Platine\Webauthn\Webauthn::processAuthentication()

Complexity

Conditions	21
Paths	34

Size

Total Lines	118
Code Lines	44

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
    public function processAuthentication(
        string $clientDataJson,
        string $authenticatorData,
        string $signature,
        string $credentialPublicKey,
        $challenge,
        ?int $previousSignatureCount = null,
        bool $requireUserVerification = false,
        bool $requireUserPresent = true
    ): bool {
        if (is_string($challenge)) {
            $challenge =  new ByteBuffer($challenge);
        }
        $clientDataHash = hash('sha256', $clientDataJson, true);
        $authenticator = new AuthenticatorData($authenticatorData);
        try {
            // 5. Let JSON text be the result of running UTF-8 decode on the value of cData.
            $clientData = Json::decode($clientDataJson);
        } catch (Exception $ex) {
            throw new WebauthnException(sprintf('Invalid client data provided, [%s]', $ex->getMessage()));
        }

        // https://www.w3.org/TR/webauthn/#verifying-assertion

        // 1. If the allowCredentials option was given when this authentication ceremony was initiated,
        //    verify that credential.id identifies one of the public key credentials
        //    that were listed in allowCredentials.
        //    -> TO BE VERIFIED BY IMPLEMENTATION

        // 2. If credential.response.userHandle is present, verify that the user identified
        //    by this value is the owner of the public key credential identified by credential.id.
        //    -> TO BE VERIFIED BY IMPLEMENTATION

        // 3. Using credential’s id attribute (or the corresponding rawId, if base64url encoding is
        //    inappropriate for your use case),
        //    look up the corresponding credential public key.
        //    -> TO BE LOOKED UP BY IMPLEMENTATION

        // 7. Verify that the value of C.type is the string webauthn.get.
        if (! isset($clientData->type) || $clientData->type !== 'webauthn.get') {
            throw new WebauthnException('Invalid client type provided');
        }

        // 8. Verify that the value of C.challenge matches the challenge that was sent to the
        //    authenticator in the PublicKeyCredentialRequestOptions passed to the get() call.
        if (
            ! isset($clientData->challenge) ||
            ByteBuffer::fromBase64Url($clientData->challenge)->getBinaryString() !== $challenge->getBinaryString()
        ) {
            throw new WebauthnException('Invalid challenge provided');
        }

        // 9. Verify that the value of C.origin matches the Relying Party's origin.
        if (! isset($clientData->origin) || $this->checkOrigin($clientData->origin) === false) {
            throw new WebauthnException('Invalid origin provided');
        }

        // 11. Verify that the rpIdHash in authData is the SHA-256 hash
        // of the RP ID expected by the Relying Party.
        if ($authenticator->getRelyingPartyIdHash() !== $this->relyingParty->getHashId()) {
            throw new WebauthnException('Invalid relying party id hash provided');
        }

        // 12. Verify that the User Present bit of the flags in authData is set
        if ($requireUserPresent && $authenticator->isUserPresent() === false) {
            throw new WebauthnException('User is not present during authentication');
        }

        // 13. If user verification is required for this assertion, verify that
        // the User Verified bit of the flags in authData is set.
        if ($requireUserVerification && $authenticator->isUserVerified() === false) {
            throw new WebauthnException('User is not verified during authentication');
        }

        // 14. Verify the values of the client extension outputs
        // TODO    (extensions not implemented)

        // 16. Using the credential public key looked up in step 3, verify
        // that sig is a valid signature over the binary
        //  concatenation of authData and hash.
        $dataToVerify = '';
        $dataToVerify .= $authenticatorData;
        $dataToVerify .= $clientDataHash;

        $publicKey = openssl_pkey_get_public($credentialPublicKey);
        if ($publicKey === false) {
            throw new WebauthnException('Invalid public key provided');
        }

        if (
            openssl_verify(
                $dataToVerify,
                $signature,
                $publicKey,
                OPENSSL_ALGO_SHA256
            ) !== 1
        ) {
            throw new WebauthnException('Invalid signature provided');
        }

        $signatureCount = $authenticator->getSignatureCount();
        if ($signatureCount !== 0) {
            $this->signatureCounter = $signatureCount;
        }

        // 17. If either of the signature counter value authData.signCount or
        //     previous signature count is non-zero, and if authData.signCount
        //     less than or equal to previous signature count, it's a signal
        //     that the authenticator may be cloned
        if ($previousSignatureCount !== null) {
            if ($signatureCount !== 0 || $previousSignatureCount !== 0) {
                if ($previousSignatureCount >= $signatureCount) {
                    throw new WebauthnException('Invalid signature counter provided');
                }
            }
        }

        return true;
    }