490 lines
13 KiB
PHP
490 lines
13 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/*
|
|
* The MIT License (MIT)
|
|
*
|
|
* Copyright (c) 2014-2019 Spomky-Labs
|
|
*
|
|
* This software may be modified and distributed under the terms
|
|
* of the MIT license. See the LICENSE file for details.
|
|
*/
|
|
|
|
namespace Webauthn\MetadataService;
|
|
|
|
use Assert\Assertion;
|
|
use InvalidArgumentException;
|
|
|
|
class MetadataStatement
|
|
{
|
|
public const KEY_PROTECTION_SOFTWARE = 0x0001;
|
|
public const KEY_PROTECTION_HARDWARE = 0x0002;
|
|
public const KEY_PROTECTION_TEE = 0x0004;
|
|
public const KEY_PROTECTION_SECURE_ELEMENT = 0x0008;
|
|
public const KEY_PROTECTION_REMOTE_HANDLE = 0x0010;
|
|
|
|
public const MATCHER_PROTECTION_SOFTWARE = 0x0001;
|
|
public const MATCHER_PROTECTION_TEE = 0x0002;
|
|
public const MATCHER_PROTECTION_ON_CHIP = 0x0004;
|
|
|
|
public const ATTACHMENT_HINT_INTERNAL = 0x0001;
|
|
public const ATTACHMENT_HINT_EXTERNAL = 0x0002;
|
|
public const ATTACHMENT_HINT_WIRED = 0x0004;
|
|
public const ATTACHMENT_HINT_WIRELESS = 0x0008;
|
|
public const ATTACHMENT_HINT_NFC = 0x0010;
|
|
public const ATTACHMENT_HINT_BLUETOOTH = 0x0020;
|
|
public const ATTACHMENT_HINT_NETWORK = 0x0040;
|
|
public const ATTACHMENT_HINT_READY = 0x0080;
|
|
public const ATTACHMENT_HINT_WIFI_DIRECT = 0x0100;
|
|
|
|
public const TRANSACTION_CONFIRMATION_DISPLAY_ANY = 0x0001;
|
|
public const TRANSACTION_CONFIRMATION_DISPLAY_PRIVILEGED_SOFTWARE = 0x0002;
|
|
public const TRANSACTION_CONFIRMATION_DISPLAY_TEE = 0x0004;
|
|
public const TRANSACTION_CONFIRMATION_DISPLAY_HARDWARE = 0x0008;
|
|
public const TRANSACTION_CONFIRMATION_DISPLAY_REMOTE = 0x0010;
|
|
|
|
public const ALG_SIGN_SECP256R1_ECDSA_SHA256_RAW = 0x0001;
|
|
public const ALG_SIGN_SECP256R1_ECDSA_SHA256_DER = 0x0002;
|
|
public const ALG_SIGN_RSASSA_PSS_SHA256_RAW = 0x0003;
|
|
public const ALG_SIGN_RSASSA_PSS_SHA256_DER = 0x0004;
|
|
public const ALG_SIGN_SECP256K1_ECDSA_SHA256_RAW = 0x0005;
|
|
public const ALG_SIGN_SECP256K1_ECDSA_SHA256_DER = 0x0006;
|
|
public const ALG_SIGN_SM2_SM3_RAW = 0x0007;
|
|
public const ALG_SIGN_RSA_EMSA_PKCS1_SHA256_RAW = 0x0008;
|
|
public const ALG_SIGN_RSA_EMSA_PKCS1_SHA256_DER = 0x0009;
|
|
public const ALG_SIGN_RSASSA_PSS_SHA384_RAW = 0x000A;
|
|
public const ALG_SIGN_RSASSA_PSS_SHA512_RAW = 0x000B;
|
|
public const ALG_SIGN_RSASSA_PKCSV15_SHA256_RAW = 0x000C;
|
|
public const ALG_SIGN_RSASSA_PKCSV15_SHA384_RAW = 0x000D;
|
|
public const ALG_SIGN_RSASSA_PKCSV15_SHA512_RAW = 0x000E;
|
|
public const ALG_SIGN_RSASSA_PKCSV15_SHA1_RAW = 0x000F;
|
|
public const ALG_SIGN_SECP384R1_ECDSA_SHA384_RAW = 0x0010;
|
|
public const ALG_SIGN_SECP521R1_ECDSA_SHA512_RAW = 0x0011;
|
|
public const ALG_SIGN_ED25519_EDDSA_SHA256_RAW = 0x0012;
|
|
|
|
public const ALG_KEY_ECC_X962_RAW = 0x0100;
|
|
public const ALG_KEY_ECC_X962_DER = 0x0101;
|
|
public const ALG_KEY_RSA_2048_RAW = 0x0102;
|
|
public const ALG_KEY_RSA_2048_DER = 0x0103;
|
|
public const ALG_KEY_COSE = 0x0104;
|
|
|
|
public const ATTESTATION_BASIC_FULL = 0x3E07;
|
|
public const ATTESTATION_BASIC_SURROGATE = 0x3E08;
|
|
public const ATTESTATION_ECDAA = 0x3E09;
|
|
public const ATTESTATION_ATTCA = 0x3E0A;
|
|
|
|
/**
|
|
* @var string|null
|
|
*/
