webauthn.h 39 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014
  1. // Copyright (c) Microsoft Corporation. All rights reserved.
  2. // Licensed under the MIT License.
  3. #ifndef __WEBAUTHN_H_
  4. #define __WEBAUTHN_H_
  5. #pragma once
  6. #include <winapifamily.h>
  7. #pragma region Desktop Family or OneCore Family
  8. #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)
  9. #ifdef __cplusplus
  10. extern "C" {
  11. #endif
  12. #ifndef WINAPI
  13. #define WINAPI __stdcall
  14. #endif
  15. #ifndef INITGUID
  16. #define INITGUID
  17. #include <guiddef.h>
  18. #undef INITGUID
  19. #else
  20. #include <guiddef.h>
  21. #endif
  22. //+------------------------------------------------------------------------------------------
  23. // API Version Information.
  24. // Caller should check for WebAuthNGetApiVersionNumber to check the presence of relevant APIs
  25. // and features for their usage.
  26. //-------------------------------------------------------------------------------------------
  27. #define WEBAUTHN_API_VERSION_1 1
  28. // WEBAUTHN_API_VERSION_1 : Baseline Version
  29. // Data Structures and their sub versions:
  30. // - WEBAUTHN_RP_ENTITY_INFORMATION : 1
  31. // - WEBAUTHN_USER_ENTITY_INFORMATION : 1
  32. // - WEBAUTHN_CLIENT_DATA : 1
  33. // - WEBAUTHN_COSE_CREDENTIAL_PARAMETER : 1
  34. // - WEBAUTHN_COSE_CREDENTIAL_PARAMETERS : Not Applicable
  35. // - WEBAUTHN_CREDENTIAL : 1
  36. // - WEBAUTHN_CREDENTIALS : Not Applicable
  37. // - WEBAUTHN_CREDENTIAL_EX : 1
  38. // - WEBAUTHN_CREDENTIAL_LIST : Not Applicable
  39. // - WEBAUTHN_EXTENSION : Not Applicable
  40. // - WEBAUTHN_EXTENSIONS : Not Applicable
  41. // - WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS : 3
  42. // - WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS : 4
  43. // - WEBAUTHN_COMMON_ATTESTATION : 1
  44. // - WEBAUTHN_CREDENTIAL_ATTESTATION : 3
  45. // - WEBAUTHN_ASSERTION : 1
  46. // Extensions:
  47. // - WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET
  48. // APIs:
  49. // - WebAuthNGetApiVersionNumber
  50. // - WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable
  51. // - WebAuthNAuthenticatorMakeCredential
  52. // - WebAuthNAuthenticatorGetAssertion
  53. // - WebAuthNFreeCredentialAttestation
  54. // - WebAuthNFreeAssertion
  55. // - WebAuthNGetCancellationId
  56. // - WebAuthNCancelCurrentOperation
  57. // - WebAuthNGetErrorName
  58. // - WebAuthNGetW3CExceptionDOMError
  59. #define WEBAUTHN_API_VERSION_2 2
  60. // WEBAUTHN_API_VERSION_2 : Delta From WEBAUTHN_API_VERSION_1
  61. // Added Extensions:
  62. // - WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT
  63. //
  64. #define WEBAUTHN_API_VERSION_3 3
  65. // WEBAUTHN_API_VERSION_3 : Delta From WEBAUTHN_API_VERSION_2
  66. // Data Structures and their sub versions:
  67. // - WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS : 4
  68. // - WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS : 5
  69. // - WEBAUTHN_CREDENTIAL_ATTESTATION : 4
  70. // - WEBAUTHN_ASSERTION : 2
  71. // Added Extensions:
  72. // - WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_BLOB
  73. // - WEBAUTHN_EXTENSIONS_IDENTIFIER_MIN_PIN_LENGTH
  74. //
  75. #define WEBAUTHN_API_VERSION_4 4
  76. // WEBAUTHN_API_VERSION_4 : Delta From WEBAUTHN_API_VERSION_3
  77. // Data Structures and their sub versions:
  78. // - WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS : 5
  79. // - WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS : 6
  80. // - WEBAUTHN_ASSERTION : 3
  81. // APIs:
  82. // - WebAuthNGetPlatformCredentialList
  83. // - WebAuthNFreePlatformCredentialList
  84. // - WebAuthNDeletePlatformCredential
  85. //
  86. #define WEBAUTHN_API_CURRENT_VERSION WEBAUTHN_API_VERSION_4
  87. //+------------------------------------------------------------------------------------------
  88. // Information about an RP Entity
  89. //-------------------------------------------------------------------------------------------
  90. #define WEBAUTHN_RP_ENTITY_INFORMATION_CURRENT_VERSION 1
  91. typedef struct _WEBAUTHN_RP_ENTITY_INFORMATION {
  92. // Version of this structure, to allow for modifications in the future.
  93. // This field is required and should be set to CURRENT_VERSION above.
  94. DWORD dwVersion;
  95. // Identifier for the RP. This field is required.
  96. PCWSTR pwszId;
  97. // Contains the friendly name of the Relying Party, such as "Acme Corporation", "Widgets Inc" or "Awesome Site".
  98. // This field is required.
  99. PCWSTR pwszName;
  100. // Optional URL pointing to RP's logo.
  101. PCWSTR pwszIcon;
  102. } WEBAUTHN_RP_ENTITY_INFORMATION, *PWEBAUTHN_RP_ENTITY_INFORMATION;
  103. typedef const WEBAUTHN_RP_ENTITY_INFORMATION *PCWEBAUTHN_RP_ENTITY_INFORMATION;
  104. //+------------------------------------------------------------------------------------------
  105. // Information about an User Entity
  106. //-------------------------------------------------------------------------------------------
  107. #define WEBAUTHN_MAX_USER_ID_LENGTH 64
  108. #define WEBAUTHN_USER_ENTITY_INFORMATION_CURRENT_VERSION 1
  109. typedef struct _WEBAUTHN_USER_ENTITY_INFORMATION {
  110. // Version of this structure, to allow for modifications in the future.
  111. // This field is required and should be set to CURRENT_VERSION above.
  112. DWORD dwVersion;
  113. // Identifier for the User. This field is required.
  114. DWORD cbId;
  115. _Field_size_bytes_(cbId)
  116. PBYTE pbId;
  117. // Contains a detailed name for this account, such as "john.p.smith@example.com".
  118. PCWSTR pwszName;
  119. // Optional URL that can be used to retrieve an image containing the user's current avatar,
  120. // or a data URI that contains the image data.
  121. PCWSTR pwszIcon;
  122. // For User: Contains the friendly name associated with the user account by the Relying Party, such as "John P. Smith".
  123. PCWSTR pwszDisplayName;
  124. } WEBAUTHN_USER_ENTITY_INFORMATION, *PWEBAUTHN_USER_ENTITY_INFORMATION;
  125. typedef const WEBAUTHN_USER_ENTITY_INFORMATION *PCWEBAUTHN_USER_ENTITY_INFORMATION;
  126. //+------------------------------------------------------------------------------------------
  127. // Information about client data.
  128. //-------------------------------------------------------------------------------------------
  129. #define WEBAUTHN_HASH_ALGORITHM_SHA_256 L"SHA-256"
  130. #define WEBAUTHN_HASH_ALGORITHM_SHA_384 L"SHA-384"
  131. #define WEBAUTHN_HASH_ALGORITHM_SHA_512 L"SHA-512"
  132. #define WEBAUTHN_CLIENT_DATA_CURRENT_VERSION 1
  133. typedef struct _WEBAUTHN_CLIENT_DATA {
  134. // Version of this structure, to allow for modifications in the future.
  135. // This field is required and should be set to CURRENT_VERSION above.
  136. DWORD dwVersion;
  137. // Size of the pbClientDataJSON field.
  138. DWORD cbClientDataJSON;
  139. // UTF-8 encoded JSON serialization of the client data.
  140. _Field_size_bytes_(cbClientDataJSON)
  141. PBYTE pbClientDataJSON;
  142. // Hash algorithm ID used to hash the pbClientDataJSON field.
  143. LPCWSTR pwszHashAlgId;
  144. } WEBAUTHN_CLIENT_DATA, *PWEBAUTHN_CLIENT_DATA;
  145. typedef const WEBAUTHN_CLIENT_DATA *PCWEBAUTHN_CLIENT_DATA;
  146. //+------------------------------------------------------------------------------------------
  147. // Information about credential parameters.
  148. //-------------------------------------------------------------------------------------------
  149. #define WEBAUTHN_CREDENTIAL_TYPE_PUBLIC_KEY L"public-key"
  150. #define WEBAUTHN_COSE_ALGORITHM_ECDSA_P256_WITH_SHA256 -7
  151. #define WEBAUTHN_COSE_ALGORITHM_ECDSA_P384_WITH_SHA384 -35
  152. #define WEBAUTHN_COSE_ALGORITHM_ECDSA_P521_WITH_SHA512 -36
  153. #define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA256 -257
  154. #define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA384 -258
  155. #define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA512 -259
  156. #define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA256 -37
  157. #define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA384 -38
  158. #define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA512 -39
  159. #define WEBAUTHN_COSE_CREDENTIAL_PARAMETER_CURRENT_VERSION 1
  160. typedef struct _WEBAUTHN_COSE_CREDENTIAL_PARAMETER {
  161. // Version of this structure, to allow for modifications in the future.
  162. DWORD dwVersion;
  163. // Well-known credential type specifying a credential to create.
  164. LPCWSTR pwszCredentialType;
  165. // Well-known COSE algorithm specifying the algorithm to use for the credential.
  166. LONG lAlg;
  167. } WEBAUTHN_COSE_CREDENTIAL_PARAMETER, *PWEBAUTHN_COSE_CREDENTIAL_PARAMETER;
  168. typedef const WEBAUTHN_COSE_CREDENTIAL_PARAMETER *PCWEBAUTHN_COSE_CREDENTIAL_PARAMETER;
  169. typedef struct _WEBAUTHN_COSE_CREDENTIAL_PARAMETERS {
  170. DWORD cCredentialParameters;
  171. _Field_size_(cCredentialParameters)
  172. PWEBAUTHN_COSE_CREDENTIAL_PARAMETER pCredentialParameters;
  173. } WEBAUTHN_COSE_CREDENTIAL_PARAMETERS, *PWEBAUTHN_COSE_CREDENTIAL_PARAMETERS;
  174. typedef const WEBAUTHN_COSE_CREDENTIAL_PARAMETERS *PCWEBAUTHN_COSE_CREDENTIAL_PARAMETERS;
  175. //+------------------------------------------------------------------------------------------
  176. // Information about credential.
  177. //-------------------------------------------------------------------------------------------
  178. #define WEBAUTHN_CREDENTIAL_CURRENT_VERSION 1
  179. typedef struct _WEBAUTHN_CREDENTIAL {
  180. // Version of this structure, to allow for modifications in the future.
  181. DWORD dwVersion;
  182. // Size of pbID.
  183. DWORD cbId;
  184. // Unique ID for this particular credential.
  185. _Field_size_bytes_(cbId)
  186. PBYTE pbId;
  187. // Well-known credential type specifying what this particular credential is.
