WIP: Support device public key and passkeys

Src/Fido2.Models/Exceptions/Fido2ErrorCode.cs

@@ -35,5 +35,6 @@ public enum Fido2ErrorCode
     UnimplementedAlgorithm,
     BackupEligibilityRequirementNotMet,
     BackupStateRequirementNotMet,
-    CredentialAlgorithmRequirementNotMet
+    CredentialAlgorithmRequirementNotMet,
+    DevicePublicKeyAuthentication
 }

Src/Fido2.Models/Objects/AssertionVerificationResult.cs

@@ -13,12 +13,14 @@ public class AssertionVerificationResult : Fido2ResponseBase
     /// The latest value of the signature counter in the authenticator data from any ceremony using the public key credential source.
     /// </summary>
     public uint SignCount { get; set; }
+
     /// <summary>
     /// The latest value of the BS flag in the authenticator data from any ceremony using the public key credential source.
     /// </summary>
     public bool BS { get; set; }
+
     /// <summary>
-    /// 
+    /// The public key portion of a hardware-bound device key pair
     /// </summary>
     public byte[] DevicePublicKey { get; set; }
 }

Src/Fido2.Models/Objects/AuthenticationExtensionsDevicePublicKeyInputs.cs

@@ -1,14 +1,13 @@
-using System;
+namespace Fido2NetLib.Objects;
+
+using System;
 using System.Text.Json.Serialization;
 
-namespace Fido2NetLib.Objects
+public sealed class AuthenticationExtensionsDevicePublicKeyInputs
 {
-    public sealed class AuthenticationExtensionsDevicePublicKeyInputs
-    {
-        [JsonPropertyName("attestation")]
-        public string Attestation { get; set; } = "none";
+    [JsonPropertyName("attestation")]
+    public string Attestation { get; set; } = "none";
 
-        [JsonPropertyName("attestationFormats")]
-        public string[] AttestationFormats { get; set; } = Array.Empty<string>();
-    }
+    [JsonPropertyName("attestationFormats")]
+    public string[] AttestationFormats { get; set; } = Array.Empty<string>();
 }

Src/Fido2.Models/Objects/AuthenticationExtensionsDevicePublicKeyOutputs.cs

@@ -1,15 +1,14 @@
-using System.Text.Json.Serialization;
+namespace Fido2NetLib.Objects;
 
-namespace Fido2NetLib.Objects
+using System.Text.Json.Serialization;
+
+public sealed class AuthenticationExtensionsDevicePublicKeyOutputs
 {
-    public sealed class AuthenticationExtensionsDevicePublicKeyOutputs
-    {
-        [JsonConverter(typeof(Base64UrlConverter))]
-        [JsonPropertyName("authenticatorOutput")]
-        public byte[] AuthenticatorOutput { get; set; }
+    [JsonConverter(typeof(Base64UrlConverter))]
+    [JsonPropertyName("authenticatorOutput")]
+    public byte[] AuthenticatorOutput { get; set; }
 
-        [JsonConverter(typeof(Base64UrlConverter))]
-        [JsonPropertyName("signature")]
-        public byte[] Signature { get; set; }
-    }
+    [JsonConverter(typeof(Base64UrlConverter))]
+    [JsonPropertyName("signature")]
+    public byte[] Signature { get; set; }
 }

Src/Fido2.Models/Objects/PublicKeyCredentialType.cs

@@ -12,6 +12,7 @@ public enum PublicKeyCredentialType
 {
     [EnumMember(Value = "public-key")]
     PublicKey,
+
     [EnumMember(Value = "invalid")]
     Invalid
 }

