fido_constants.h 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_FIDO_CONSTANTS_H_
  5. #define DEVICE_FIDO_FIDO_CONSTANTS_H_
  6. #include <stdint.h>
  7. #include <array>
  8. #include <vector>
  9. #include "base/component_export.h"
  10. #include "base/containers/fixed_flat_set.h"
  11. #include "base/time/time.h"
  12. #include "device/fido/fido_types.h"
  13. namespace device {
  14. // Length of the U2F challenge parameter:
  15. // https://goo.gl/y75WrX#registration-request-message---u2f_register
  16. constexpr size_t kU2fChallengeParamLength = 32;
  17. // Length of the U2F application parameter:
  18. // https://goo.gl/y75WrX#registration-request-message---u2f_register
  19. constexpr size_t kU2fApplicationParamLength = 32;
  20. // Offset of the length of the U2F registration key handle:
  21. // https://goo.gl/y75WrX#registration-response-message-success
  22. constexpr size_t kU2fKeyHandleLengthOffset = 66;
  23. // Offset of the U2F registration key handle:
  24. // https://goo.gl/y75WrX#registration-response-message-success
  25. constexpr size_t kU2fKeyHandleOffset = 67;
  26. // Length of the SHA-256 hash of the JSON-serialized client data:
  27. // https://www.w3.org/TR/webauthn/#collectedclientdata-hash-of-the-serialized-client-data
  28. constexpr size_t kClientDataHashLength = 32;
  29. // Length of the SHA-256 hash of the RP ID asssociated with the credential:
  30. // https://www.w3.org/TR/webauthn/#sec-authenticator-data
  31. constexpr size_t kRpIdHashLength = 32;
  32. // Length of the key used to encrypt large blobs.
  33. // TODO(nsatragno): add a link to the spec once it's published.
  34. constexpr size_t kLargeBlobKeyLength = 32;
  35. // Max length for the user handle:
  36. // https://www.w3.org/TR/webauthn/#user-handle
  37. constexpr size_t kUserHandleMaxLength = 64;
  38. static_assert(kU2fApplicationParamLength == kRpIdHashLength,
  39. "kU2fApplicationParamLength must be equal to kRpIdHashLength.");
  40. // Length of the flags:
  41. // https://www.w3.org/TR/webauthn/#sec-authenticator-data
  42. constexpr size_t kFlagsLength = 1;
  43. // Length of the signature counter, 32-bit unsigned big-endian integer:
  44. // https://www.w3.org/TR/webauthn/#sec-authenticator-data
  45. constexpr size_t kSignCounterLength = 4;
  46. // Length of the AAGUID of the authenticator:
  47. // https://www.w3.org/TR/webauthn/#sec-attested-credential-data
  48. constexpr size_t kAaguidLength = 16;
  49. // Length of the byte length L of Credential ID, 16-bit unsigned big-endian
  50. // integer: https://www.w3.org/TR/webauthn/#sec-attested-credential-data
  51. constexpr size_t kCredentialIdLengthLength = 2;
  52. // Length of an X9.62-encoded, uncompresed, P-256 public key.
  53. constexpr size_t kP256X962Length = 1 /* type byte */ + 32 /* x */ + 32 /* y */;
  54. constexpr uint32_t kMinPinLength = 4;
  55. constexpr uint32_t kDefaultMaxTemplateFriendlyName = 64;
  56. // CTAP protocol device response code, as specified in
  57. // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html#authenticator-api
  58. enum class CtapDeviceResponseCode : uint8_t {
  59. kSuccess = 0x00,
  60. kCtap1ErrInvalidCommand = 0x01,
  61. kCtap1ErrInvalidParameter = 0x02,
  62. kCtap1ErrInvalidLength = 0x03,
  63. kCtap1ErrInvalidSeq = 0x04,
  64. kCtap1ErrTimeout = 0x05,
  65. kCtap1ErrChannelBusy = 0x06,
  66. kCtap1ErrLockRequired = 0x0A,
  67. kCtap1ErrInvalidChannel = 0x0B,
  68. kCtap2ErrCBORUnexpectedType = 0x11,
  69. kCtap2ErrInvalidCBOR = 0x12,
  70. kCtap2ErrMissingParameter = 0x14,
  71. kCtap2ErrLimitExceeded = 0x15,
  72. kCtap2ErrUnsupportedExtension = 0x16,
  73. kCtap2ErrFpDatabaseFull = 0x17,
  74. kCtap2ErrLargeBlobStorageFull = 0x18,
  75. kCtap2ErrCredentialExcluded = 0x19,
  76. kCtap2ErrProcesssing = 0x21,
  77. kCtap2ErrInvalidCredential = 0x22,
  78. kCtap2ErrUserActionPending = 0x23,
  79. kCtap2ErrOperationPending = 0x24,
  80. kCtap2ErrNoOperations = 0x25,
  81. kCtap2ErrUnsupportedAlgorithm = 0x26,
  82. kCtap2ErrOperationDenied = 0x27,
  83. kCtap2ErrKeyStoreFull = 0x28,
  84. kCtap2ErrNotBusy = 0x29,
  85. kCtap2ErrNoOperationPending = 0x2A,
  86. kCtap2ErrUnsupportedOption = 0x2B,
  87. kCtap2ErrInvalidOption = 0x2C,
  88. kCtap2ErrKeepAliveCancel = 0x2D,
  89. kCtap2ErrNoCredentials = 0x2E,
  90. kCtap2ErrUserActionTimeout = 0x2F,
  91. kCtap2ErrNotAllowed = 0x30,
  92. kCtap2ErrPinInvalid = 0x31,
  93. kCtap2ErrPinBlocked = 0x32,
  94. kCtap2ErrPinAuthInvalid = 0x33,
  95. kCtap2ErrPinAuthBlocked = 0x34,
  96. kCtap2ErrPinNotSet = 0x35,
  97. kCtap2ErrPinRequired = 0x36,
  98. kCtap2ErrPinPolicyViolation = 0x37,
  99. kCtap2ErrPinTokenExpired = 0x38,
  100. kCtap2ErrRequestTooLarge = 0x39,
  101. kCtap2ErrActionTimeout = 0x3A,
  102. kCtap2ErrUpRequired = 0x3B,
  103. kCtap2ErrUvBlocked = 0x3C,
  104. kCtap2ErrIntegrityFailure = 0x3D,
  105. kCtap2ErrInvalidSubcommand = 0x3E,
  106. kCtap2ErrUvInvalid = 0x3F,
  107. kCtap2ErrUnauthorizedPermission = 0x40,
  108. kCtap2ErrOther = 0x7F,
  109. kCtap2ErrSpecLast = 0xDF,
  110. kCtap2ErrExtensionFirst = 0xE0,
  111. kCtap2ErrExtensionLast = 0xEF,
  112. kCtap2ErrVendorFirst = 0xF0,
  113. kCtap2ErrVendorLast = 0xFF
  114. };
  115. constexpr auto kCtapResponseCodeList = base::MakeFixedFlatSet<uint8_t>({
