Class: TwoFactorAuth::RegistrationVerifier

Inherits:
Object
  • Object
show all
Includes:
ActiveModel::Validations
Defined in:
app/models/two_factor_auth/registration_verifier.rb

Instance Method Summary collapse

Instance Method Details

#application_parameter ⇒ Object 



21
22
23
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 21

def application_parameter
  OpenSSL::Digest::SHA256.new.digest(request.app_id.encode('ASCII-8BIT'))
end

#challenge_parameter ⇒ Object 



25
26
27
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 25

def challenge_parameter
  OpenSSL::Digest::SHA256.new.digest(client_data.json)
end

#client_challenge_matches ⇒ Object 



40
41
42
43
44
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 40

def client_challenge_matches
  if client_data.challenge != request.challenge
    errors.add :client_data, "challenge does not match the challenge they were sent"
  end
end

#client_origin_matches ⇒ Object 



46
47
48
49
50
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 46

def client_origin_matches
  if client_data.origin != request.app_id
    errors.add :client_data, "origin does not match the appId they were sent"
  end
end

#digest ⇒ Object 



29
30
31
32
33
34
35
36
37
38
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 29

def digest
  data = [
    0.chr.encode('ASCII-8BIT'),
    application_parameter,
    challenge_parameter,
    response.key_handle,
    response.public_key,
  ].join('')
  OpenSSL::Digest::SHA256.new.digest(data)
end

#persist! ⇒ Object 



87
88
89
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 87

def persist!
  Registration.create!(registration_attributes)
end

#persisted? ⇒ Boolean

Returns:

  • (Boolean) 


65
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 65

def persisted? ; false ; end

#registration_attributes ⇒ Object 



76
77
78
79
80
81
82
83
84
85
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 76

def registration_attributes
  {
    login: ,
    counter: 0,
    key_handle: response.key_handle,
    public_key: response.public_key,
    certificate: response.certificate,
    last_authenticated_at: Time.now,
  }
end

#save ⇒ Object 



67
68
69
70
71
72
73
74
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 67

def save
  if valid?
    persist!
    true
  else
    false
  end
end

#verify_signature ⇒ Object 



52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'app/models/two_factor_auth/registration_verifier.rb', line 52

def verify_signature
  ec = OpenSSL::PKey::EC.new('prime256v1')
  ec.public_key = response.certificate_public_key
  return false if ec.public_key.nil?
  if !ec.dsa_verify_asn1(digest, response.signature)
    errors.add :response, "signature is not correct"
  end
rescue TypeError # from certificate_public_key not extracting cert and using nil
  errors.add(:response, "certificate was not extracted")
rescue OpenSSL::PKey::ECError # signature is invalid, not just incorrect
  errors.add(:response, "signature not valid")
end