fix(protocol): single signature encoding policy and canonical der (#744)

The signature encoding was carried by the attestation policy while assertions were governed by an experimental process global, so one deviation had two controls with different reach. Where both applied the global won, and a Relying Party which selected DER while the global was set had a BER signature accepted anyway. SignaturePolicy is now a member of webauthn.Config in its own right, threaded through both ceremonies, and the global and its setter are removed. The encoding is one decision which applies wherever a signature is verified.

Verification of an ECDSA signature against a credential public key now requires the DER encoding to be canonical. The decoder discards data trailing the signature and elements trailing the two integers within it rather than reporting either, so a signature carrying an appended integer or arbitrary appended bytes verified against the same message as the signature it was built from. Re-encoding the decoded integers and requiring the result to equal the input rejects both, along with the non-minimal integers which previously depended on the global. A Relying Party which accepts the BER encoding normalizes the signature before it reaches this point, so the relaxation stays in one place rather than being repeated at each verifier.

The helpers no longer wrap the errors they return, which the format handlers already describe in the terms of the attestation they were verifying, so a signature which fails to decode is reported once rather than twice.

BREAKING CHANGE: ConfigProvider requires GetSignaturePolicy. AttestationObject.Verify, AttestationObject.VerifyAttestation, ParsedCredentialAssertionData.Verify, ParsedCredentialCreationData.Verify, Credential.Verify, Credential.VerifyAttestationType and the attestation format validation handler registered by RegisterAttestationFormat take a SignaturePolicy. AttestationPolicy no longer carries a Signature member and webauthncose.SetExperimentalInsecureAllowBERIntegers is removed.

Author: james-d-elliott

protocol/assertion.go

@@ -145,7 +145,7 @@ func (car CredentialAssertionResponse) Parse() (par *ParsedCredentialAssertionDa
 // documentation. It's important to note that the credentialBytes field is the CBOR representation of the credential.
 //
 // Specification: §7.2 Verifying an Authentication Assertion (https://www.w3.org/TR/webauthn/#sctn-verifying-assertion)
-func (p *ParsedCredentialAssertionData) Verify(storedChallenge string, relyingPartyID, appID string, rpOrigins, rpTopOrigins []string, rpTopOriginsVerify TopOriginVerificationMode, allowCrossOrigin, verifyUser, verifyUserPresence bool, credentialBytes []byte) error {
+func (p *ParsedCredentialAssertionData) Verify(storedChallenge string, relyingPartyID, appID string, rpOrigins, rpTopOrigins []string, rpTopOriginsVerify TopOriginVerificationMode, allowCrossOrigin, verifyUser, verifyUserPresence bool, credentialBytes []byte, signature SignaturePolicy) error {
 	// Steps 4 through 6 in verifying the assertion data (https://www.w3.org/TR/webauthn/#verifying-assertion) are
 	// "assertive" steps, i.e. "Let JSONtext be the result of running UTF-8 decode on the value of cData."
 	// We handle these steps in part as we verify but also beforehand
@@ -196,7 +196,7 @@ func (p *ParsedCredentialAssertionData) Verify(storedChallenge string, relyingPa
 		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error parsing the assertion public key: %+v", err)).WithError(err)
 	}
 
-	valid, err := webauthncose.VerifySignature(key, sigData, p.Response.Signature)
+	valid, err := keyVerifySignature(key, sigData, p.Response.Signature, signature)
 	if !valid || err != nil {
 		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error validating the assertion signature: %+v", err)).WithError(err)
 	}

protocol/assertion_test.go

@@ -337,7 +337,7 @@ func TestParsedCredentialAssertionData_Verify(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			err := par.Verify(tc.challenge, tc.relyingPartyID, tc.appID, tc.rpOrigins, nil, TopOriginExplicitVerificationMode, false, false, true, tc.credentialBytes)
+			err := par.Verify(tc.challenge, tc.relyingPartyID, tc.appID, tc.rpOrigins, nil, TopOriginExplicitVerificationMode, false, false, true, tc.credentialBytes, SignaturePolicy{})
 
 			if tc.err == "" {
 				assert.NoError(t, err)

protocol/attestation.go

@@ -99,7 +99,7 @@ type NonCompoundAttestationObject struct {
 	AttStatement map[string]any `json:"attStmt,omitempty"`
 }
 
-type attestationFormatValidationHandler func(att AttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy) (attestationType string, x5cs []any, err error)
+type attestationFormatValidationHandler func(att AttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, signature SignaturePolicy) (attestationType string, x5cs []any, err error)
 
 var attestationRegistry = make(map[AttestationFormat]attestationFormatValidationHandler)
 
@@ -149,7 +149,7 @@ func (ccr *AuthenticatorAttestationResponse) Parse() (p *ParsedAttestationRespon
 //
 // Steps 13 through 15 are verified against the auth data. These steps are identical to 15 through 18 for assertion so we
 // handle them with AuthData.
-func (a *AttestationObject) Verify(relyingPartyID string, clientDataHash []byte, userVerificationRequired bool, userPresenceRequired bool, mds metadata.Provider, credParams []CredentialParameter, policy AttestationPolicy) (err error) {
+func (a *AttestationObject) Verify(relyingPartyID string, clientDataHash []byte, userVerificationRequired bool, userPresenceRequired bool, mds metadata.Provider, credParams []CredentialParameter, policy AttestationPolicy, signature SignaturePolicy) (err error) {
 	rpIDHash := sha256.Sum256([]byte(relyingPartyID))
 
 	// Begin Step 13 through 15. Verify that the rpIdHash in authData is the SHA-256 hash of the RP ID expected by the RP.
@@ -177,15 +177,15 @@ func (a *AttestationObject) Verify(relyingPartyID string, clientDataHash []byte,
 		return ErrAttestationFormat.WithInfo("Credential public key algorithm not supported")
 	}
 
-	return a.VerifyAttestation(clientDataHash, mds, policy)
+	return a.VerifyAttestation(clientDataHash, mds, policy, signature)
 }
 
 // VerifyAttestation only verifies the attestation object excluding the AuthData values. If you wish to also verify the
 // AuthData values you should use [Verify].
 //
 // The policy carries the Relying Party decisions which §8 leaves to the Relying Party. Its zero value selects the
 // most restrictive behavior available. See [AttestationPolicy].
-func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy) (err error) {
+func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, signature SignaturePolicy) (err error) {
 	// Step 18. Determine the attestation statement format by performing a
 	// USASCII case-sensitive match on fmt against the set of supported
 	// WebAuthn Attestation Statement Format Identifier values. The up-to-date
@@ -226,7 +226,7 @@ func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadat
 	// Step 19. Verify that attStmt is a correct attestation statement, conveying a valid attestation signature, by using
 	// the attestation statement format fmt’s verification procedure given attStmt, authData and the hash of the serialized
 	// client data computed in step 7.
-	if attestationType, x5cs, err = handler(*a, clientDataHash, mds, policy); err != nil {
+	if attestationType, x5cs, err = handler(*a, clientDataHash, mds, policy, signature); err != nil {
 		var e *Error
 
 		if errors.As(err, &e) {

protocol/attestation_androidkey.go

@@ -37,7 +37,7 @@ import (
 // See: https://www.w3.org/TR/webauthn/#sctn-android-key-attestation
 //
 //nolint:gocyclo
-func attestationFormatValidationHandlerAndroidKey(att AttestationObject, clientDataHash []byte, _ metadata.Provider, policy AttestationPolicy) (attestationType string, x5cs []any, err error) {
+func attestationFormatValidationHandlerAndroidKey(att AttestationObject, clientDataHash []byte, _ metadata.Provider, policy AttestationPolicy, signature SignaturePolicy) (attestationType string, x5cs []any, err error) {
 	var (
 		alg int64
 		sig []byte
@@ -83,7 +83,7 @@ func attestationFormatValidationHandlerAndroidKey(att AttestationObject, clientD
 
 	if sigAlg := webauthncose.SigAlgFromCOSEAlg(webauthncose.COSEAlgorithmIdentifier(alg)); sigAlg == x509.UnknownSignatureAlgorithm {
 		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Unsupported COSE alg: %d", alg))
-	} else if err = attestationCertCheckSignature(credCert, sigAlg, signatureData, sig, policy.Signature); err != nil {
+	} else if err = certCheckSignature(credCert, sigAlg, signatureData, sig, signature); err != nil {
 		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v", err)).WithError(err)
 	}
 