|
|
private $legalHeader;
|
|
|
|
/**
|
|
* @var string|null
|
|
*/
|
|
private $aaid;
|
|
|
|
/**
|
|
* @var string|null
|
|
*/
|
|
private $aaguid;
|
|
/**
|
|
* @var string[]
|
|
*/
|
|
private $attestationCertificateKeyIdentifiers = [];
|
|
|
|
/**
|
|
* @var string
|
|
*/
|
|
private $description;
|
|
|
|
/**
|
|
* @var string[]
|
|
*/
|
|
private $alternativeDescriptions = [];
|
|
|
|
/**
|
|
* @var int
|
|
*/
|
|
private $authenticatorVersion;
|
|
|
|
/**
|
|
* @var string
|
|
*/
|
|
private $protocolFamily;
|
|
|
|
/**
|
|
* @var Version[]
|
|
*/
|
|
private $upv = [];
|
|
|
|
/**
|
|
* @var string|null
|
|
*/
|
|
private $assertionScheme;
|
|
|
|
/**
|
|
* @var int|null
|
|
*/
|
|
private $authenticationAlgorithm;
|
|
|
|
/**
|
|
* @var int[]
|
|
*/
|
|
private $authenticationAlgorithms = [];
|
|
|
|
/**
|
|
* @var int|null
|
|
*/
|
|
private $publicKeyAlgAndEncoding;
|
|
|
|
/**
|
|
* @var int[]
|
|
*/
|
|
private $publicKeyAlgAndEncodings = [];
|
|
|
|
/**
|
|
* @var int[]
|
|
*/
|
|
private $attestationTypes = [];
|
|
|
|
/**
|
|
* @var VerificationMethodANDCombinations[]
|
|
*/
|
|
private $userVerificationDetails = [];
|
|
|
|
/**
|
|
* @var int
|
|
*/
|
|
private $keyProtection;
|
|
|
|
/**
|
|
* @var bool|null
|
|
*/
|
|
private $isKeyRestricted;
|
|
|
|
/**
|
|
* @var bool|null
|
|
*/
|
|
private $isFreshUserVerificationRequired;
|
|
|
|
/**
|
|
* @var int
|
|
*/
|
|
private $matcherProtection;
|
|
|
|
/**
|
|
* @var int|null
|
|
*/
|
|
private $cryptoStrength;
|
|
|
|
/**
|
|
* @var string|null
|
|
*/
|
|
private $operatingEnv;
|
|
|
|
/**
|
|
* @var int
|
|
*/
|
|
private $attachmentHint = 0;
|
|
|
|
/**
|
|
* @var bool|null
|
|
*/
|
|
private $isSecondFactorOnly;
|
|
|
|
/**
|
|
* @var int
|
|
*/
|
|
private $tcDisplay;
|
|
|
|
/**
|
|
* @var string|null
|
|
*/
|
|
private $tcDisplayContentType;
|
|
|
|
/**
|
|
* @var DisplayPNGCharacteristicsDescriptor[]
|
|
*/
|
|
private $tcDisplayPNGCharacteristics = [];
|
|
|
|
/**
|
|
* @var string[]
|
|
*/
|
|
private $attestationRootCertificates = [];
|
|
|
|
/**
|
|
* @var EcdaaTrustAnchor[]
|
|
*/
|
|
private $ecdaaTrustAnchors = [];
|
|
|
|
/**
|
|
* @var string|null
|
|
*/
|
|
private $icon;
|
|
|
|
/**
|
|
* @var ExtensionDescriptor[]
|
|
*/
|
|
private $supportedExtensions = [];
|
|
|
|
public function getLegalHeader(): ?string
|
|
{
|
|
return $this->legalHeader;
|
|
}
|
|
|
|
public function getAaid(): ?string
|
|
{
|
|
return $this->aaid;
|
|
}
|
|
|
|
public function getAaguid(): ?string
|
|
{
|
|
return $this->aaguid;
|
|
}
|
|
|
|
/**
|
|
* @return string[]
|
|
*/
|
|
public function getAttestationCertificateKeyIdentifiers(): array
|
|
{
|
|
return $this->attestationCertificateKeyIdentifiers;
|
|
}
|
|
|
|
public function getDescription(): string
|
|
{
|
|
return $this->description;
|
|
}
|
|
|
|
/**
|
|
* @return string[]
|
|
*/
|
|
public function getAlternativeDescriptions(): array
|
|
{
|
|
return $this->alternativeDescriptions;
|
|
}
|
|
|
|
public function getAuthenticatorVersion(): int
|
|
{
|
|
return $this->authenticatorVersion;
|
|
}
|
|
|
|
public function getProtocolFamily(): string
|
|
{
|
|
return $this->protocolFamily;
|
|
}
|
|
|
|
/**
|
|
* @return Version[]
|
|
*/
|
|
public function getUpv(): array
|
|
{
|