  116. static_cast<uint8_t>(CtapDeviceResponseCode::kSuccess),
  117. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrInvalidCommand),
  118. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrInvalidParameter),
  119. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrInvalidLength),
  120. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrInvalidSeq),
  121. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrTimeout),
  122. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrChannelBusy),
  123. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrLockRequired),
  124. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap1ErrInvalidChannel),
  125. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrCBORUnexpectedType),
  126. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrInvalidCBOR),
  127. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrMissingParameter),
  128. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrLimitExceeded),
  129. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUnsupportedExtension),
  130. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrFpDatabaseFull),
  131. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrLargeBlobStorageFull),
  132. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrCredentialExcluded),
  133. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrProcesssing),
  134. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrInvalidCredential),
  135. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUserActionPending),
  136. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrOperationPending),
  137. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrNoOperations),
  138. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUnsupportedAlgorithm),
  139. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrOperationDenied),
  140. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrKeyStoreFull),
  141. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrNotBusy),
  142. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrNoOperationPending),
  143. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUnsupportedOption),
  144. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrInvalidOption),
  145. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrKeepAliveCancel),
  146. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrNoCredentials),
  147. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUserActionTimeout),
  148. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrNotAllowed),
  149. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinInvalid),
  150. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinBlocked),
  151. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinAuthInvalid),
  152. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinAuthBlocked),
  153. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinNotSet),
  154. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinRequired),
  155. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinPolicyViolation),
  156. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrPinTokenExpired),
  157. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrRequestTooLarge),
  158. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrActionTimeout),
  159. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUpRequired),
  160. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUvBlocked),
  161. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrIntegrityFailure),
  162. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrInvalidSubcommand),
  163. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrUvInvalid),
  164. static_cast<uint8_t>(
  165. CtapDeviceResponseCode::kCtap2ErrUnauthorizedPermission),
  166. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrOther),
  167. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrSpecLast),
  168. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrExtensionFirst),
  169. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrExtensionLast),
  170. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrVendorFirst),
  171. static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrVendorLast),
  172. });
  173. // Commands supported by CTAPHID device as specified in
  174. // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html#ctaphid-commands
  175. enum class FidoHidDeviceCommand : uint8_t {
  176. kMsg = 0x03,
  177. kCbor = 0x10,
  178. kInit = 0x06,
  179. kPing = 0x01,
  180. kCancel = 0x11,
  181. kError = 0x3F,
  182. kKeepAlive = 0x3B,
  183. kWink = 0x08,
  184. kLock = 0x04,
  185. };
  186. constexpr std::array<FidoHidDeviceCommand, 9> GetFidoHidDeviceCommandList() {
  187. return {FidoHidDeviceCommand::kMsg, FidoHidDeviceCommand::kCbor,
  188. FidoHidDeviceCommand::kInit, FidoHidDeviceCommand::kPing,
  189. FidoHidDeviceCommand::kCancel, FidoHidDeviceCommand::kError,
  190. FidoHidDeviceCommand::kKeepAlive, FidoHidDeviceCommand::kWink,
  191. FidoHidDeviceCommand::kLock};
  192. }
  193. // BLE device command as specified in
  194. // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html#command-status-and-error-constants
  195. // U2F BLE device does not support cancel command.
