Registration validation first steps

lib/webauthn.rb

@@ -1,12 +1,16 @@
+require "webauthn/validator"
 require "webauthn/version"
+
 require "securerandom"
 require "base64"
+require "json"
 
 module WebAuthn
  ES256_ALGORITHM = { type: "public-key", alg: -7 }.freeze
  RP_NAME = "web-server".freeze
  USER_ID = "1".freeze
  USER_NAME = "web-user".freeze
+ CREATE_TYPE = "webauthn.create"
 
  def self.registration_payload
  {
@@ -18,4 +22,14 @@ def self.registration_payload
  }
  }
  end
+
+ def self.valid?(attestation_object:, client_data_bin:, original_challenge:)
+ validator = WebAuthn::Validator.new(
+ original_challenge: original_challenge,
+ attestation_object: attestation_object,
+ client_data_bin: client_data_bin
+ )
+
+ validator.valid?
+ end
 end

lib/webauthn/validator.rb

@@ -0,0 +1,57 @@
+require "cbor"
+
+module WebAuthn
+ class Validator
+ AUTHENTICATOR_DATA_MIN_LENGTH = 37.freeze
+ USER_PRESENT_BIT_POSITION = 0.freeze
+
+ def initialize(attestation_object:, client_data_bin:, original_challenge:)
+ @attestation_object = attestation_object
+ @client_data_bin = client_data_bin
+ @original_challenge = original_challenge
+ end
+
+ def valid?
+ valid_type? &&
+ valid_challenge? &&
+ valid_authenticator_data? &&
+ user_present?
+ end
+
+ private
+
+ attr_reader :attestation_object, :client_data_bin, :original_challenge
+
+ def valid_type?
+ client_data["type"] == CREATE_TYPE
+ end
+
+ def valid_challenge?
+ Base64.urlsafe_decode64(client_data["challenge"]) == original_challenge
+ end
+
+ def valid_authenticator_data?
+ authenticator_data.length > AUTHENTICATOR_DATA_MIN_LENGTH
+ end
+
+ def user_present?
+ authenticator_data_flags[USER_PRESENT_BIT_POSITION] == "1"
+ end
+
+ def authenticator_data_flags
+ @authenticator_data_flags ||= authenticator_data[32].unpack("b*").first
+ end
+
+ def client_data
+ @client_data ||= JSON.parse(Base64.urlsafe_decode64(client_data_bin))
+ end
+
+ def authenticator_data
+ @authenticator_data ||= attestation["authData"]
+ end
+
+ def attestation
+ @attestation ||= CBOR.decode(Base64.urlsafe_decode64(attestation_object))
+ end
+ end
+end

spec/webauthn_spec.rb

@@ -28,4 +28,20 @@
  expect(user_info[:id]).to eq("MQ==\n")
  end
  end
+
+ describe "#valid?" do
+ it "validates registration attestation" do
+ original_challenge = Base64.urlsafe_decode64('SJoqxXSZAlElBfSa11DtZQ==')
+ attestation_object = 'o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjESZYN5YgOjGh0NBcPZHZgW4/krrmihjLHmVzzuoMdl2NBAAAAAAAAAAAAAAAAAAAAAAAAAAAAQPx8VO/e2RN8kYB4fx1r1JqiqxukuoebUJrb5LDjVhNX5qefpOiOsQ/GWvQDVnzF4AugvPs/WCUZ+tOp6hpmZp6lAQIDJiABIVggblr3cP0yKHKavNkN4R7AecQKZsRZriWO79Kgwzvon8MiWCBdEB+QtzhJj+HkkvQPbVxK+HUDNtkIIBmhqGquQrn6YQ=='
+ client_data_bin = 'eyJjaGFsbGVuZ2UiOiJTSm9xeFhTWkFsRWxCZlNhMTFEdFpRIiwiY2xpZW50RXh0ZW5zaW9ucyI6e30sImhhc2hBbGdvcml0aG0iOiJTSEEtMjU2Iiwib3JpZ2luIjoiaHR0cDovL2xvY2FsaG9zdDozMDAwIiwidHlwZSI6IndlYmF1dGhuLmNyZWF0ZSJ9'
+
+ valid = WebAuthn.valid?(
+ original_challenge: original_challenge,
+ attestation_object: attestation_object,
+ client_data_bin: client_data_bin
+ )
+
+ expect(valid).to eq(true)
+ end
+ end
 end

webauthn.gemspec

@@ -19,6 +19,8 @@ Gem::Specification.new do |spec|
  spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
  spec.require_paths = ["lib"]
 
+ spec.add_dependency "cbor", "~> 0.5.9.2"
+
  spec.add_development_dependency "bundler", "~> 1.16"
  spec.add_development_dependency "byebug", "~> 10.0"
  spec.add_development_dependency "rake", "~> 10.0"