Skip to content

Commit 7fc0c45

Browse files
varjolintuvarjolintu
authored and
phoerious
committed
Passkeys: Set BE and BS flags to true (#13042)
Passkeys: Set BE flag to true --------- Co-authored-by: varjolintu <sami.vanttinen@ahmala.org>
1 parent 8904293 commit 7fc0c45

File tree

6 files changed

+68
-27
lines changed

6 files changed

+68
-27
lines changed

‎src/browser/BrowserPasskeys.cpp‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2025 KeePassXC Team <team@keepassxc.org>
2+
* Copyright (C) 2026 KeePassXC Team <team@keepassxc.org>
33
*
44
* This program is free software: you can redistribute it and/or modify
55
* it under the terms of the GNU General Public License as published by
@@ -125,14 +125,16 @@ PublicKeyCredential BrowserPasskeys::buildRegisterPublicKeyCredential(const QJso
125125
QJsonObject BrowserPasskeys::buildGetPublicKeyCredential(const QJsonObject& assertionOptions,
126126
const QString& credentialId,
127127
const QString& userHandle,
128-
const QString& privateKeyPem)
128+
const QString& privateKeyPem,
129+
const bool beFlag,
130+
const bool bsFlag)
129131
{
130132
if (!passkeyUtils()->checkCredentialAssertionOptions(assertionOptions)) {
131133
return {};
132134
}
133135

134-
const auto authenticatorData =
135-
buildAuthenticatorData(assertionOptions["rpId"].toString(), assertionOptions["extensions"].toString());
136+
const auto authenticatorData = buildAuthenticatorData(
137+
assertionOptions["rpId"].toString(), assertionOptions["extensions"].toString(), beFlag, bsFlag);
136138
const auto clientDataJson = assertionOptions["clientDataJson"].toString();
137139
const auto clientDataArray = clientDataJson.toUtf8();
138140

@@ -171,8 +173,12 @@ QByteArray BrowserPasskeys::buildAttestationObject(const QJsonObject& credential
171173
result.append(rpIdHash);
172174

173175
// Use default flags
174-
const auto flags = setFlagsFromJson(QJsonObject(
175-
{{"ED", !extensions.isEmpty()}, {"AT", true}, {"BS", false}, {"BE", false}, {"UV", true}, {"UP", true}}));
176+
const auto flags = setFlagsFromJson(QJsonObject({{"ED", !extensions.isEmpty()},
177+
{"AT", true},
178+
{"BS", DEFAULT_BS_FLAG},
179+
{"BE", DEFAULT_BE_FLAG},
180+
{"UV", true},
181+
{"UP", true}}));
176182
result.append(flags);
177183

178184
// Signature counter (not supported, always 0
@@ -204,15 +210,18 @@ QByteArray BrowserPasskeys::buildAttestationObject(const QJsonObject& credential
204210
}
205211

206212
// Build a short version of the attestation object for webauthn.get
207-
QByteArray BrowserPasskeys::buildAuthenticatorData(const QString& rpId, const QString& extensions)
213+
QByteArray BrowserPasskeys::buildAuthenticatorData(const QString& rpId,
214+
const QString& extensions,
215+
const bool beFlag,
216+
const bool bsFlag)
208217
{
209218
QByteArray result;
210219

211220
const auto rpIdHash = browserMessageBuilder()->getSha256Hash(rpId);
212221
result.append(rpIdHash);
213222

214223
const auto flags = setFlagsFromJson(QJsonObject(
215-
{{"ED", !extensions.isEmpty()}, {"AT", false}, {"BS", false}, {"BE", false}, {"UV", true}, {"UP", true}}));
224+
{{"ED", !extensions.isEmpty()}, {"AT", false}, {"BS", bsFlag}, {"BE", beFlag}, {"UV", true}, {"UP", true}}));
216225
result.append(flags);
217226