  188. LPCWSTR pwszCredentialType;
  189. } WEBAUTHN_CREDENTIAL, *PWEBAUTHN_CREDENTIAL;
  190. typedef const WEBAUTHN_CREDENTIAL *PCWEBAUTHN_CREDENTIAL;
  191. typedef struct _WEBAUTHN_CREDENTIALS {
  192. DWORD cCredentials;
  193. _Field_size_(cCredentials)
  194. PWEBAUTHN_CREDENTIAL pCredentials;
  195. } WEBAUTHN_CREDENTIALS, *PWEBAUTHN_CREDENTIALS;
  196. typedef const WEBAUTHN_CREDENTIALS *PCWEBAUTHN_CREDENTIALS;
  197. //+------------------------------------------------------------------------------------------
  198. // Information about credential with extra information, such as, dwTransports
  199. //-------------------------------------------------------------------------------------------
  200. #define WEBAUTHN_CTAP_TRANSPORT_USB 0x00000001
  201. #define WEBAUTHN_CTAP_TRANSPORT_NFC 0x00000002
  202. #define WEBAUTHN_CTAP_TRANSPORT_BLE 0x00000004
  203. #define WEBAUTHN_CTAP_TRANSPORT_TEST 0x00000008
  204. #define WEBAUTHN_CTAP_TRANSPORT_INTERNAL 0x00000010
  205. #define WEBAUTHN_CTAP_TRANSPORT_FLAGS_MASK 0x0000001F
  206. #define WEBAUTHN_CREDENTIAL_EX_CURRENT_VERSION 1
  207. typedef struct _WEBAUTHN_CREDENTIAL_EX {
  208. // Version of this structure, to allow for modifications in the future.
  209. DWORD dwVersion;
  210. // Size of pbID.
  211. DWORD cbId;
  212. // Unique ID for this particular credential.
  213. _Field_size_bytes_(cbId)
  214. PBYTE pbId;
  215. // Well-known credential type specifying what this particular credential is.
  216. LPCWSTR pwszCredentialType;
  217. // Transports. 0 implies no transport restrictions.
  218. DWORD dwTransports;
  219. } WEBAUTHN_CREDENTIAL_EX, *PWEBAUTHN_CREDENTIAL_EX;
  220. typedef const WEBAUTHN_CREDENTIAL_EX *PCWEBAUTHN_CREDENTIAL_EX;
  221. //+------------------------------------------------------------------------------------------
  222. // Information about credential list with extra information
  223. //-------------------------------------------------------------------------------------------
  224. typedef struct _WEBAUTHN_CREDENTIAL_LIST {
  225. DWORD cCredentials;
  226. _Field_size_(cCredentials)
  227. PWEBAUTHN_CREDENTIAL_EX *ppCredentials;
  228. } WEBAUTHN_CREDENTIAL_LIST, *PWEBAUTHN_CREDENTIAL_LIST;
  229. typedef const WEBAUTHN_CREDENTIAL_LIST *PCWEBAUTHN_CREDENTIAL_LIST;
  230. //+------------------------------------------------------------------------------------------
  231. // Credential Information for WebAuthNGetPlatformCredentialList API
  232. //-------------------------------------------------------------------------------------------
  233. #define WEBAUTHN_CREDENTIAL_DETAILS_VERSION_1 1
  234. #define WEBAUTHN_CREDENTIAL_DETAILS_CURRENT_VERSION \
  235. WEBAUTHN_CREDENTIAL_DETAILS_VERSION_1
  236. typedef struct _WEBAUTHN_CREDENTIAL_DETAILS {
  237. // Version of this structure, to allow for modifications in the future.
  238. DWORD dwVersion;
  239. // Size of pbCredentialID.
  240. DWORD cbCredentialID;
  241. _Field_size_bytes_(cbCredentialID) PBYTE pbCredentialID;
  242. // RP Info
  243. PWEBAUTHN_RP_ENTITY_INFORMATION pRpInformation;
  244. // User Info
  245. PWEBAUTHN_USER_ENTITY_INFORMATION pUserInformation;
  246. // Removable or not.
  247. BOOL bRemovable;
  248. } WEBAUTHN_CREDENTIAL_DETAILS, *PWEBAUTHN_CREDENTIAL_DETAILS;
  249. typedef const WEBAUTHN_CREDENTIAL_DETAILS* PCWEBAUTHN_CREDENTIAL_DETAILS;
  250. typedef struct _WEBAUTHN_CREDENTIAL_DETAILS_LIST {
  251. DWORD cCredentialDetails;
  252. _Field_size_(cCredentialDetails)
  253. PWEBAUTHN_CREDENTIAL_DETAILS* ppCredentialDetails;
  254. } WEBAUTHN_CREDENTIAL_DETAILS_LIST, *PWEBAUTHN_CREDENTIAL_DETAILS_LIST;
  255. typedef const WEBAUTHN_CREDENTIAL_DETAILS_LIST*
  256. PCWEBAUTHN_CREDENTIAL_DETAILS_LIST;
  257. #define WEBAUTHN_GET_CREDENTIALS_OPTIONS_VERSION_1 1
  258. #define WEBAUTHN_GET_CREDENTIALS_OPTIONS_CURRENT_VERSION \
  259. WEBAUTHN_GET_CREDENTIALS_OPTIONS_VERSION_1
  260. typedef struct _WEBAUTHN_GET_CREDENTIALS_OPTIONS {
  261. // Version of this structure, to allow for modifications in the future.
  262. DWORD dwVersion;
  263. // Optional.
  264. LPCWSTR pwszRpId;
  265. // Optional. BrowserInPrivate Mode. Defaulting to FALSE.
  266. BOOL bBrowserInPrivateMode;
  267. } WEBAUTHN_GET_CREDENTIALS_OPTIONS, *PWEBAUTHN_GET_CREDENTIALS_OPTIONS;
  268. typedef const WEBAUTHN_GET_CREDENTIALS_OPTIONS*
  269. PCWEBAUTHN_GET_CREDENTIALS_OPTIONS;
  270. //+------------------------------------------------------------------------------------------
  271. // PRF values.
