Added a bunch of packed and TPM tests, added a little bit more error …

…handling.

Src/Fido2/AttestationFormat/Packed.cs

@@ -37,10 +37,11 @@ public static bool IsValidPackedAttnCertSubject(string attnCertSubj)
  var dictSubject = attnCertSubj.Split(new string[] { ", " }, StringSplitOptions.None)
  .Select(part => part.Split('='))
  .ToDictionary(split => split[0], split => split[1]);
- return (0 != dictSubject["C"].Length ||
- 0 != dictSubject["O"].Length ||
- 0 != dictSubject["OU"].Length ||
- 0 != dictSubject["CN"].Length ||
+
+ return (0 != dictSubject["C"].Length &&
+ 0 != dictSubject["O"].Length &&
+ 0 != dictSubject["OU"].Length &&
+ 0 != dictSubject["CN"].Length &&
  "Authenticator Attestation" == dictSubject["OU"].ToString());
  }
 
@@ -106,7 +107,7 @@ public override void Verify()
  if (aaguid != null)
  {
  if (0 != AttestedCredentialData.FromBigEndian(aaguid).CompareTo(AuthData.AttestedCredentialData.AaGuid))
- throw new Fido2VerificationException("aaguid present in packed attestation but does not match aaguid from authData");
+ throw new Fido2VerificationException("aaguid present in packed attestation cert exts but does not match aaguid from authData");
  }
  // 2d. The Basic Constraints extension MUST have the CA component set to false
  if (IsAttnCertCACert(attestnCert.Extensions))

Src/Fido2/AttestationFormat/Tpm.cs

@@ -590,7 +590,7 @@ public override void Verify()
  var aaguid = AaguidFromAttnCertExts(aikCert.Extensions);
  if ((null != aaguid) &&
  (!aaguid.SequenceEqual(Guid.Empty.ToByteArray())) &&
- (0 != new Guid(aaguid).CompareTo(AuthData.AttestedCredentialData.AaGuid)))
+ (0 != AttestedCredentialData.FromBigEndian(aaguid).CompareTo(AuthData.AttestedCredentialData.AaGuid)))
  throw new Fido2VerificationException(string.Format("aaguid malformed, expected {0}, got {1}", AuthData.AttestedCredentialData.AaGuid, new Guid(aaguid)));
  }
  // If ecdaaKeyId is present, then the attestation type is ECDAA
@@ -738,9 +738,18 @@ public static (ushort size, byte[] name) NameFromTPM2BName(Memory<byte> ab, ref
  {
  name = AuthDataHelper.GetSizedByteArray(ab, ref offset, tpmAlgToDigestSizeMap[tpmalg]);
  }
+ else
+ {
+ throw new Fido2VerificationException("TPM_ALG_ID found in TPM2B_NAME not acceptable hash algorithm");
+ }
  }
+ else
+ {
+ throw new Fido2VerificationException("Invalid TPM_ALG_ID found in TPM2B_NAME");
+ }
+
  if (totalSize != bytes.Length + name.Length)
- throw new Fido2VerificationException("Unexpected no name found in TPM2B_NAME");
+ throw new Fido2VerificationException("Unexpected extra bytes found in TPM2B_NAME");
  return (size, name);
  }
 
@@ -752,10 +761,10 @@ public CertInfo(byte[] certInfo)
  var offset = 0;
  Magic = AuthDataHelper.GetSizedByteArray(certInfo, ref offset, 4);
  if (0xff544347 != BitConverter.ToUInt32(Magic.ToArray().Reverse().ToArray(), 0))
- throw new Fido2VerificationException("Bad magic number " + Magic.ToString());
+ throw new Fido2VerificationException("Bad magic number " + BitConverter.ToString(Magic).Replace("-",""));
  Type = AuthDataHelper.GetSizedByteArray(certInfo, ref offset, 2);
  if (0x8017 != BitConverter.ToUInt16(Type.ToArray().Reverse().ToArray(), 0))
- throw new Fido2VerificationException("Bad structure tag " + Type.ToString());
+ throw new Fido2VerificationException("Bad structure tag " + BitConverter.ToString(Type).Replace("-", ""));
  QualifiedSigner = AuthDataHelper.GetSizedByteArray(certInfo, ref offset);
  ExtraData = AuthDataHelper.GetSizedByteArray(certInfo, ref offset);
  if (null == ExtraData || 0 == ExtraData.Length)

Test/Attestation/FidoU2f.cs

@@ -21,8 +21,7 @@ public FidoU2f()
  {
  var attRequest = new CertificateRequest("CN=U2FTesting, OU=Authenticator Attestation, O=FIDO2-NET-LIB, C=US", ecdsaAtt, HashAlgorithmName.SHA256);
 
- attRequest.CertificateExtensions.Add(
- new X509BasicConstraintsExtension(false, false, 0, false));
+ attRequest.CertificateExtensions.Add(notCAExt);
 
  using (attestnCert = attRequest.CreateSelfSigned(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(2)))
  {

Test/Attestation/None.cs

@@ -36,6 +36,7 @@ public void TestNone()
  public void TestNoneWithAttStmt()
  {
  _attestationObject.Add("attStmt", CBORObject.NewMap().Add("foo", "bar"));
+ _credentialPublicKey = Fido2Tests.MakeCredentialPublicKey(Fido2Tests._validCOSEParameters[0]);
  var ex = Assert.ThrowsAsync<Fido2VerificationException>(() => MakeAttestationResponse(_attestationObject, COSE.KeyType.EC2, COSE.Algorithm.ES256, COSE.EllipticCurve.P256));
  Assert.Equal("Attestation format none should have no attestation statement", ex.Result.Message);
  }