Package io.jans.fido2.service.processor.attestation

Class AndroidKeyAttestationProcessor

java.lang.Object

io.jans.fido2.service.processor.attestation.AndroidKeyAttestationProcessor

All Implemented Interfaces:

AttestationFormatProcessor

@ApplicationScoped
public class AndroidKeyAttestationProcessor
extends Object
implements AttestationFormatProcessor

Attestation processor for fmt = "android-key" (Android Keystore attestation). Implements the WebAuthn android-key verification procedure: 1. Verify sig over authData ‖ clientDataHash with the public key of the leaf x5c certificate (credCert), using the COSE alg. 2. Verify the credential public key in authData equals credCert's subject public key. 3. Verify the attestation challenge in the key-description extension (OID 1.3.6.1.4.1.11129.2.1.17) equals clientDataHash. 4. Verify the authorization lists: allApplications must be absent, the key origin must be GENERATED (0) and purpose must contain SIGN (2). 5. (Attestation enforced) Verify the x5c chain to a trusted root from the authenticator metadata, mirroring the packed full-attestation flow.

Constructor Summary

Constructors

Constructor	Description
AndroidKeyAttestationProcessor()

Method Summary

Modifier and Type	Method	Description
AttestationFormat	getAttestationFormat()
void	process(com.fasterxml.jackson.databind.JsonNode attStmt, AuthData authData, io.jans.orm.model.fido2.Fido2RegistrationData registration, byte[] clientDataHash, CredAndCounterData credIdAndCounters)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AndroidKeyAttestationProcessor

public AndroidKeyAttestationProcessor()

Method Details

getAttestationFormat

public AttestationFormat getAttestationFormat()

Specified by:

getAttestationFormat in interface AttestationFormatProcessor

process

public void process(com.fasterxml.jackson.databind.JsonNode attStmt,
 AuthData authData,
 io.jans.orm.model.fido2.Fido2RegistrationData registration,
 byte[] clientDataHash,
 CredAndCounterData credIdAndCounters)

Specified by:

process in interface AttestationFormatProcessor