@@ -99,7 +99,7 @@ func attestationFormatValidationHandlerAndroidKey(att AttestationObject, clientD
 	// as each selects the digest from the algorithm it carries.
 	var valid bool
 
-	if valid, err = attestationKeyVerifySignature(credentialPublicKey, signatureData, sig, policy.Signature); err != nil {
+	if valid, err = keyVerifySignature(credentialPublicKey, signatureData, sig, signature); err != nil {
 		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error verifying the signature with the credential public key: %+v", err)).WithError(err)
 	} else if !valid {
 		return "", nil, ErrInvalidAttestation.WithDetails("Signature is not valid for the credential public key")

protocol/attestation_androidkey_test.go

@@ -100,13 +100,13 @@ func TestVerifyAndroidKeyFormat(t *testing.T) {
 					tc.setup(t, mds)
 				}
 
-				attestationType, x5cs, err = attestationFormatValidationHandlerAndroidKey(tc.args.att, tc.args.clientDataHash, mds, AttestationPolicy{})
+				attestationType, x5cs, err = attestationFormatValidationHandlerAndroidKey(tc.args.att, tc.args.clientDataHash, mds, AttestationPolicy{}, SignaturePolicy{})
 			} else {
 				if tc.setup != nil {
 					tc.setup(t, nil)
 				}
 
-				attestationType, x5cs, err = attestationFormatValidationHandlerAndroidKey(tc.args.att, tc.args.clientDataHash, nil, AttestationPolicy{})
+				attestationType, x5cs, err = attestationFormatValidationHandlerAndroidKey(tc.args.att, tc.args.clientDataHash, nil, AttestationPolicy{}, SignaturePolicy{})
 			}
 
 			if tc.err != "" {
@@ -283,7 +283,7 @@ func TestAndroidKeyFormat_HandlerErrors(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			_, _, err := attestationFormatValidationHandlerAndroidKey(tc.att, tc.clientDataHash, nil, AttestationPolicy{})
+			_, _, err := attestationFormatValidationHandlerAndroidKey(tc.att, tc.clientDataHash, nil, AttestationPolicy{}, SignaturePolicy{})
 
 			assert.EqualError(t, err, tc.err)
 		})

protocol/attestation_apple.go

@@ -27,7 +27,7 @@ import (
 // Specification: §8.8. Apple Anonymous Attestation Statement Format
 //
 // See : https://www.w3.org/TR/webauthn/#sctn-apple-anonymous-attestation
-func attestationFormatValidationHandlerAppleAnonymous(att AttestationObject, clientDataHash []byte, _ metadata.Provider, _ AttestationPolicy) (attestationType string, x5cs []any, err error) {
+func attestationFormatValidationHandlerAppleAnonymous(att AttestationObject, clientDataHash []byte, _ metadata.Provider, _ AttestationPolicy, _ SignaturePolicy) (attestationType string, x5cs []any, err error) {
 	// Step 1. Verify that attStmt is valid CBOR conforming to the syntax defined above and perform CBOR decoding on it
 	// to extract the contained fields.
 	var (

protocol/attestation_apple_test.go

@@ -41,7 +41,7 @@ func Test_VerifyAppleFormat(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			attestationType, x5cs, err := attestationFormatValidationHandlerAppleAnonymous(tc.args.att, tc.args.clientDataHash, nil, AttestationPolicy{})
+			attestationType, x5cs, err := attestationFormatValidationHandlerAppleAnonymous(tc.args.att, tc.args.clientDataHash, nil, AttestationPolicy{}, SignaturePolicy{})
 
 			assert.Equal(t, tc.attestationType, attestationType)
 			assert.Equal(t, tc.x5cs, x5cs)

protocol/attestation_compound.go

@@ -34,7 +34,7 @@ func init() {
 // Specification: §8.9. Compound Attestation Statement Forma
 //
 // See: https://www.w3.org/TR/webauthn-3/#sctn-compound-attestation
-func attestationFormatValidationHandlerCompound(att AttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy) (attestationType string, x5cs []any, err error) {
+func attestationFormatValidationHandlerCompound(att AttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, signature SignaturePolicy) (attestationType string, x5cs []any, err error) {
 	var (
 		aaguid   uuid.UUID
 		raw      any
@@ -96,20 +96,20 @@ func attestationFormatValidationHandlerCompound(att AttestationObject, clientDat
 	// for more than one sub-statement, and the paths of independent sub-statements joined together describe no real
 	// chain.
 	if policy.Compound.SubStatementScope.any() {
-		return compoundVerifySubStatementsAny(att, attStmts, clientDataHash, mds, policy, aaguid)
+		return compoundVerifySubStatementsAny(att, attStmts, clientDataHash, mds, policy, signature, aaguid)
 	}
 
