[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  declare(strict_types=1);
   4  
   5  /*
   6   * The MIT License (MIT)
   7   *
   8   * Copyright (c) 2014-2019 Spomky-Labs
   9   *
  10   * This software may be modified and distributed under the terms
  11   * of the MIT license.  See the LICENSE file for details.
  12   */
  13  
  14  namespace Webauthn\MetadataService;
  15  
  16  use Assert\Assertion;
  17  use InvalidArgumentException;
  18  
  19  class MetadataStatement
  20  {
  21      public const KEY_PROTECTION_SOFTWARE = 0x0001;
  22      public const KEY_PROTECTION_HARDWARE = 0x0002;
  23      public const KEY_PROTECTION_TEE = 0x0004;
  24      public const KEY_PROTECTION_SECURE_ELEMENT = 0x0008;
  25      public const KEY_PROTECTION_REMOTE_HANDLE = 0x0010;
  26  
  27      public const MATCHER_PROTECTION_SOFTWARE = 0x0001;
  28      public const MATCHER_PROTECTION_TEE = 0x0002;
  29      public const MATCHER_PROTECTION_ON_CHIP = 0x0004;
  30  
  31      public const ATTACHMENT_HINT_INTERNAL = 0x0001;
  32      public const ATTACHMENT_HINT_EXTERNAL = 0x0002;
  33      public const ATTACHMENT_HINT_WIRED = 0x0004;
  34      public const ATTACHMENT_HINT_WIRELESS = 0x0008;
  35      public const ATTACHMENT_HINT_NFC = 0x0010;
  36      public const ATTACHMENT_HINT_BLUETOOTH = 0x0020;
  37      public const ATTACHMENT_HINT_NETWORK = 0x0040;
  38      public const ATTACHMENT_HINT_READY = 0x0080;
  39      public const ATTACHMENT_HINT_WIFI_DIRECT = 0x0100;
  40  
  41      public const TRANSACTION_CONFIRMATION_DISPLAY_ANY = 0x0001;
  42      public const TRANSACTION_CONFIRMATION_DISPLAY_PRIVILEGED_SOFTWARE = 0x0002;
  43      public const TRANSACTION_CONFIRMATION_DISPLAY_TEE = 0x0004;
  44      public const TRANSACTION_CONFIRMATION_DISPLAY_HARDWARE = 0x0008;
  45      public const TRANSACTION_CONFIRMATION_DISPLAY_REMOTE = 0x0010;
  46  
  47      public const ALG_SIGN_SECP256R1_ECDSA_SHA256_RAW = 0x0001;
  48      public const ALG_SIGN_SECP256R1_ECDSA_SHA256_DER = 0x0002;
  49      public const ALG_SIGN_RSASSA_PSS_SHA256_RAW = 0x0003;
  50      public const ALG_SIGN_RSASSA_PSS_SHA256_DER = 0x0004;
  51      public const ALG_SIGN_SECP256K1_ECDSA_SHA256_RAW = 0x0005;
  52      public const ALG_SIGN_SECP256K1_ECDSA_SHA256_DER = 0x0006;
  53      public const ALG_SIGN_SM2_SM3_RAW = 0x0007;
  54      public const ALG_SIGN_RSA_EMSA_PKCS1_SHA256_RAW = 0x0008;
  55      public const ALG_SIGN_RSA_EMSA_PKCS1_SHA256_DER = 0x0009;
  56      public const ALG_SIGN_RSASSA_PSS_SHA384_RAW = 0x000A;
  57      public const ALG_SIGN_RSASSA_PSS_SHA512_RAW = 0x000B;
  58      public const ALG_SIGN_RSASSA_PKCSV15_SHA256_RAW = 0x000C;
  59      public const ALG_SIGN_RSASSA_PKCSV15_SHA384_RAW = 0x000D;
  60      public const ALG_SIGN_RSASSA_PKCSV15_SHA512_RAW = 0x000E;
  61      public const ALG_SIGN_RSASSA_PKCSV15_SHA1_RAW = 0x000F;
  62      public const ALG_SIGN_SECP384R1_ECDSA_SHA384_RAW = 0x0010;
  63      public const ALG_SIGN_SECP521R1_ECDSA_SHA512_RAW = 0x0011;
  64      public const ALG_SIGN_ED25519_EDDSA_SHA256_RAW = 0x0012;
  65  
  66      public const ALG_KEY_ECC_X962_RAW = 0x0100;
  67      public const ALG_KEY_ECC_X962_DER = 0x0101;
  68      public const ALG_KEY_RSA_2048_RAW = 0x0102;
  69      public const ALG_KEY_RSA_2048_DER = 0x0103;
  70      public const ALG_KEY_COSE = 0x0104;
  71  
  72      public const ATTESTATION_BASIC_FULL = 0x3E07;
  73      public const ATTESTATION_BASIC_SURROGATE = 0x3E08;
  74      public const ATTESTATION_ECDAA = 0x3E09;
  75      public const ATTESTATION_ATTCA = 0x3E0A;
  76  
  77      /**
  78       * @var string|null
  79       */
  80      private $legalHeader;
  81  
  82      /**
  83       * @var string|null
  84       */
  85      private $aaid;
  86  
  87      /**
  88       * @var string|null
  89       */
  90      private $aaguid;
  91      /**
  92       * @var string[]
  93       */
  94      private $attestationCertificateKeyIdentifiers = [];
  95  
  96      /**
  97       * @var string
  98       */
  99      private $description;
 100  
