alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Cast alg to a valid COSEAlgorithmIdentifier

Browse source
This commit is contained in:
Herman Slatman 2023-04-04 12:20:31 +02:00
parent e25acff13c
commit 1c38e252a6
No known key found for this signature in database
GPG key ID: F4D8A44EA0A75A4F
2 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
acme/challenge.go
View file

@ -511,6 +511,15 @@ type tpmAttestationData struct {
Fingerprint string Fingerprint string
} }
// coseAlgorithmIdentifier models a COSEAlgorithmIdentifier.
// Also see https://www.w3.org/TR/webauthn-2/#sctn-alg-identifier.
type coseAlgorithmIdentifier int32
const (
coseAlgES256 coseAlgorithmIdentifier = -7
coseAlgRS256 coseAlgorithmIdentifier = -257
)
func doTPMAttestationFormat(ctx context.Context, prov Provisioner, ch *Challenge, jwk *jose.JSONWebKey, att *attestationObject) (*tpmAttestationData, error) { func doTPMAttestationFormat(ctx context.Context, prov Provisioner, ch *Challenge, jwk *jose.JSONWebKey, att *attestationObject) (*tpmAttestationData, error) {
ver, ok := att.AttStatement["ver"].(string) ver, ok := att.AttStatement["ver"].(string)
if !ok { if !ok {
@ -622,7 +631,8 @@ func doTPMAttestationFormat(ctx context.Context, prov Provisioner, ch *Challenge
} }
// only RS256 and ES256 are allowed // only RS256 and ES256 are allowed
if alg != -257 && alg != -1 { coseAlg := coseAlgorithmIdentifier(alg)
if coseAlg != coseAlgRS256 && coseAlg != coseAlgES256 {
return nil, NewError(ErrorBadAttestationStatementType, "invalid alg %d in attestation statement", alg) return nil, NewError(ErrorBadAttestationStatementType, "invalid alg %d in attestation statement", alg)
} }

2
acme/challenge_tpmsimulator_test.go
View file

@ -515,7 +515,7 @@ func Test_doTPMAttestationFormat(t *testing.T) {
AttStatement: map[string]interface{}{ AttStatement: map[string]interface{}{
"ver": "2.0", "ver": "2.0",
"x5c": []interface{}{akCert.Raw, aca.Intermediate.Raw}, "x5c": []interface{}{akCert.Raw, aca.Intermediate.Raw},
"alg": int64(-257), // "alg": int64(-257), // RS256
"sig": params.CreateSignature, "sig": params.CreateSignature,
"certInfo": params.CreateAttestation, "certInfo": params.CreateAttestation,
"pubArea": params.Public, "pubArea": params.Public,