device/fido/mac/util.mm

// Copyright 2018 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "device/fido/mac/get_assertion_operation.h"

#include <array>
#include <set>
#include <string>

#import <Foundation/Foundation.h>

#include "base/bind.h"
#include "base/mac/foundation_util.h"
#include "base/mac/mac_logging.h"
#include "base/mac/scoped_cftyperef.h"
#include "base/mac/scoped_nsobject.h"
#include "base/strings/string_number_conversions.h"
#include "components/cbor/cbor_writer.h"
#include "device/fido/ec_public_key.h"
#include "device/fido/fido_attestation_statement.h"
#include "device/fido/fido_constants.h"
#include "device/fido/fido_parsing_utils.h"
#include "device/fido/mac/keychain.h"

namespace device {
namespace fido {
namespace mac {

using base::ScopedCFTypeRef;
using base::scoped_nsobject;
using cbor::CBORWriter;
using cbor::CBORValue;

// The authenticator AAGUID value.
constexpr std::array<uint8_t, 16> kAaguid = {0xad, 0xce, 0x00, 0x02, 0x35, 0xbc,
                                             0xc6, 0x0a, 0x64, 0x8b, 0x0b, 0x25,
                                             0xf1, 0xf0, 0x55, 0x03};

std::vector<uint8_t> TouchIdAaguid() {
  return std::vector<uint8_t>(kAaguid.begin(), kAaguid.end());
}

namespace {

// MakeECPublicKey converts a SecKeyRef for a public key into an equivalent
// |ECPublicKey| instance. It returns |nullptr| if the key cannot be converted.
std::unique_ptr<ECPublicKey> MakeECPublicKey(SecKeyRef public_key_ref)
    API_AVAILABLE(macosx(10.12.2)) {
  CHECK(public_key_ref);
  ScopedCFTypeRef<CFErrorRef> err;
  ScopedCFTypeRef<CFDataRef> data_ref(
      SecKeyCopyExternalRepresentation(public_key_ref, err.InitializeInto()));
  if (!data_ref) {
    LOG(ERROR) << "SecCopyExternalRepresentation failed: " << err;
    return nullptr;
  }
  base::span<const uint8_t> key_data =
      base::make_span(CFDataGetBytePtr(data_ref), CFDataGetLength(data_ref));
  auto key =
      ECPublicKey::ParseX962Uncompressed(fido_parsing_utils::kEs256, key_data);
  if (!key) {
    LOG(ERROR) << "Unexpected public key format: "
               << base::HexEncode(key_data.data(), key_data.size());
    return nullptr;
  }
  return key;
}

}  // namespace

// KeychainItemIdentifier returns the unique identifier for a given RP ID
// and user handle. It is stored in the keychain items Application Label and
// used for later lookup.
std::vector<uint8_t> KeychainItemIdentifier(std::string rp_id,
                                            std::vector<uint8_t> user_id) {
  std::vector<CBORValue> array;
  array.emplace_back(CBORValue(rp_id));
  array.emplace_back(CBORValue(user_id));
  auto value = CBORWriter::Write(CBORValue(std::move(array)));
  CHECK(value);
  return *value;
}

base::Optional<AuthenticatorData> MakeAuthenticatorData(
    const std::string& rp_id,
    std::vector<uint8_t> credential_id,
    SecKeyRef public_key) API_AVAILABLE(macosx(10.12.2)) {
  if (credential_id.size() > 255) {
    LOG(ERROR) << "credential id too long: "
               << base::HexEncode(credential_id.data(), credential_id.size());
    return base::nullopt;
  }
  std::array<uint8_t, 2> encoded_credential_id_length = {
      0, static_cast<uint8_t>(credential_id.size())};
  constexpr uint8_t flags =
      static_cast<uint8_t>(AuthenticatorData::Flag::kTestOfUserVerification) |
      static_cast<uint8_t>(AuthenticatorData::Flag::kAttestation);
  std::vector<uint8_t> counter = {0, 0, 0, 0};  // implement
  auto ec_public_key = MakeECPublicKey(public_key);
  if (!ec_public_key) {
    LOG(ERROR) << "MakeECPublicKey failed";
    return base::nullopt;
  }
  return AuthenticatorData(
      fido_parsing_utils::CreateSHA256Hash(rp_id), flags, counter,
      AttestedCredentialData(kAaguid, encoded_credential_id_length,
                             std::move(credential_id),
                             std::move(ec_public_key)));
}

base::Optional<std::vector<uint8_t>> GenerateSignature(
    const AuthenticatorData& authenticator_data,
    const std::vector<uint8_t>& client_data_hash,
    SecKeyRef private_key) API_AVAILABLE(macosx(10.12.2)) {
  const std::vector<uint8_t> serialized_authenticator_data =
      authenticator_data.SerializeToByteArray();
  size_t capacity =
      serialized_authenticator_data.size() + client_data_hash.size();
  ScopedCFTypeRef<CFMutableDataRef> sig_input(
      CFDataCreateMutable(kCFAllocatorDefault, capacity));
  CFDataAppendBytes(sig_input, serialized_authenticator_data.data(),
                    serialized_authenticator_data.size());
  CFDataAppendBytes(sig_input, client_data_hash.data(),
                    client_data_hash.size());
  ScopedCFTypeRef<CFErrorRef> err;
  ScopedCFTypeRef<CFDataRef> sig_data(
      Keychain::GetInstance().KeyCreateSignature(
          private_key, kSecKeyAlgorithmECDSASignatureMessageX962SHA256,
          sig_input, err.InitializeInto()));
  if (!sig_data) {
    LOG(ERROR) << "SecKeyCreateSignature failed: " << err;
    return base::nullopt;
  }
  return std::vector<uint8_t>(
      CFDataGetBytePtr(sig_data),
      CFDataGetBytePtr(sig_data) + CFDataGetLength(sig_data));
}

}  // namespace mac
}  // namespace fido
}  // namespace device