|
| 1 | +//! PRF extension over caBLE/hybrid, against a phone authenticator that |
| 2 | +//! advertises the `prf` extension in getInfo. |
| 3 | +//! |
| 4 | +//! cargo run --example webauthn_prf_cable -- create |
| 5 | +//! cargo run --example webauthn_prf_cable -- get [credential-id] |
| 6 | +//! |
| 7 | +//! `create` registers a discoverable credential with PRF enabled and an eval |
| 8 | +//! at creation, then prints the credential ID. `get` asserts with PRF eval |
| 9 | +//! salts. When a credential ID is given, it is added to the allow list with an |
| 10 | +//! evalByCredential entry. |
| 11 | +
|
| 12 | +use std::collections::HashMap; |
| 13 | +use std::error::Error; |
| 14 | +use std::time::Duration; |
| 15 | + |
| 16 | +use libwebauthn::ops::webauthn::{ |
| 17 | + GetAssertionRequest, GetAssertionRequestExtensions, JsonFormat, MakeCredentialPrfInput, |
| 18 | + MakeCredentialRequest, MakeCredentialsRequestExtensions, PrfInput, PrfInputValue, |
| 19 | + ResidentKeyRequirement, UserVerificationRequirement, WebAuthnIDLResponse as _, |
| 20 | +}; |
| 21 | +use libwebauthn::proto::ctap2::{ |
| 22 | + Ctap2CredentialType, Ctap2PublicKeyCredentialDescriptor, Ctap2PublicKeyCredentialRpEntity, |
| 23 | + Ctap2PublicKeyCredentialType, Ctap2PublicKeyCredentialUserEntity, |
| 24 | +}; |
| 25 | +use libwebauthn::transport::cable::channel::CableChannel; |
| 26 | +use libwebauthn::transport::cable::is_available; |
| 27 | +use libwebauthn::transport::cable::qr_code_device::{ |
| 28 | + CableQrCodeDevice, CableTransports, QrCodeOperationHint, |
| 29 | +}; |
| 30 | +use libwebauthn::transport::{Channel as _, ChannelSettings, Device}; |
| 31 | +use libwebauthn::webauthn::WebAuthn; |
| 32 | +use qrcode::render::unicode; |
| 33 | +use qrcode::QrCode; |
| 34 | +use serde_bytes::ByteBuf; |
| 35 | + |
| 36 | +#[path = "../common/mod.rs"] |
| 37 | +mod common; |
| 38 | + |
| 39 | +const TIMEOUT: Duration = Duration::from_secs(120); |
| 40 | +const RP_ID: &str = "example.org"; |
| 41 | +const ORIGIN: &str = "https://example.org"; |
| 42 | + |
| 43 | +// Deterministic PRF inputs, so results can be cross-checked against another |
| 44 | +// client holding the same credential. |
| 45 | +const CREATE_EVAL_FIRST: &[u8] = b"example-prf-create-first"; |
| 46 | +const CREATE_EVAL_SECOND: &[u8] = b"example-prf-create-second"; |
| 47 | +const GET_EVAL_FIRST: &[u8] = b"example-prf-get-first"; |
| 48 | +const GET_EVAL_SECOND: &[u8] = b"example-prf-get-second"; |
| 49 | +const BY_CRED_FIRST: &[u8] = b"example-prf-bycred-first"; |
| 50 | +const BY_CRED_SECOND: &[u8] = b"example-prf-bycred-second"; |
| 51 | + |
| 52 | +#[tokio::main] |
| 53 | +pub async fn main() -> Result<(), Box<dyn Error>> { |
| 54 | + common::setup_logging(); |
| 55 | + |
| 56 | + let args: Vec<String> = std::env::args().collect(); |
| 57 | + let mode = args.get(1).map(String::as_str); |
| 58 | + |
| 59 | + if !is_available().await { |
| 60 | + eprintln!("No Bluetooth adapter found. Cable/Hybrid transport is unavailable."); |
| 61 | + return Err("Cable transport not available".into()); |
| 62 | + } |
| 63 | + |
| 64 | + match mode { |
| 65 | + Some("create") => create().await, |
| 66 | + Some("get") => get(args.get(2).map(String::as_str)).await, |
| 67 | + _ => { |
| 68 | + eprintln!("Usage: webauthn_prf_cable <create | get [credential-id-base64url]>"); |
| 69 | + Err("missing or unknown subcommand".into()) |
| 70 | + } |
| 71 | + } |
| 72 | +} |
| 73 | + |
| 74 | +async fn connect( |
| 75 | + hint: QrCodeOperationHint, |
| 76 | +) -> Result<(CableQrCodeDevice, CableChannel), Box<dyn Error>> { |
| 77 | + let mut device: CableQrCodeDevice = |
| 78 | + CableQrCodeDevice::new_transient(hint, CableTransports::CloudAssistedOrLocal)?; |
| 79 | + |
| 80 | + println!("Created QR code, awaiting advertisement."); |
| 81 | + let qr_code = QrCode::new(device.qr_code.to_string()).unwrap(); |
| 82 | + let image = qr_code |
| 83 | + .render::<unicode::Dense1x2>() |
| 84 | + .dark_color(unicode::Dense1x2::Light) |
| 85 | + .light_color(unicode::Dense1x2::Dark) |
| 86 | + .build(); |
| 87 | + println!("{}", image); |
| 88 | + |
| 89 | + let channel = device.channel(ChannelSettings::default()).await?; |
| 90 | + println!("Channel established {:?}", channel); |
| 91 | + |
| 92 | + let state_recv = channel.get_ux_update_receiver(); |
| 93 | + tokio::spawn(common::handle_cable_updates(state_recv)); |
| 94 | + Ok((device, channel)) |
| 95 | +} |
| 96 | + |
| 97 | +async fn create() -> Result<(), Box<dyn Error>> { |
| 98 | + let (_device, mut channel) = connect(QrCodeOperationHint::MakeCredential).await?; |
| 99 | + |
| 100 | + let extensions = MakeCredentialsRequestExtensions { |
| 101 | + prf: Some(MakeCredentialPrfInput { |
| 102 | + eval: Some(PrfInputValue { |
| 103 | + first: CREATE_EVAL_FIRST.to_vec(), |
| 104 | + second: Some(CREATE_EVAL_SECOND.to_vec()), |
| 105 | + }), |
| 106 | + }), |
| 107 | + ..Default::default() |
| 108 | + }; |
| 109 | + |
| 110 | + let request = MakeCredentialRequest { |
| 111 | + challenge: vec![0x11; 32], |
| 112 | + origin: ORIGIN.to_owned(), |
| 113 | + top_origin: None, |
| 114 | + relying_party: Ctap2PublicKeyCredentialRpEntity::new(RP_ID, "Example Relying Party"), |
| 115 | + user: Ctap2PublicKeyCredentialUserEntity::new(&[0x42; 16], "alice", "Alice"), |
| 116 | + resident_key: Some(ResidentKeyRequirement::Required), |
| 117 | + user_verification: UserVerificationRequirement::Preferred, |
| 118 | + algorithms: vec![Ctap2CredentialType::default()], |
| 119 | + exclude: None, |
| 120 | + extensions: Some(extensions), |
| 121 | + timeout: TIMEOUT, |
| 122 | + }; |
| 123 | + |
| 124 | + let response = retry_user_errors!(channel.webauthn_make_credential(&request)).unwrap(); |
| 125 | + |
| 126 | + let response_json = response |
| 127 | + .to_json_string(&request, JsonFormat::Prettified) |
| 128 | + .expect("Failed to serialize MakeCredential response"); |
| 129 | + println!("WebAuthn MakeCredential response (JSON):\n{response_json}"); |
| 130 | + |
| 131 | + let credential: Ctap2PublicKeyCredentialDescriptor = |
| 132 | + (&response.authenticator_data).try_into().unwrap(); |
| 133 | + println!( |
| 134 | + "\nCredential ID (base64url): {}", |
| 135 | + base64_url::encode(&credential.id) |
| 136 | + ); |
| 137 | + println!("Next: run the `get` leg, e.g."); |
| 138 | + println!( |
| 139 | + "cargo run --example webauthn_prf_cable -- get {}", |
| 140 | + base64_url::encode(&credential.id) |
| 141 | + ); |
| 142 | + Ok(()) |
| 143 | +} |
| 144 | + |
| 145 | +async fn get(credential_id: Option<&str>) -> Result<(), Box<dyn Error>> { |
| 146 | + let (_device, mut channel) = connect(QrCodeOperationHint::GetAssertionRequest).await?; |
| 147 | + |
| 148 | + let mut eval_by_credential = HashMap::new(); |
| 149 | + let allow = match credential_id { |
| 150 | + Some(encoded) => { |
| 151 | + eval_by_credential.insert( |
| 152 | + encoded.to_owned(), |
| 153 | + PrfInputValue { |
| 154 | + first: BY_CRED_FIRST.to_vec(), |
| 155 | + second: Some(BY_CRED_SECOND.to_vec()), |
| 156 | + }, |
| 157 | + ); |
| 158 | + vec![Ctap2PublicKeyCredentialDescriptor { |
| 159 | + r#type: Ctap2PublicKeyCredentialType::PublicKey, |
| 160 | + id: ByteBuf::from( |
| 161 | + base64_url::decode(encoded) |
| 162 | + .map_err(|e| format!("invalid credential id: {e}"))?, |
| 163 | + ), |
| 164 | + transports: None, |
| 165 | + }] |
| 166 | + } |
| 167 | + None => vec![], |
| 168 | + }; |
| 169 | + |
| 170 | + let request = GetAssertionRequest { |
| 171 | + relying_party_id: RP_ID.to_owned(), |
| 172 | + challenge: vec![0x22; 32], |
| 173 | + origin: ORIGIN.to_owned(), |
| 174 | + top_origin: None, |
| 175 | + allow, |
| 176 | + user_verification: UserVerificationRequirement::Preferred, |
| 177 | + extensions: Some(GetAssertionRequestExtensions { |
| 178 | + prf: Some(PrfInput { |
| 179 | + eval: Some(PrfInputValue { |
| 180 | + first: GET_EVAL_FIRST.to_vec(), |
| 181 | + second: Some(GET_EVAL_SECOND.to_vec()), |
| 182 | + }), |
| 183 | + eval_by_credential, |
| 184 | + }), |
| 185 | + ..Default::default() |
| 186 | + }), |
| 187 | + timeout: TIMEOUT, |
| 188 | + }; |
| 189 | + |
| 190 | + let response = retry_user_errors!(channel.webauthn_get_assertion(&request)).unwrap(); |
| 191 | + |
| 192 | + for (num, assertion) in response.assertions.iter().enumerate() { |
| 193 | + let assertion_json = assertion |
| 194 | + .to_json_string(&request, JsonFormat::Prettified) |
| 195 | + .expect("Failed to serialize GetAssertion response"); |
| 196 | + println!("Assertion {num} (JSON):\n{assertion_json}"); |
| 197 | + } |
| 198 | + Ok(()) |
| 199 | +} |
0 commit comments