Verify passkey algorithms from COSE keys

authwebauthn/algorithm_test.go

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: MPL-2.0
+
+package authwebauthn
+
+import (
+	"crypto/ecdh"
+	"crypto/rand"
+	"errors"
+	"testing"
+
+	"gamertan.com/web/internal/webauthnvendored/protocol/webauthncbor"
+	"gamertan.com/web/internal/webauthnvendored/protocol/webauthncose"
+	wa "gamertan.com/web/internal/webauthnvendored/webauthn"
+)
+
+func TestEnforceCredentialAlgorithmUsesVerifiedCOSEKey(t *testing.T) {
+	privateKey, err := ecdh.P256().GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	publicKey := privateKey.PublicKey().Bytes()
+	encoded, err := webauthncbor.Marshal(map[int64]any{
+		1:  int64(webauthncose.EllipticKey),
+		3:  int64(webauthncose.AlgES256),
+		-1: int64(webauthncose.P256),
+		-2: publicKey[1:33],
+		-3: publicKey[33:65],
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	credential := &wa.Credential{
+		PublicKey: encoded,
+		// This value is absent when a standards-compliant client serializes the
+		// mandatory attestation object without optional response conveniences.
+		Attestation: wa.CredentialAttestation{PublicKeyAlgorithm: 0},
+	}
+	if err = enforceCredentialAlgorithm(credential); err != nil {
+		t.Fatalf("verified ES256 COSE key rejected when convenience value was absent: %v", err)
+	}
+}
+
+func TestEnforceCredentialAlgorithmRejectsOtherOrInvalidKeys(t *testing.T) {
+	rsaKey, err := webauthncbor.Marshal(map[int64]any{
+		1:  int64(webauthncose.RSAKey),
+		3:  int64(webauthncose.AlgRS256),
+		-1: []byte{0xff},
+		-2: []byte{0x01, 0x00, 0x01},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, credential := range map[string]*wa.Credential{
+		"nil":       nil,
+		"malformed": {PublicKey: []byte("not-cose")},
+		"rsa":       {PublicKey: rsaKey},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if err := enforceCredentialAlgorithm(credential); !errors.Is(err, ErrUnsupportedCredential) {
+				t.Fatalf("error=%v", err)
+			}
+		})
+	}
+}

authwebauthn/service.go

@@ -375,7 +375,7 @@ func (service *Service) finishRegistrationCeremony(ctx context.Context, ceremony
 	if err != nil {
 		return Credential{}, fmt.Errorf("authwebauthn: verify registration: %w", err)
 	}
-	if verified.Attestation.PublicKeyAlgorithm != int64(webauthncose.AlgES256) {
+	if err = enforceCredentialAlgorithm(verified); err != nil {
 		return Credential{}, ErrUnsupportedCredential
 	}
 	encoded, err := json.Marshal(verified)
@@ -407,6 +407,26 @@ func (service *Service) finishRegistrationCeremony(ctx context.Context, ceremony
 	return record, nil
 }
 
+// enforceCredentialAlgorithm derives the algorithm from the verified COSE key
+// carried inside authenticator data. AuthenticatorAttestationResponse's
+// publicKeyAlgorithm member is an optional browser convenience value: clients
+// that serialize the mandatory attestation object directly may omit it, and it
+// is not the cryptographically authoritative representation.
+func enforceCredentialAlgorithm(credential *wa.Credential) error {
+	if credential == nil {
+		return ErrUnsupportedCredential
+	}
+	parsed, err := webauthncose.ParsePublicKey(credential.PublicKey)
+	if err != nil {
+		return ErrUnsupportedCredential
+	}
+	key, ok := parsed.(webauthncose.EC2PublicKeyData)
+	if !ok || key.Algorithm != int64(webauthncose.AlgES256) {
+		return ErrUnsupportedCredential
+	}
+	return nil
+}
+
 func (service *Service) BeginLogin(ctx context.Context) (BeginResult, error) {
 	challenge, err := service.randomBytes(32)
 	if err != nil {