MadWizard\WebAuthn\Attestation\Verifier\FidoU2fAttestationVerifier::verify()

Complexity

Conditions	6
Paths	12

Size

Total Lines	53
Code Lines	24

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	20
CRAP Score	6.0798

Importance

Changes

0

<?php
    public function verify(AttestationStatementInterface $attStmt, AuthenticatorData $authenticatorData, string $clientDataHash): VerificationResult
    {
        if (!($attStmt instanceof FidoU2fAttestationStatement)) {
            throw new VerificationException('Expecting FidoU2fAttestationStatement');
        }

        // AAGUID for U2F should be zeroes (not in WebAuthn spec but in FIDO2 CTAP specs and FIDO conformance tools)
        if (!$authenticatorData->getAaguid()->isZeroAaguid()) {
            throw new VerificationException('AAGUID should be zeroed for U2F attestations.');
        }

        // 1. Verify that attStmt is valid CBOR conforming to the syntax defined above and perform CBOR decoding
        //    on it to extract the contained fields.
        // -> This is done in FidoU2fAttestationStatement

        // 2
        $key = $this->checkAttCertKey($attStmt);

        try {
            // 3. Extract the claimed rpIdHash from authenticatorData, and the claimed credentialId and credentialPublicKey
            //    from authenticatorData.attestedCredentialData.
            $rpIdHash = $authenticatorData->getRpIdHash();
            $credentialId = $authenticatorData->getCredentialId();
            if ($credentialId === null) {
                throw new VerificationException('No credential id available.');
            }

            // 4
            $publicKeyU2f = $this->getPublicKeyU2f($authenticatorData);

            // 5. Let verificationData be the concatenation of (0x00 || rpIdHash || clientDataHash || credentialId || publicKeyU2F)
            $verificationData = "\x00" . $rpIdHash->getBinaryString() . $clientDataHash . $credentialId->getBinaryString() . $publicKeyU2f;

            // 6. Verify the sig using verificationData and certificate public key per [SEC1].
            $result = openssl_verify(
                $verificationData,
                $attStmt->getSignature()->getBinaryString(),
                $key,
                OPENSSL_ALGO_SHA256
            );

            if ($result === 1) {
                // 7. If successful, return attestation type Basic with the attestation trust path set to x5c.
                return new VerificationResult(AttestationType::BASIC, new CertificateTrustPath(...$attStmt->getCertificates()));
            }

            if ($result === 0) {
                throw new VerificationException('Signature invalid.');
            }

            throw new VerificationException('Failed to check signature');
        } finally {
            openssl_free_key($key);
        }