  272. //-------------------------------------------------------------------------------------------
  273. #define WEBAUTHN_CTAP_ONE_HMAC_SECRET_LENGTH 32
  274. // SALT values below by default are converted into RAW Hmac-Secret values as per
  275. // PRF extension.
  276. // - SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || Value)
  277. //
  278. // Set WEBAUTHN_CTAP_HMAC_SECRET_VALUES_FLAG in dwFlags in
  279. // WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS,
  280. // if caller wants to provide RAW Hmac-Secret SALT values directly. In that
  281. // case, values if provided MUST be of WEBAUTHN_CTAP_ONE_HMAC_SECRET_LENGTH
  282. // size.
  283. typedef struct _WEBAUTHN_HMAC_SECRET_SALT {
  284. // Size of pbFirst.
  285. DWORD cbFirst;
  286. _Field_size_bytes_(cbFirst) PBYTE pbFirst; // Required
  287. // Size of pbSecond.
  288. DWORD cbSecond;
  289. _Field_size_bytes_(cbSecond) PBYTE pbSecond;
  290. } WEBAUTHN_HMAC_SECRET_SALT, *PWEBAUTHN_HMAC_SECRET_SALT;
  291. typedef const WEBAUTHN_HMAC_SECRET_SALT* PCWEBAUTHN_HMAC_SECRET_SALT;
  292. typedef struct _WEBAUTHN_CRED_WITH_HMAC_SECRET_SALT {
  293. // Size of pbCredID.
  294. DWORD cbCredID;
  295. _Field_size_bytes_(cbCredID) PBYTE pbCredID; // Required
  296. // PRF Values for above credential
  297. PWEBAUTHN_HMAC_SECRET_SALT pHmacSecretSalt; // Required
  298. } WEBAUTHN_CRED_WITH_HMAC_SECRET_SALT, *PWEBAUTHN_CRED_WITH_HMAC_SECRET_SALT;
  299. typedef const WEBAUTHN_CRED_WITH_HMAC_SECRET_SALT*
  300. PCWEBAUTHN_CRED_WITH_HMAC_SECRET_SALT;
  301. typedef struct _WEBAUTHN_HMAC_SECRET_SALT_VALUES {
  302. PWEBAUTHN_HMAC_SECRET_SALT pGlobalHmacSalt;
  303. DWORD cCredWithHmacSecretSaltList;
  304. _Field_size_(cCredWithHmacSecretSaltList)
  305. PWEBAUTHN_CRED_WITH_HMAC_SECRET_SALT pCredWithHmacSecretSaltList;
  306. } WEBAUTHN_HMAC_SECRET_SALT_VALUES, *PWEBAUTHN_HMAC_SECRET_SALT_VALUES;
  307. typedef const WEBAUTHN_HMAC_SECRET_SALT_VALUES*
  308. PCWEBAUTHN_HMAC_SECRET_SALT_VALUES;
  309. //+------------------------------------------------------------------------------------------
  310. // Hmac-Secret extension
  311. //-------------------------------------------------------------------------------------------
  312. #define WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET L"hmac-secret"
  313. // Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET
  314. // MakeCredential Input Type: BOOL.
  315. // - pvExtension must point to a BOOL with the value TRUE.
  316. // - cbExtension must contain the sizeof(BOOL).
  317. // MakeCredential Output Type: BOOL.
  318. // - pvExtension will point to a BOOL with the value TRUE if credential
  319. // was successfully created with HMAC_SECRET.
  320. // - cbExtension will contain the sizeof(BOOL).
  321. // GetAssertion Input Type: Not Supported
  322. // GetAssertion Output Type: Not Supported
  323. //+------------------------------------------------------------------------------------------
  324. // credProtect extension
  325. //-------------------------------------------------------------------------------------------
  326. #define WEBAUTHN_USER_VERIFICATION_ANY 0
  327. #define WEBAUTHN_USER_VERIFICATION_OPTIONAL 1
  328. #define WEBAUTHN_USER_VERIFICATION_OPTIONAL_WITH_CREDENTIAL_ID_LIST 2
  329. #define WEBAUTHN_USER_VERIFICATION_REQUIRED 3
  330. typedef struct _WEBAUTHN_CRED_PROTECT_EXTENSION_IN {
  331. // One of the above WEBAUTHN_USER_VERIFICATION_* values
  332. DWORD dwCredProtect;
  333. // Set the following to TRUE to require authenticator support for the
  334. // credProtect extension
  335. BOOL bRequireCredProtect;
  336. } WEBAUTHN_CRED_PROTECT_EXTENSION_IN, *PWEBAUTHN_CRED_PROTECT_EXTENSION_IN;
  337. typedef const WEBAUTHN_CRED_PROTECT_EXTENSION_IN*
  338. PCWEBAUTHN_CRED_PROTECT_EXTENSION_IN;
  339. #define WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT L"credProtect"
  340. // Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT
  341. // MakeCredential Input Type: WEBAUTHN_CRED_PROTECT_EXTENSION_IN.
  342. // - pvExtension must point to a WEBAUTHN_CRED_PROTECT_EXTENSION_IN struct
  343. // - cbExtension will contain the
  344. // sizeof(WEBAUTHN_CRED_PROTECT_EXTENSION_IN).
  345. // MakeCredential Output Type: DWORD.
  346. // - pvExtension will point to a DWORD with one of the above
  347. // WEBAUTHN_USER_VERIFICATION_* values
  348. // if credential was successfully created with CRED_PROTECT.
  349. // - cbExtension will contain the sizeof(DWORD).
  350. // GetAssertion Input Type: Not Supported
  351. // GetAssertion Output Type: Not Supported
  352. //+------------------------------------------------------------------------------------------
  353. // credBlob extension
  354. //-------------------------------------------------------------------------------------------
  355. typedef struct _WEBAUTHN_CRED_BLOB_EXTENSION {
  356. // Size of pbCredBlob.
