Skip to content

Commit 3d3679d

Browse files
shimunnshimunn
committed
implement hmac extension
1 parent 0fa8d42 commit 3d3679d

File tree

8 files changed

+348
-133
lines changed

8 files changed

+348
-133
lines changed

‎src/cbor.rs

Lines changed: 55 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
55
// http://opensource.org/licenses/MIT>, at your option. This file may not be
66
// copied, modified, or distributed except according to those terms.
7-
use cbor_codec::{Config, Encoder, Decoder, GenericDecoder, GenericEncoder};
8-
use cbor_codec::value::Value;
97
use cbor_codec::value;
8+
use cbor_codec::value::Value;
9+
use cbor_codec::{Config, Decoder, Encoder, GenericDecoder, GenericEncoder};
1010

11-
use byteorder::{WriteBytesExt, ReadBytesExt, BigEndian, ByteOrder};
11+
use byteorder::{BigEndian, ByteOrder, ReadBytesExt, WriteBytesExt};
1212
use failure::ResultExt;
1313

1414
use std::collections::HashMap;
@@ -29,25 +29,23 @@ impl<'a> Request<'a> {
2929
match self {
3030
Request::MakeCredential(req) => req.encode(&mut encoder),
3131
Request::GetAssertion(req) => req.encode(&mut encoder),
32-
Request::GetInfo => {
33-
encoder
34-
.writer()
35-
.write_u8(0x04)
36-
.context(FidoErrorKind::CborEncode)
37-
.map_err(From::from)
38-
}
32+
Request::GetInfo => encoder
33+
.writer()
34+
.write_u8(0x04)
35+
.context(FidoErrorKind::CborEncode)
36+
.map_err(From::from),
3937
Request::ClientPin(req) => req.encode(&mut encoder),
4038
}
4139
}
4240

4341
pub fn decode<R: ReadBytesExt>(&self, reader: R) -> FidoResult<Response> {
4442
Ok(match self {
45-
Request::MakeCredential(_) => Response::MakeCredential(
46-
MakeCredentialResponse::decode(reader)?,
47-
),
48-
Request::GetAssertion(_) => Response::GetAssertion(
49-
GetAssertionResponse::decode(reader)?,
50-
),
43+
Request::MakeCredential(_) => {
44+
Response::MakeCredential(MakeCredentialResponse::decode(reader)?)
45+
}
46+
Request::GetAssertion(_) => {
47+
Response::GetAssertion(GetAssertionResponse::decode(reader)?)
48+
}
5149
Request::GetInfo => Response::GetInfo(GetInfoResponse::decode(reader)?),
5250
Request::ClientPin(_) => Response::ClientPin(ClientPinResponse::decode(reader)?),
5351
})
@@ -77,9 +75,10 @@ pub struct MakeCredentialRequest<'a> {
7775

7876
impl<'a> MakeCredentialRequest<'a> {
7977
pub fn encode<W: WriteBytesExt>(&self, mut encoder: &mut Encoder<W>) -> FidoResult<()> {
80-
encoder.writer().write_u8(0x01).context(
81-
FidoErrorKind::CborEncode,
82-
)?; // authenticatorMakeCredential
78+
encoder
79+
.writer()
80+
.write_u8(0x01)
81+
.context(FidoErrorKind::CborEncode)?; // authenticatorMakeCredential
8382
let mut length = 4;
8483
length += !self.exclude_list.is_empty() as usize;
8584
length += !self.extensions.is_empty() as usize;
@@ -176,9 +175,10 @@ pub struct GetAssertionRequest<'a> {
176175

177176
impl<'a> GetAssertionRequest<'a> {
178177
pub fn encode<W: WriteBytesExt>(&self, mut encoder: &mut Encoder<W>) -> FidoResult<()> {
179-
encoder.writer().write_u8(0x02).context(
180-
FidoErrorKind::CborEncode,
181-
)?; // authenticatorGetAssertion
178+
encoder
179+
.writer()
180+
.write_u8(0x02)
181+
.context(FidoErrorKind::CborEncode)?; // authenticatorGetAssertion
182182
let mut length = 2;
183183
length += !self.allow_list.is_empty() as usize;
184184
length += !self.extensions.is_empty() as usize;
@@ -315,9 +315,10 @@ pub struct ClientPinRequest<'a> {
315315

316316
impl<'a> ClientPinRequest<'a> {
317317
pub fn encode<W: WriteBytesExt>(&self, encoder: &mut Encoder<W>) -> FidoResult<()> {
318-
encoder.writer().write_u8(0x06).context(
319-
FidoErrorKind::CborEncode,
320-
)?; // authenticatorClientPIN
318+
encoder
319+
.writer()
320+
.write_u8(0x06)
321+
.context(FidoErrorKind::CborEncode)?; // authenticatorClientPIN
321322
let mut length = 2;
322323
length += self.key_agreement.is_some() as usize;
323324
length += self.pin_auth.is_some() as usize;
@@ -383,7 +384,6 @@ impl ClientPinResponse {
383384
}
384385
}
385386

