appattest

package
v0.4.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 9, 2025 License: GPL-3.0 Imports: 14 Imported by: 0

Documentation

Index

Constants

View Source
const (
	Format = "apple-appattest"
)

Variables

View Source
var (
	NonceOID   = asn1.ObjectIdentifier{1, 2, 840, 113635, 100, 8, 2}
	AAGUIDProd = Environment("appattest\x00\x00\x00\x00\x00\x00\x00")
	AAGUIDDev  = Environment("appattestdevelop")
)

Functions

func ComputeKeyHash

func ComputeKeyHash(key *ecdsa.PublicKey) [sha256.Size]byte

func ComputeNonce

func ComputeNonce(authData, clientDataHash []byte) (res [sha256.Size]byte, err error)

func VerifyChain

func VerifyChain(chain []*x509.Certificate, roots []*x509.Certificate) error

VerifyChain is a simplified verification routine. Since it might be desireable to verify the validity of an attestation beyond its lifetime, this function returns the timerange in which it was valid. It assumes that the chain will be passed in the order of leaf to root.

func WithAppAttestRoots

func WithAppAttestRoots(certs []*x509.Certificate) option

WithAppAttestRoots lets the user provide its own authoritative certificates

Types

type ASN1AANonceContainer

type ASN1AANonceContainer struct {
	Nonce []byte `asn1:"tag:1,explicit"`
}

type AssertionObject

type AssertionObject struct {
	Signature         []byte `cbor:"signature"`
	AuthenticatorData []byte `cbor:"authenticatorData"`
}

type AttestationObject

type AttestationObject struct {
	Format               string               `cbor:"fmt"`
	AttestationStatement AttestationStatement `cbor:"attStmt"`
	AuthData             []byte               `cbor:"authData"` // https://www.w3.org/TR/webauthn/#sctn-authenticator-data
}

type AttestationStatement

type AttestationStatement struct {
	X509CertChain [][]byte `cbor:"x5c"` // leaf cert is first
	Receipt       []byte   `cbor:"receipt"`
}

type Attestor

type Attestor interface {
	VerifyAttestation(*VerifyAttestationInput) (VerifyAttestationOutput, error)
}

type AttestorImpl

type AttestorImpl struct {
	// contains filtered or unexported fields
}

func New

func New(
	options ...option,
) (*AttestorImpl, error)

func (*AttestorImpl) VerifyAttestation

func (at *AttestorImpl) VerifyAttestation(in *VerifyAttestationInput) (VerifyAttestationOutput, error)

type Environment

type Environment = []byte

type VerifyAssertionInput

type VerifyAssertionInput struct {
	Pubkey           *ecdsa.PublicKey
	Assertion        []byte
	ClientDataSHA256 []byte
}

type VerifyAttestationInput

type VerifyAttestationInput struct {
	ServerChallenge []byte
	AttestationCBOR []byte

	OutAuthenticatorData *authenticatordata.T
}

type VerifyAttestationInputPure

type VerifyAttestationInputPure struct {
	AttestationInput *VerifyAttestationInput
	Time             time.Time
	AARoots          []*x509.Certificate
}

type VerifyAttestationOutput

type VerifyAttestationOutput struct {
	AuthenticatorData *authenticatordata.T
	LeafCert          *x509.Certificate

	EnvironmentGUID Environment
	BundleDigest    []byte
	KeyID           []byte
}

func VerifyAttestationPure

func VerifyAttestationPure(in *VerifyAttestationInputPure) (VerifyAttestationOutput, error)

VerifyAttestationPure performs attestation without the guardrails provided by AppAttestImpl.

func (*VerifyAttestationOutput) AttestedPubkey

func (o *VerifyAttestationOutput) AttestedPubkey() *ecdsa.PublicKey

AttestedPubkey returns the key from the leaf certificate

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL