Movatterモバイル変換

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 8FIDO（Fast IDentity Online）パスワードへの依存度を減らし、利便性と安全性を向上するPoor EasyWeakStrongUSABILITYSECURITYUSABILITYSECURITYhttps://www.slideshare.net/FIDOAlliance/fido-83445442https://www.slideshare.net/FIDOAlliance/introduction-to-fido-alliance-66730790

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 9FIDO認証モデルAuthenticatorUser verification FIDO Authenticationchallengegesture signatureprivatekeypublickey 公開鍵暗号方式による認証 オンラインサービスへの登録時に鍵ペアを生成して登録clientRP

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 15クレデンシャル情報の通信経路パスワード認証リモート認証（ユーザー名, パスワード）ローカル認証（指紋など）リモート認証（署名）FIDO認証モデルUser ClientUser Authenticator clientRelying partyRelying party

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 16クレデンシャル情報の安全性FIDO AuthenticationKpub1Kpub2RPごとに鍵ペアを生成して登録rpid1（origin)rpid2（origin)Relying party1Relying party2Client リスト型攻撃に対する耐性 フィッシングに対する耐性AuthenticatorKpriv1 Kpriv2User Presence

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 17クレデンシャル情報の安全性（リスト型攻撃対策）AuthenticatorFIDO Authentication Kpub1Kpriv1RPごとに異なる公開鍵を登録Kpriv2rpid1（origin)rpid2（origin)Relying party1Relying party2ClientKpub2User Presence

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 18クレデンシャル情報の安全性（フィッシング対策）FIDO AuthenticationKpriv1RPごとに異なる秘密鍵を保管Kpriv2ClientUser PresenceKpub1Relying party1Relying party2 Kpub2AuthenticatorRelying party3

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 19認証器の信頼性Attestation & MetadataAuthenticatorRegistrationAttestation privKey MetadataAuthentication KeysSigned Attestation ObjectRelying partyAttestation pubKeyAttestation Certificate

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 24UAFとU2F ユースケースが異なる• UAF（FIDOクライアント=アプリ）• U2F（ブラウザから利用できるが二要素認証） ブラウザからパスワードレス認証を!!https://www.slideshare.net/FIDOAlliance/fido-83445442

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 25FIDO2FIDO認証対応プラットフォームの拡大Web Authentication APIブラウザからクレデンシャルにアクセスするAPICTAPクライアントと外部認証器間の通信をサポートするプロトコルhttps://www.slideshare.net/FIDOAlliance/fido-psd2-solving-the-strong-customer-authentication-challenge-in-europe

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 26Web Authentication APIブラウザからクレデンシャルにアクセスするAPI ブラウザの標準インターフェース Credential Management API の拡張 登録 : navigator.credentials.create() 認証 : navigator.credentials.get()

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 31登録フロー（概略）Authenticator Client Relying partyユーザー名チャレンジなどAttestation response鍵ペアの生成Attestation responseチャレンジ・RPの情報・ユーザーの情報（署名・証明書・公開鍵など）（署名・証明書・公開鍵など）検証公開鍵の保存

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 32実装範囲Authenticator Client Relying partyWeb Authentication API 実装が必要な箇所ユーザー名チャレンジなどAttestation response 検証公開鍵の保存鍵ペアの生成Attestation responseチャレンジ・RPの情報・ユーザーの情報（署名・証明書・公開鍵など）（署名・証明書・公開鍵など）

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 33登録フロー（概略）Authenticator Client Relying partyユーザー名チャレンジなどAttestation response 検証公開鍵の保存鍵ペアの生成Attestation responseチャレンジ・RPの情報・ユーザーの情報（署名・証明書・公開鍵など）（署名・証明書・公開鍵など）

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 35ユーザー名の送信fetch('/webauthn/register', {method: 'POST',credentials: 'include',headers: {'Content-Type': 'application/json'},body: JSON.stringify({username: this.username.value,name: this.name.value})}) サンプル フォームからユーザー名を取得 ユーザー名を送信してチャレンジなどの情報を要求