  196. enum class FidoBleDeviceCommand : uint8_t {
  197. kPing = 0x81,
  198. kKeepAlive = 0x82,
  199. kMsg = 0x83,
  200. kControl = 0x84,
  201. kCancel = 0xBE,
  202. kError = 0xBF,
  203. };
  204. // Relevant LE Discoverable Mode bits. Reference:
  205. // Bluetooth Core Specification Supplement, Part A, section 1.3
  206. constexpr uint8_t kLeLimitedDiscoverableModeBit = 0;
  207. constexpr uint8_t kLeGeneralDiscoverableModeBit = 1;
  208. // Fido Service Data Flags as specified in
  209. // https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html#ble-pairing-authnr-considerations
  210. enum class FidoServiceDataFlags : uint8_t {
  211. kPairingMode = 0x80,
  212. kPasskeyEntry = 0x40,
  213. };
  214. // Authenticator API commands supported by CTAP devices, as specified in
  215. // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html#authenticator-api
  216. enum class CtapRequestCommand : uint8_t {
  217. kAuthenticatorMakeCredential = 0x01,
  218. kAuthenticatorGetAssertion = 0x02,
  219. kAuthenticatorGetNextAssertion = 0x08,
  220. kAuthenticatorGetInfo = 0x04,
  221. kAuthenticatorClientPin = 0x06,
  222. kAuthenticatorReset = 0x07,
  223. kAuthenticatorBioEnrollment = 0x09,
  224. kAuthenticatorSelection = 0x0B,
  225. kAuthenticatorLargeBlobs = 0x0C,
  226. kAuthenticatorBioEnrollmentPreview = 0x40,
  227. kAuthenticatorCredentialManagement = 0x0a,
  228. kAuthenticatorCredentialManagementPreview = 0x41,
  229. };
  230. // Enumerates the keys in a COSE Key structure. See
  231. // https://tools.ietf.org/html/rfc8152#section-7.1
  232. enum class CoseKeyKey : int {
  233. kAlg = 3,
  234. kKty = 1,
  235. kRSAModulus = -1,
  236. kRSAPublicExponent = -2,
  237. kEllipticCurve = -1,
  238. kEllipticX = -2,
  239. kEllipticY = -3,
  240. };
  241. // Enumerates COSE key types. See
  242. // https://tools.ietf.org/html/rfc8152#section-13
  243. enum class CoseKeyTypes : int {
  244. kOKP = 1,
  245. kEC2 = 2,
  246. kRSA = 3,
  247. // kInvalidForTesting is a random 32-bit number used to test unknown key
  248. // types.
  249. kInvalidForTesting = 146919568,
  250. };
  251. // Enumerates COSE elliptic curves. See
  252. // https://tools.ietf.org/html/rfc8152#section-13.1
  253. enum class CoseCurves : int {
  254. kP256 = 1,
  255. kEd25519 = 6,
  256. };
  257. enum class CoseAlgorithmIdentifier : int {
  258. kEs256 = -7,
  259. kEdDSA = -8,
  260. kRs256 = -257,
  261. // kInvalidForTesting is a random 32-bit number used to test unknown
  262. // algorithms.
  263. kInvalidForTesting = 146919568,
  264. };
  265. // APDU instruction code for U2F request encoding.