  357. DWORD cbCredBlob;
  358. _Field_size_bytes_(cbCredBlob) PBYTE pbCredBlob;
  359. } WEBAUTHN_CRED_BLOB_EXTENSION, *PWEBAUTHN_CRED_BLOB_EXTENSION;
  360. typedef const WEBAUTHN_CRED_BLOB_EXTENSION* PCWEBAUTHN_CRED_BLOB_EXTENSION;
  361. #define WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_BLOB L"credBlob"
  362. // Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_BLOB
  363. // MakeCredential Input Type: WEBAUTHN_CRED_BLOB_EXTENSION.
  364. // - pvExtension must point to a WEBAUTHN_CRED_BLOB_EXTENSION struct
  365. // - cbExtension must contain the sizeof(WEBAUTHN_CRED_BLOB_EXTENSION).
  366. // MakeCredential Output Type: BOOL.
  367. // - pvExtension will point to a BOOL with the value TRUE if credBlob was
  368. // successfully created
  369. // - cbExtension will contain the sizeof(BOOL).
  370. // GetAssertion Input Type: BOOL.
  371. // - pvExtension must point to a BOOL with the value TRUE to request the
  372. // credBlob.
  373. // - cbExtension must contain the sizeof(BOOL).
  374. // GetAssertion Output Type: WEBAUTHN_CRED_BLOB_EXTENSION.
  375. // - pvExtension will point to a WEBAUTHN_CRED_BLOB_EXTENSION struct if the
  376. // authenticator
  377. // returns the credBlob in the signed extensions
  378. // - cbExtension will contain the sizeof(WEBAUTHN_CRED_BLOB_EXTENSION).
  379. //+------------------------------------------------------------------------------------------
  380. // minPinLength extension
  381. //-------------------------------------------------------------------------------------------
  382. #define WEBAUTHN_EXTENSIONS_IDENTIFIER_MIN_PIN_LENGTH L"minPinLength"
  383. // Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_MIN_PIN_LENGTH
  384. // MakeCredential Input Type: BOOL.
  385. // - pvExtension must point to a BOOL with the value TRUE to request the
  386. // minPinLength.
  387. // - cbExtension must contain the sizeof(BOOL).
  388. // MakeCredential Output Type: DWORD.
  389. // - pvExtension will point to a DWORD with the minimum pin length if
  390. // returned by the authenticator
  391. // - cbExtension will contain the sizeof(DWORD).
  392. // GetAssertion Input Type: Not Supported
  393. // GetAssertion Output Type: Not Supported
  394. //+------------------------------------------------------------------------------------------
  395. // Information about Extensions.
  396. //-------------------------------------------------------------------------------------------
  397. typedef struct _WEBAUTHN_EXTENSION {
  398. LPCWSTR pwszExtensionIdentifier;
  399. DWORD cbExtension;
  400. PVOID pvExtension;
  401. } WEBAUTHN_EXTENSION, *PWEBAUTHN_EXTENSION;
  402. typedef const WEBAUTHN_EXTENSION *PCWEBAUTHN_EXTENSION;
  403. typedef struct _WEBAUTHN_EXTENSIONS {
  404. DWORD cExtensions;
  405. _Field_size_(cExtensions)
  406. PWEBAUTHN_EXTENSION pExtensions;
  407. } WEBAUTHN_EXTENSIONS, *PWEBAUTHN_EXTENSIONS;
  408. typedef const WEBAUTHN_EXTENSIONS *PCWEBAUTHN_EXTENSIONS;
  409. //+------------------------------------------------------------------------------------------
  410. // Options.
  411. //-------------------------------------------------------------------------------------------
  412. #define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_ANY 0
  413. #define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM 1
  414. #define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM 2
  415. #define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM_U2F_V2 3
  416. #define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_ANY 0
  417. #define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED 1
  418. #define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED 2
  419. #define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_DISCOURAGED 3
  420. #define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ANY 0
  421. #define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE 1
  422. #define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT 2
  423. #define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT 3
  424. #define WEBAUTHN_ENTERPRISE_ATTESTATION_NONE 0
  425. #define WEBAUTHN_ENTERPRISE_ATTESTATION_VENDOR_FACILITATED 1
  426. #define WEBAUTHN_ENTERPRISE_ATTESTATION_PLATFORM_MANAGED 2
  427. #define WEBAUTHN_LARGE_BLOB_SUPPORT_NONE 0
  428. #define WEBAUTHN_LARGE_BLOB_SUPPORT_REQUIRED 1
  429. #define WEBAUTHN_LARGE_BLOB_SUPPORT_PREFERRED 2
  430. #define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_1 1
  431. #define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_2 2
  432. #define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_3 3
  433. #define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_4 4
  434. #define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_5 5
  435. #define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_CURRENT_VERSION \
  436. WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_5
  437. typedef struct _WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS {
  438. // Version of this structure, to allow for modifications in the future.
  439. DWORD dwVersion;
  440. // Time that the operation is expected to complete within.
  441. // This is used as guidance, and can be overridden by the platform.
  442. DWORD dwTimeoutMilliseconds;
  443. // Credentials used for exclusion.
  444. WEBAUTHN_CREDENTIALS CredentialList;
  445. // Optional extensions to parse when performing the operation.
  446. WEBAUTHN_EXTENSIONS Extensions;
  447. // Optional. Platform vs Cross-Platform Authenticators.
  448. DWORD dwAuthenticatorAttachment;
  449. // Optional. Require key to be resident or not. Defaulting to FALSE.
  450. BOOL bRequireResidentKey;
  451. // User Verification Requirement.
  452. DWORD dwUserVerificationRequirement;
  453. // Attestation Conveyance Preference.
  454. DWORD dwAttestationConveyancePreference;
  455. // Reserved for future Use
  456. DWORD dwFlags;
  457. //
  458. // The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_2
  459. //
  460. // Cancellation Id - Optional - See WebAuthNGetCancellationId
  461. GUID *pCancellationId;
  462. //
  463. // The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_3
  464. //
  465. // Exclude Credential List. If present, "CredentialList" will be ignored.
  466. PWEBAUTHN_CREDENTIAL_LIST pExcludeCredentialList;
  467. //
  468. // The following fields have been added in
  469. // WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_4
  470. //
  471. // Enterprise Attestation
  472. DWORD dwEnterpriseAttestation;
  473. // Large Blob Support: none, required or preferred
  474. //
  475. // NTE_INVALID_PARAMETER when large blob required or preferred and
  476. // bRequireResidentKey isn't set to TRUE
  477. DWORD dwLargeBlobSupport;
  478. // Optional. Prefer key to be resident. Defaulting to FALSE. When TRUE,
  479. // overrides the above bRequireResidentKey.
  480. BOOL bPreferResidentKey;
  481. //
  482. // The following fields have been added in
  483. // WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_5
  484. //
  485. // Optional. BrowserInPrivate Mode. Defaulting to FALSE.
  486. BOOL bBrowserInPrivateMode;
  487. } WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS, *PWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS;
  488. typedef const WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS *PCWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS;
  489. #define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_NONE 0
  490. #define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_GET 1
  491. #define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_SET 2
  492. #define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_DELETE 3
  493. #define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_1 1
  494. #define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_2 2
  495. #define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_3 3
  496. #define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_4 4
  497. #define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_5 5
  498. #define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_6 6
  499. #define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_CURRENT_VERSION \
  500. WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_6
  501. /*
  502. Information about flags.
  503. */
  504. #define WEBAUTHN_AUTHENTICATOR_HMAC_SECRET_VALUES_FLAG 0x00100000
  505. typedef struct _WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS {
  506. // Version of this structure, to allow for modifications in the future.
  507. DWORD dwVersion;
  508. // Time that the operation is expected to complete within.
  509. // This is used as guidance, and can be overridden by the platform.
  510. DWORD dwTimeoutMilliseconds;
  511. // Allowed Credentials List.
  512. WEBAUTHN_CREDENTIALS CredentialList;
  513. // Optional extensions to parse when performing the operation.
  514. WEBAUTHN_EXTENSIONS Extensions;
  515. // Optional. Platform vs Cross-Platform Authenticators.
  516. DWORD dwAuthenticatorAttachment;
  517. // User Verification Requirement.
  518. DWORD dwUserVerificationRequirement;
  519. // Flags
  520. DWORD dwFlags;
  521. //
  522. // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_2
  523. //
  524. // Optional identifier for the U2F AppId. Converted to UTF8 before being hashed. Not lower cased.
  525. PCWSTR pwszU2fAppId;
  526. // If the following is non-NULL, then, set to TRUE if the above pwszU2fAppid was used instead of
  527. // PCWSTR pwszRpId;
  528. BOOL *pbU2fAppId;
  529. //
  530. // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_3
  531. //
  532. // Cancellation Id - Optional - See WebAuthNGetCancellationId
  533. GUID *pCancellationId;
  534. //
  535. // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_4
  536. //
  537. // Allow Credential List. If present, "CredentialList" will be ignored.
  538. PWEBAUTHN_CREDENTIAL_LIST pAllowCredentialList;
  539. //
  540. // The following fields have been added in
  541. // WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_5
  542. //
  543. DWORD dwCredLargeBlobOperation;
  544. // Size of pbCredLargeBlob
  545. DWORD cbCredLargeBlob;
  546. _Field_size_bytes_(cbCredLargeBlob) PBYTE pbCredLargeBlob;
  547. //
  548. // The following fields have been added in
  549. // WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_6
  550. //
  551. // PRF values which will be converted into HMAC-SECRET values according to
  552. // WebAuthn Spec.
  553. PWEBAUTHN_HMAC_SECRET_SALT_VALUES pHmacSecretSaltValues;
  554. // Optional. BrowserInPrivate Mode. Defaulting to FALSE.
  555. BOOL bBrowserInPrivateMode;
  556. } WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS, *PWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS;
  557. typedef const WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS *PCWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS;
  558. //+------------------------------------------------------------------------------------------
  559. // Attestation Info.
  560. //
  561. //-------------------------------------------------------------------------------------------
  562. #define WEBAUTHN_ATTESTATION_DECODE_NONE 0
  563. #define WEBAUTHN_ATTESTATION_DECODE_COMMON 1
  564. // WEBAUTHN_ATTESTATION_DECODE_COMMON supports format types
  565. // L"packed"
  566. // L"fido-u2f"
  567. #define WEBAUTHN_ATTESTATION_VER_TPM_2_0 L"2.0"
  568. typedef struct _WEBAUTHN_X5C {
  569. // Length of X.509 encoded certificate
  570. DWORD cbData;
  571. // X.509 encoded certificate bytes
  572. _Field_size_bytes_(cbData)
  573. PBYTE pbData;
  574. } WEBAUTHN_X5C, *PWEBAUTHN_X5C;
  575. // Supports either Self or Full Basic Attestation
  576. // Note, new fields will be added to the following data structure to
  577. // support additional attestation format types, such as, TPM.
  578. // When fields are added, the dwVersion will be incremented.
  579. //
  580. // Therefore, your code must make the following check:
  581. // "if (dwVersion >= WEBAUTHN_COMMON_ATTESTATION_CURRENT_VERSION)"
  582. #define WEBAUTHN_COMMON_ATTESTATION_CURRENT_VERSION 1
  583. typedef struct _WEBAUTHN_COMMON_ATTESTATION {
  584. // Version of this structure, to allow for modifications in the future.
  585. DWORD dwVersion;
  586. // Hash and Padding Algorithm
  587. //
  588. // The following won't be set for "fido-u2f" which assumes "ES256".
