passkey: don't print User ID

[ikerexxe]

The User ID isn't part of any signed data, thus there isn't any indication that it's related to the token. Moreover, the effort to store it securely on the LDAP attribute is quite big. Taking that into account the passkey child doesn't print it and this way we avoid storing it in the LDAP server.

passkey_child testing

Register key

$ ./passkey_child --register --cred-type=discoverable --username=user --domain=test.com
passkey:yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh,MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyZW9QAvbN8axjZaTf3K81oYdncDqZoQWo0AQq4COIhpHl5vPy50sjIXwH4x1ylI72YL9YIZ8F3v/M77g1CQRVw==

Authentication

$echo -n "123456" | ./passkey_child --authenticate --username=user --domain=test.com --key-handle=yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh --public-key=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyZW9QAvbN8axjZaTf3K81oYdncDqZoQWo0AQq4COIhpHl5vPy50sjIXwH4x1ylI72YL9YIZ8F3v/M77g1CQRVw==
Authentication success.

Assertion obtention

$ ./passkey_child --get-assert --domain=test.com --key-handle=yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh --cryptographic-challenge=mZmBWUaJGwEjSNQvkFaicpCzDKhap2pQlfi8FXsv68k=
{"credential_id": "yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh", "cryptographic_challenge": "mZmBWUaJGwEjSNQvkFaicpCzDKhap2pQlfi8FXsv68k=", "authenticator_data": "WCWZq3FdhKO8Xg6SqlDmelgTY3/RdEvTAasI+HGR3bgW4AUAAAAQ", "assertion_signature": "MEYCIQDDy01C/Q1WUDQrgx0GMM5XhevyEA+TexmO0zsmjMlueQIhAKesPRZlO2i65JGRM23wqfTHdUGfrp57vEmXcjJKp/QA", "user_id": ""}

Assertion validation

$ ./passkey_child --verify-assert --domain=test.com --key-handle=yZW9QAvbN8axjZaTf7fICw8frNV3dV8+aBjqn+QMvdMtAhh0ds7XzNAuB8ESODsh --public-key=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyZW9QAvbN8axjZaTf3K81oYdncDqZoQWo0AQq4COIhpHl5vPy50sjIXwH4x1ylI72YL9YIZ8F3v/M77g1CQRVw== --cryptographic-challenge=mZmBWUaJGwEjSNQvkFaicpCzDKhap2pQlfi8FXsv68k= --auth-data=WCWZq3FdhKO8Xg6SqlDmelgTY3/RdEvTAasI+HGR3bgW4AUAAAAQ --signature=MEYCIQDDy01C/Q1WUDQrgx0GMM5XhevyEA+TexmO0zsmjMlueQIhAKesPRZlO2i65JGRM23wqfTHdUGfrp57vEmXcjJKp/QA
Verification success.

End to end testing

Use the COPR repository

[justin-stephenson]

LGTM.

[ikerexxe]

Rebased on top of master to get rid of the CI failure.

[sumit-bose]

Hi,

since the CI failures are not related, ACK.

bye,
Sumit

[pbrezina]

Pushed PR: #6675

• master
  • f97cd4d - passkey: don't print User ID