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 36challengeの送信{// random numberchallenge: randomBase64URLBuffer(32),rp: {name: "FIDO Examples Corporation”},user: {id: id,name: username,displayName: displayName},pubKeyCredParams: [{type: "public-key",alg: -7 // "ES256" IANA COSE Algorithms registry}]} サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved.Web Authentication API37登録フロー（概略）Authenticator Client Relying partyユーザー名チャレンジなどAttestation response 検証公開鍵の保存鍵ペアの生成Attestation responseチャレンジ・RPの情報・ユーザーの情報（署名・証明書・公開鍵など）（署名・証明書・公開鍵など）

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 38navigator.credentials.create()navigator.credentials.create({publicKey: {rp: {id: "example.com”,name: "Acme"},user: {id: new Uint8Array(16),name: "john.p.smith@example.com",displayName: "John P. Smith "},pubKeyCredParams: [{type: "public-key",alg: -7}],attestation: "direct",timeout: 60000,// must be a cryptographically random number sent from a serverchallenge: new Uint8Array([0x8C, 0x0A, 0x26, 0xFF, 0x22, 0x91, 0xC1, 0xE9, ... ]).buffer}})サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 39Parameter rp [Object] （必須）• Relying partyに関する情報 user [Object]（必須）• Credentialが紐づくユーザー情報 challenge[ArrayBuffer] （必須）• サーバーで生成した乱数 pubKeyCredParams[Object] （必須）• Credentialのタイプとアルゴリズムの指定（typeはpublic-key固定） timeout [Int]• ユーザーの入力待機時間 attestation [String]• Authenticatorの出どころを検証するかどうか authenticatorSelection [Object]• 認証器への要求事項

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 42AuthenticatorAttestationResponse{// credential identifier on the device"rawId": "imCIoe8U_N9M1rTGeCqJ96TAu5uqSPa7YUzd ... ","id": ” imCIoe8U_N9M1rTGeCqJ96TAu5uqSPa7YUzdh7qq ... ",// attestation data"response": {"clientDataJSON": ”eyJjaGFsbGVuZ2UiOiJJSFdtWjFPa1MydDZLaH ... ”,"attestationObject": ”o2NmbXRoZmlkby11MmZnYXR0U3RtdKJjc2 ... "},// extensions results struct"getClientExtensionResults": {},// type of credential"type": "public-key”}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 43clientDataJSON{// random number"challenge": "IHWmZ1OkS2t6KhvX-koNxutkYuMVEunCjYNSXXgAxvU",// origin of the website"origin": "http://localhost:3000",// type of the call."type": "webauthn.create”}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 44attestationObject CBOR（Concise Binary Object Representation）• JSONフォーマットをバイナリで表現• JSONよりもサイズが小さいconst cbor = require('cbor');. . .let attestationBuffer =base64url.toBuffer(webAuthnResponse.response.attestationObject);let ctapMakeCredResp = cbor.decodeAllSync(attestationBuffer)[0];公開鍵などを含むCBORでエンコードされたデータサンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 45attestationObject{// attestation format"fmt": ”packed",// raw buffer struct containing user info"authData": "9569088f1ecee3232954035dbd10d7cae3 ... ",// attestation statement data"attStmt": {// signature"sig": "3046022100db3162cfa7b5dbd78c46864e5f9 ... ",// X.509 Certificate Chain"x5c": ["3082013c3081e4a003020102020a395187893878526 ... ”]}}サンプル公開鍵などを含むCBORでエンコードされたデータ