Src/Fido2/AuthenticatorAssertionResponse.cs

@@ -277,7 +277,7 @@ byte[] hash
             if (matches.Count > 1)
             {
                 // Some form of error has occurred. It is indeterminate whether this is a known device. Terminate these verification steps.
-                throw new Fido2VerificationException(Fido2ErrorCode.MissingStoredPublicKey, Fido2ErrorMessages.MissingStoredPublicKey);
+                throw new Fido2VerificationException(Fido2ErrorCode.DevicePublicKeyAuthentication, Fido2ErrorMessages.NonUniqueDevicePublicKey);
             }
             // exactly one match
             else if (matches.Count is 1)
@@ -307,10 +307,10 @@ byte[] hash
                         // This is a known device public key with a valid signature and valid attestation and thus a known device. Terminate these verification steps.
                         _ = verifier.Verify(devicePublicKeyAuthenticatorOutput.AttStmt, devicePublicKeyAuthenticatorOutput.AuthData, devicePublicKeyAuthenticatorOutput.Hash);
                     }
-                    catch
+                    catch (Exception ex)
                     {
                         // Some form of error has occurred. It is indeterminate whether this is a known device. Terminate these verification steps.
-                        throw;
+                        throw new Fido2VerificationException(Fido2ErrorCode.DevicePublicKeyAuthentication, Fido2ErrorMessages.InvalidDevicePublicKeyAttestation, ex);
                     }
                 }
             }
@@ -341,10 +341,10 @@ byte[] hash
                             _ = verifier.Verify(devicePublicKeyAuthenticatorOutput.AttStmt, devicePublicKeyAuthenticatorOutput.AuthData, devicePublicKeyAuthenticatorOutput.Hash);
                             return devicePublicKeyAuthenticatorOutput.GetBytes();
                         }
-                        catch
+                        catch (Exception ex)
                         {
                             // Some form of error has occurred. It is indeterminate whether this is a known device. Terminate these verification steps.
-                            throw;
+                            throw new Fido2VerificationException(Fido2ErrorCode.DevicePublicKeyAuthentication, Fido2ErrorMessages.InvalidDevicePublicKeyAttestation, ex);
                         }
                     }
                 }
@@ -353,7 +353,7 @@ byte[] hash
                     // Otherwise there is some form of error: we recieved a known dpk value, but one or more of the
                     // accompanying aaguid, scope, or fmt values did not match what the Relying Party has stored
                     // along with that dpk value. Terminate these verification steps.
-                    throw new Fido2VerificationException(Fido2ErrorCode.MissingStoredPublicKey, Fido2ErrorMessages.MissingStoredPublicKey);
+                    throw new Fido2VerificationException(Fido2ErrorCode.DevicePublicKeyAuthentication, Fido2ErrorMessages.MissingStoredPublicKey);
                 }
             }
         }
@@ -381,7 +381,7 @@ byte[] hash
                 catch
                 {
                     // Some form of error has occurred. It is indeterminate whether this is a known device. Terminate these verification steps.
-                    throw;
+                    throw new Fido2VerificationException(Fido2ErrorCode.MissingStoredPublicKey, Fido2ErrorMessages.MissingStoredPublicKey);
                 }
             }
         }

Src/Fido2/AuthenticatorAttestationResponse.cs

@@ -127,7 +127,7 @@ public static AuthenticatorAttestationResponse Parse(AuthenticatorAttestationRaw
             throw new Fido2VerificationException(Fido2ErrorCode.UserVerificationRequirementNotMet, Fido2ErrorMessages.UserVerificationRequirementNotMet);
 
         // 15. If the Relying Party uses the credential's backup eligibility to inform its user experience flows and/or policies, evaluate the BE bit of the flags in authData.
-        if (authData.BackupEligibility)
+        if (authData.IsBackupEligibile)
             throw new Fido2VerificationException(Fido2ErrorCode.BackupEligibilityRequirementNotMet, Fido2ErrorMessages.BackupEligibilityRequirementNotMet);
 
         if (!authData.HasAttestedCredentialData)
@@ -211,7 +211,7 @@ public static AuthenticatorAttestationResponse Parse(AuthenticatorAttestationRaw
             PublicKey = authData.AttestedCredentialData.CredentialPublicKey.GetBytes(),
             SignCount = authData.SignCount,
             //Transports = result of response.getTransports();
-            BE = authData.BackupEligibility,
+            BE = authData.IsBackupEligibile,
             BS = authData.BackupState,
             AttestationObject = Raw.Response.AttestationObject,
             AttestationClientDataJSON = Raw.Response.ClientDataJson,