|
return $this->upv;
|
|
}
|
|
|
|
public function getAssertionScheme(): ?string
|
|
{
|
|
return $this->assertionScheme;
|
|
}
|
|
|
|
public function getAuthenticationAlgorithm(): ?int
|
|
{
|
|
return $this->authenticationAlgorithm;
|
|
}
|
|
|
|
/**
|
|
* @return int[]
|
|
*/
|
|
public function getAuthenticationAlgorithms(): array
|
|
{
|
|
return $this->authenticationAlgorithms;
|
|
}
|
|
|
|
public function getPublicKeyAlgAndEncoding(): ?int
|
|
{
|
|
return $this->publicKeyAlgAndEncoding;
|
|
}
|
|
|
|
/**
|
|
* @return int[]
|
|
*/
|
|
public function getPublicKeyAlgAndEncodings(): array
|
|
{
|
|
return $this->publicKeyAlgAndEncodings;
|
|
}
|
|
|
|
/**
|
|
* @return int[]
|
|
*/
|
|
public function getAttestationTypes(): array
|
|
{
|
|
return $this->attestationTypes;
|
|
}
|
|
|
|
/**
|
|
* @return VerificationMethodANDCombinations[]
|
|
*/
|
|
public function getUserVerificationDetails(): array
|
|
{
|
|
return $this->userVerificationDetails;
|
|
}
|
|
|
|
public function getKeyProtection(): int
|
|
{
|
|
return $this->keyProtection;
|
|
}
|
|
|
|
public function isKeyRestricted(): ?bool
|
|
{
|
|
return (bool) $this->isKeyRestricted;
|
|
}
|
|
|
|
public function isFreshUserVerificationRequired(): ?bool
|
|
{
|
|
return (bool) $this->isFreshUserVerificationRequired;
|
|
}
|
|
|
|
public function getMatcherProtection(): int
|
|
{
|
|
return $this->matcherProtection;
|
|
}
|
|
|
|
public function getCryptoStrength(): ?int
|
|
{
|
|
return $this->cryptoStrength;
|
|
}
|
|
|
|
public function getOperatingEnv(): ?string
|
|
{
|
|
return $this->operatingEnv;
|
|
}
|
|
|
|
public function getAttachmentHint(): int
|
|
{
|
|
return $this->attachmentHint;
|
|
}
|
|
|
|
public function isSecondFactorOnly(): ?bool
|
|
{
|
|
return (bool) $this->isSecondFactorOnly;
|
|
}
|
|
|
|
public function getTcDisplay(): int
|
|
{
|
|
return $this->tcDisplay;
|
|
}
|
|
|
|
public function getTcDisplayContentType(): ?string
|
|
{
|
|
return $this->tcDisplayContentType;
|
|
}
|
|
|
|
/**
|
|
* @return DisplayPNGCharacteristicsDescriptor[]
|
|
*/
|
|
public function getTcDisplayPNGCharacteristics(): array
|
|
{
|
|
return $this->tcDisplayPNGCharacteristics;
|
|
}
|
|
|
|
/**
|
|
* @return string[]
|
|
*/
|
|
public function getAttestationRootCertificates(): array
|
|
{
|
|
return $this->attestationRootCertificates;
|
|
}
|
|
|
|
/**
|
|
* @return EcdaaTrustAnchor[]
|
|
*/
|
|
public function getEcdaaTrustAnchors(): array
|
|
{
|
|
return $this->ecdaaTrustAnchors;
|
|
}
|
|
|
|
public function getIcon(): ?string
|
|
{
|
|
return $this->icon;
|
|
}
|
|
|
|
/**
|
|
* @return ExtensionDescriptor[]
|
|
*/
|
|
public function getSupportedExtensions(): array
|
|
{
|
|
return $this->supportedExtensions;
|
|
}
|
|
|
|
public static function createFromArray(array $data): self
|
|
{
|
|
$object = new self();
|
|
foreach (['description', 'protocolFamily'] as $key) {
|
|
if (!isset($data[$key])) {
|
|
throw new InvalidArgumentException(sprintf('The parameter "%s" is missing', $key));
|
|
}
|
|
}
|
|
$object->legalHeader = $data['legalHeader'] ?? null;
|
|
$object->aaid = $data['aaid'] ?? null;
|
|
$object->aaguid = $data['aaguid'] ?? null;
|
|
$object->attestationCertificateKeyIdentifiers = $data['attestationCertificateKeyIdentifiers'] ?? [];
