+45
-26
lines changedFilter options
+45
-26
lines changed Original file line number Diff line number Diff line change
@@ -74,10 +74,12 @@ public OkObjectResult MakeCredentialOptionsTest([FromBody] TEST_MakeCredentialPa
74 74
ExcludeCredentials = existingKeys,
75 75
AuthenticatorSelection = opts.AuthenticatorSelection,
76 76
AttestationPreference = opts.Attestation,
77 -
Extensions = exts
78 -
});
79 - 80 -
// 4. Temporarily store options, session/in-memory cache/redis/db
77 +
Extensions = exts,
78 +
// Conformance tools requires RS1, but it's deprecated
79 +
PubKeyCredParams = [.. PubKeyCredParam.Defaults, PubKeyCredParam.RS1]
80 +
});
81 + 82 +
// 4. Temporarily store options, session/in-memory cache/redis/db
81 83
HttpContext.Session.SetString("fido2.attestationOptions", options.ToJson());
82 84 83 85
// 5. return options to client
@@ -35,7 +35,7 @@ public sealed class CredentialCreateOptions
35 35
/// This member contains information about the desired properties of the credential to be created. The sequence is ordered from most preferred to least preferred. The platform makes a best-effort to create the most preferred credential that it can.
36 36
/// </summary>
37 37
[JsonPropertyName("pubKeyCredParams")]
38 -
public List<PubKeyCredParam> PubKeyCredParams { get; set; }
38 +
public IReadOnlyList<PubKeyCredParam> PubKeyCredParams { get; set; }
39 39 40 40
/// <summary>
41 41
/// This member specifies a time, in milliseconds, that the caller is willing to wait for the call to complete. This is treated as a hint, and MAY be overridden by the platform.
@@ -122,29 +122,17 @@ public static CredentialCreateOptions Create(
122 122
AuthenticatorSelection authenticatorSelection,
123 123
AttestationConveyancePreference attestationConveyancePreference,
124 124
IReadOnlyList<PublicKeyCredentialDescriptor> excludeCredentials,
125 -
AuthenticationExtensionsClientInputs extensions)
125 +
AuthenticationExtensionsClientInputs extensions,
126 +
IReadOnlyList<PubKeyCredParam> pubKeyCredParams)
127 + 126 128
{
127 129
return new CredentialCreateOptions
128 130
{
129 131
Challenge = challenge,
130 132
Rp = new PublicKeyCredentialRpEntity(config.ServerDomain, config.ServerName, config.ServerIcon),
131 133
Timeout = config.Timeout,
132 134
User = user,
133 -
PubKeyCredParams =
134 -
[
135 -
// Add additional as appropriate
136 -
PubKeyCredParam.Ed25519,
137 -
PubKeyCredParam.ES256,
138 -
PubKeyCredParam.RS256,
139 -
PubKeyCredParam.PS256,
140 -
PubKeyCredParam.ES384,
141 -
PubKeyCredParam.RS384,
142 -
PubKeyCredParam.PS384,
143 -
PubKeyCredParam.ES512,
144 -
PubKeyCredParam.RS512,
145 -
PubKeyCredParam.PS512,
146 -
PubKeyCredParam.RS1
147 -
],
135 +
PubKeyCredParams = pubKeyCredParams,
148 136
AuthenticatorSelection = authenticatorSelection,
149 137
Attestation = attestationConveyancePreference,
150 138
ExcludeCredentials = excludeCredentials,
@@ -195,7 +183,25 @@ public sealed class PubKeyCredParam(
195 183
public static readonly PubKeyCredParam PS384 = new(COSE.Algorithm.PS384);
196 184
public static readonly PubKeyCredParam PS512 = new(COSE.Algorithm.PS512);
197 185
public static readonly PubKeyCredParam Ed25519 = new(COSE.Algorithm.EdDSA);
198 -
public static readonly PubKeyCredParam RS1 = new(COSE.Algorithm.RS1);
186 +
public static readonly PubKeyCredParam RS1 = new(COSE.Algorithm.RS1);
187 + 188 +
/// <summary>
189 +
/// The default algorithms supported by the library
190 +
/// </summary>
191 +
public static IReadOnlyList<PubKeyCredParam> Defaults =>
192 +
[
193 +
// Add additional as appropriate
194 +
Ed25519,
195 +
ES256,
196 +
RS256,
197 +
PS256,
198 +
ES384,
199 +
RS384,
200 +
PS384,
201 +
ES512,
202 +
RS512,
203 +
PS512
204 +
];
199 205
}
200 206 201 207
/// <summary>
@@ -31,7 +31,7 @@ public Fido2(
31 31