  589. PCWSTR pwszAlg;
  590. LONG lAlg; // COSE algorithm
  591. // Signature that was generated for this attestation.
  592. DWORD cbSignature;
  593. _Field_size_bytes_(cbSignature)
  594. PBYTE pbSignature;
  595. // Following is set for Full Basic Attestation. If not, set then, this is Self Attestation.
  596. // Array of X.509 DER encoded certificates. The first certificate is the signer, leaf certificate.
  597. DWORD cX5c;
  598. _Field_size_(cX5c)
  599. PWEBAUTHN_X5C pX5c;
  600. // Following are also set for tpm
  601. PCWSTR pwszVer; // L"2.0"
  602. DWORD cbCertInfo;
  603. _Field_size_bytes_(cbCertInfo)
  604. PBYTE pbCertInfo;
  605. DWORD cbPubArea;
  606. _Field_size_bytes_(cbPubArea)
  607. PBYTE pbPubArea;
  608. } WEBAUTHN_COMMON_ATTESTATION, *PWEBAUTHN_COMMON_ATTESTATION;
  609. typedef const WEBAUTHN_COMMON_ATTESTATION *PCWEBAUTHN_COMMON_ATTESTATION;
  610. #define WEBAUTHN_ATTESTATION_TYPE_PACKED L"packed"
  611. #define WEBAUTHN_ATTESTATION_TYPE_U2F L"fido-u2f"
  612. #define WEBAUTHN_ATTESTATION_TYPE_TPM L"tpm"
  613. #define WEBAUTHN_ATTESTATION_TYPE_NONE L"none"
  614. #define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_1 1
  615. #define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_2 2
  616. #define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_3 3
  617. #define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_4 4
  618. #define WEBAUTHN_CREDENTIAL_ATTESTATION_CURRENT_VERSION \
  619. WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_4
  620. typedef struct _WEBAUTHN_CREDENTIAL_ATTESTATION {
  621. // Version of this structure, to allow for modifications in the future.
  622. DWORD dwVersion;
  623. // Attestation format type
  624. PCWSTR pwszFormatType;
  625. // Size of cbAuthenticatorData.
  626. DWORD cbAuthenticatorData;
  627. // Authenticator data that was created for this credential.
  628. _Field_size_bytes_(cbAuthenticatorData)
  629. PBYTE pbAuthenticatorData;
  630. // Size of CBOR encoded attestation information
  631. //0 => encoded as CBOR null value.
  632. DWORD cbAttestation;
  633. //Encoded CBOR attestation information
  634. _Field_size_bytes_(cbAttestation)
  635. PBYTE pbAttestation;
  636. DWORD dwAttestationDecodeType;
  637. // Following depends on the dwAttestationDecodeType
  638. // WEBAUTHN_ATTESTATION_DECODE_NONE
  639. // NULL - not able to decode the CBOR attestation information
  640. // WEBAUTHN_ATTESTATION_DECODE_COMMON
  641. // PWEBAUTHN_COMMON_ATTESTATION;
  642. PVOID pvAttestationDecode;
  643. // The CBOR encoded Attestation Object to be returned to the RP.
  644. DWORD cbAttestationObject;
  645. _Field_size_bytes_(cbAttestationObject)
  646. PBYTE pbAttestationObject;
  647. // The CredentialId bytes extracted from the Authenticator Data.
  648. // Used by Edge to return to the RP.
  649. DWORD cbCredentialId;
  650. _Field_size_bytes_(cbCredentialId)
  651. PBYTE pbCredentialId;
  652. //
  653. // Following fields have been added in WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_2
  654. //
  655. WEBAUTHN_EXTENSIONS Extensions;
  656. //
  657. // Following fields have been added in WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_3
  658. //
  659. // One of the WEBAUTHN_CTAP_TRANSPORT_* bits will be set corresponding to
  660. // the transport that was used.
  661. DWORD dwUsedTransport;
  662. //
  663. // Following fields have been added in
  664. // WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_4
  665. //
  666. BOOL bEpAtt;
  667. BOOL bLargeBlobSupported;
  668. BOOL bResidentKey;
  669. } WEBAUTHN_CREDENTIAL_ATTESTATION, *PWEBAUTHN_CREDENTIAL_ATTESTATION;
  670. typedef const WEBAUTHN_CREDENTIAL_ATTESTATION *PCWEBAUTHN_CREDENTIAL_ATTESTATION;
  671. //+------------------------------------------------------------------------------------------
  672. // authenticatorGetAssertion output.
  673. //-------------------------------------------------------------------------------------------
  674. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_NONE 0
  675. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_SUCCESS 1
  676. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_NOT_SUPPORTED 2
  677. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_INVALID_DATA 3
  678. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_INVALID_PARAMETER 4
  679. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_NOT_FOUND 5
  680. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_MULTIPLE_CREDENTIALS 6
  681. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_LACK_OF_SPACE 7
  682. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_PLATFORM_ERROR 8
  683. #define WEBAUTHN_CRED_LARGE_BLOB_STATUS_AUTHENTICATOR_ERROR 9
  684. #define WEBAUTHN_ASSERTION_VERSION_1 1
  685. #define WEBAUTHN_ASSERTION_VERSION_2 2
  686. #define WEBAUTHN_ASSERTION_VERSION_3 3
  687. #define WEBAUTHN_ASSERTION_CURRENT_VERSION WEBAUTHN_ASSERTION_VERSION_3
  688. typedef struct _WEBAUTHN_ASSERTION {
  689. // Version of this structure, to allow for modifications in the future.
  690. DWORD dwVersion;
  691. // Size of cbAuthenticatorData.
  692. DWORD cbAuthenticatorData;
  693. // Authenticator data that was created for this assertion.
  694. _Field_size_bytes_(cbAuthenticatorData)
  695. PBYTE pbAuthenticatorData;
  696. // Size of pbSignature.