Src/Fido2/DevelopmentInMemoryStore.cs

@@ -72,49 +72,66 @@ public class StoredCredential
     /// The type of the public key credential source.
     /// </summary>
     public PublicKeyCredentialType Type { get; set; } = PublicKeyCredentialType.PublicKey;
+
     /// <summary>
     /// The Credential ID of the public key credential source.
     /// </summary>
     public byte[] Id { get; set; }
+
     /// <summary>
     /// The credential public key of the public key credential source.
     /// </summary>
     public byte[] PublicKey { get; set; }
+
     /// <summary>
     /// The latest value of the signature counter in the authenticator data from any ceremony using the public key credential source.
     /// </summary>
     public uint SignCount { get; set; }
+
     /// <summary>
     /// The value returned from getTransports() when the public key credential source was registered.
     /// </summary>
     public AuthenticatorTransport[] Transports { get; set; }
+
     /// <summary>
     /// The value of the BE flag when the public key credential source was created.
     /// </summary>
     public bool BE { get; set; }
+
     /// <summary>
     /// The latest value of the BS flag in the authenticator data from any ceremony using the public key credential source.
     /// </summary>
     public bool BS { get; set; }
+
     /// <summary>
     /// The value of the attestationObject attribute when the public key credential source was registered. 
     /// Storing this enables the Relying Party to reference the credential's attestation statement at a later time.
     /// </summary>
     public byte[] AttestationObject { get; set; }
+
     /// <summary>
     /// The value of the clientDataJSON attribute when the public key credential source was registered. 
     /// Storing this in combination with the above attestationObject item enables the Relying Party to re-verify the attestation signature at a later time.
     /// </summary>
     public byte[] AttestationClientDataJSON { get; set; }
+
     /// <summary>
     /// 
     /// </summary>
     public List<byte[]> DevicePublicKeys { get; set; }
+
     public byte[] UserId { get; set; }
+
     public PublicKeyCredentialDescriptor Descriptor { get; set; }
+
     public byte[] UserHandle { get; set; }
+
     public uint SignatureCounter => SignCount;
+
     public string CredType { get; set; }
+
     public DateTime RegDate { get; set; }
+
     public Guid AaGuid { get; set; }
+
 }

Src/Fido2/Fido2ErrorMessages.cs

@@ -31,6 +31,8 @@ internal static class Fido2ErrorMessages
     public static readonly string NonUniqueCredentialId                  = "CredentialId is not unique to this user";
     public static readonly string MissingAttestationType                 = "Missing attestation type";
     public static readonly string InvalidAttestationCertSubject          = "Invalid attestation cert subject";
+    public static readonly string InvalidDevicePublicKeyAttestation      = "Invalid devicePublicKey attestation";
+    public static readonly string NonUniqueDevicePublicKey               = "More than one devicePublicKey match";
 
     public static readonly string UnimplementedAlgorithm_Ecdaa_Packed    = "ECDAA support for packed attestation is not yet implemented";
     public static readonly string UnimplementedAlgorithm_Ecdaa_Tpm       = "ECDAA support for TPM attestation is not yet implemented";

Src/Fido2/Objects/AttestedCredentialData.cs

@@ -16,7 +16,7 @@ public sealed class AttestedCredentialData
     /// <see cref="https://www.w3.org/TR/webauthn/#attested-credential-data"/>
     /// </summary>
     private readonly int _minLength = Marshal.SizeOf(typeof(Guid)) + sizeof(ushort) + sizeof(byte) + sizeof(byte);
-    private readonly int _maxCredentialIdLength = 1023;
+    private const int _maxCredentialIdLength = 1023;
 
     /// <summary>
     /// Instantiates an AttestedCredentialData object from an aaguid, credentialID, and CredentialPublicKey

Src/Fido2/Objects/AuthenticatorData.cs

@@ -48,7 +48,7 @@ public sealed class AuthenticatorData
     /// A backup eligible public key credential source is referred to as a multi-device credential whereas one that is not backup eligible is referred to as a single-device credential.
     /// <see cref="https://w3c.github.io/webauthn/#backup-eligibility"/>
     /// </summary>
-    public bool BackupEligibility => _flags.HasFlag(AuthenticatorFlags.BE);
+    public bool IsBackupEligibile => _flags.HasFlag(AuthenticatorFlags.BE);
 
     /// <summary>
     /// The current backup state of a multi-device credential as determined by the current managing authenticator.