Skip to content

Add support for extensions and attestedCredentialData in assertion response #45

@sirkrypt0

Description

@sirkrypt0

We currently do not support the extensions and attestedCredentialData in the authenticator data structure, as specified in WebAuthn § 6.1 Authenticator Data and CTAP 2.1 § 6.2.2 authenticatorGetAssertion Algorithm.

This is mostly due to its variable length, which makes it hard to store in fixed size stack-allocated structures, and also that we didn't need it for our PoC.

However, it might be desirable in the future to receive this data (such as extension outputs) and parse it in the relying party.

Implementation Note

The struct is defined here:

typedef struct fido_assert_auth_data {
uint8_t rp_id_hash[ASSERTION_AUTH_DATA_RPID_HASH_LEN];
fido_assert_auth_data_flags_t flags;
uint32_t sign_count;
// TODO: extensions and attestedCredentialData not supported for now.
} fido_assert_auth_data_t;

The processing may happen here:

if (fido_check_flags(reply->auth_data.flags, assert->opt) < 0) {
fido_log_debug("%s: fido_check_flags", __func__);
return FIDO_ERR_INVALID_PARAM;
}
// TODO: Extensions not supported for now.
if (fido_check_rp_id(&(assert->rp_id), reply->auth_data.rp_id_hash) != 0) {
fido_log_debug("%s: fido_check_rp_id", __func__);
return FIDO_ERR_INVALID_PARAM;
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions