WebAuthnRegistrationEvent::validateAttestedCredentialData()

Complexity

Conditions	6
Paths	20

Size

Total Lines	65
Code Lines	44

Duplication

Lines	0
Ratio	0 %

Importance

Changes	6
Bugs	2	Features	0

<?php
    private function validateAttestedCredentialData(string $attData, string $responseId): void
    {
        $aaguid = substr($attData, 0, 16);
        $credIdLenBytes = substr($attData, 16, 2);
        $credIdLen = intval(bin2hex($credIdLenBytes), 16);
        $credId = substr($attData, 18, $credIdLen);
        $this->debugBuffer .= "AAGUID (hex) = " . bin2hex($aaguid) . "</br/>";
        $this->AAGUID = bin2hex($aaguid);
        $this->debugBuffer .= "Length Raw = " . bin2hex($credIdLenBytes) . "<br/>";
        $this->debugBuffer .= "Credential ID Length (decimal) = " . $credIdLen . "<br/>";
        $this->debugBuffer .= "Credential ID (hex) = " . bin2hex($credId) . "<br/>";
        if (bin2hex(WebAuthnAbstractEvent::base64urlDecode($responseId)) === bin2hex($credId)) {
            $this->pass("Credential IDs in authenticator response and in attestation data match.");
        } else {
            $this->fail(
                "Mismatch of credentialId (" . bin2hex($credId) . ") vs. response ID (" .
                bin2hex(WebAuthnAbstractEvent::base64urlDecode($responseId)) . ").",
            );
        }
        // so far so good. Now extract the actual public key from its COSE
        // encoding.
        // finding out the number of bytes to CBOR decode appears non-trivial.
        // The simple case is if no ED is present as the CBOR data then goes to
        // the end of the byte sequence.
        // since we don't know the algoritm yet, we don't know how many bytes
        // of credential CBOR follow. Let's read to the end; the CBOR decoder
        // silently ignores trailing extensions (if any)
        $pubKeyCBOR = substr($attData, 18 + $credIdLen);
        $arrayPK = $this->cborDecode($pubKeyCBOR);
        $this->debugBuffer .= "pubKey in canonical form: <pre>" .
            /** @scrutinizer ignore-type */ print_r($arrayPK, true) .
            "</pre>";
        /**
         * STEP 13 of the validation procedure in § 7.1 of the spec: is the algorithm the expected one?
         */
        if (in_array($arrayPK['3'], self::PK_ALGORITHM)) { // we requested -7 or -257, so want to see it here
            $this->algo = (int)$arrayPK['3'];
            $this->pass("Public Key Algorithm is expected (" .
                implode(' or ', WebAuthnRegistrationEvent::PK_ALGORITHM) .
                ").");
        } else {
            $this->fail("Public Key Algorithm mismatch!");
        }
        $this->credentialId = bin2hex($credId);
        $this->credential = bin2hex($pubKeyCBOR);

        // now that we know credential and its length, we can CBOR-decode the
        // trailing extensions
        switch ($this->algo) {
            case self::PK_ALGORITHM_ECDSA:
                $credentialLength = 77;
                break;
            case self::PK_ALGORITHM_RSA:
                $credentialLength = 272;
                break;
            default:
                $this->fail("No credential length information for $this->algo");
                // be sure to end execution even if the Exception is caught
                exit(1);

Using exit here is not recommended.

        }
        $extensions = substr($attData, 18 + $credIdLen + $credentialLength);
        if (strlen($extensions) !== 0) {
            $this->pass("Found the following extensions (" .
                strlen($extensions) .
                " bytes) during registration ceremony: ");
        }