218227
// Signature counter (not supported, always 0

‎src/browser/BrowserPasskeys.h‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2024 KeePassXC Team <team@keepassxc.org>
2+
* Copyright (C) 2026 KeePassXC Team <team@keepassxc.org>
33
*
44
* This program is free software: you can redistribute it and/or modify
55
* it under the terms of the GNU General Public License as published by
@@ -25,6 +25,8 @@
2525
#include <botan/asn1_obj.h>
2626
#include <botan/bigint.h>
2727

28+
#define DEFAULT_BE_FLAG true
29+
#define DEFAULT_BS_FLAG true
2830
#define ID_BYTES 32
2931
#define HASH_BYTES 32
3032
#define RSA_BITS 2048
@@ -87,7 +89,9 @@ class BrowserPasskeys : public QObject
8789
QJsonObject buildGetPublicKeyCredential(const QJsonObject& assertionOptions,
8890
const QString& credentialId,
8991
const QString& userHandle,
90-
const QString& privateKeyPem);
92+
const QString& privateKeyPem,
93+
const bool beFlag = DEFAULT_BE_FLAG,
94+
const bool bsFlag = DEFAULT_BE_FLAG);
9195

9296
static const QString AAGUID;
9397

@@ -113,7 +117,10 @@ class BrowserPasskeys : public QObject
113117
const QString& credentialId,
114118
const QByteArray& cborEncodedPublicKey,
115119
const TestingVariables& testingVariables = {});
116-
QByteArray buildAuthenticatorData(const QString& rpId, const QString& extensions);
120+
QByteArray buildAuthenticatorData(const QString& rpId,
121+
const QString& extensions,
122+
const bool beFlag = DEFAULT_BE_FLAG,
123+
const bool bsFlag = DEFAULT_BE_FLAG);
117124
AttestationKeyPair buildCredentialPrivateKey(int alg, const TestingVariables& testingVariables = {});
118125
QByteArray
119126
buildSignature(const QByteArray& authenticatorData, const QByteArray& clientData, const QString& privateKeyPem);

‎src/browser/BrowserService.cpp‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2025 KeePassXC Team <team@keepassxc.org>
2+
* Copyright (C) 2026 KeePassXC Team <team@keepassxc.org>
33
* Copyright (C) 2017 Sami Vänttinen <sami.vanttinen@protonmail.com>
44
* Copyright (C) 2013 Francois Ferrand
55
*
@@ -774,8 +774,16 @@ QJsonObject BrowserService::showPasskeysAuthenticationPrompt(const QJsonObject&
774774
const auto credentialId = passkeyUtils()->getCredentialIdFromEntry(selectedEntry);
775775
const auto userHandle = selectedEntry->attributes()->value(EntryAttributes::KPEX_PASSKEY_USER_HANDLE);
776776

777-
auto publicKeyCredential =
778-
browserPasskeys()->buildGetPublicKeyCredential(assertionOptions, credentialId, userHandle, privateKeyPem);
777+
// Get BE and BS flags if present
778+
const auto beFlag = selectedEntry->attributes()->hasKey(EntryAttributes::KPEX_PASSKEY_FLAG_BE)
779+
? selectedEntry->attributes()->value(EntryAttributes::KPEX_PASSKEY_FLAG_BE) == TRUE_STR
780+
: DEFAULT_BE_FLAG;
781+
const auto bsFlag = selectedEntry->attributes()->hasKey(EntryAttributes::KPEX_PASSKEY_FLAG_BS)
782+
? selectedEntry->attributes()->value(EntryAttributes::KPEX_PASSKEY_FLAG_BS) == TRUE_STR
783+
: DEFAULT_BS_FLAG;
784+
785+
auto publicKeyCredential = browserPasskeys()->buildGetPublicKeyCredential(
786+
assertionOptions, credentialId, userHandle, privateKeyPem, beFlag, bsFlag);
779787
if (publicKeyCredential.isEmpty()) {
780788
return getPasskeyError(ERROR_PASSKEYS_UNKNOWN_ERROR);
781789
}
@@ -855,6 +863,8 @@ void BrowserService::addPasskeyToEntry(Entry* entry,
855863
entry->attributes()->set(EntryAttributes::KPEX_PASSKEY_PRIVATE_KEY_PEM, privateKey, true);
856864
entry->attributes()->set(EntryAttributes::KPEX_PASSKEY_RELYING_PARTY, rpId);
857865
entry->attributes()->set(EntryAttributes::KPEX_PASSKEY_USER_HANDLE, userHandle, true);
866+
entry->attributes()->set(EntryAttributes::KPEX_PASSKEY_FLAG_BE, TRUE_STR);
867+
entry->attributes()->set(EntryAttributes::KPEX_PASSKEY_FLAG_BS, TRUE_STR);
858868
entry->addTag(tr("Passkey"));
859869

