEST_H_
  5. #define DEVICE_FIDO_CTAP_MAKE_CREDENTIAL_REQUEST_H_
  6. #include <stdint.h>
  7. #include <array>
  8. #include <string>
  9. #include <vector>
  10. #include "base/component_export.h"
  11. #include "device/fido/authenticator_selection_criteria.h"
  12. #include "device/fido/fido_constants.h"
  13. #include "device/fido/pin.h"
  14. #include "device/fido/public_key_credential_descriptor.h"
  15. #include "device/fido/public_key_credential_params.h"
  16. #include "device/fido/public_key_credential_rp_entity.h"
  17. #include "device/fido/public_key_credential_user_entity.h"
  18. #include "third_party/abseil-cpp/absl/types/optional.h"
  19. namespace cbor {
  20. class Value;
  21. }
  22. namespace device {
  23. // Object containing request parameters for AuthenticatorMakeCredential command
  24. // as specified in
  25. // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html
  26. struct COMPONENT_EXPORT(DEVICE_FIDO) CtapMakeCredentialRequest {
  27. public:
  28. using ClientDataHash = std::array<uint8_t, kClientDataHashLength>;
  29. // ParseOpts are optional parameters passed to Parse().
  30. struct ParseOpts {
  31. // reject_all_extensions makes parsing fail if any extensions are present.
  32. bool reject_all_extensions = false;
  33. };
  34. // Decodes a CTAP2 authenticatorMakeCredential request message. The request's
  35. // |client_data_json| will be empty and |client_data_hash| will be set.
  36. static absl::optional<CtapMakeCredentialRequest> Parse(
  37. const cbor::Value::MapValue& request_map) {
  38. return Parse(request_map, ParseOpts());
  39. }
  40. static absl::optional<CtapMakeCredentialRequest> Parse(
  41. const cbor::Value::MapValue& request_map,
  42. const ParseOpts& opts);
  43. CtapMakeCredentialRequest(
  44. std::string client_data_json,
  45. PublicKeyCredentialRpEntity rp,
  46. PublicKeyCredentialUserEntity user,
  47. PublicKeyCredentialParams public_key_credential_params);
  48. CtapMakeCredentialRequest(const CtapMakeCredentialRequest& that);
  49. CtapMakeCredentialRequest(CtapMakeCredentialRequest&& that);
  50. CtapMakeCredentialRequest& operator=(const CtapMakeCredentialRequest& that);
  51. CtapMakeCredentialRequest& operator=(CtapMakeCredentialRequest&& that);
  52. ~CtapMakeCredentialRequest();
  53. std::string client_data_json;
  54. ClientDataHash client_data_hash;
  55. PublicKeyCredentialRpEntity rp;
  56. PublicKeyCredentialUserEntity user;
  57. PublicKeyCredentialParams public_key_credential_params;
  58. UserVerificationRequirement user_verification =
  59. UserVerificationRequirement::kDiscouraged;
  60. AuthenticatorAttachment authenticator_attachment =
  61. AuthenticatorAttachment::kAny;
  62. bool resident_key_required = false;
  63. // hmac_secret indicates whether the "hmac-secret" extension should be
  64. // asserted to CTAP2 authenticators.
  65. bool hmac_secret = false;
  66. // large_blob_key indicates whether a large blob key should be associated to
  67. // the new credential through the "largeBlobKey" extension.
  68. bool large_blob_key = false;
  69. std::vector<PublicKeyCredentialDescriptor> exclude_list;
  70. // The pinUvAuthParam field. This is the result of calling
  71. // |pin::TokenResponse::PinAuth(client_data_hash)| with the PIN/UV Auth Token
  72. // response obtained from the authenticator.
  73. absl::optional<std::vector<uint8_t>> pin_auth;
  74. // The pinUvAuthProtocol field. It is the version of the PIN/UV Auth Token
  75. // response obtained from the authenticator.
  76. absl::optional<PINUVAuthProtocol> pin_protocol;
  77. // The PIN/UV Auth Token response obtained from the authenticator. This field
  78. // is only used for computing a fresh pinUvAuthParam for getAssertion requests
  79. // during silent probing of |exclude_list| credentials. It is ignored when
  80. // encoding this request to CBOR (|pin_auth| and |pin_protocol| are used for
  81. // that).
  82. absl::optional<pin::TokenResponse> pin_token_for_exclude_list_probing;
  83. AttestationConveyancePreference attestation_preference =
  84. AttestationConveyancePreference::kNone;
  85. // U2F AppID for excluding credentials.
  86. absl::optional<std::string> app_id_exclude;
  87. // cred_protect indicates the level of protection afforded to a credential.