  697. DWORD cbSignature;
  698. // Signature that was generated for this assertion.
  699. _Field_size_bytes_(cbSignature)
  700. PBYTE pbSignature;
  701. // Credential that was used for this assertion.
  702. WEBAUTHN_CREDENTIAL Credential;
  703. // Size of User Id
  704. DWORD cbUserId;
  705. // UserId
  706. _Field_size_bytes_(cbUserId)
  707. PBYTE pbUserId;
  708. //
  709. // Following fields have been added in WEBAUTHN_ASSERTION_VERSION_2
  710. //
  711. WEBAUTHN_EXTENSIONS Extensions;
  712. // Size of pbCredLargeBlob
  713. DWORD cbCredLargeBlob;
  714. _Field_size_bytes_(cbCredLargeBlob) PBYTE pbCredLargeBlob;
  715. DWORD dwCredLargeBlobStatus;
  716. //
  717. // Following fields have been added in WEBAUTHN_ASSERTION_VERSION_3
  718. //
  719. PWEBAUTHN_HMAC_SECRET_SALT pHmacSecret;
  720. } WEBAUTHN_ASSERTION, *PWEBAUTHN_ASSERTION;
  721. typedef const WEBAUTHN_ASSERTION *PCWEBAUTHN_ASSERTION;
  722. //+------------------------------------------------------------------------------------------
  723. // APIs.
  724. //-------------------------------------------------------------------------------------------
  725. DWORD
  726. WINAPI
  727. WebAuthNGetApiVersionNumber();
  728. HRESULT
  729. WINAPI
  730. WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable(
  731. _Out_ BOOL *pbIsUserVerifyingPlatformAuthenticatorAvailable);
  732. HRESULT
  733. WINAPI
  734. WebAuthNAuthenticatorMakeCredential(
  735. _In_ HWND hWnd,
  736. _In_ PCWEBAUTHN_RP_ENTITY_INFORMATION pRpInformation,
  737. _In_ PCWEBAUTHN_USER_ENTITY_INFORMATION pUserInformation,
  738. _In_ PCWEBAUTHN_COSE_CREDENTIAL_PARAMETERS pPubKeyCredParams,
  739. _In_ PCWEBAUTHN_CLIENT_DATA pWebAuthNClientData,
  740. _In_opt_ PCWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS pWebAuthNMakeCredentialOptions,
  741. _Outptr_result_maybenull_ PWEBAUTHN_CREDENTIAL_ATTESTATION *ppWebAuthNCredentialAttestation);
  742. HRESULT
  743. WINAPI
  744. WebAuthNAuthenticatorGetAssertion(
  745. _In_ HWND hWnd,
  746. _In_ LPCWSTR pwszRpId,
  747. _In_ PCWEBAUTHN_CLIENT_DATA pWebAuthNClientData,
  748. _In_opt_ PCWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS pWebAuthNGetAssertionOptions,
  749. _Outptr_result_maybenull_ PWEBAUTHN_ASSERTION *ppWebAuthNAssertion);
  750. void
  751. WINAPI
  752. WebAuthNFreeCredentialAttestation(
  753. _In_opt_ PWEBAUTHN_CREDENTIAL_ATTESTATION pWebAuthNCredentialAttestation);
  754. void
  755. WINAPI
  756. WebAuthNFreeAssertion(
  757. _In_ PWEBAUTHN_ASSERTION pWebAuthNAssertion);
  758. HRESULT
  759. WINAPI
  760. WebAuthNGetCancellationId(
  761. _Out_ GUID* pCancellationId);
  762. HRESULT
  763. WINAPI
  764. WebAuthNCancelCurrentOperation(
  765. _In_ const GUID* pCancellationId);
  766. // Returns NTE_NOT_FOUND when credentials are not found.
  767. HRESULT
  768. WINAPI
  769. WebAuthNGetPlatformCredentialList(
  770. _In_ PCWEBAUTHN_GET_CREDENTIALS_OPTIONS pGetCredentialsOptions,
  771. _Outptr_result_maybenull_ PWEBAUTHN_CREDENTIAL_DETAILS_LIST*
  772. ppCredentialDetailsList);
  773. void WINAPI WebAuthNFreePlatformCredentialList(
  774. _In_ PWEBAUTHN_CREDENTIAL_DETAILS_LIST pCredentialDetailsList);
  775. HRESULT
  776. WINAPI
  777. WebAuthNDeletePlatformCredential(_In_ DWORD cbCredentialId,
  778. _In_reads_bytes_(cbCredentialId)
  779. const BYTE* pbCredentialId);
  780. //
  781. // Returns the following Error Names:
  782. // L"Success" - S_OK
  783. // L"InvalidStateError" - NTE_EXISTS
  784. // L"ConstraintError" - HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED),
  785. // NTE_NOT_SUPPORTED,
  786. // NTE_TOKEN_KEYSET_STORAGE_FULL
  787. // L"NotSupportedError" - NTE_INVALID_PARAMETER
  788. // L"NotAllowedError" - NTE_DEVICE_NOT_FOUND,
  789. // NTE_NOT_FOUND,
  790. // HRESULT_FROM_WIN32(ERROR_CANCELLED),
  791. // NTE_USER_CANCELLED,
  792. // HRESULT_FROM_WIN32(ERROR_TIMEOUT)
  793. // L"UnknownError" - All other hr values
  794. //
  795. PCWSTR
  796. WINAPI
  797. WebAuthNGetErrorName(
  798. _In_ HRESULT hr);
  799. HRESULT
  800. WINAPI
  801. WebAuthNGetW3CExceptionDOMError(
  802. _In_ HRESULT hr);
  803. #ifdef __cplusplus
  804. } // Balance extern "C" above
  805. #endif
  806. #endif // WINAPI_FAMILY_PARTITION
  807. #pragma endregion
  808. #endif // __WEBAUTHN_H_