860870
entry->endUpdate();

‎src/core/EntryAttributes.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2024 KeePassXC Team <team@keepassxc.org>
2+
* Copyright (C) 2026 KeePassXC Team <team@keepassxc.org>
33
* Copyright (C) 2012 Felix Geyer <debfx@fobos.de>
44
*
55
* This program is free software: you can redistribute it and/or modify
@@ -46,6 +46,8 @@ const QString EntryAttributes::KPEX_PASSKEY_RELYING_PARTY = QStringLiteral("KPEX
4646
const QString EntryAttributes::KPEX_PASSKEY_USER_HANDLE = QStringLiteral("KPEX_PASSKEY_USER_HANDLE");
4747
const QString EntryAttributes::KPEX_PASSKEY_PRIVATE_KEY_START = QStringLiteral("-----BEGIN PRIVATE KEY-----");
4848
const QString EntryAttributes::KPEX_PASSKEY_PRIVATE_KEY_END = QStringLiteral("-----END PRIVATE KEY-----");
49+
const QString EntryAttributes::KPEX_PASSKEY_FLAG_BE = QStringLiteral("KPEX_PASSKEY_FLAG_BE");
50+
const QString EntryAttributes::KPEX_PASSKEY_FLAG_BS = QStringLiteral("KPEX_PASSKEY_FLAG_BS");
4951

5052
// For compatibility with StrongBox
5153
const QString EntryAttributes::KPEX_PASSKEY_GENERATED_USER_ID = QStringLiteral("KPEX_PASSKEY_GENERATED_USER_ID");

‎src/core/EntryAttributes.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2024 KeePassXC Team <team@keepassxc.org>
2+
* Copyright (C) 2026 KeePassXC Team <team@keepassxc.org>
33
* Copyright (C) 2012 Felix Geyer <debfx@fobos.de>
44
*
55
* This program is free software: you can redistribute it and/or modify
@@ -75,6 +75,8 @@ class EntryAttributes : public ModifiableObject
7575
static const QString KPEX_PASSKEY_USER_HANDLE;
7676
static const QString KPEX_PASSKEY_PRIVATE_KEY_START;
7777
static const QString KPEX_PASSKEY_PRIVATE_KEY_END;
78+
static const QString KPEX_PASSKEY_FLAG_BE;
79+
static const QString KPEX_PASSKEY_FLAG_BS;
7880

7981
static bool isDefaultAttribute(const QString& key);
8082
static bool isPasskeyAttribute(const QString& key);