  266. // https://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fido-u2f-u2f.h-v1.0-ps-20141009.pdf
  267. enum class U2fApduInstruction : uint8_t {
  268. kRegister = 0x01,
  269. kSign = 0x02,
  270. kVersion = 0x03,
  271. kVendorFirst = 0x40,
  272. kVenderLast = 0xBF,
  273. };
  274. // Enumerates the two types of application parameter values used: the
  275. // "primary" value is the hash of the relying party ID[1] and is always
  276. // provided. The "alternative" value is the hash of a U2F AppID, specified in
  277. // an extension[2], for compatibility with keys that were registered with the
  278. // old API.
  279. //
  280. // [1] https://w3c.github.io/webauthn/#rp-id
  281. // [2] https://w3c.github.io/webauthn/#sctn-appid-extension
  282. enum class ApplicationParameterType {
  283. kPrimary,
  284. kAlternative,
  285. };
  286. // Parameters for fake U2F registration used to check for user presence.
  287. COMPONENT_EXPORT(DEVICE_FIDO)
  288. extern const std::array<uint8_t, 32> kBogusAppParam;
  289. COMPONENT_EXPORT(DEVICE_FIDO)
  290. extern const std::array<uint8_t, 32> kBogusChallenge;
  291. // String used as Relying Party ID to check for user presence.
  292. constexpr char kDummyRpID[] = ".dummy";
  293. // String key values for CTAP request optional parameters and
  294. // AuthenticatorGetInfo response.
  295. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kResidentKeyMapKey[];
  296. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kUserVerificationMapKey[];
  297. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kUserPresenceMapKey[];
  298. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kClientPinMapKey[];
  299. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kPlatformDeviceMapKey[];
  300. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kEntityIdMapKey[];
  301. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kEntityNameMapKey[];
  302. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kDisplayNameMapKey[];
  303. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kIconUrlMapKey[];
  304. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kCredentialTypeMapKey[];
  305. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kCredentialAlgorithmMapKey[];
  306. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kCredentialManagementMapKey[];
  307. COMPONENT_EXPORT(DEVICE_FIDO)
  308. extern const char kCredentialManagementPreviewMapKey[];
  309. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kBioEnrollmentMapKey[];
  310. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kBioEnrollmentPreviewMapKey[];
  311. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kPinUvTokenMapKey[];
  312. extern const char kDefaultCredProtectKey[];
  313. extern const char kEnterpriseAttestationKey[];
  314. extern const char kLargeBlobsKey[];
  315. extern const char kAlwaysUvKey[];
  316. extern const char kMakeCredUvNotRqdKey[];
  317. // HID transport specific constants.
  318. constexpr uint32_t kHidBroadcastChannel = 0xffffffff;
  319. constexpr size_t kHidInitPacketHeaderSize = 7;
  320. constexpr size_t kHidContinuationPacketHeaderSize = 5;
  321. constexpr size_t kHidMaxPacketSize = 64;
  322. constexpr uint8_t kHidMaxLockSeconds = 10;
  323. // Messages are limited to an initiation packet and 128 continuation packets.
  324. constexpr size_t kHidMaxMessageSize = 7609;
  325. // U2F APDU encoding constants, as specified in
  326. // https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-raw-message-formats-v1.2-ps-20170411.html#bib-U2FHeader
  327. constexpr size_t kU2fMaxResponseSize = 65536;
  328. // P1 instructions.
  329. constexpr uint8_t kP1TupRequired = 0x01;
  330. constexpr uint8_t kP1TupConsumed = 0x02;
  331. constexpr uint8_t kP1TupRequiredConsumed = kP1TupRequired | kP1TupConsumed;
  332. // Control byte used for check-only setting. The check-only command is used to
  333. // determine if the provided key handle was originally created by this token
  334. // and whether it was created for the provided application parameter.
  335. constexpr uint8_t kP1CheckOnly = 0x07;
  336. // Indicates that an individual attestation certificate is acceptable to
  337. // return with this registration.
  338. constexpr uint8_t kP1IndividualAttestation = 0x80;
  339. constexpr size_t kMaxKeyHandleLength = 255;
  340. // kCableWebSocketProtocol is the name of the WebSocket subprotocol used by
  341. // caBLEv2. See https://tools.ietf.org/html/rfc6455#section-1.9.
  342. constexpr char kCableWebSocketProtocol[] = "fido.cable";
  343. // kCableShardIdHeader is the name of an HTTP header that is sent in the reply
  344. // from the tunnel server and which specifies the server's chosen shard number.
  345. // TODO(agl): remove. Only being kept around to allow things to compile.
  346. constexpr char kCableShardIdHeader[] = "X-caBLE-Shard";
  347. // kCableRoutingIdHeader is the name of an HTTP header that is sent in the reply
  348. // from the tunnel server and which specifies the server's chosen routing ID
  349. // which other parties can use to reach the same tunnel server.