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 47authDataのパースlet parseMakeCredAuthData = (buffer) => {let rpIdHash = buffer.slice(0, 32); buffer = buffer.slice(32);let flagsBuf = buffer.slice(0, 1); buffer = buffer.slice(1);let flags = flagsBuf[0];let counterBuf = buffer.slice(0, 4); buffer = buffer.slice(4);let counter = counterBuf.readUInt32BE(0);let aaguid = buffer.slice(0, 16); buffer = buffer.slice(16);let credIDLenBuf = buffer.slice(0, 2); buffer = buffer.slice(2);let credIDLen = credIDLenBuf.readUInt16BE(0);let credID = buffer.slice(0, credIDLen); buffer = buffer.slice(credIDLen);let COSEPublicKey = buffer;return {rpIdHash, flagsBuf, flags, counter, counterBuf, aaguid, credID, credIDLen, credIDLenBuf,COSEPublicKey}}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 48authDataのパース結果{// hash of the rpIdrpIdHash: <Buffer 49 96 0d e5 88 0e 8c 68 74 34 17 0f 64 76 60 5b 8f ... >,// state of the authenticator during the authenticationflags: 65,flagsBuf: <Buffer 41>,// 4byte countercounter: 53,counterBuf: <Buffer 00 00 00 35>,// authenticator attestation identifier aaguid: <Buffer f8 a0 11 f3 8c 0a 4d 15 80 06 17 11 1f 9e dc 7d>,// credential IdentifiercredID: <Buffer de 13 93 92 33 87 5a 0e 89 1b de 60 dc 43 1f 89 8c ... >,credIDLenBuf: <Buffer 00 40>,credIDLen: 64,// COSE encoded public keyCOSEPublicKey: <Buffer a5 01 02 03 26 20 01 21 58 20 36 25 71 4a ... >} サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 51challengeの検証router.post('/response', (request, response) => {let webauthnResp = request.bodylet clientData =JSON.parse(base64url.decode(webauthnResp.response.clientDataJSON));if(clientData.challenge !== request.session.challenge) {response.json({'status': 'failed','message': 'Challenges don¥'t match!’})}. . .})サンプルclientDataJSON内のchallengeを検証

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 52originの検証router.post('/response', (request, response) => {let webauthnResp = request.bodylet clientData =JSON.parse(base64url.decode(webauthnResp.response.clientDataJSON));. . .if(clientData.origin !== config.origin) {response.json({'status': 'failed','message': 'Origins don¥'t match!’})}})サンプルclientDataJSON内のoriginを検証

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 53typeの検証. . .let webauthnResp = request.bodylet clientData =JSON.parse(base64url.decode(webauthnResp.response.clientDataJSON));if(clientData.type !== 'webauthn.create') {. . .}})サンプルclientDataJSON内のtypeがwebauthn.createであるか確認

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 55flagsの検証AuthenticatorでのUP、UVの結果 UP : User Presence• ユーザーの存在確認（必須） UV : User Verification• ユーザーの認証（任意）https://slides.com/fidoalliance/jan-2018-fido-seminar-webauthn-tutorial#/

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 56flagsの検証let authrDataStruct = parseMakeCredAuthData(ctapMakeCredResp.authData);if(!(authrDataStruct.flags & 0x01))throw new Error('User was NOT presented durring authentication!');サンプルAuthenticatorでのUP、UVの結果 UP : User Presence• ユーザーの存在確認（必須） UV : User Verification• ユーザーの認証（任意）