 101      /**
 102       * @var string[]
 103       */
 104      private $alternativeDescriptions = [];
 105  
 106      /**
 107       * @var int
 108       */
 109      private $authenticatorVersion;
 110  
 111      /**
 112       * @var string
 113       */
 114      private $protocolFamily;
 115  
 116      /**
 117       * @var Version[]
 118       */
 119      private $upv = [];
 120  
 121      /**
 122       * @var string|null
 123       */
 124      private $assertionScheme;
 125  
 126      /**
 127       * @var int|null
 128       */
 129      private $authenticationAlgorithm;
 130  
 131      /**
 132       * @var int[]
 133       */
 134      private $authenticationAlgorithms = [];
 135  
 136      /**
 137       * @var int|null
 138       */
 139      private $publicKeyAlgAndEncoding;
 140  
 141      /**
 142       * @var int[]
 143       */
 144      private $publicKeyAlgAndEncodings = [];
 145  
 146      /**
 147       * @var int[]
 148       */
 149      private $attestationTypes = [];
 150  
 151      /**
 152       * @var VerificationMethodANDCombinations[]
 153       */
 154      private $userVerificationDetails = [];
 155  
 156      /**
 157       * @var int
 158       */
 159      private $keyProtection;
 160  
 161      /**
 162       * @var bool|null
 163       */
 164      private $isKeyRestricted;
 165  
 166      /**
 167       * @var bool|null
 168       */
 169      private $isFreshUserVerificationRequired;
 170  
 171      /**
 172       * @var int
 173       */
 174      private $matcherProtection;
 175  
 176      /**
 177       * @var int|null
 178       */
 179      private $cryptoStrength;
 180  
 181      /**
 182       * @var string|null
 183       */
 184      private $operatingEnv;
 185  
 186      /**
 187       * @var int
 188       */
 189      private $attachmentHint = 0;
 190  
 191      /**
 192       * @var bool|null
 193       */
 194      private $isSecondFactorOnly;
 195  
 196      /**
 197       * @var int
 198       */
 199      private $tcDisplay;
 200  
 201      /**
 202       * @var string|null
 203       */
 204      private $tcDisplayContentType;
 205  
 206      /**
 207       * @var DisplayPNGCharacteristicsDescriptor[]
 208       */
 209      private $tcDisplayPNGCharacteristics = [];
 210  
 211      /**
 212       * @var string[]
 213       */
 214      private $attestationRootCertificates = [];
 215  
 216      /**
 217       * @var EcdaaTrustAnchor[]
 218       */
 219      private $ecdaaTrustAnchors = [];
 220  
 221      /**
 222       * @var string|null
 223       */
 224      private $icon;
 225  
 226      /**
 227       * @var ExtensionDescriptor[]
 228       */
 229      private $supportedExtensions = [];
 230  
 231      public function getLegalHeader(): ?string
 232      {
 233          return $this->legalHeader;
 234      }
 235  
 236      public function getAaid(): ?string
 237      {
 238          return $this->aaid;
 239      }
 240  
 241      public function getAaguid(): ?string
 242      {
 243          return $this->aaguid;
 244      }
 245  
 246      /**
 247       * @return string[]
 248       */
 249      public function getAttestationCertificateKeyIdentifiers(): array
 250      {
 251          return $this->attestationCertificateKeyIdentifiers;
 252      }
 253  
 254      public function getDescription(): string
 255      {
 256          return $this->description;
 257      }
 258  
 259      /**
 260       * @return string[]
 261       */
 262      public function getAlternativeDescriptions(): array
 263      {
 264          return $this->alternativeDescriptions;
 265      }
 266  
 267      public function getAuthenticatorVersion(): int
 268      {
 269          return $this->authenticatorVersion;
 270      }
 271  
 272      public function getProtocolFamily(): string
 273      {
 274          return $this->protocolFamily;
 275      }
 276  
 277      /**
 278       * @return Version[]
 279       */
 280      public function getUpv(): array
 281      {
 282          return $this->upv;
 283      }
 284  
 285      public function getAssertionScheme(): ?string
 286      {
 287          return $this->assertionScheme;
 288      }
 289  
 290      public function getAuthenticationAlgorithm(): ?int
 291      {
 292          return $this->authenticationAlgorithm;
 293      }
 294  
 295      /**
 296       * @return int[]
 297       */
 298      public function getAuthenticationAlgorithms(): array
 299      {
 300          return $this->authenticationAlgorithms;
 301      }
 302  
 303      public function getPublicKeyAlgAndEncoding(): ?int
 304      {
 305          return $this->publicKeyAlgAndEncoding;
 306      }
 307  
 308      /**
 309       * @return int[]
 310       */
 311      public function getPublicKeyAlgAndEncodings(): array
 312      {
 313          return $this->publicKeyAlgAndEncodings;
 314      }
 315  
 316      /**
 317       * @return int[]
 318       */
 319      public function getAttestationTypes(): array
 320      {
 321          return $this->attestationTypes;
 322      }
 323  
 324      /**
 325       * @return VerificationMethodANDCombinations[]
 326       */
 327      public function getUserVerificationDetails(): array
 328      {
 329          return $this->userVerificationDetails;
 330      }
 331  
 332      public function getKeyProtection(): int
 333      {
 334          return $this->keyProtection;
 335      }
 336  
 337      public function isKeyRestricted(): ?bool
 338      {
 339          return (bool) $this->isKeyRestricted;
 340      }
 341  
 342      public function isFreshUserVerificationRequired(): ?bool
 343      {
 344          return (bool) $this->isFreshUserVerificationRequired;
 345      }
 346  
 347      public function getMatcherProtection(): int
 348      {
 349          return $this->matcherProtection;
 350      }
 351  
 352      public function getCryptoStrength(): ?int
 353      {
 354          return $this->cryptoStrength;
 355      }
 356  
 357      public function getOperatingEnv(): ?string
 358      {
 359          return $this->operatingEnv;
 360      }
 361  
 362      public function getAttachmentHint(): int
 363      {
 364          return $this->attachmentHint;
 365      }
 366  
 367      public function isSecondFactorOnly(): ?bool
 368      {
 369          return (bool) $this->isSecondFactorOnly;
 370      }
 371  
 372      public function getTcDisplay(): int
 373      {
 374          return $this->tcDisplay;
 375      }
 376  
 377      public function getTcDisplayContentType(): ?string
 378      {
 379          return $this->tcDisplayContentType;
 380      }
 381  
 382      /**
 383       * @return DisplayPNGCharacteristicsDescriptor[]
 384       */
 385      public function getTcDisplayPNGCharacteristics(): array
 386      {
 387          return $this->tcDisplayPNGCharacteristics;
 388      }
 389  
 390      /**
 391       * @return string[]
 392       */
 393      public function getAttestationRootCertificates(): array
 394      {
 395          return $this->attestationRootCertificates;
 396      }
 397  
 398      /**
 399       * @return EcdaaTrustAnchor[]
 400       */
 401      public function getEcdaaTrustAnchors(): array
 402      {
 403          return $this->ecdaaTrustAnchors;
 404      }
 405  
 406      public function getIcon(): ?string
 407      {
 408          return $this->icon;
 409      }
 410  
 411      /**
 412       * @return ExtensionDescriptor[]
 413       */
 414      public function getSupportedExtensions(): array
 415      {
 416          return $this->supportedExtensions;
 417      }
 418  
 419      public static function createFromArray(array $data): self
 420      {
 421          $object = new self();
 422          foreach (['description', 'protocolFamily'] as $key) {
 423              if (!isset($data[$key])) {
 424                  throw new InvalidArgumentException(sprintf('The parameter "%s" is missing', $key));
 425              }
 426          }
 427          $object->legalHeader = $data['legalHeader'] ?? null;
 428          $object->aaid = $data['aaid'] ?? null;
 429          $object->aaguid = $data['aaguid'] ?? null;
 430          $object->attestationCertificateKeyIdentifiers = $data['attestationCertificateKeyIdentifiers'] ?? [];
 431          $object->description = $data['description'];
 432          $object->alternativeDescriptions = $data['alternativeDescriptions'] ?? [];
 433          $object->authenticatorVersion = $data['authenticatorVersion'] ?? 0;
 434          $object->protocolFamily = $data['protocolFamily'];
 435          if (isset($data['upv'])) {
 436              $upv = $data['upv'];
 437              Assertion::isArray($upv, 'Invalid Metadata Statement');
 438              foreach ($upv as $value) {
 439                  Assertion::isArray($value, 'Invalid Metadata Statement');
 440                  $object->upv[] = Version::createFromArray($value);
 441              }
 442          }
 443          $object->assertionScheme = $data['assertionScheme'] ?? null;
 444          $object->authenticationAlgorithm = $data['authenticationAlgorithm'] ?? null;
 445          $object->authenticationAlgorithms = $data['authenticationAlgorithms'] ?? [];
 446          $object->publicKeyAlgAndEncoding = $data['publicKeyAlgAndEncoding'] ?? null;
 447          $object->publicKeyAlgAndEncodings = $data['publicKeyAlgAndEncodings'] ?? [];
 448          $object->attestationTypes = $data['attestationTypes'] ?? [];
 449          if (isset($data['userVerificationDetails'])) {
 450              $userVerificationDetails = $data['userVerificationDetails'];
 451              Assertion::isArray($userVerificationDetails, 'Invalid Metadata Statement');
 452              foreach ($userVerificationDetails as $value) {
 453                  Assertion::isArray($value, 'Invalid Metadata Statement');
 454                  $object->userVerificationDetails[] = VerificationMethodANDCombinations::createFromArray($value);
 455              }
 456          }
 457          $object->keyProtection = $data['keyProtection'] ?? 0;
 458          $object->isKeyRestricted = $data['isKeyRestricted'] ?? null;
 459          $object->isFreshUserVerificationRequired = $data['isFreshUserVerificationRequired'] ?? null;
 460          $object->matcherProtection = $data['matcherProtection'] ?? 0;
 461          $object->cryptoStrength = $data['cryptoStrength'] ?? null;
 462          $object->operatingEnv = $data['operatingEnv'] ?? null;
 463          $object->attachmentHint = $data['attachmentHint'] ?? 0;
 464          $object->isSecondFactorOnly = $data['isSecondFactorOnly'] ?? null;
 465          $object->tcDisplay = $data['tcDisplay'] ?? 0;
 466          $object->tcDisplayContentType = $data['tcDisplayContentType'] ?? null;
 467          if (isset($data['tcDisplayPNGCharacteristics'])) {
 468              $tcDisplayPNGCharacteristics = $data['tcDisplayPNGCharacteristics'];
 469              Assertion::isArray($tcDisplayPNGCharacteristics, 'Invalid Metadata Statement');
 470              foreach ($tcDisplayPNGCharacteristics as $tcDisplayPNGCharacteristic) {
 471                  Assertion::isArray($tcDisplayPNGCharacteristic, 'Invalid Metadata Statement');
 472                  $object->tcDisplayPNGCharacteristics[] = DisplayPNGCharacteristicsDescriptor::createFromArray($tcDisplayPNGCharacteristic);
 473              }
 474          }
 475          $object->attestationRootCertificates = $data['attestationRootCertificates'] ?? [];
 476          $object->ecdaaTrustAnchors = $data['ecdaaTrustAnchors'] ?? [];
 477          $object->icon = $data['icon'] ?? null;
 478          if (isset($data['supportedExtensions'])) {
 479              $supportedExtensions = $data['supportedExtensions'];
 480              Assertion::isArray($supportedExtensions, 'Invalid Metadata Statement');
 481              foreach ($supportedExtensions as $supportedExtension) {
 482                  Assertion::isArray($supportedExtension, 'Invalid Metadata Statement');
 483                  $object->supportedExtensions[] = ExtensionDescriptor::createFromArray($supportedExtension);
 484              }
 485          }
 486  
 487          return $object;
 488      }
 489  }