|
|
$object->description = $data['description'];
|
|
$object->alternativeDescriptions = $data['alternativeDescriptions'] ?? [];
|
|
$object->authenticatorVersion = $data['authenticatorVersion'] ?? 0;
|
|
$object->protocolFamily = $data['protocolFamily'];
|
|
if (isset($data['upv'])) {
|
|
$upv = $data['upv'];
|
|
Assertion::isArray($upv, 'Invalid Metadata Statement');
|
|
foreach ($upv as $value) {
|
|
Assertion::isArray($value, 'Invalid Metadata Statement');
|
|
$object->upv[] = Version::createFromArray($value);
|
|
}
|
|
}
|
|
$object->assertionScheme = $data['assertionScheme'] ?? null;
|
|
$object->authenticationAlgorithm = $data['authenticationAlgorithm'] ?? null;
|
|
$object->authenticationAlgorithms = $data['authenticationAlgorithms'] ?? [];
|
|
$object->publicKeyAlgAndEncoding = $data['publicKeyAlgAndEncoding'] ?? null;
|
|
$object->publicKeyAlgAndEncodings = $data['publicKeyAlgAndEncodings'] ?? [];
|
|
$object->attestationTypes = $data['attestationTypes'] ?? [];
|
|
if (isset($data['userVerificationDetails'])) {
|
|
$userVerificationDetails = $data['userVerificationDetails'];
|
|
Assertion::isArray($userVerificationDetails, 'Invalid Metadata Statement');
|
|
foreach ($userVerificationDetails as $value) {
|
|
Assertion::isArray($value, 'Invalid Metadata Statement');
|
|
$object->userVerificationDetails[] = VerificationMethodANDCombinations::createFromArray($value);
|
|
}
|
|
}
|
|
$object->keyProtection = $data['keyProtection'] ?? 0;
|
|
$object->isKeyRestricted = $data['isKeyRestricted'] ?? null;
|
|
$object->isFreshUserVerificationRequired = $data['isFreshUserVerificationRequired'] ?? null;
|
|
$object->matcherProtection = $data['matcherProtection'] ?? 0;
|
|
$object->cryptoStrength = $data['cryptoStrength'] ?? null;
|
|
$object->operatingEnv = $data['operatingEnv'] ?? null;
|
|
$object->attachmentHint = $data['attachmentHint'] ?? 0;
|
|
$object->isSecondFactorOnly = $data['isSecondFactorOnly'] ?? null;
|
|
$object->tcDisplay = $data['tcDisplay'] ?? 0;
|
|
$object->tcDisplayContentType = $data['tcDisplayContentType'] ?? null;
|
|
if (isset($data['tcDisplayPNGCharacteristics'])) {
|
|
$tcDisplayPNGCharacteristics = $data['tcDisplayPNGCharacteristics'];
|
|
Assertion::isArray($tcDisplayPNGCharacteristics, 'Invalid Metadata Statement');
|
|
foreach ($tcDisplayPNGCharacteristics as $tcDisplayPNGCharacteristic) {
|
|
Assertion::isArray($tcDisplayPNGCharacteristic, 'Invalid Metadata Statement');
|
|
$object->tcDisplayPNGCharacteristics[] = DisplayPNGCharacteristicsDescriptor::createFromArray($tcDisplayPNGCharacteristic);
|
|
}
|
|
}
|
|
$object->attestationRootCertificates = $data['attestationRootCertificates'] ?? [];
|
|
$object->ecdaaTrustAnchors = $data['ecdaaTrustAnchors'] ?? [];
|
|
$object->icon = $data['icon'] ?? null;
|
|
if (isset($data['supportedExtensions'])) {
|
|
$supportedExtensions = $data['supportedExtensions'];
|
|
Assertion::isArray($supportedExtensions, 'Invalid Metadata Statement');
|
|
foreach ($supportedExtensions as $supportedExtension) {
|
|
Assertion::isArray($supportedExtension, 'Invalid Metadata Statement');
|
|
$object->supportedExtensions[] = ExtensionDescriptor::createFromArray($supportedExtension);
|
|
}
|
|
}
|
|
|
|
return $object;
|
|
}
|
|
}
|