Skip to content

Commit 9229c9b

Browse files
emlunemlun
committed
Add missing FIDO MDS data model fields
1 parent 4f7164e commit 9229c9b

File tree

8 files changed

+465
-7
lines changed

8 files changed

+465
-7
lines changed

‎NEWS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,17 @@ New features:
2525
** ProtocolFamily`
2626
** PublicKeyRepresentationFormat`
2727
** TransactionConfirmationDisplayType`
28+
* Added enum constant `CtapVersion.FIDO_2_3`.
29+
* Added missing fields to FIDO MDS data model:
30+
** `AuthenticatorGetInfo`: `attestationFormats`, `longTouchForReset`,
31+
`uvCountSinceLastPinEntry`, `transportsForReset`, `pinComplexityPolicy`,
32+
`pinComplexityPolicyURL`, `maxPINLength`, `authenticatorConfigCommands`
33+
** `BiometricAccuracyDescriptor`: `iAPARThreshold`
34+
** `MetadataStatement`: `friendlyNames`, `iconDark`, `providerLogoLight`,
35+
`providerLogoDark`, `keyScope`, `multiDeviceCredentialSupport`,
36+
`cxpConfigURL`
37+
** `StatusReport`: `certificationProfiles`, `sunsetDate`, `fipsRevision`,
38+
`fipsPhysicalSecurityLevel`
2839

2940
Fixes:
3041

‎webauthn-server-attestation/src/main/java/com/yubico/fido/metadata/AuthenticatorGetInfo.java‎

Lines changed: 198 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,11 @@
4545
@Builder(toBuilder = true)
4646
@Jacksonized
4747
@JsonIgnoreProperties({
48-
"maxAuthenticatorConfigLength",
49-
"defaultCredProtect"
50-
}) // Present in example but not defined
48+
"maxAuthenticatorConfigLength", // Present in example but not defined
49+
"defaultCredProtect", // Present in example but not defined
50+
"encIdentifier", // Nonsensical in MDS context
51+
"encCredStoreState" // Nonsensical in MDS context
52+
})
5153
public class AuthenticatorGetInfo {
5254

5355
/**
@@ -178,6 +180,139 @@ public class AuthenticatorGetInfo {
178180
Integer remainingDiscoverableCredentials;
179181
Set<Integer> vendorPrototypeConfigCommands;
180182