public CredentialCreateOptions RequestNewCredential(RequestNewCredentialParams requestNewCredentialParams)
32 32
{
33 33
var challenge = RandomNumberGenerator.GetBytes(_config.ChallengeSize);
34 -
return CredentialCreateOptions.Create(_config, challenge, requestNewCredentialParams.User, requestNewCredentialParams.AuthenticatorSelection, requestNewCredentialParams.AttestationPreference, requestNewCredentialParams.ExcludeCredentials, requestNewCredentialParams.Extensions);
34 +
return CredentialCreateOptions.Create(_config, challenge, requestNewCredentialParams.User, requestNewCredentialParams.AuthenticatorSelection, requestNewCredentialParams.AttestationPreference, requestNewCredentialParams.ExcludeCredentials, requestNewCredentialParams.Extensions, requestNewCredentialParams.PubKeyCredParams);
35 35 36 36
}
37 37
@@ -34,4 +34,9 @@ public sealed class RequestNewCredentialParams
34 34
/// The Relying Party MAY use this OPTIONAL member to provide client extension inputs requesting additional processing by the client and authenticator. For example, the Relying Party may request that the client returns additional information about the credential that was created.
35 35
/// </summary>
36 36
public AuthenticationExtensionsClientInputs? Extensions { get; init; }
37 + 38 +
/// <summary>
39 +
/// For advanced use cases. This member lists the key types and signature algorithms the Relying Party supports, ordered from most preferred to least preferred. The client and authenticator make a best-effort to create a credential of the most preferred type possible. If none of the listed types can be created, the create() operation fails.
40 +
/// </summary>
41 +
public IReadOnlyList<PubKeyCredParam> PubKeyCredParams { get; init; } = PubKeyCredParam.Defaults;
37 42
}
Original file line number Diff line number Diff line change
@@ -611,7 +611,6 @@ public async Task TestPackedAttestationAsync()
611 611
var jsonPost = JsonSerializer.Deserialize<AuthenticatorAttestationRawResponse>(await File.ReadAllTextAsync("./attestationResultsPacked.json"));
612 612
var options = JsonSerializer.Deserialize<CredentialCreateOptions>(await File.ReadAllTextAsync("./attestationOptionsPacked.json"));
613 613
var o = AuthenticatorAttestationResponse.Parse(jsonPost);
614 -
options.PubKeyCredParams.Add(new PubKeyCredParam(COSE.Algorithm.RS1, PublicKeyCredentialType.PublicKey));
615 614
await o.VerifyAsync(options, _config, (x, cancellationToken) => Task.FromResult(true), _metadataService, null, CancellationToken.None);
616 615
var authData = o.AttestationObject.AuthData;
617 616
var acdBytes = authData.AttestedCredentialData.ToByteArray();
@@ -644,7 +643,6 @@ public async Task TestTPMSHA1AttestationAsync()
644 643
var jsonPost = JsonSerializer.Deserialize<AuthenticatorAttestationRawResponse>(await File.ReadAllTextAsync("./attestationTPMSHA1Response.json"));
645 644
var options = JsonSerializer.Deserialize<CredentialCreateOptions>(await File.ReadAllTextAsync("./attestationTPMSHA1Options.json"));
646 645
var o = AuthenticatorAttestationResponse.Parse(jsonPost);
647 -
options.PubKeyCredParams.Add(new PubKeyCredParam(COSE.Algorithm.RS1, PublicKeyCredentialType.PublicKey));
648 646
await o.VerifyAsync(options, _config, (x, cancellationToken) => Task.FromResult(true), _metadataService, null, CancellationToken.None);
649 647
}
650 648
@@ -15,6 +15,10 @@
15 15
{
16 16
"type": "public-key",
17 17
"alg": -7
18 +
},
19 +
{
20 +
"type": "public-key",
21 +
"alg": -65535
18 22
}
19 23
],
20 24
"timeout": 0
@@ -19,7 +19,11 @@
19 19
{
20 20
"type": "public-key",
21 21
"alg": -257
22 -
}
22 +
},
23 +
{
24 +
"type": "public-key",
25 +
"alg": -65535
26 +
}
23 27
],
24 28
"timeout": 60000,
25 29
"attestation": "direct",
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4