Class PasskeyVerifier

java.lang.Object
com.iizix.server.user.passkey.PasskeyVerifier
public final class PasskeyVerifier extends Object
The verification of the two WebAuthn ceremonies as the specification's sections 7.1 (registering a new credential) and 7.2 (verifying an authentication assertion) define it, for passkeys (CC-LOGIN-L8-PASSKEYS). It is pure: it reads no database and knows no session. What the server expects - the challenge it made, its relying party ID, the origins of its pages, user verification - is an PasskeyVerifier.Expectation; what the client sent is the JSON text of PublicKeyCredential.toJSON().

What is verified. The type of the ceremony; the challenge, byte for byte; the origin, against the exact origins expected; that the credential was not made in a frame of another origin; the hash of the relying party ID; user presence, and user verification when expected; the consistency of the backup flags; the algorithm, against the ones offered; the credential public key (see CoseKey); for an assertion the signature over the authenticator data and the hash of the client data, with the stored public key, the owner of the credential against the user handle the authenticator returned, and the signature counter, which must grow when it is used.

Attestation. The server asks for none, and takes no decision from an attestation: a passkey proves the user, not the make of the authenticator. The format none must have an empty statement; the format packed is verified - a self attestation against the credential key, a certified one against the key of its first certificate, whose chain is NOT validated (the server keeps no trust anchors); any other format is accepted without evaluation, and its name is recorded.

Every refusal is a PasskeyException whose message is for the server log.

Author:
Christopher Mindus

  • Field Details

    • MAX_RESPONSE_LENGTH

      public static final int MAX_RESPONSE_LENGTH
      The longest JSON text of a client that is read, in characters.
      See Also:

  • Method Details

    • verifyRegistration

      public static PasskeyVerifier.Registration verifyRegistration(PasskeyVerifier.Expectation expected, String responseJSON) throws PasskeyException
      Verifies a registration.
      Parameters:
      expected - What the server expects.
      responseJSON - The JSON text of the client's RegistrationResponseJSON.
      Returns:
      The new credential.
      Throws:
      NullPointerException - If a parameter is null.
      PasskeyException - If the registration is refused; the message says why.

    • parseAssertion

      public static PasskeyVerifier.AssertionResponse parseAssertion(String responseJSON) throws PasskeyException
      Decodes the assertion a client sent, without verifying it: the credential it names is needed to find the public key it is verified with.
      Parameters:
      responseJSON - The JSON text of the client's AuthenticationResponseJSON.
      Returns:
      The decoded response.
      Throws:
      NullPointerException - If responseJSON is null.
      PasskeyException - If the text is not a well-formed response.

    • verifyAssertion

      public static PasskeyVerifier.Assertion verifyAssertion(PasskeyVerifier.Expectation expected, PasskeyVerifier.AssertionResponse response, CoseKey publicKey, long signCount, boolean backupEligible, byte[] userHandle, boolean discoverable) throws PasskeyException
      Verifies an assertion against the credential it names.
      Parameters:
      expected - What the server expects.
      response - The decoded response.
      publicKey - The stored public key of the credential.
      signCount - The stored signature counter of the credential.
      backupEligible - The stored backup eligibility of the credential.
      userHandle - The user handle of the user who owns the credential.
      discoverable - true when the request named no credential: the authenticator must then return the user handle.
      Returns:
      The verified assertion.
      Throws:
      NullPointerException - If a parameter is null.
      PasskeyException - If the assertion is refused; the message says why.