183+
/**
184+
* @since 2.9.0
185+
* @see <a
186+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
187+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
188+
*/
189+
List<String> attestationFormats;
190+
191+
/**
192+
* <code>true</code> if the <code>longTouchForReset</code> member is set to <code>true</code> or
193+
* <code>false</code> in the metadata statement. <code>false</code> if the <code>longTouchForReset
194+
* </code> member is absent in the metadata statement.
195+
*
196+
* @since 2.9.0
197+
* @see <a
198+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
199+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
200+
*/
201+
boolean longTouchForReset;
202+
203+
/**
204+
* @since 2.9.0
205+
* @see <a
206+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
207+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
208+
*/
209+
Integer uvCountSinceLastPinEntry;
210+
211+
/**
212+
* @since 2.9.0
213+
* @see <a
214+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
215+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
216+
*/
217+
Set<String> transportsForReset;
218+
219+
/**
220+
* <code>true</code> if the <code>pinComplexityPolicy</code> member is set to <code>true</code> or
221+
* <code>false</code> in the metadata statement. <code>false</code> if the <code>
222+
* pinComplexityPolicy</code> member is absent in the metadata statement.
223+
*
224+
* @since 2.9.0
225+
* @see <a
226+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
227+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
228+
*/
229+
boolean pinComplexityPolicy;
230+
231+
/**
232+
* @since 2.9.0
233+
* @see <a
234+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
235+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
236+
*/
237+
String pinComplexityPolicyURL;
238+
239+
/**
240+
* @since 2.9.0
241+
* @see <a
242+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
243+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
244+
*/
245+
Integer maxPINLength;
246+
247+
/**
248+
* @since 2.9.0
249+
* @see <a
250+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
251+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
252+
*/
253+
Set<Integer> authenticatorConfigCommands;
254+
255+
AuthenticatorGetInfo(
256+
@NonNull Set<CtapVersion> versions,
257+
Set<String> extensions,
258+
AAGUID aaguid,
259+
SupportedCtapOptions options,
260+
Integer maxMsgSize,
261+
Set<CtapPinUvAuthProtocolVersion> pinUvAuthProtocols,
262+
Integer maxCredentialCountInList,
263+
Integer maxCredentialIdLength,
264+
Set<AuthenticatorTransport> transports,
265+
List<PublicKeyCredentialParameters> algorithms,
266+
Integer maxSerializedLargeBlobArray,
267+
Boolean forcePINChange,
268+
Integer minPINLength,
269+
Integer firmwareVersion,
270+
Integer maxCredBlobLength,
271+
Integer maxRPIDsForSetMinPINLength,
272+
Integer preferredPlatformUvAttempts,
273+
Set<UserVerificationMethod> uvModality,
274+
Map<CtapCertificationId, Integer> certifications,
275+
Integer remainingDiscoverableCredentials,
276+
Set<Integer> vendorPrototypeConfigCommands,
277+
List<String> attestationFormats,
278+
Boolean longTouchForReset,
279+
Integer uvCountSinceLastPinEntry,
280+
Set<String> transportsForReset,
281+
Boolean pinComplexityPolicy,
282+
String pinComplexityPolicyURL,
283+
Integer maxPINLength,
284+
Set<Integer> authenticatorConfigCommands) {
285+
this.versions = versions;
286+
this.extensions = extensions;
287+
this.aaguid = aaguid;
288+
this.options = options;
289+
this.maxMsgSize = maxMsgSize;
290+
this.pinUvAuthProtocols = pinUvAuthProtocols;
291+
this.maxCredentialCountInList = maxCredentialCountInList;
292+
this.maxCredentialIdLength = maxCredentialIdLength;
293+
this.transports = transports;
294+
this.algorithms = algorithms;
295+
this.maxSerializedLargeBlobArray = maxSerializedLargeBlobArray;
296+
this.forcePINChange = forcePINChange;
297+
this.minPINLength = minPINLength;
298+
this.firmwareVersion = firmwareVersion;
299+
this.maxCredBlobLength = maxCredBlobLength;
300+
this.maxRPIDsForSetMinPINLength = maxRPIDsForSetMinPINLength;
301+
this.preferredPlatformUvAttempts = preferredPlatformUvAttempts;
302+
this.uvModality = uvModality;
303+
this.certifications = certifications;
304+
this.remainingDiscoverableCredentials = remainingDiscoverableCredentials;
305+
this.vendorPrototypeConfigCommands = vendorPrototypeConfigCommands;
306+
this.attestationFormats = attestationFormats;
307+
this.longTouchForReset = longTouchForReset != null;
308+
this.uvCountSinceLastPinEntry = uvCountSinceLastPinEntry;
309+
this.transportsForReset = transportsForReset;
310+
this.pinComplexityPolicy = pinComplexityPolicy != null;
311+
this.pinComplexityPolicyURL = pinComplexityPolicyURL;
312+
this.maxPINLength = maxPINLength;
313+
this.authenticatorConfigCommands = authenticatorConfigCommands;
314+
}
315+
181316
/**
182317
* @see <a
183318
* href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
@@ -358,6 +493,66 @@ public Optional<Set<Integer>> getVendorPrototypeConfigCommands() {
358493
return Optional.ofNullable(vendorPrototypeConfigCommands);
359494
}
360495