‎tests/TestPasskeys.cpp‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2025 KeePassXC Team <team@keepassxc.org>
2+
* Copyright (C) 2026 KeePassXC Team <team@keepassxc.org>
33
*
44
* This program is free software: you can redistribute it and/or modify
55
* it under the terms of the GNU General Public License as published by
@@ -77,7 +77,7 @@ const QString PublicKeyCredential = R"(
7777
"id": "yrzFJ5lwcpTwYMOdXSmxF5b5cYQlqBMzbbU_d-oFLO8",
7878
"rawId": "cabcc52799707294f060c39d5d29b11796f9718425a813336db53f77ea052cef",
7979
"response": {
80-
"attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVikdKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvBFAAAAAP2xQbJdhEQ-ijVGmMIFpQIAIMq8xSeZcHKU8GDDnV0psReW-XGEJagTM221P3fqBSzvpQECAyYgASFYIHK1iVimeR02UYipyiEKrKhhfhJRMew8EbDWGKtMZ2wUIlggbtZ70X11SLx17QFDWVAR3_qqk5OqrRS--Whc7hyw9YU",
80+
"attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVikdKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvBdAAAAAP2xQbJdhEQ-ijVGmMIFpQIAIMq8xSeZcHKU8GDDnV0psReW-XGEJagTM221P3fqBSzvpQECAyYgASFYIHK1iVimeR02UYipyiEKrKhhfhJRMew8EbDWGKtMZ2wUIlggbtZ70X11SLx17QFDWVAR3_qqk5OqrRS--Whc7hyw9YU",
8181
"clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoibFZlSHpWeFdzcjhNUXhNa1pGMHRpNkZYaGRnTWxqcUt6Z0EtcV96azJNbmlpM2VKNDdWRjk3c3FVb1lrdFZDODVXQVoxdUlBU20tYV9sREZad3NMZnciLCJvcmlnaW4iOiJodHRwczovL3dlYmF1dGhuLmlvIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ"
8282
},
8383
"type": "public-key"
@@ -185,6 +185,8 @@ void TestPasskeys::testDecodeResponseData()
185185
QCOMPARE(authData["rpIdHash"].toString(), QString("dKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvA"));
186186
QCOMPARE(flags["AT"], true);
187187
QCOMPARE(flags["UP"], true);
188+
QCOMPARE(flags["BE"], true);
189+
QCOMPARE(flags["BS"], true);
188190
QCOMPARE(publicKey["1"], 2);
189191
QCOMPARE(publicKey["3"], -7);
190192
QCOMPARE(publicKey["-1"], 1);
@@ -285,13 +287,18 @@ void TestPasskeys::testCreatingAttestationObjectWithEC()
285287
result,
286288
QString("\xA3"
287289
"cfmtdnonegattStmt\xA0hauthDataX\xA4t\xA6\xEA\x92\x13\xC9\x9C/t\xB2$\x92\xB3 \xCF@&*\x94\xC1\xA9P\xA0"
288-
"9\x7F)%\x0B`\x84\x1E\xF0"
289-
"E\x00\x00\x00\x01\x01\x02\x03\x04\x05\x06\x07\b\x01\x02\x03\x04\x05\x06\x07\b\x00 \x8B\xB0\xCA"
290-
"6\x17\xD6\xDE\x01\x11|\xEA\x94\r\xA0R\xC0\x80_\xF3r\xFBr\xB5\x02\x03:"
291-
"\xBAr\x0Fi\x81\xFE\xA5\x01\x02\x03& \x01!X "
292-
"e\xE2\xF2\x1F:cq\xD3G\xEA\xE0\xF7\x1F\xCF\xFA\\\xABO\xF6\x86\x88\x80\t\xAE\x81\x8BT\xB2\x9B\x15\x85~"
293-
"\"X \\\x8E\x1E@\xDB\x97T-\xF8\x9B\xB0\xAD"
294-
"5\xDC\x12^\xC3\x95\x05\xC6\xDF^\x03\xCB\xB4Q\x91\xFF|\xDB\x94\xB7"));
290+
"9\x7F)%\x0B`\x84\x1E\xF0]\x00\x00\x00\x00\xFD\xB1"
291+
"A\xB2]\x84"
292+
"D>\x8A"
293+
"5F\x98\xC2\x05\xA5\x02\x00 \xCA\xBC\xC5'\x99pr\x94\xF0`\xC3\x9D])\xB1\x17\x96\xF9q\x84%\xA8\x13"
294+
"3m\xB5?w\xEA\x05,\xEF\xA5\x01\x02\x03& \x01!X \x06\xEC\xAF"
295+
"4[b\x91"
296+
"am\x19Y\x03\xA6P*\xCA"
297+
"1\xC4\x95\xA8i\xE5\xF0\x87\xE5\xD4\xB8"
298+
"2\xCD\b\x85\xDD\"X \xE2\xEE\x7F\xE9\x0F\x0E\xE9\x1D\x07\x83J\x03\t\xDB"
299+
"B$\xB1\x0B\xD3%\xFF\x18"
300+
"2\xE1S\x99\xB7\x1D"
301+
"B\x04\xE7\x83"));
295302

