feat: add support for BS / BE flags in AuthData #8903

[duttarnab]

closes #8903

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on enhancing the security and functionality of the FIDO2 authentication process by introducing support for handling credential backup-related flags, verifying backup eligibility and backup state, and improving the overall robustness of the FIDO2 authentication implementation.

Expand for full summary

Summary:

The code changes in this pull request are focused on enhancing the security and functionality of the FIDO2 (Fast IDentity Online 2) authentication process. The changes span multiple Java classes and introduce support for handling credential backup-related flags, verifying backup eligibility and backup state, and improving the overall robustness of the FIDO2 authentication implementation.

Key security-related changes include:

1. Backup Eligibility and Backup State Verification: The code now extracts and verifies the backup eligibility and backup state flags from the authenticator data, ensuring that the authentication process is secure even when using backup-enabled authenticators.
2. Signature Verification: The code thoroughly verifies the assertion signatures using the extracted public keys, providing an important security measure to ensure the authenticity and integrity of the received authentication data.
3. Counter Verification: The code checks the counter values from the authenticator data to mitigate potential replay attacks, a crucial security feature for FIDO2 authentication.
4. Exception Handling and Logging: The code includes robust exception handling and logging mechanisms, which can help detect and investigate any security-related issues that may arise during the authentication process.

Overall, the changes in this pull request demonstrate a strong focus on improving the security and compliance of the FIDO2 authentication implementation, in line with the FIDO2 specification and best practices for secure authentication.

Files Changed:

1. AuthenticatorDataParser.java: Introduces new flags to handle credential backup eligibility and backup state, and adds methods to verify these flags.
2. CredAndCounterData.java: Adds new boolean fields to track backup state and eligibility flags.
3. AppleAssertionFormatProcessor.java: Verifies the backup eligibility and backup state flags in the authenticator data.
4. AttestationService.java: Adds the backup eligibility and backup state flags to the registration data.
5. PackedAssertionFormatProcessor.java: Extracts and verifies the backup eligibility and backup state flags.
6. NoneAssertionFormatProcessor.java: Updates the registration data with backup eligibility and backup state flags.
7. U2FAssertionFormatProcessor.java: Sets the backup eligibility and backup state flags in the registration data.
8. U2FSuperGluuAssertionFormatProcessor.java: Verifies the backup eligibility and backup state flags.
9. TPMAssertionFormatProcessor.java: Extracts and sets the backup eligibility and backup state flags.
10. Fido2RegistrationData.java: Adds new fields to track backup state and eligibility.
11. AttestationVerifier.java: Calls methods to verify backup eligibility and backup state.

Code Analysis

We ran 9 analyzers against 11 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	9 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed for 'orm'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[yackermann]

LGTM!