  88. // This depends on a CTAP2 extension that not all authenticators will support.
  89. // This is filled out by |MakeCredentialRequestHandler|.
  90. absl::optional<CredProtect> cred_protect;
  91. // If |cred_protect| is not |nullopt|, this is true if the credProtect level
  92. // must be provided by the target authenticator for the MakeCredential request
  93. // to be sent. This only makes sense when there is a collection of
  94. // authenticators to consider, i.e. for the Windows API.
  95. bool cred_protect_enforce = false;
  96. // min_pin_length_requested indicates that the minPinLength extension[1]
  97. // should be sent to request that the authenticator report the minimum allowed
  98. // PIN length configured.
  99. //
  100. // [1]
  101. // https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-minpinlength-extension
  102. bool min_pin_length_requested = false;
  103. // cred_blob contains an optional credBlob extension.
  104. // https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credBlob-extension
  105. absl::optional<std::vector<uint8_t>> cred_blob;
  106. };
  107. // MakeCredentialOptions contains higher-level request parameters that aren't
  108. // part of the makeCredential request itself, or that need to be combined with
  109. // knowledge of the specific authenticator, thus don't live in
  110. // |CtapMakeCredentialRequest|.
  111. struct COMPONENT_EXPORT(DEVICE_FIDO) MakeCredentialOptions {
  112. MakeCredentialOptions();
  113. explicit MakeCredentialOptions(
  114. const AuthenticatorSelectionCriteria& authenticator_selection_criteria);
  115. ~MakeCredentialOptions();
  116. MakeCredentialOptions(const MakeCredentialOptions&);
  117. MakeCredentialOptions(MakeCredentialOptions&&);
  118. MakeCredentialOptions& operator=(const MakeCredentialOptions&);
  119. MakeCredentialOptions& operator=(MakeCredentialOptions&&);
  120. // authenticator_attachment is a constraint on the type of authenticator
  121. // that a credential should be created on.
  122. AuthenticatorAttachment authenticator_attachment =
  123. AuthenticatorAttachment::kAny;
  124. // resident_key indicates whether the request should result in the creation
  125. // of a client-side discoverable credential (aka resident key).
  126. ResidentKeyRequirement resident_key = ResidentKeyRequirement::kDiscouraged;
  127. // user_verification indicates whether the authenticator should (or must)
  128. // perform user verficiation before creating the credential.
  129. UserVerificationRequirement user_verification =
  130. UserVerificationRequirement::kPreferred;
  131. // cred_protect_request extends |CredProtect| to include information that
  132. // applies at request-routing time. The second element is true if the
  133. // indicated protection level must be provided by the target authenticator
  134. // for the MakeCredential request to be sent.
  135. absl::optional<std::pair<CredProtectRequest, bool>> cred_protect_request;
  136. // allow_skipping_pin_touch causes the handler to forego the first
  137. // "touch-only" step to collect a PIN if exactly one authenticator is
  138. // discovered.
  139. bool allow_skipping_pin_touch = false;
  140. // large_blob_support indicates whether the request should select for
  141. // authenticators supporting the largeBlobs extension (kRequired), merely
  142. // indicate support on the response (kPreferred), or ignore it
  143. // (kNotRequested).
  144. // Values other than kNotRequested will attempt to initialize the large blob
  145. // on the authenticator.
  146. LargeBlobSupport large_blob_support = LargeBlobSupport::kNotRequested;
  147. // make_u2f_api_credential indicates that the credential should be made on a
  148. // U2F security key. It will be scoped to an appId, which is passed in the
  149. // rp.id field of |CtapMakeCredentialRequest|.
  150. bool make_u2f_api_credential = false;
  151. // Indicates whether the request was created in an off-the-record
  152. // BrowserContext (e.g. Chrome Incognito mode).
  153. bool is_off_the_record_context = false;
  154. };
  155. // Serializes MakeCredential request parameter into CBOR encoded map with
  156. // integer keys and CBOR encoded values as defined by the CTAP spec.
  157. // https://drafts.fidoalliance.org/fido-2/latest/fido-client-to-authenticator-protocol-v2.0-wd-20180305.html#authenticatorMakeCredential
  158. COMPONENT_EXPORT(DEVICE_FIDO)
  159. std::pair<CtapRequestCommand, absl::optional<cbor::Value>>
  160. AsCTAPRequestValuePair(const CtapMakeCredentialRequest& request);
  161. } // namespace device
  162. #endif // DEVICE_FIDO_CTAP_MAKE_CREDENTIAL_REQUEST_H_