Skip to content

Update TPM authenticator attestation response in seeds#460

Merged
santiagorodriguez96 merged 1 commit intomasterfrom
sr--fix-seeds
Apr 25, 2025
Merged

Update TPM authenticator attestation response in seeds#460
santiagorodriguez96 merged 1 commit intomasterfrom
sr--fix-seeds

Conversation

@santiagorodriguez96
Copy link
Copy Markdown
Contributor

Motivation

Tests are currently failing with the following errors

Failures:

  1) WebAuthn::AuthenticatorAttestationResponse when TPM attestation returns attestation info
     Failure/Error: expect(attestation_response.attestation_type).to eq("AttCA")

       expected: "AttCA"
            got: false

       (compared using ==)

       Diff:
       @@ -1 +1 @@
       -"AttCA"
       +false
     # ./spec/webauthn/authenticator_attestation_response_spec.rb:318:in 'block (3 levels) in <top (required)>'

  2) WebAuthn::AuthenticatorAttestationResponse when TPM attestation verifies
     Failure/Error: raise Object.const_get(error_const_name)

     WebAuthn::AttestationStatementVerificationError:
       WebAuthn::AttestationStatementVerificationError
     # ./lib/webauthn/authenticator_response.rb:75:in 'WebAuthn::AuthenticatorResponse#verify_item'
     # ./lib/webauthn/authenticator_attestation_response.rb:46:in 'WebAuthn::AuthenticatorAttestationResponse#verify'
     # ./spec/webauthn/authenticator_attestation_response_spec.rb:308:in 'block (3 levels) in <top (required)>'

  3) WebAuthn::AuthenticatorAttestationResponse when TPM attestation is valid
     Failure/Error: expect(attestation_response.valid?(challenge, WebAuthn.configuration.allowed_origins)).to eq(true)

       expected: true
            got: false

       (compared using ==)

       Diff:
       @@ -1 +1 @@
       -true
       +false
     # ./spec/webauthn/authenticator_attestation_response_spec.rb:312:in 'block (3 levels) in <top (required)>'

Finished in 1.45 seconds (files took 0.29036 seconds to load)
359 examples, 3 failures

Failed examples:

rspec ./spec/webauthn/authenticator_attestation_response_spec.rb:315 # WebAuthn::AuthenticatorAttestationResponse when TPM attestation returns attestation info
rspec ./spec/webauthn/authenticator_attestation_response_spec.rb:307 # WebAuthn::AuthenticatorAttestationResponse when TPM attestation verifies
rspec ./spec/webauthn/authenticator_attestation_response_spec.rb:311 # WebAuthn::AuthenticatorAttestationResponse when TPM attestation is valid

Details

It seems that the error comes from the authenticator attestation response that we have in our seeds file. Specifically, this response become invalid after its attestation certificate expired:

<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name >, issuer=#<OpenSSL::X509::Name CN=NCU-NTC-KEYID-1591D4B6EAF98D0104864B6903A48DD0026077D3>, serial=#<OpenSSL::BN:0x00000001216d9e18>, not_before=2019-08-12 21:40:04 UTC, not_after=2025-03-21 20:30:10 UTC>

This PR updates the TPM authenticator attestation response with a new one recently generated.

The last one that we had became invalid after its attestation
certificate expired:

```
<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name >, issuer=#<OpenSSL::X509::Name CN=NCU-NTC-KEYID-1591D4B6EAF98D0104864B6903A48DD0026077D3>, serial=#<OpenSSL::BN:0x00000001216d9e18>, not_before=2019-08-12 21:40:04 UTC, not_after=2025-03-21 20:30:10 UTC>
```

This was making some of our tests to fail:

```
Failures:

  1) WebAuthn::AuthenticatorAttestationResponse when TPM attestation returns attestation info
     Failure/Error: expect(attestation_response.attestation_type).to eq("AttCA")

       expected: "AttCA"
            got: false

       (compared using ==)

       Diff:
       @@ -1 +1 @@
       -"AttCA"
       +false
     # ./spec/webauthn/authenticator_attestation_response_spec.rb:318:in 'block (3 levels) in <top (required)>'

  2) WebAuthn::AuthenticatorAttestationResponse when TPM attestation verifies
     Failure/Error: raise Object.const_get(error_const_name)

     WebAuthn::AttestationStatementVerificationError:
       WebAuthn::AttestationStatementVerificationError
     # ./lib/webauthn/authenticator_response.rb:75:in 'WebAuthn::AuthenticatorResponse#verify_item'
     # ./lib/webauthn/authenticator_attestation_response.rb:46:in 'WebAuthn::AuthenticatorAttestationResponse#verify'
     # ./spec/webauthn/authenticator_attestation_response_spec.rb:308:in 'block (3 levels) in <top (required)>'

  3) WebAuthn::AuthenticatorAttestationResponse when TPM attestation is valid
     Failure/Error: expect(attestation_response.valid?(challenge, WebAuthn.configuration.allowed_origins)).to eq(true)

       expected: true
            got: false

       (compared using ==)

       Diff:
       @@ -1 +1 @@
       -true
       +false
     # ./spec/webauthn/authenticator_attestation_response_spec.rb:312:in 'block (3 levels) in <top (required)>'

Finished in 1.45 seconds (files took 0.29036 seconds to load)
359 examples, 3 failures

Failed examples:

rspec ./spec/webauthn/authenticator_attestation_response_spec.rb:315 # WebAuthn::AuthenticatorAttestationResponse when TPM attestation returns attestation info
rspec ./spec/webauthn/authenticator_attestation_response_spec.rb:307 # WebAuthn::AuthenticatorAttestationResponse when TPM attestation verifies
rspec ./spec/webauthn/authenticator_attestation_response_spec.rb:311 # WebAuthn::AuthenticatorAttestationResponse when TPM attestation is valid
```

This commit updates the response with a new one.
Copy link
Copy Markdown
Member

@nicolastemciuc nicolastemciuc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! ❤️

@santiagorodriguez96 santiagorodriguez96 merged commit 0f70df8 into master Apr 25, 2025
11 checks passed
@santiagorodriguez96 santiagorodriguez96 deleted the sr--fix-seeds branch April 25, 2025 15:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants