Class: TwoFactorAuth::AuthenticationVerifier

Inherits:
Object
  • Object
show all
Includes:
ActiveModel::Validations
Defined in:
app/models/two_factor_auth/authentication_verifier.rb

Instance Method Summary collapse

Instance Method Details

#application_parameter ⇒ Object 



19
20
21
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 19

def application_parameter
  OpenSSL::Digest::SHA256.new.digest(request.app_id.encode('ASCII-8BIT'))
end

#challenge_parameter ⇒ Object 



23
24
25
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 23

def challenge_parameter
  OpenSSL::Digest::SHA256.new.digest(client_data.json)
end

#client_challenge_matches ⇒ Object 



27
28
29
30
31
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 27

def client_challenge_matches
  if client_data.challenge != request.challenge
    errors.add :client_data, "challenge does not match the challenge they were sent"
  end
end

#client_origin_matches ⇒ Object 



33
34
35
36
37
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 33

def client_origin_matches
  if client_data.origin != request.app_id
    errors.add :client_data, "origin does not match the appId they were sent"
  end
end

#counter ⇒ Object 



64
65
66
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 64

def counter
  response.counter
end

#counter_advances ⇒ Object 



39
40
41
42
43
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 39

def counter_advances
  if response.counter <= registration.counter
    errors.add :response, "does not advance counter - could mean device was cloned"
  end
end

#digest ⇒ Object 



45
46
47
48
49
50
51
52
53
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 45

def digest
  data = [
    application_parameter,
    response.bitfield.chr,
    [response.counter].pack('N'),
    challenge_parameter,
  ].join('')
  OpenSSL::Digest::SHA256.new.digest(data)
end

#verify_signature ⇒ Object 



55
56
57
58
59
60
61
62
 
# File 'app/models/two_factor_auth/authentication_verifier.rb', line 55

def verify_signature
  ec = OpenSSL::PKey::EC.new('prime256v1')
  ec.public_key = TwoFactorAuth.decode_pubkey registration.public_key
  return false if ec.public_key.nil?
  if !ec.dsa_verify_asn1(digest, response.signature)
    errors.add :response, "signature is not correct"
  end
end