-	return compoundVerifySubStatementsAll(att, attStmts, clientDataHash, mds, policy, aaguid)
+	return compoundVerifySubStatementsAll(att, attStmts, clientDataHash, mds, policy, signature, aaguid)
 }
 
 // compoundVerifySubStatementsAll verifies every sub-statement, rejecting the attestation on the first which fails.
 //
 // This is the behavior of [CompoundSubStatementScopeAll].
-func compoundVerifySubStatementsAll(att AttestationObject, attStmts []NonCompoundAttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, aaguid uuid.UUID) (attestationType string, x5cs []any, err error) {
+func compoundVerifySubStatementsAll(att AttestationObject, attStmts []NonCompoundAttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, signature SignaturePolicy, aaguid uuid.UUID) (attestationType string, x5cs []any, err error) {
 	for i, attStmt := range attStmts {
 		var subAttType string
 
-		if subAttType, err = compoundVerifySubStatement(att, attStmt, clientDataHash, mds, policy, aaguid); err != nil {
+		if subAttType, err = compoundVerifySubStatement(att, attStmt, clientDataHash, mds, policy, signature, aaguid); err != nil {
 			return "", nil, err
 		}
 
@@ -129,7 +129,7 @@ func compoundVerifySubStatementsAll(att AttestationObject, attStmts []NonCompoun
 // reached is not lost.
 //
 // This is the behavior of [CompoundSubStatementScopeAny].
-func compoundVerifySubStatementsAny(att AttestationObject, attStmts []NonCompoundAttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, aaguid uuid.UUID) (attestationType string, x5cs []any, err error) {
+func compoundVerifySubStatementsAny(att AttestationObject, attStmts []NonCompoundAttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, signature SignaturePolicy, aaguid uuid.UUID) (attestationType string, x5cs []any, err error) {
 	var (
 		errs    = make([]error, 0, len(attStmts))
 		reasons = make([]string, 0, len(attStmts))
@@ -138,7 +138,7 @@ func compoundVerifySubStatementsAny(att AttestationObject, attStmts []NonCompoun
 	for _, attStmt := range attStmts {
 		var subAttType string
 
-		if subAttType, err = compoundVerifySubStatement(att, attStmt, clientDataHash, mds, policy, aaguid); err != nil {
+		if subAttType, err = compoundVerifySubStatement(att, attStmt, clientDataHash, mds, policy, signature, aaguid); err != nil {
 			errs = append(errs, err)
 			reasons = append(reasons, fmt.Sprintf("%s: %s", attStmt.Format, compoundSubStatementFailureReason(err)))
 
@@ -179,7 +179,7 @@ func compoundSubStatementFailureReason(err error) string {
 // path it produces against the Metadata Service. A sub-statement is verified in full or not at all, so a scope which
 // tolerates a failure treats a sub-statement whose trust path the Metadata Service rejects the same as one whose
 // verification procedure fails.
-func compoundVerifySubStatement(att AttestationObject, attStmt NonCompoundAttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, aaguid uuid.UUID) (attestationType string, err error) {
+func compoundVerifySubStatement(att AttestationObject, attStmt NonCompoundAttestationObject, clientDataHash []byte, mds metadata.Provider, policy AttestationPolicy, signature SignaturePolicy, aaguid uuid.UUID) (attestationType string, err error) {
 	object := AttestationObject{
 		Format:       attStmt.Format,
 		AttStatement: attStmt.AttStatement,
@@ -189,7 +189,7 @@ func compoundVerifySubStatement(att AttestationObject, attStmt NonCompoundAttest
 
 	var cx5cs []any
 
-	if attestationType, cx5cs, err = attestationRegistry[AttestationFormat(object.Format)](object, clientDataHash, mds, policy); err != nil {
+	if attestationType, cx5cs, err = attestationRegistry[AttestationFormat(object.Format)](object, clientDataHash, mds, policy, signature); err != nil {
 		return "", err
 	}