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 59Attestation Certificateの取得 authData内にあるattSmtのx5c（X.509 Certificate Chain） PEM形式に変換する• Base64エンコード• 64文字ごとに改行コードをいれる• ヘッダとフッタを入れるlet ASN1toPEM = (pkBuffer) => {let type;. . .type = 'CERTIFICATE';}let b64cert = pkBuffer.toString('base64');let PEMKey = '';for(let i = 0; i < Math.ceil(b64cert.length / 64); i++) {let start = 64 * i;PEMKey += b64cert.substr(start, 64) + '¥n';}PEMKey = `-----BEGIN ${type}-----¥n` + PEMKey + `-----END ${type}-----¥n`;return PEMKey}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 60signatureの検証. . .let attestationBuffer = base64url.toBuffer(attestationObject);let ctapMakeCredResp = cbor.decodeAllSync(attestationBuffer)[0];let authrDataStruct = parseMakeCredAuthData(ctapMakeCredResp.authData);let clientDataHash = hash(base64url.toBuffer(clientDataJSON))// Attestation Certificateの取得let PEMCertificate = ASN1toPEM(ctapMakeCredResp.attStmt.x5c[0]);// authDataのパラメーターとclientDataJSONのハッシュ値を連結let signatureBase = Buffer.concat([authrDataStruct.rpIdHash,authrDataStruct.flagsBuf,authrDataStruct.counterBuf,authrDataStruct.aaguid,authrDataStruct.credIDLenBuf,authrDataStruct.credID,authrDataStruct.COSEPublicKey,clientDataHash]);// attStmtからsignatureの取得let signature = ctapMakeCredResp.attStmt.sig;// 検証response.verified = crypto.createVerify('SHA256').update(signatureBase).verify(PEMCertificate, signature);}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 64publicKeyの保存let verifyAuthenticatorAttestationResponse = (webAuthnResponse) => {. . .let authrDataStruct = parseMakeCredAuthData(ctapMakeCredResp.authData);// COSE PublicKeyをPKCS形式に変換let publicKey = COSEECDHAtoPKCS(authrDataStruct.COSEPublicKey)let verified = verifySignature(signature, signatureBase, PEMCertificate)if(verified) {// publicKeyなどを保存response.authrInfo = {fmt: ’packed',publicKey: base64url.encode(publicKey),counter: authrDataStruct.counter,credID: base64url.encode(authrDataStruct.credID)}}}return response}サンプル COSE（CBOR Object Signing and Encryption）• 暗号鍵を表現するためのJSONをCBORエンコードしたフォーマット• COSEから取得したxとyを連結し、先頭に0x04を加えるとPublicKeyになる

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 65publicKeyの保存 COSE（CBOR Object Signing and Encryption）• 暗号鍵を表現するためのJSONをCBORエンコードしたフォーマット• COSEから取得したxとyを連結し、先頭に0x04を加えるとPublicKeyになる// result of COSE parse{1: kty=2,3: alg=-7,-1: crv=1,-2: x,-3: y,} サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 66publicKeyの保存 COSE（CBOR Object Signing and Encryption）• 暗号鍵を表現するためのJSONをCBORエンコードしたフォーマット• COSEから取得したxとyを連結し、先頭に0x04を加えるとPublicKeyになるconst cbor = require('cbor');. . .let COSEECDHAtoPKCS = (COSEPublicKey) => {let coseStruct = cbor.decodeAllSync(COSEPublicKey)[0];let tag = Buffer.from([0x04]);let x = coseStruct.get(-2);let y = coseStruct.get(-3);return Buffer.concat([tag, x, y])}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 68認証フロー（概略）Authenticator Client Relying partyユーザー名チャレンジやユーザーの情報などAssertion response検証署名の生成Assertion responseチャレンジ・RPの情報・ユーザーの情報（署名など）（署名など）

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 69実装範囲Authenticator Client Relying partyWeb Authentication API 実装が必要な箇所ユーザー名チャレンジやユーザーの情報などAssertion response検証署名の生成Assertion responseチャレンジ・RPの情報・ユーザーの情報（署名など）（署名など）

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 72ユーザー名の送信fetch('/webauthn/login', {method: 'POST',credentials: 'include',headers: {'Content-Type': 'application/json'},body: JSON.stringify({username: this.username.value})})サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 73challengeの送信let generateServerGetAssertion = (authenticators) => {let allowCredentials = [];for(let authr of authenticators) {allowCredentials.push({type: 'public-key',id: authr.credID,transports: ['usb', 'nfc', 'ble']})}return {// random numberchallenge: randomBase64URLBuffer(32),allowCredentials: allowCredentials}}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved.Web Authentication API74実装範囲Authenticator Client Relying partyユーザー名チャレンジやユーザーの情報などAssertion response検証署名の生成Assertion responseチャレンジ・RPの情報・ユーザーの情報（署名など）（署名など）