386-
387387
#[derive(Debug)]
388388
pub struct OptionsInfo {
389389
pub plat: bool,
@@ -439,21 +439,28 @@ impl AuthenticatorData {
439439
let flags = bytes[32];
440440
data.up = (flags & 0x01) == 0x01;
441441
data.uv = (flags & 0x02) == 0x02;
442+
let is_attested = (flags & 0x40) == 0x40;
443+
let has_extension_data = (flags & 0x80) == 0x80;
442444
data.sign_count = BigEndian::read_u32(&bytes[33..37]);
443445
if bytes.len() < 38 {
444446
return Ok(data);
445447
}
448+
446449
let mut cur = Cursor::new(&bytes[37..]);
447-
let attested_credential_data = AttestedCredentialData::from_bytes(&mut cur)?;
448-
data.attested_credential_data = attested_credential_data;
449-
if cur.position() >= (bytes.len() - 37) as u64 {
450-
return Ok(data);
450+
if is_attested {
451+
let attested_credential_data = AttestedCredentialData::from_bytes(&mut cur)?;
452+
data.attested_credential_data = attested_credential_data;
453+
if cur.position() >= (bytes.len() - 37) as u64 {
454+
return Ok(data);
455+
}
451456
}
452-
let mut decoder = GenericDecoder::new(Config::default(), cur);
453-
for _ in 0..decoder.borrow_mut().object()? {
454-
let key = decoder.borrow_mut().text()?;
455-
let value = decoder.value()?;
456-
data.extensions.insert(key.to_string(), value);
457+
if has_extension_data {
458+
let mut decoder = GenericDecoder::new(Config::default(), cur);
459+
for _ in 0..decoder.borrow_mut().object()? {
460+
let key = decoder.borrow_mut().text()?;
461+
let value = decoder.value()?;
462+
data.extensions.insert(key.to_string(), value);
463+
}
457464
}
458465
Ok(data)
459466
}
@@ -494,15 +501,15 @@ impl P256Key {
494501
if cose.key_type != 2 || cose.algorithm != -7 {
495502
Err(FidoErrorKind::KeyType)?
496503
}
497-
if let (Some(Value::U8(curve)),
498-
Some(Value::Bytes(value::Bytes::Bytes(x))),
499-
Some(Value::Bytes(value::Bytes::Bytes(y)))) =
500-
(
501-
cose.parameters.get(&-1),
502-
cose.parameters.get(&-2),
503-
cose.parameters.get(&-3),
504-
)
505-
{
504+
if let (
505+
Some(Value::U8(curve)),
506+
Some(Value::Bytes(value::Bytes::Bytes(x))),
507+
Some(Value::Bytes(value::Bytes::Bytes(y))),
508+
) = (
509+
cose.parameters.get(&-1),
510+
cose.parameters.get(&-2),
511+
cose.parameters.get(&-3),
512+
) {
506513
if *curve != 1 {
507514
Err(FidoErrorKind::KeyType)?
508515
}
@@ -532,9 +539,10 @@ impl P256Key {
532539
(-1, Value::U8(1)),
533540
(-2, Value::Bytes(value::Bytes::Bytes(self.x.to_vec()))),
534541
(-3, Value::Bytes(value::Bytes::Bytes(self.y.to_vec()))),
535-
].iter()
536-
.cloned()
537-
.collect(),
542+
]
543+
.iter()
544+
.cloned()
545+
.collect(),
538546
}
539547
}
540548

‎src/crypto.rs

Lines changed: 34 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,16 @@
44
// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
55
// http://opensource.org/licenses/MIT>, at your option. This file may not be
66
// copied, modified, or distributed except according to those terms.
7-
use ring::{agreement, rand, digest, hmac, signature};
7+
use super::cbor::{CoseKey, P256Key};
8+
use super::error::*;
9+
use failure::ResultExt;
810
use ring::error::Unspecified;
9-
use untrusted::Input;
10-
use rust_crypto::blockmodes::NoPadding;
11+
use ring::{agreement, digest, hmac, rand, signature};
1112
use rust_crypto::aes;
13+
use rust_crypto::blockmodes::NoPadding;
1214
use rust_crypto::buffer::{RefReadBuffer, RefWriteBuffer};
13-
use failure::ResultExt;
14-
use super::cbor::{CoseKey, P256Key};
15-
use super::error::*;
15+
use rust_crypto::symmetriccipher::{Decryptor, Encryptor};
16+
use untrusted::Input;
1617

