Webauthn HID client

crypto/cose.go

@@ -0,0 +1,76 @@
+package crypto
+
+import (
+	"github.com/fxamacker/cbor/v2"
+)
+
+// COSEKey, as defined per https://tools.ietf.org/html/rfc8152#section-7.1
+// Only supports Elliptic Curve Public keys.
+type COSEKey struct {
+	Y     []byte    `cbor:"-3,keyasint,omitempty"`
+	X     []byte    `cbor:"-2,keyasint,omitempty"`
+	Curve CurveType `cbor:"-1,keyasint,omitempty"`
+
+	KeyType KeyType        `cbor:"1,keyasint"`
+	KeyID   []byte         `cbor:"2,keyasint,omitempty"`
+	Alg     Alg            `cbor:"3,keyasint,omitempty"`
+	KeyOps  []KeyOperation `cbor:"4,keyasint,omitempty"`
+	BaseIV  []byte         `cbor:"5,keyasint,omitempty"`
+}
+
+func (k *COSEKey) CBOREncode() ([]byte, error) {
+	enc, err := cbor.CTAP2EncOptions().EncMode()
+	if err != nil {
+		return nil, err
+	}
+
+	return enc.Marshal(k)
+}
+
+// KeyType defines a key type from https://tools.ietf.org/html/rfc8152#section-13
+type KeyType int
+
+const (
+	// OKP is an Octet Key Pair
+	OKP KeyType = 0x01
+	// EC2 is an Elliptic Curve Key
+	EC2 KeyType = 0x02
+)
+
+type CurveType int
+
+const (
+	P256    CurveType = 0x01
+	P384    CurveType = 0x02
+	P521    CurveType = 0x03
+	X25519  CurveType = 0x04
+	X448    CurveType = 0x05
+	Ed25519 CurveType = 0x06
+	Ed448   CurveType = 0x07
+)
+
+type KeyOperation int
+
+const (
+	Sign KeyOperation = iota + 1
+	Verify
+	Encrypt
+	Decrypt
+	WrapKey
+	UnwrapKey
+	DeriveKey
+	DeriveBits
+	MACCreate
+	MACVerify
+)
+
+// Alg must be the value of one of the algorithms registered in
+// https://www.iana.org/assignments/cose/cose.xhtml#algorithms.
+type Alg int
+
+const (
+	RS256          Alg = -257 // RSASSA-PKCS1-v1_5 using SHA-256
+	PS256          Alg = -37  // RSASSA-PSS w/ SHA-256
+	ECDHES_HKDF256 Alg = -25  // ECDH-ES + HKDF-256
+	ES256          Alg = -7   // ECDSA w/ SHA-256
+)

ctap2token/example/main.go

@@ -0,0 +1,175 @@
+package main
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"math/big"
+
+	"github.com/flynn/u2f/ctap2token"
+	"github.com/flynn/u2f/ctap2token/pin"
+	"github.com/flynn/u2f/u2fhid"
+)
+
+func main() {
+	devices, err := u2fhid.Devices()
+	if err != nil {
+		panic(err)
+	}
+
+	for _, d := range devices {
+		dev, err := u2fhid.Open(d)
+		if err != nil {
+			panic(err)
+		}
+
+		token := ctap2token.NewToken(dev)
+
+		info, err := token.GetInfo()
+		if err != nil {
+			fmt.Printf("failed to retrieve token info (%v), does the token support CTAP2 ?\n", err)
+			continue
+		}
+		fmt.Printf("Token info:\n%#v\n", info)
+
+		clientDataHash := make([]byte, 32)
+		if _, err := rand.Read(clientDataHash); err != nil {
+			panic(err)
+		}
+
+		userID := make([]byte, 32)
+		if _, err := rand.Read(userID); err != nil {
+			panic(err)
+		}
+
+		req := &ctap2token.MakeCredentialRequest{
+			ClientDataHash: clientDataHash,
+			RP: ctap2token.CredentialRpEntity{
+				ID:   "example.com",
+				Name: "Acme",
+			},
+			User: ctap2token.CredentialUserEntity{
+				ID:          userID,
+				Icon:        "https://pics.example.com/00/p/aBjjjpqPb.png",
+				Name:        "[email protected]",
+				DisplayName: "John P. Smith",
+			},
+			PubKeyCredParams: []ctap2token.CredentialParam{
+				ctap2token.PublicKeyES256,
+				ctap2token.PublicKeyRS256,
+			},
+		}
+
+		// first try without user verification
+		fmt.Println("Sending makeCredential request, please press authenticator button...")
+		resp, err := token.MakeCredential(req)
+		if err != nil {
+			// retry but with user verification
+			if errors.Unwrap(err) != ctap2token.ErrPinRequired {
+				panic(err)
+			}
+
+			// HyperSecu Mini returns CTAP2_ERR_PIN_REQUIRED instead of CTAP2_ERR_ACTION_TIMEOUT
+			// so we need an extra check to ensure the Pin is set on the token before asking the user input.
+			if pinEnabled, ok := info.Options["clientPin"]; !ok || !pinEnabled {
+				panic(fmt.Errorf("Got %s error from token but pin is not set.", ctap2token.ErrPinRequired))
+			}
+
+			pinHandler := pin.NewInteractiveHandler()
+			userPIN, err := pinHandler.ReadPIN()
+			if err != nil {
+				panic(err)
+			}
+
+			pinAuth, err := pin.ExchangeUserPin(token, userPIN, clientDataHash)
+			if err != nil {
+				panic(err)
+			}
+			req.PinUVAuth = &pinAuth
+			req.PinUVAuthProtocol = ctap2token.PinProtoV1
+
+			resp, err = token.MakeCredential(req)
+			if err != nil {
+				panic(err)
+			}
+		}
+		fmt.Println("Successfully created credential")
+
+		// Verify signature with the X509 certificate from the attestation statement
+		x509certs, ok := resp.AttSmt["x5c"]
+		if !ok {
+			panic("no x5c field")
+		}
+
+		x509cert := x509certs.([]interface{})[0].([]byte)
+		cert, err := x509.ParseCertificate(x509cert)
+		if err != nil {
+			panic(err)
+		}
+
+		signed := append(resp.AuthData, clientDataHash...)
+		if err := cert.CheckSignature(x509.ECDSAWithSHA256, signed, resp.AttSmt["sig"].([]byte)); err != nil {
+			panic(err)
+		}
+		fmt.Println("MakeCredentials signature is valid!")
+
+		mcpAuthData, err := resp.AuthData.Parse()
+		if err != nil {
+			panic(err)
+		}
+		fmt.Printf("credentialID: %x\n", mcpAuthData.AttestedCredentialData.CredentialID)
+
+		fmt.Println("Sending GetAssertion request, please press authenticator button...")
+		getAssertionResp, err := token.GetAssertion(&ctap2token.GetAssertionRequest{
+			RPID: "example.com",
+			AllowList: []*ctap2token.CredentialDescriptor{
+				{
+					ID:   mcpAuthData.AttestedCredentialData.CredentialID,
+					Type: ctap2token.PublicKey,
+				},
+			},
+			ClientDataHash: clientDataHash,
+			// enable UserVerified flag
+			// PinUVAuth:         pinAuth,
+			// PinUVAuthProtocol: ctap2token.PinProtoV1,
+		})
+		if err != nil {
+			panic(err)
+		}
+
+		if !bytes.Equal(getAssertionResp.Credential.ID, mcpAuthData.AttestedCredentialData.CredentialID) {
+			panic("CredentialID mismatch")
+		}
+		fmt.Printf("Found credential %x\n", getAssertionResp.Credential.ID)
+
+		// Verify signature with the public key from MakeCredential
+		pubX := new(big.Int)
+		pubX.SetBytes(mcpAuthData.AttestedCredentialData.CredentialPublicKey.X)
+		pubY := new(big.Int)
+		pubY.SetBytes(mcpAuthData.AttestedCredentialData.CredentialPublicKey.Y)
+
+		pubkey := &ecdsa.PublicKey{
+			Curve: elliptic.P256(),
+			X:     pubX,
+			Y:     pubY,
+		}
+
+		hash := sha256.New()
+		if _, err := hash.Write(getAssertionResp.AuthData); err != nil {
+			panic(err)
+		}
+		if _, err := hash.Write(clientDataHash); err != nil {
+			panic(err)
+		}
+
+		if !ecdsa.VerifyASN1(pubkey, hash.Sum(nil), getAssertionResp.Signature) {
+			panic("invalid signature")
+		}
+		fmt.Println("Signature verified!")
+	}
+}