496+
/**
497+
* @since 2.9.0
498+
* @see <a
499+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
500+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
501+
*/
502+
public Optional<List<String>> getAttestationFormats() {
503+
return Optional.ofNullable(attestationFormats);
504+
}
505+
506+
/**
507+
* @since 2.9.0
508+
* @see <a
509+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
510+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
511+
*/
512+
public Optional<Integer> getUvCountSinceLastPinEntry() {
513+
return Optional.ofNullable(uvCountSinceLastPinEntry);
514+
}
515+
516+
/**
517+
* @since 2.9.0
518+
* @see <a
519+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
520+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
521+
*/
522+
public Optional<Set<String>> getTransportsForReset() {
523+
return Optional.ofNullable(transportsForReset);
524+
}
525+
526+
/**
527+
* @since 2.9.0
528+
* @see <a
529+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
530+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
531+
*/
532+
public Optional<String> getPinComplexityPolicyURL() {
533+
return Optional.ofNullable(pinComplexityPolicyURL);
534+
}
535+
536+
/**
537+
* @since 2.9.0
538+
* @see <a
539+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
540+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
541+
*/
542+
public Optional<Integer> getMaxPINLength() {
543+
return Optional.ofNullable(maxPINLength);
544+
}
545+
546+
/**
547+
* @since 2.9.0
548+
* @see <a
549+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
550+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
551+
*/
552+
public Optional<Set<Integer>> getAuthenticatorConfigCommands() {
553+
return Optional.ofNullable(authenticatorConfigCommands);
554+
}
555+
361556
private static class SetFromIntJsonDeserializer
362557
extends JsonDeserializer<Set<UserVerificationMethod>> {
363558
@Override

‎webauthn-server-attestation/src/main/java/com/yubico/fido/metadata/BiometricAccuracyDescriptor.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.yubico.fido.metadata;
22

3+
import com.fasterxml.jackson.annotation.JsonProperty;
34
import java.util.Optional;
45
import lombok.Builder;
56
import lombok.Value;
@@ -24,6 +25,7 @@ public class BiometricAccuracyDescriptor {
2425

2526
Double selfAttestedFRR;
2627
Double selfAttestedFAR;
28+
Double iAPARThreshold;
2729
Integer maxTemplates;
2830
Integer maxRetries;
2931
Integer blockSlowdown;
@@ -46,6 +48,17 @@ public Optional<Double> getSelfAttestedFAR() {
4648
return Optional.ofNullable(selfAttestedFAR);
4749
}
4850

51+
/**
52+
* @since 2.9.0
53+
* @see <a
54+
* href="https://fidoalliance.org/specs/mds/fido-metadata-statement-v3.1-ps-20250521.html#sctn-type-bad">FIDO
55+
* Metadata Statement §3.3. BiometricAccuracyDescriptor dictionary</a>
56+
*/
57+
@JsonProperty("iAPARThreshold")
58+
public Optional<Double> getIAPARThreshold() {
59+
return Optional.ofNullable(iAPARThreshold);
60+
}
61+
4962
/**
5063
* @see <a
5164
* href="https://fidoalliance.org/specs/mds/fido-metadata-statement-v3.0-ps-20210518.html#biometricaccuracydescriptor-dictionary">FIDO

‎webauthn-server-attestation/src/main/java/com/yubico/fido/metadata/CtapVersion.java‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.yubico.fido.metadata;
22

3+
import com.fasterxml.jackson.annotation.JsonAlias;
34
import com.fasterxml.jackson.annotation.JsonEnumDefaultValue;
45

56
/**
@@ -17,6 +18,7 @@ public enum CtapVersion {
1718
* @since 2.9.0
1819
*/
1920
@JsonEnumDefaultValue
21+
@JsonAlias("FIDO_2_2") // Forbidden by CTAP 2.3 spec
2022
UNKNOWN,
2123

2224
/**
@@ -45,5 +47,13 @@ public enum CtapVersion {
4547
* href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetInfo">Client
4648
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
4749
*/
48-
FIDO_2_1;
50+
FIDO_2_1,
51+
52+
/**
53+
* @since 2.9.0
54+
* @see <a
55+
* href="https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetInfo">Client
56+
* to Authenticator Protocol (CTAP) §6.4. authenticatorGetInfo (0x04)</a>
57+
*/
58+
FIDO_2_3;
4959
}

0 commit comments

Comments
 (0)