|
| 1 | +<?php |
| 2 | +declare(strict_types=1); |
| 3 | + |
| 4 | +namespace Firehed\U2F\WebAuthn; |
| 5 | + |
| 6 | +use BadMethodCallException; |
| 7 | +use Firehed\CBOR\Decoder; |
| 8 | + |
| 9 | +/** |
| 10 | + * @phpstan-type AttestedCredentialData array{ |
| 11 | + * aaguid: string, |
| 12 | + * credentialId: string, |
| 13 | + * credentialPublicKey: array{ |
| 14 | + * 1: int, |
| 15 | + * 3?: int, |
| 16 | + * -1: int, |
| 17 | + * -2?: string, |
| 18 | + * -3?: string, |
| 19 | + * -4?: string, |
| 20 | + * } |
| 21 | + * } |
| 22 | + */ |
| 23 | +class AuthenticatorData |
| 24 | +{ |
| 25 | + /** @var bool */ |
| 26 | + private $isUserPresent; |
| 27 | + |
| 28 | + /** @var bool */ |
| 29 | + private $isUserVerified; |
| 30 | + |
| 31 | + /** @var string (binary) */ |
| 32 | + private $rpIdHash; |
| 33 | + |
| 34 | + /** @var int */ |
| 35 | + private $signCount; |
| 36 | + |
| 37 | + /** |
| 38 | + * @var ?AttestedCredentialData Attested Credential Data |
| 39 | + */ |
| 40 | + private $ACD; |
| 41 | + |
| 42 | + /** @var null RESERVED: WebAuthn Extensions */ |
| 43 | + private $extensions; |
| 44 | + |
| 45 | + /** |
| 46 | + * @see https://w3c.github.io/webauthn/#sec-authenticator-data |
| 47 | + * WebAuthn 6.1 |
| 48 | + */ |
| 49 | + public static function parse(string $bytes): AuthenticatorData |
| 50 | + { |
| 51 | + assert(strlen($bytes) >= 37); |
| 52 | + |
| 53 | + $rpIdHash = substr($bytes, 0, 32); |
| 54 | + $flags = ord(substr($bytes, 32, 1)); |
| 55 | + $UP = ($flags & 0x01) === 0x01; // bit 0 |
| 56 | + $UV = ($flags & 0x04) === 0x04; // bit 2 |
| 57 | + $AT = ($flags & 0x40) === 0x40; // bit 6 |
| 58 | + $ED = ($flags & 0x80) === 0x80; // bit 7 |
| 59 | + $signCount = unpack('N', substr($bytes, 33, 4))[1]; |
| 60 | + |
| 61 | + $authData = new AuthenticatorData(); |
| 62 | + $authData->isUserPresent = $UP; |
| 63 | + $authData->isUserVerified = $UV; |
| 64 | + $authData->rpIdHash = $rpIdHash; |
| 65 | + $authData->signCount = $signCount; |
| 66 | + |
| 67 | + $restOfBytes = substr($bytes, 37); |
| 68 | + $restOfBytesLength = strlen($restOfBytes); |
| 69 | + if ($AT) { |
| 70 | + assert($restOfBytesLength >= 18); |
| 71 | + |
| 72 | + $aaguid = substr($restOfBytes, 0, 16); |
| 73 | + $credentialIdLength = unpack('n', substr($restOfBytes, 16, 2))[1]; |
| 74 | + assert($restOfBytesLength >= (18 + $credentialIdLength)); |
| 75 | + $credentialId = substr($restOfBytes, 18, $credentialIdLength); |
| 76 | + |
| 77 | + $rawCredentialPublicKey = substr($restOfBytes, 18 + $credentialIdLength); |
| 78 | + |
| 79 | + $decoder = new Decoder(); |
| 80 | + $credentialPublicKey = $decoder->decode($rawCredentialPublicKey); |
| 81 | + |
| 82 | + $authData->ACD = [ |
| 83 | + 'aaguid' => $aaguid, |
| 84 | + 'credentialId' => $credentialId, |
| 85 | + 'credentialPublicKey' => $credentialPublicKey, |
| 86 | + ]; |
| 87 | + // var_dump($decoder->getNumberOfBytesRead()); |
| 88 | + // cut rest of bytes down based on that ^ ? |
| 89 | + } |
| 90 | + if ($ED) { |
| 91 | + // @codeCoverageIgnoreStart |
| 92 | + throw new BadMethodCallException('Not implemented yet'); |
| 93 | + // @codeCoverageIgnoreEnd |
| 94 | + } |
| 95 | + |
| 96 | + return $authData; |
| 97 | + } |
| 98 | + |
| 99 | + /** @return ?AttestedCredentialData */ |
| 100 | + public function getAttestedCredentialData(): ?array |
| 101 | + { |
| 102 | + return $this->ACD; |
| 103 | + } |
| 104 | + |
| 105 | + public function getRpIdHash(): string |
| 106 | + { |
| 107 | + return $this->rpIdHash; |
| 108 | + } |
| 109 | + |
| 110 | + public function getSignCount(): int |
| 111 | + { |
| 112 | + return $this->signCount; |
| 113 | + } |
| 114 | + |
| 115 | + public function isUserPresent(): bool |
| 116 | + { |
| 117 | + return $this->isUserPresent; |
| 118 | + } |
| 119 | + |
| 120 | + /** |
| 121 | + * @return array{ |
| 122 | + * isUserPresent: bool, |
| 123 | + * isUserVerified: bool, |
| 124 | + * rpIdHash: string, |
| 125 | + * signCount: int, |
| 126 | + * ACD?: array{ |
| 127 | + * aaguid: string, |
| 128 | + * credentialId: string, |
| 129 | + * credentialPublicKey: array{ |
| 130 | + * kty: int, |
| 131 | + * alg: ?int, |
| 132 | + * crv: int, |
| 133 | + * x: string, |
| 134 | + * y: string, |
| 135 | + * d: string, |
| 136 | + * }, |
| 137 | + * }, |
| 138 | + * } |
| 139 | + */ |
| 140 | + public function __debugInfo(): array |
| 141 | + { |
| 142 | + $hex = function ($str) { |
| 143 | + return '0x' . bin2hex($str); |
| 144 | + }; |
| 145 | + $data = [ |
| 146 | + 'isUserPresent' => $this->isUserPresent, |
| 147 | + 'isUserVerified' => $this->isUserVerified, |
| 148 | + 'rpIdHash' => $hex($this->rpIdHash), |
| 149 | + 'signCount' => $this->signCount, |
| 150 | + ]; |
| 151 | + |
| 152 | + if ($this->ACD) { |
| 153 | + // See RFC8152 section 7 (COSE key parameters) |
| 154 | + $pk = [ |
| 155 | + 'kty' => $this->ACD['credentialPublicKey'][1], // MUST be 'EC2' (sec 13 tbl 21) |
| 156 | + // kid = 2 |
| 157 | + 'alg' => $this->ACD['credentialPublicKey'][3] ?? null, |
| 158 | + // key_ops = 4 // must include sign (1)/verify(2) if present, depending on usage |
| 159 | + // Base IV = 5 |
| 160 | + |
| 161 | + // this would be 'k' if 'kty'===4(Symmetric) |
| 162 | + 'crv' => $this->ACD['credentialPublicKey'][-1], // (13.1 tbl 22) |
| 163 | + 'x' => $hex($this->ACD['credentialPublicKey'][-2] ?? ''), // (13.1.1 tbl 23/13.2 tbl 24) |
| 164 | + 'y' => $hex($this->ACD['credentialPublicKey'][-3] ?? ''), // (13.1.1 tbl 23) |
| 165 | + 'd' => $hex($this->ACD['credentialPublicKey'][-4] ?? ''), // (13.2 tbl 24) |
| 166 | + |
| 167 | + ]; |
| 168 | + $acd = [ |
| 169 | + 'aaguid' => $hex($this->ACD['aaguid']), |
| 170 | + 'credentialId' => $hex($this->ACD['credentialId']), |
| 171 | + 'credentialPublicKey' => $pk, |
| 172 | + ]; |
| 173 | + $data['ACD'] = $acd; |
| 174 | + } |
| 175 | + return $data; |
| 176 | + } |
| 177 | +} |
0 commit comments