125 lines
3.0 KiB
TypeScript
125 lines
3.0 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
bytesToArrayBuffer,
|
|
bytesToBase64Url,
|
|
utf8ToBytes,
|
|
} from "../../src/crypto/encoding";
|
|
import { verifyAttestation } from "../../src/webauthn/attestation";
|
|
|
|
function bytesValue(value: Uint8Array): number[] {
|
|
if (value.length < 24) return [0x40 | value.length, ...value];
|
|
if (value.length < 256) return [0x58, value.length, ...value];
|
|
return [0x59, value.length >>> 8, value.length & 0xff, ...value];
|
|
}
|
|
|
|
function textValue(value: string): number[] {
|
|
const encoded = utf8ToBytes(value);
|
|
return [0x60 | encoded.length, ...encoded];
|
|
}
|
|
|
|
function noneAttestation(
|
|
authenticatorData: Uint8Array,
|
|
format = "none",
|
|
): Uint8Array {
|
|
return Uint8Array.from([
|
|
0xa3,
|
|
...textValue("fmt"),
|
|
...textValue(format),
|
|
...textValue("authData"),
|
|
...bytesValue(authenticatorData),
|
|
...textValue("attStmt"),
|
|
0xa0,
|
|
]);
|
|
}
|
|
|
|
async function registrationData(): Promise<{
|
|
attestationObject: string;
|
|
clientDataJSON: string;
|
|
challenge: string;
|
|
}> {
|
|
const challenge = bytesToBase64Url(Uint8Array.of(1, 2, 3, 4));
|
|
const client = utf8ToBytes(
|
|
JSON.stringify({
|
|
type: "webauthn.create",
|
|
challenge,
|
|
origin: "https://example.test",
|
|
crossOrigin: false,
|
|
}),
|
|
);
|
|
const rpHash = new Uint8Array(
|
|
await crypto.subtle.digest(
|
|
"SHA-256",
|
|
bytesToArrayBuffer(utf8ToBytes("example.test")),
|
|
),
|
|
);
|
|
const cose = Uint8Array.from([
|
|
0xa5,
|
|
0x01,
|
|
0x02,
|
|
0x03,
|
|
0x26,
|
|
0x20,
|
|
0x01,
|
|
0x21,
|
|
0x58,
|
|
0x20,
|
|
...new Uint8Array(32).fill(1),
|
|
0x22,
|
|
0x58,
|
|
0x20,
|
|
...new Uint8Array(32).fill(2),
|
|
]);
|
|
const authData = Uint8Array.from([
|
|
...rpHash,
|
|
0x41,
|
|
0,
|
|
0,
|
|
0,
|
|
0,
|
|
...new Uint8Array(16),
|
|
0,
|
|
1,
|
|
7,
|
|
...cose,
|
|
]);
|
|
return {
|
|
attestationObject: bytesToBase64Url(noneAttestation(authData)),
|
|
clientDataJSON: bytesToBase64Url(client),
|
|
challenge,
|
|
};
|
|
}
|
|
|
|
describe("WebAuthn attestation verification", () => {
|
|
it("verifies a registration with none attestation without claiming trust", async () => {
|
|
const data = await registrationData();
|
|
const result = await verifyAttestation({
|
|
...data,
|
|
expectedChallenge: data.challenge,
|
|
expectedOrigin: "https://example.test",
|
|
expectedRpId: "example.test",
|
|
});
|
|
expect(result).toMatchObject({
|
|
verified: true,
|
|
format: "none",
|
|
attestationType: "none",
|
|
trustEstablished: false,
|
|
});
|
|
});
|
|
|
|
it("rejects mismatched ceremony state", async () => {
|
|
const data = await registrationData();
|
|
const result = await verifyAttestation({
|
|
...data,
|
|
expectedChallenge: "different",
|
|
expectedOrigin: "https://evil.test",
|
|
expectedRpId: "evil.test",
|
|
});
|
|
expect(result.verified).toBe(false);
|
|
expect(
|
|
result.checks
|
|
.filter((check) => check.status === "fail")
|
|
.map((check) => check.name),
|
|
).toEqual(expect.arrayContaining(["Challenge", "Origin", "RP ID hash"]));
|
|
});
|
|
});
|