  350. constexpr char kCableRoutingIdHeader[] = "X-caBLE-Routing-ID";
  351. // kCableClientPayloadHeader is the name of an HTTP header that is to
  352. // the tunnel server when performing a state-assisted handshake and which
  353. // includes the client's nonce and pairing ID.
  354. constexpr char kCableClientPayloadHeader[] = "X-caBLE-Client-Payload";
  355. // Maximum wait time before client error outs on device.
  356. COMPONENT_EXPORT(DEVICE_FIDO) extern const base::TimeDelta kDeviceTimeout;
  357. // Wait time before polling device for U2F register/sign operation again when
  358. // device times out waiting for user presence.
  359. COMPONENT_EXPORT(DEVICE_FIDO) extern const base::TimeDelta kU2fRetryDelay;
  360. // String key values for attestation object as a response to MakeCredential
  361. // request.
  362. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kFormatKey[];
  363. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kAttestationStatementKey[];
  364. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kAuthDataKey[];
  365. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kNoneAttestationValue[];
  366. // String representation of public key credential enum.
  367. // https://w3c.github.io/webauthn/#credentialType
  368. COMPONENT_EXPORT(DEVICE_FIDO)
  369. extern const char kPublicKey[];
  370. const char* CredentialTypeToString(CredentialType type);
  371. // Values used to construct/validate handshake messages for Cable handshake
  372. // protocol.
  373. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kCableHandshakeKeyInfo[];
  374. COMPONENT_EXPORT(DEVICE_FIDO)
  375. extern const std::array<uint8_t, 24> kCableDeviceEncryptionKeyInfo;
  376. COMPONENT_EXPORT(DEVICE_FIDO)
  377. extern const char kCableAuthenticatorHelloMessage[];
  378. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kCableClientHelloMessage[];
  379. // The list of CTAP versions returned in the getInfo response for different
  380. // minor versions.
  381. constexpr Ctap2Version kCtap2Versions2_0[] = {Ctap2Version::kCtap2_0};
  382. constexpr Ctap2Version kCtap2Versions2_1[] = {Ctap2Version::kCtap2_0,
  383. Ctap2Version::kCtap2_1};
  384. // Protocol version strings.
  385. // https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetInfo
  386. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kCtap2Version[];
  387. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kU2fVersion[];
  388. // The version identifier for CTAP 2.1.
  389. // TODO(nsatragno): link to the spec once this is standardized.
  390. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kCtap2_1Version[];
  391. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kExtensionHmacSecret[];
  392. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kExtensionCredProtect[];
  393. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kExtensionLargeBlobKey[];
  394. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kExtensionCredBlob[];
  395. COMPONENT_EXPORT(DEVICE_FIDO) extern const char kExtensionMinPINLength[];
  396. // Maximum number of seconds the browser waits for Bluetooth authenticator to
  397. // send packets that advertises that the device is in pairing mode before
  398. // setting pairing mode to false. The interval time is set to 2 seconds, which
  399. // is equivalent to the maximum Bluetooth error wait interval set by the CTAP
  400. // spec.
  401. // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html#BTCORE
  402. COMPONENT_EXPORT(DEVICE_FIDO)
  403. extern const base::TimeDelta kBleDevicePairingModeWaitingInterval;
  404. // CredProtect enumerates the levels of credential protection specified by the
  405. // `credProtect` CTAP2 extension.
  406. enum class CredProtect : uint8_t {
  407. kUVOptional = 1,
  408. kUVOrCredIDRequired = 2,
  409. kUVRequired = 3,
  410. };
  411. // CredProtectRequest extends |CredProtect| with an additional value that
  412. // represents a request for |kUVOrCredIDRequired|, unless the default is
  413. // higher.
  414. enum class CredProtectRequest : uint8_t {
  415. kUVOptional = 1,
  416. kUVOrCredIDRequired = 2,
  417. kUVRequired = 3,
  418. kUVOrCredIDRequiredOrBetter = 255,
  419. };
  420. // PINUVAuthProtocol is the version number of a PIN/UV auth protocol.
  421. enum class PINUVAuthProtocol : uint8_t {
  422. kV1 = 1,
  423. kV2 = 2,
  424. };
  425. // FidoRequestType enumerates the top-level, user-visable types of requests.
  426. // These correspond to the create() and get() calls at the Web Platform layer.
  427. enum class FidoRequestType : uint8_t {
  428. kMakeCredential = 0,
  429. kGetAssertion = 1,
  430. };
  431. } // namespace device
  432. #endif // DEVICE_FIDO_FIDO_CONSTANTS_H_