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 75navigator.credentials.get()navigator.credentials.get({publicKey: {timeout: 60000,challenge: new Uint8Array([0x79, 0x50, 0x68, 0x71, 0xDA, 0xEE, 0xEE, 0xB9, 0x94, 0xC3, 0xC2, ...]).buffer,allowCredentials: [{id: cred.rawId,transports: ["usb", "nfc", "ble"],type: "public-key"}]},})サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 76Parameter challenge [ArrayBuffer] （必須）• サーバーで生成した乱数 timeout [Int]• ユーザーの入力待機時間 allowCredentials [Array]• ユーザーに紐づくCredentialのidリスト rpId [String]• rpIdの指定（登録時と同じ値を指定） userVerification [String]• ユーザーに紐づくCredentialのリスト

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 79AuthenticatorAssertionResponse{// credential identifier on the device"rawId": "imCIoe8U_N9M1rTGeCqJ96TAu5uqSPa7YUzd ... " ,"id": "imCIoe8U_N9M1rTGeCqJ96TAu5uqSPa7YUzdh7qq ... ",// assertion data"response": {"authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MBAAAALQ","signature": "MEUCIQCFOqnsAFZLQmcPt2qSjnCb403SisGEASSjT3fOPuD5JgIgF ...","userHandle": "","clientDataJSON": "eyJjaGFsbGVuZ2UiOiJDUXF5aUlrQ00yWEtvaHVSdlNqTEFoN ...”},// extensions results struct"getClientExtensionResults": {},// type of credential"type": "public-key”}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 81authenticatorDataのパースlet parseGetAssertAuthData = (buffer) => {let rpIdHash = buffer.slice(0, 32); buffer = buffer.slice(32);let flagsBuf = buffer.slice(0, 1); buffer = buffer.slice(1);let flags = flagsBuf[0];let counterBuf = buffer.slice(0, 4); buffer = buffer.slice(4);let counter = counterBuf.readUInt32BE(0);return {rpIdHash, flagsBuf, flags, counter, counterBuf}}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 82authenticatorDataのパース結果{// hash of the rpIdrpIdHash: <Buffer 49 96 0d e5 88 0e 8c 68 74 34 17 0f 64 76 60 5b 8f e4 ae b9a2 86 32 c7 99 5c f3 ba 83 1d 97 63>,// state of the authenticator during the authenticationflags: 1,flagsBuf: <Buffer 01>,// 4byte countercounter: 68,counterBuf: <Buffer 00 00 00 44>}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 85challengeの検証router.post('/response', (request, response) => {let webauthnResp = request.bodylet clientData =JSON.parse(base64url.decode(webauthnResp.response.clientDataJSON));if(clientData.challenge !== request.session.challenge) {response.json({'status': 'failed','message': 'Challenges don¥'t match!’})}. . .})サンプルclientDataJSONとセッションなどに保存していたchallengeを比較

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 86originの検証router.post('/response', (request, response) => {let webauthnResp = request.bodylet clientData =JSON.parse(base64url.decode(webauthnResp.response.clientDataJSON));. . .if(clientData.origin !== config.origin) {response.json({'status': 'failed','message': 'Origins don¥'t match!’})}})サンプルclientDataJSONとサーバーのコンフィグなどから取得したoriginを比較

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 87typeの検証. . .let webauthnResp = request.bodylet clientData =JSON.parse(base64url.decode(webauthnResp.response.clientDataJSON));if(clientData.type !== 'webauthn.get') {. . .}})サンプルclientDataJSONのtypeがwebauthn.getであるか確認

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 89flagsの検証let authrDataStruct = parseMakeCredAuthData(ctapMakeCredResp.authData);if(!(authrDataStruct.flags & 0x01))throw new Error('User was NOT presented durring authentication!');サンプルAuthenticatorでのUP、UVの結果を検証

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 91signatureの検証 Authenticatorの検索 PublicKeyの取得 authenticatorDataのパラメータとclientDataJSONのハッシュ値を連結 AuthenticatorAssertionResponseからsignatureを取得 signatureを検証

