WebAuthnRegistrationEvent::validateAttestationFormatAndroidKey()

Complexity

Conditions	19
Paths	257

Size

Total Lines	81
Code Lines	53

Duplication

Lines	0
Ratio	0 %

Importance

Changes	11
Bugs	5	Features	0

<?php
    private function validateAttestationFormatAndroidKey(array $attestationArray): void
    {
        $stmtDecoded = $attestationArray['attStmt'];
        $this->debugBuffer .= "AttStmt: " . /** @scrutinizer ignore-type */ print_r($stmtDecoded, true) . "<br/>";
        $this->commonX5cSignatureChecks($attestationArray);
        // first certificate's properties
        $certProps = openssl_x509_parse($this->der2pem($stmtDecoded['x5c'][0]));
        $keyResource = openssl_pkey_get_public($this->der2pem($stmtDecoded['x5c'][0]));
        $keyDetails = openssl_pkey_get_details($keyResource);
        switch ($keyDetails['type']) {
            case OPENSSL_KEYTYPE_EC:
                $certPubkey = $keyDetails['ec'];
                break;
            case OPENSSL_KEYTYPE_RSA:
                $certPubkey = $keyDetails['rsa'];
                break;
            default:
                throw new Exception("Public key was neither a RSA nor EC key.");
        }
        $statementKeyData = $this->cborDecode(hex2bin($this->credential));
        // this will only work for ECDSA keys, screw RSA
        if (
            $statementKeyData['x'] != $certPubkey[-2] || $statementKeyData['y'] != $certPubkey[-3]
        ) {
            $this->fail("Certificate public key does not match credentialPublicKey in authenticatorData (" .
                /** @scrutinizer ignore-type */ print_r($certPubkey, true) .
                "###" .
                /** @scrutinizer ignore-type */ print_r($statementKeyData, true) .
                ").");
        }
        // throw new Exception(print_r($certProps, true));
        $rawAsn1Oid = $certProps['extensions']['1.3.6.1.4.1.11129.2.1.17'];
        $keyDescription = UnspecifiedType::fromDER($rawAsn1Oid)->asSequence();
        $attestationVersion = $keyDescription->at(0)->asInteger()->intNumber();
        $attestationChallenge = $keyDescription->at(4)->asOctetString()->string();
        $softwareEnforced = $keyDescription->at(6)->asSequence();
        $teeEnforced = $keyDescription->at(7)->asSequence();

        if ($this->clientDataHash !== $attestationChallenge) {
            $this->fail("ClientDataHash is not in certificate's extension data (attestationChallenge).");
        }

        if ($attestationVersion < self::MIN_SUPPORTED_KEYMASTER_VERSION) {
            $this->fail("Attestation versions below " .
                self::MIN_SUPPORTED_KEYMASTER_VERSION .
                " not supported, found $attestationVersion.");
        }

        if ($softwareEnforced->hasTagged(600) || $teeEnforced->hasTagged(600)) {
            $this->fail("Tag allApplications found!");
        }
        // need to go through both software and TEE and check origins and purpose

        // phpcs:disable Generic.Files.LineLength.TooLong
        if (
            ($softwareEnforced->hasTagged(702) && ($softwareEnforced->getTagged(702)->asExplicit()->asInteger()->intNumber() != array_search("GENERATED", self::ORIGINS_3))) ||
            ($teeEnforced->hasTagged(702) && ($teeEnforced->getTagged(702)->asExplicit()->asInteger()->intNumber() != array_search("GENERATED", self::ORIGINS_3)))
        ) {
            $this->fail("Incorrect value for ORIGIN!");
        }
        // phpcs:enable Generic.Files.LineLength.TooLong

        if ($softwareEnforced->hasTagged(1)) {
            $purposesSoftware = $softwareEnforced->getTagged(1)->asExplicit()->asSet();
            foreach ($purposesSoftware->elements() as $onePurpose) {
                if ($onePurpose->asInteger()->intNumber() != array_search("SIGN", self::PURPOSE_3)) {
                    $this->fail("Incorrect value for PURPOSE (softwareEnforced)!");
                }
            }
        }
        if ($teeEnforced->hasTagged(1)) {
            $purposesTee = $teeEnforced->getTagged(1)->asExplicit()->asSet();
            foreach ($purposesTee->elements() as $onePurpose) {
                if ($onePurpose->asInteger()->intNumber() != array_search("SIGN", self::PURPOSE_3)) {
                    $this->fail("Incorrect value for PURPOSE (teeEnforced)!");
                }
            }
        }

        $this->pass("Android Key attestation passed.");
        $this->AAGUIDAssurance = self::AAGUID_ASSURANCE_LEVEL_BASIC;
    }