1718
#[derive(Debug)]
1819
pub struct SharedSecret {
@@ -26,9 +27,9 @@ impl SharedSecret {
2627
let private = agreement::EphemeralPrivateKey::generate(&agreement::ECDH_P256, &rng)
2728
.context(FidoErrorKind::GenerateKey)?;
2829
let public = &mut [0u8; agreement::PUBLIC_KEY_MAX_LEN][..private.public_key_len()];
29-
private.compute_public_key(public).context(
30-
FidoErrorKind::GenerateKey,
31-
)?;
30+
private
31+
.compute_public_key(public)
32+
.context(FidoErrorKind::GenerateKey)?;
3233
let peer = P256Key::from_cose(peer_key)
3334
.context(FidoErrorKind::ParsePublic)?
3435
.bytes();
@@ -39,7 +40,8 @@ impl SharedSecret {
3940
peer,
4041
Unspecified,
4142
|material| Ok(digest::digest(&digest::SHA256, material)),
42-
).context(FidoErrorKind::GenerateSecret)?;
43+
)
44+
.context(FidoErrorKind::GenerateSecret)?;
4345
let mut res = SharedSecret {
4446
public_key: P256Key::from_bytes(&public)
4547
.context(FidoErrorKind::ParsePublic)?
@@ -50,42 +52,46 @@ impl SharedSecret {
5052
Ok(res)
5153
}
5254

53-
pub fn encrypt_pin(&self, pin: &str) -> FidoResult<[u8; 16]> {
54-
let mut encryptor = aes::cbc_encryptor(
55+
pub fn encryptor(&self) -> Box<dyn Encryptor + 'static> {
56+
aes::cbc_encryptor(
5557
aes::KeySize::KeySize256,
5658
&self.shared_secret,
5759
&[0u8; 16],
5860
NoPadding,
59-
);
61+
)
62+
}
63+
64+
pub fn encrypt_pin(&self, pin: &str) -> FidoResult<[u8; 16]> {
65+
let mut encryptor = self.encryptor();
6066
let pin_bytes = pin.as_bytes();
6167
let hash = digest::digest(&digest::SHA256, &pin_bytes);
6268
let in_bytes = &hash.as_ref()[0..16];
6369
let mut input = RefReadBuffer::new(&in_bytes);
6470
let mut out_bytes = [0; 16];
6571
let mut output = RefWriteBuffer::new(&mut out_bytes);
66-
encryptor.encrypt(&mut input, &mut output, true).map_err(
67-
|_| {
68-
FidoErrorKind::EncryptPin
69-
},
70-
)?;
72+
encryptor
73+
.encrypt(&mut input, &mut output, true)
74+
.map_err(|_| FidoErrorKind::EncryptPin)?;
7175
Ok(out_bytes)
7276
}
7377

74-
pub fn decrypt_token(&self, data: &mut [u8]) -> FidoResult<PinToken> {
75-
let mut decryptor = aes::cbc_decryptor(
78+
pub fn decryptor(&self) -> Box<dyn Decryptor + 'static> {
79+
aes::cbc_decryptor(
7680
aes::KeySize::KeySize256,
7781
&self.shared_secret,
7882
&[0u8; 16],
7983
NoPadding,
80-
);
84+
)
85+
}
86+
87+
pub fn decrypt_token(&self, data: &mut [u8]) -> FidoResult<PinToken> {
88+
let mut decryptor = self.decryptor();
8189
let mut input = RefReadBuffer::new(data);
8290
let mut out_bytes = [0; 16];
8391
let mut output = RefWriteBuffer::new(&mut out_bytes);
84-
decryptor.decrypt(&mut input, &mut output, true).map_err(
85-
|_| {
86-
FidoErrorKind::DecryptPin
87-
},
88-
)?;
92+
decryptor
93+
.decrypt(&mut input, &mut output, true)
94+
.map_err(|_| FidoErrorKind::DecryptPin)?;
8995
Ok(PinToken(hmac::SigningKey::new(&digest::SHA256, &out_bytes)))
9096
}
9197
}
@@ -119,5 +125,6 @@ pub fn verify_signature(
119125
public_key,
120126
msg,
121127
signature,
122-
).is_ok()
128+
)
129+
.is_ok()
123130
}

‎src/error.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
55
// http://opensource.org/licenses/MIT>, at your option. This file may not be
66
// copied, modified, or distributed except according to those terms.
7-
use cbor_codec::{EncodeError, DecodeError};
7+
use cbor_codec::{DecodeError, EncodeError};
88

9+
use failure::{Backtrace, Context, Fail};
910
use std::fmt;
1011
use std::fmt::Display;
11-
use failure::{Context, Backtrace, Fail};
1212

1313
pub type FidoResult<T> = Result<T, FidoError>;
1414

@@ -52,7 +52,7 @@ pub enum FidoErrorKind {
5252
}
5353

5454
impl Fail for FidoError {
55-
fn cause(&self) -> Option<&Fail> {
55+
fn cause(&self) -> Option<&dyn Fail> {
5656
self.0.cause()
5757
}
5858

0 commit comments

Comments
 (0)