U2fPrimitives { public void finishSignature(SignRequest signRequest, SignResponse response, DeviceRegistration deviceRegistration) throws U2fAuthenticationException { finishSignature(signRequest, response, deviceRegistration, null); } U2fPrimitives(Crypto crypto, ChallengeGenerator challengeGenerator);  U2fPrimitives(); RegisterRequest startRegistration(String appId); RegisterRequest startRegistration(String appId, byte[] challenge); DeviceRegistration finishRegistration(RegisterRequest registerRequest, RegisterResponse response); DeviceRegistration finishRegistration(RegisterRequest registerRequest,
                                                 RegisterResponse response,
                                                 Set<String> facets); SignRequest startSignature(String appId, DeviceRegistration deviceRegistration); SignRequest startSignature(String appId, DeviceRegistration deviceRegistration, byte[] challenge); void finishSignature(SignRequest signRequest,
                                SignResponse response,
                                DeviceRegistration deviceRegistration); void finishSignature(SignRequest signRequest,
                                SignResponse response,
                                DeviceRegistration deviceRegistration,
                                Set<String> facets); static final String U2F_VERSION; }
@Test public void finishSignature() throws Exception { SignRequest signRequest = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse tokenResponse = new SignResponse(CLIENT_DATA_SIGN_BASE64, SIGN_RESPONSE_DATA_BASE64, KEY_HANDLE_BASE64); u2f.finishSignature(signRequest, tokenResponse, new DeviceRegistration(KEY_HANDLE_BASE64, USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0), allowedOrigins); }
@Test(expected = U2fAuthenticationException.class) public void finishSignature_badOrigin() throws Exception { Set<String> allowedOrigins = ImmutableSet.of("some-other-domain.com"); SignRequest request = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse response = new SignResponse(CLIENT_DATA_SIGN_BASE64, SIGN_RESPONSE_DATA_BASE64, SERVER_CHALLENGE_SIGN_BASE64); u2f.finishSignature(request, response, new DeviceRegistration(KEY_HANDLE_BASE64, USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0), allowedOrigins); }
@Test(expected = U2fBadInputException.class) public void finishAuthentication_badBase64() throws Exception { SignRequest authentication = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse response = new SignResponse("****", "****", "****"); u2f.finishSignature(authentication, response, new DeviceRegistration(KEY_HANDLE_BASE64, USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0)); }
@Test(expected = U2fBadInputException.class) public void finishAuthentication_clientDataMissingField() throws Exception { SignRequest authentication = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse response = new SignResponse(U2fB64Encoding.encode("{}".getBytes()), "", ""); u2f.finishSignature(authentication, response, new DeviceRegistration(KEY_HANDLE_BASE64, USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0)); }
@Test public void finishAuthentication_truncatedData() throws Exception { expectedException.expectCause(isA(U2fBadInputException.class)); SignRequest authentication = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse response = new SignResponse(CLIENT_DATA_SIGN_BASE64, "", KEY_HANDLE_BASE64); u2f.finishSignature(authentication, response, new DeviceRegistration(KEY_HANDLE_BASE64, USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0)); }
@Test(expected = IllegalArgumentException.class) public void finishSignature_compromisedDevice() throws Exception { SignRequest signRequest = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse tokenResponse = new SignResponse(CLIENT_DATA_SIGN_BASE64, SIGN_RESPONSE_DATA_BASE64, KEY_HANDLE_BASE64); DeviceRegistration deviceRegistration = new DeviceRegistration(KEY_HANDLE_BASE64, USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0); deviceRegistration.markCompromised(); u2f.finishSignature(signRequest, tokenResponse, deviceRegistration, allowedOrigins); }
@Test public void finishSignatureShouldDetectInvalidUserPresence() throws Exception { expectedException.expectCause(isA(U2fBadInputException.class)); SignRequest signRequest = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse tokenResponse = new SignResponse( CLIENT_DATA_SIGN_BASE64, SIGN_RESPONSE_INVALID_USER_PRESENCE_BASE64, KEY_HANDLE_BASE64 ); u2f.finishSignature( signRequest, tokenResponse, new DeviceRegistration( KEY_HANDLE_BASE64, USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0 ), allowedOrigins ); fail("finishSignature did not detect a non-0x01 user presence byte in the sign response."); }
@Test(expected = IllegalArgumentException.class) public void finishSignatureShouldDetectIncorrectDeviceRegistration() throws Exception { SignRequest signRequest = SignRequest.builder() .challenge(SERVER_CHALLENGE_SIGN_BASE64) .appId(APP_ID_SIGN) .keyHandle(KEY_HANDLE_BASE64) .build(); SignResponse tokenResponse = new SignResponse( CLIENT_DATA_SIGN_BASE64, SIGN_RESPONSE_DATA_BASE64, KEY_HANDLE_BASE64 ); u2f.finishSignature( signRequest, tokenResponse, new DeviceRegistration( "ARGHABLARGHLER", USER_PUBLIC_KEY_SIGN_HEX, ATTESTATION_CERTIFICATE, 0 ), allowedOrigins ); }