Chrome Release Bot (LUCI) 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
..
aoa 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
bio 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
cable 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
cros 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
hid 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
mac 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
response_data_fuzzer_corpus 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
strings 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
win 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
BUILD.gn 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
DEPS 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
DIR_METADATA 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
OWNERS 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
README.md 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
appid_exclude_probe_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
appid_exclude_probe_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attestation_object.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attestation_object.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attestation_statement.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attestation_statement.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attestation_statement_formats.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attestation_statement_formats.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attestation_statement_formats_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attested_credential_data.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
attested_credential_data.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
auth_token_requester.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
auth_token_requester.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
auth_token_requester_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_data.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_data.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_get_assertion_response.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_get_assertion_response.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_get_info_response.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_get_info_response.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_make_credential_response.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_make_credential_response.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_selection_criteria.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_selection_criteria.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_supported_options.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
authenticator_supported_options.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ble_adapter_manager.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ble_adapter_manager.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ble_adapter_manager_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
cbor_extract.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
cbor_extract.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
cbor_extract_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
credential_management.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
credential_management.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
credential_management_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
credential_management_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
credential_management_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap2_device_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_authenticator_selection_request.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_authenticator_selection_request.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_get_assertion_request.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_get_assertion_request.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_make_credential_request.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_make_credential_request.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_request_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_response_fuzzer.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ctap_response_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
device_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
device_response_converter.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
device_response_converter.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
discoverable_credential_metadata.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
discoverable_credential_metadata.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ed25519_public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
ed25519_public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fake_fido_discovery.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fake_fido_discovery.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fake_fido_discovery_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
features.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
features.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_authenticator.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_authenticator.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_constants.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_constants.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device_authenticator.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device_authenticator.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device_authenticator_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device_discovery.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device_discovery.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_device_discovery_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_discovery_base.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_discovery_base.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_discovery_factory.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_discovery_factory.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_parsing_utils.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_parsing_utils.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_parsing_utils_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_request_handler_base.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_request_handler_base.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_request_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_strings.grd 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_test_data.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_transport_protocol.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_transport_protocol.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
fido_types.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
filter.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
filter.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
filter_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
get_assertion_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
get_assertion_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
get_assertion_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
get_assertion_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
get_assertion_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
get_assertion_task_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
large_blob.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
large_blob.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
large_blob_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
make_credential_handler_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
make_credential_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
make_credential_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
make_credential_task.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
make_credential_task.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
make_credential_task_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
mock_fido_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
mock_fido_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
mock_fido_discovery_observer.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
mock_fido_discovery_observer.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
multiple_virtual_fido_device_factory.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
multiple_virtual_fido_device_factory.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
opaque_attestation_statement.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
opaque_attestation_statement.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
p256_public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
p256_public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
pin.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
pin.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
pin_internal.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
pin_internal.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
pin_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
platform_credential_store.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_descriptor.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_descriptor.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_params.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_params.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_rp_entity.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_rp_entity.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_user_entity.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
public_key_credential_user_entity.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
reset_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
reset_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
rsa_public_key.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
rsa_public_key.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
set_pin_request_handler.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
set_pin_request_handler.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
test_callback_receiver.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
test_callback_receiver_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_command_constructor.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_command_constructor.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_command_constructor_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_register_operation.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_register_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_register_operation_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_sign_operation.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_sign_operation.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
u2f_sign_operation_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_ctap2_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_ctap2_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_ctap2_device_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device_authenticator.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device_authenticator.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device_authenticator_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device_discovery.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device_discovery.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device_factory.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_fido_device_factory.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_u2f_device.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_u2f_device.h 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten
virtual_u2f_device_unittest.cc 4762b62e7d Publish DEPS for 106.0.5249.13 1 vuosi sitten

README.md

Security Keys

Security keys are physical devices that often connect via USB and have a button. They can generate public keys and sign with them to authenticate a user and are most often used as a second factor for security.

Websites interact with them via two APIs: the older U2F API and the modern W3C Webauthn API. In Chromium, the U2F API is not directly supported but it can be used by using postMessage with an internal extension called cryptotoken. Webauthn is supported by Blink and is part of CredMan.

(Historically cryptotoken contained a complete stack that interacted with USB devices directly. Now, however, it’s a wrapper layer over the Webauthn APIs.)

Several different types of security keys are supported. Older security keys implement the U2F protocol while more modern ones implement CTAP2. These devices can work over USB, Bluetooth Low Energy (BLE), or NFC (not supported). Additionally Chromium contains support for using Touch ID on macOS as a security key as well support for forwarding requests to the native libraries on modern versions of Windows.

Life of a request

This section provides a coarse roadmap for understanding the code involved in security key support by highlighting the path that a login request might take.

Firstly, the CredMan get call ends up in CredentialsContainer::get. CredMan supports several types of credentials but the code dealing with publicKey relates to security key support.

The request is packaged into a Mojo call defined in authenticator.mojom. On Android, that Mojo request is handled by Android-specific code and is forwarded to support libraries in Google Play Services. Otherwise the Mojo interface will be bound to AuthenticatorCommon; specifically it’ll call AuthenticatorCommon::GetAssertion.

AuthenticatorCommon is part of Chromium’s content layer and so calls into the embedder to get a delegate object that allows it to perform actions like showing UI. It also triggers the lower-level code to start the process of finding an authenticator to handle the request. For an assertion request it’ll create a GetAssertionRequestHandler from this directory.

The Handler classes manage a specific user action and their first job is to initiate discovery of possible security keys. The discovery process will find candidate USB, BLE, Touch ID, etc devices, each of which will be fed into DispatchRequest. Different actions may be taken depending on features of the discovered authenticator. For example, an authenticator which cannot handle the request may be asked to wait for a touch so that the user can still select it, even though it’ll cause the request to fail. These per-authenticator operations will be dispatched via the abstract FidoAuthenticator interface.

If a per-authenticator operation is complex and requires several steps it will be handled by a “task”. In this example, a GetAssertionTask will likely be created by a FidoDeviceAuthenticator, the implementation of FidoAuthenticator used by physical devices.

The assertion task knows how to sequence a series of U2F or CTAP2 operations to implement an assertion request. In the case of U2F, there will be another layer of state machines in, e.g., U2fSignOperation because U2F has a historical authenticator model.

If interaction with UI is required, for example to prompt for a PIN, the handler will make calls via the Observer interface, which is implemented by the embedder’s UI objects that were created by AuthenticatorCommon.

Settings

It’s also possible for security key operations to be triggered by actions in the Settings UI: there are several security key actions that can be taken on chrome://settings/securityKeys. In this case, calls from the Javascript that implements the Settings UI end up in SecurityKeysHandler, which then operates in the same way as AuthenticatorCommon, albeit without creating any native UI.

Fuzzers

libFuzzer tests are in *_fuzzer.cc files. They test for bad input from devices, e.g. when parsing responses to register or sign operations.