296303
// Double check that the result can be decoded
297304
BrowserCbor browserCbor;
@@ -312,6 +319,8 @@ void TestPasskeys::testCreatingAttestationObjectWithEC()
312319
QCOMPARE(authData["rpIdHash"].toString(), QString("dKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvA"));
313320
QCOMPARE(flags["AT"], true);
314321
QCOMPARE(flags["UP"], true);
322+
QCOMPARE(flags["BE"], true);
323+
QCOMPARE(flags["BS"], true);
315324
QCOMPARE(publicKey["1"], WebAuthnCoseKeyType::EC2);
316325
QCOMPARE(publicKey["3"], WebAuthnAlgorithms::ES256);
317326
QCOMPARE(publicKey["-1"], 1);
@@ -368,6 +377,8 @@ void TestPasskeys::testCreatingAttestationObjectWithRSA()
368377
QCOMPARE(authData["rpIdHash"].toString(), QString("dKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvA"));
369378
QCOMPARE(flags["AT"], true);
370379
QCOMPARE(flags["UP"], true);
380+
QCOMPARE(flags["BE"], true);
381+
QCOMPARE(flags["BS"], true);
371382
QCOMPARE(publicKey["1"], WebAuthnCoseKeyType::RSA);
372383
QCOMPARE(publicKey["3"], WebAuthnAlgorithms::RS256);
373384
QCOMPARE(publicKey["-1"], predefinedModulus);
@@ -438,14 +449,14 @@ void TestPasskeys::testGet()
438449
QCOMPARE(publicKeyCredential["id"].toString(), id);
439450

440451
auto response = publicKeyCredential["response"].toObject();
441-
QCOMPARE(response["authenticatorData"].toString(), QString("dKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvAFAAAAAA"));
452+
QCOMPARE(response["authenticatorData"].toString(), QString("dKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvAdAAAAAA"));
442453
QCOMPARE(response["clientDataJSON"].toString(),
443454
QString("eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiOXozNnZUZlFUTDk1TGY3V25aZ3l0ZTdvaEdlRi1YUmlMeGtML"
444455
"Ux1R1Uxem9wUm1NSVVBMUxWd3pHcHlJbTFmT0JuMVFuUmEwUUgyN0FEQWFKR0h5c1EiLCJvcmlnaW4iOiJodHRwczovL3dlYm"
445456
"F1dGhuLmlvIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ"));
446457
QCOMPARE(
447458
response["signature"].toString(),
448-
QString("MEYCIQCpbDaYJ4b2ofqWBxfRNbH3XCpsyao7Iui5lVuJRU9HIQIhAPl5moNZgJu5zmurkKK_P900Ct6wd3ahVIqCEqTeeRdE"));
459+
QString("MEUCIQCvg3nXO2fiNK9ockxscgPtoM9_u6ERaW2-F1L99YasOAIgNhYOjPJyKJ-W8roV531kC59ss1USas7jy8TfRnbJLtg"));
449460

450461
auto clientDataJson = response["clientDataJSON"].toString();
451462
auto clientDataByteArray = browserMessageBuilder()->getArrayFromBase64(clientDataJson);

0 commit comments

Comments
 (0)