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 92Authenticatorの検索let findAuthr = (credID, authenticators) => {for(let authr of authenticators) {if(authr.credID === credID)return authr}throw new Error(`Unknown authenticator with credID ${credID}!`)}サンプルCredentialIdを元にAuthenticatorを検索する

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 94publicKeyの取得let ASN1toPEM = (pkBuffer) => {. . .// 26byteのメタデータを追加pkBuffer = Buffer.concat([new Buffer.from("3059301306072a8648ce3d020106082a8648ce3d030107034200", "hex"),pkBuffer]);type = 'PUBLIC KEY';. . .// Base64エンコードlet b64cert = pkBuffer.toString('base64');let PEMKey = '';for(let i = 0; i < Math.ceil(b64cert.length / 64); i++) {let start = 64 * i;// 改行コードの追加PEMKey += b64cert.substr(start, 64) + '¥n';}// ヘッダとフッタの追加PEMKey = `-----BEGIN ${type}-----¥n` + PEMKey + `-----END ${type}-----¥n`;return PEMKey}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 95signatureの検証let verifyAuthenticatorAssertionResponse = (webAuthnResponse, authenticators) => {. . .let authenticatorData = base64url.toBuffer(webAuthnResponse.response.authenticatorData);let authrDataStruct = parseGetAssertAuthData(authenticatorData);let clientDataHash = hash(base64url.toBuffer(webAuthnResponse.response.clientDataJSON))// authenticatorDataとclientDataJSONのハッシュ値を連結let signatureBase = Buffer.concat([authrDataStruct.rpIdHash,authrDataStruct.flagsBuf,authrDataStruct.counterBuf,clientDataHash]);// 登録時に保存した公開鍵を取得let publicKey = ASN1toPEM(base64url.toBuffer(authr.publicKey));// navigator.credentials.get()の戻り値のsignatureを取得let signature = base64url.toBuffer(webAuthnResponse.response.signature);// 検証response.verified = crypto.createVerify('SHA256').update(signatureBase).verify(publicKey, signature);. . .}サンプル

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 97counterの検証と更新let verifyAuthenticatorAssertionResponse = (webAuthnResponse, authenticators) =>{. . .if(response.verified) {if(response.counter <= authr.counter)throw new Error('Authr counter did not increase!');authr.counter = authrDataStruct.counter}}. . .} サンプルauthenticatorDataのcounterを検証

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 102RPのサンプル実装様々な言語で実装されている Node.js : https://github.com/fido-alliance/webauthn-demo Python : https://github.com/duo-labs/py_webauthn Ruby : https://github.com/cedarcode/webauthn-ruby Go : https://github.com/duo-labs/webauthn Java : https://github.com/Yubico/java-webauthn-serverこの他にもいっぱい!!https://github.com/apowers313/fido2-server-demo/

Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 103参考• FIDO認証の概要説明https://www.slideshare.net/FIDOAlliance/fido-83445442?ref=https://fidoalliance.org/presentations/• Webauthn-isighttp://slides.com/herrjemand/webauthn-isig• INTRODUCTION TO FIDO ALLIANCEhttps://www.slideshare.net/FIDOAlliance/introduction-to-fido-alliance-66730790• MDN web docs WebAuthentication APIhttps://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API• Welcome to WebAuthn workshophttps://slides.com/fidoalliance/jan-2018-fido-seminar-webauthn-tutorial#/• Verifying WebAuthn/FIDO2 responseshttps://medium.com/@herrjemand/verifying-fido2-responses-4691288c8770• Verifying FIDO-U2F Attestationhttps://medium.com/@herrjemand/verifying-fido-u2f-attestations-in-fido2-f83fab80c355• WebAuthn from the relying-party viewhttps://speakerdeck.com/ynojima/webauthn-from-the-relying-party-view

Movatterモバイル変換

FIDO認証によるパスワードレスログイン実装入門

Recommended

More Related Content

What's hot(20)

Similar to FIDO認証によるパスワードレスログイン実装入門(20)

More from Yahoo!デベロッパーネットワーク(20)

Recently uploaded(8)

FIDO認証によるパスワードレスログイン実装入門