1 // Copyright 2018 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #ifndef DEVICE_FIDO_AUTHENTICATOR_MAKE_CREDENTIAL_RESPONSE_H_
6 #define DEVICE_FIDO_AUTHENTICATOR_MAKE_CREDENTIAL_RESPONSE_H_
7
8 #include <stdint.h>
9
10 #include <array>
11 #include <vector>
12
13 #include "base/component_export.h"
14 #include "base/containers/span.h"
15 #include "base/macros.h"
16 #include "base/optional.h"
17 #include "device/fido/attestation_object.h"
18 #include "device/fido/fido_constants.h"
19 #include "device/fido/fido_transport_protocol.h"
20 #include "device/fido/response_data.h"
21
22 namespace device {
23
24 // Attestation object which includes attestation format, authentication
25 // data, and attestation statement returned by the authenticator as a response
26 // to MakeCredential request.
27 // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html#authenticatorMakeCredential
COMPONENT_EXPORT(DEVICE_FIDO)28 class COMPONENT_EXPORT(DEVICE_FIDO) AuthenticatorMakeCredentialResponse
29 : public ResponseData {
30 public:
31 static base::Optional<AuthenticatorMakeCredentialResponse>
32 CreateFromU2fRegisterResponse(
33 base::Optional<FidoTransportProtocol> transport_used,
34 base::span<const uint8_t, kRpIdHashLength> relying_party_id_hash,
35 base::span<const uint8_t> u2f_data);
36
37 AuthenticatorMakeCredentialResponse(
38 base::Optional<FidoTransportProtocol> transport_used,
39 AttestationObject attestation_object);
40 AuthenticatorMakeCredentialResponse(
41 AuthenticatorMakeCredentialResponse&& that);
42 AuthenticatorMakeCredentialResponse& operator=(
43 AuthenticatorMakeCredentialResponse&& other);
44 ~AuthenticatorMakeCredentialResponse() override;
45
46 std::vector<uint8_t> GetCBOREncodedAttestationObject() const;
47
48 // Replaces the attestation statement with a “none” attestation, and removes
49 // AAGUID from authenticator data section unless |preserve_aaguid| is true.
50 // https://w3c.github.io/webauthn/#createCredential
51 void EraseAttestationStatement(AttestationObject::AAGUID erase_aaguid);
52
53 // Returns true if the attestation is a "self" attestation, i.e. is just the
54 // private key signing itself to show that it is fresh and the AAGUID is zero.
55 bool IsSelfAttestation();
56
57 // Returns true if the attestation certificate is known to be inappropriately
58 // identifying. Some tokens return unique attestation certificates even when
59 // the bit to request that is not set. (Normal attestation certificates are
60 // not intended to be trackable.)
61 bool IsAttestationCertificateInappropriatelyIdentifying();
62
63 // ResponseData:
64 const std::array<uint8_t, kRpIdHashLength>& GetRpIdHash() const override;
65
66 const AttestationObject& attestation_object() const {
67 return attestation_object_;
68 }
69
70 base::Optional<FidoTransportProtocol> transport_used() const {
71 return transport_used_;
72 }
73
74 const base::Optional<std::vector<uint8_t>>& android_client_data_ext() const {
75 return android_client_data_ext_;
76 }
77 void set_android_client_data_ext(const std::vector<uint8_t>& data) {
78 android_client_data_ext_ = data;
79 }
80
81 private:
82 AttestationObject attestation_object_;
83
84 // Contains the transport used to register the credential in this case. It is
85 // nullopt for cases where we cannot determine the transport (Windows).
86 base::Optional<FidoTransportProtocol> transport_used_;
87
88 // If not base::nullopt, the content of the googleAndroidClientData extension
89 // authenticator output.
90 base::Optional<std::vector<uint8_t>> android_client_data_ext_;
91
92 DISALLOW_COPY_AND_ASSIGN(AuthenticatorMakeCredentialResponse);
93 };
94
95 // Through cbor::Writer, produces a CTAP style CBOR-encoded byte array
96 // that conforms to the format CTAP2 devices sends to the client as a response.
97 // {01: attestation format name,
98 // 02: authenticator data bytes,
99 // 03: attestation statement bytes }
100 COMPONENT_EXPORT(DEVICE_FIDO)
101 std::vector<uint8_t> AsCTAPStyleCBORBytes(
102 const AuthenticatorMakeCredentialResponse& response);
103
104 } // namespace device
105
106 #endif // DEVICE_FIDO_AUTHENTICATOR_MAKE_CREDENTIAL_RESPONSE_H_
107