Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

passkey: don't print User ID #6675

Closed
wants to merge 1 commit into from
Closed

Conversation

ikerexxe
Copy link
Contributor

The User ID isn't part of any signed data, thus there isn't any indication that it's related to the token. Moreover, the effort to store it securely on the LDAP attribute is quite big. Taking that into account the passkey child doesn't print it and this way we avoid storing it in the LDAP server.

passkey_child testing

Register key

$ ./passkey_child --register --cred-type=discoverable --username=user --domain=test.com
passkey:yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh,MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyZW9QAvbN8axjZaTf3K81oYdncDqZoQWo0AQq4COIhpHl5vPy50sjIXwH4x1ylI72YL9YIZ8F3v/M77g1CQRVw==

Authentication

$echo -n "123456" | ./passkey_child --authenticate --username=user --domain=test.com --key-handle=yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh --public-key=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyZW9QAvbN8axjZaTf3K81oYdncDqZoQWo0AQq4COIhpHl5vPy50sjIXwH4x1ylI72YL9YIZ8F3v/M77g1CQRVw==
Authentication success.

Assertion obtention

$ ./passkey_child --get-assert --domain=test.com --key-handle=yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh --cryptographic-challenge=mZmBWUaJGwEjSNQvkFaicpCzDKhap2pQlfi8FXsv68k=
{"credential_id": "yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh", "cryptographic_challenge": "mZmBWUaJGwEjSNQvkFaicpCzDKhap2pQlfi8FXsv68k=", "authenticator_data": "WCWZq3FdhKO8Xg6SqlDmelgTY3/RdEvTAasI+HGR3bgW4AUAAAAQ", "assertion_signature": "MEYCIQDDy01C/Q1WUDQrgx0GMM5XhevyEA+TexmO0zsmjMlueQIhAKesPRZlO2i65JGRM23wqfTHdUGfrp57vEmXcjJKp/QA", "user_id": ""}

Assertion validation

$ ./passkey_child --verify-assert --domain=test.com --key-handle=yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh --public-key=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyZW9QAvbN8axjZaTf3K81oYdncDqZoQWo0AQq4COIhpHl5vPy50sjIXwH4x1ylI72YL9YIZ8F3v/M77g1CQRVw== --cryptographic-challenge=mZmBWUaJGwEjSNQvkFaicpCzDKhap2pQlfi8FXsv68k= --auth-data=WCWZq3FdhKO8Xg6SqlDmelgTY3/RdEvTAasI+HGR3bgW4AUAAAAQ --signature=MEYCIQDDy01C/Q1WUDQrgx0GMM5XhevyEA+TexmO0zsmjMlueQIhAKesPRZlO2i65JGRM23wqfTHdUGfrp57vEmXcjJKp/QA
Verification success.

End to end testing

Use the COPR repository

@ikerexxe ikerexxe added passkey Issues and PRs related to 'passkey' feature Waiting for review labels Apr 14, 2023
@alexey-tikhonov alexey-tikhonov added the no-backport This should go to target branch only. label Apr 14, 2023
Copy link
Contributor

@justin-stephenson justin-stephenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@ikerexxe
Copy link
Contributor Author

Rebased on top of master to get rid of the CI failure.

The User ID isn't part of any signed data, thus there isn't any
indication that it's related to the token. Moreover, the effort to store
it securely on the LDAP attribute is quite big. Taking that into account
the passkey child doesn't print it and this way we avoid storing it in
the LDAP server.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Copy link
Contributor

@sumit-bose sumit-bose left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,

since the CI failures are not related, ACK.

bye,
Sumit

@pbrezina
Copy link
Member

pbrezina commented May 3, 2023

Pushed PR: #6675

  • master
    • f97cd4d - passkey: don't print User ID

@pbrezina pbrezina added Pushed and removed Accepted Ready to push Ready to push labels May 3, 2023
@pbrezina pbrezina closed this May 3, 2023
@ikerexxe ikerexxe deleted the user_id branch May 17, 2023 10:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
no-backport This should go to target branch only. passkey Issues and PRs related to 'passkey' feature Pushed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants