1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
import unittest
from fido2.server import Fido2Server
from fido2.utils import websafe_encode
from fido2.webauthn import (
AttestedCredentialData,
AuthenticationResponse,
AuthenticatorAssertionResponse,
AuthenticatorData,
CollectedClientData,
PublicKeyCredentialRpEntity,
UserVerificationRequirement,
)
from .test_ctap2 import _ATT_CRED_DATA, _CRED_ID
class TestPublicKeyCredentialRpEntity(unittest.TestCase):
def test_id_hash(self):
rp = PublicKeyCredentialRpEntity(name="Example", id="example.com")
rp_id_hash = (
b"\xa3y\xa6\xf6\xee\xaf\xb9\xa5^7\x8c\x11\x804\xe2u\x1eh/"
b"\xab\x9f-0\xab\x13\xd2\x12U\x86\xce\x19G"
)
self.assertEqual(rp.id_hash, rp_id_hash)
USER = {"id": b"user_id", "name": "A. User"}
class TestFido2Server(unittest.TestCase):
def test_register_begin_rp(self):
rp = PublicKeyCredentialRpEntity(name="Example", id="example.com")
server = Fido2Server(rp)
request, state = server.register_begin(USER)
self.assertEqual(
request["publicKey"]["rp"], {"id": "example.com", "name": "Example"}
)
def test_register_begin_custom_challenge(self):
rp = PublicKeyCredentialRpEntity(name="Example", id="example.com")
server = Fido2Server(rp)
challenge = b"1234567890123456"
request, state = server.register_begin(USER, challenge=challenge)
self.assertEqual(request["publicKey"]["challenge"], websafe_encode(challenge))
def test_register_begin_custom_challenge_too_short(self):
rp = PublicKeyCredentialRpEntity(name="Example", id="example.com")
server = Fido2Server(rp)
challenge = b"123456789012345"
with self.assertRaises(ValueError):
request, state = server.register_begin(USER, challenge=challenge)
def test_authenticate_complete_invalid_signature(self):
rp = PublicKeyCredentialRpEntity(name="Example", id="example.com")
server = Fido2Server(rp)
state = {
"challenge": "GAZPACHO!",
"user_verification": UserVerificationRequirement.PREFERRED,
}
client_data = CollectedClientData.create(
CollectedClientData.TYPE.GET,
"GAZPACHO!",
"https://example.com",
)
_AUTH_DATA = bytes.fromhex(
"A379A6F6EEAFB9A55E378C118034E2751E682FAB9F2D30AB13D2125586CE1947010000001D"
)
response = AuthenticationResponse(
raw_id=_CRED_ID,
response=AuthenticatorAssertionResponse(
client_data=client_data,
authenticator_data=AuthenticatorData(_AUTH_DATA),
signature=b"INVALID",
),
)
with self.assertRaisesRegex(ValueError, "Invalid signature."):
server.authenticate_complete(
state,
[AttestedCredentialData(_ATT_CRED_DATA)],
response,
)
|
