パスワード暗記が不要になる「パスキー（FIDO2）」安心ガイド：フィッシング詐欺を仕組みで防ぐ玄関の生体鍵

#![forbid(unsafe_code)]

pub const FLAG_USER_PRESENT: u8 = 1 << 0; — 0x01 (UP)
pub const FLAG_USER_VERIFIED: u8 = 1 << 2; — 0x04 (UV)
pub const FLAG_BACKUP_ELIGIBLE: u8 = 1 << 3; — 0x08 (BE - Synced Passkey capability)
pub const FLAG_BACKUP_STATE: u8 = 1 << 4; — 0x10 (BS - Currently backed up)
pub const FLAG_ATTESTED_CRED: u8 = 1 << 6; — 0x40 (AT)

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct ParsedAuthData<'a> {
    pub rp_id_hash: &'a [u8; 32],
    pub flags: u8,
    pub sign_count: u32,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum WebAuthnVerifyError {
    BufferTooShort,
    RpIdHashMismatch,
    UserPresenceRequired,
    UserVerificationRequired,
    ClonedAuthenticatorSuspected { stored: u32, received: u32 },
}

/// Parses and validates the 37-byte header of a WebAuthn `authenticatorData` payload
/// in constant time without heap allocations.
pub fn verify_authenticator_data<'a>(
    raw: &'a [u8],
    expected_rp_id_hash: &[u8; 32],
    stored_sign_count: u32,
    require_user_verification: bool,
) -> Result<ParsedAuthData<'a>, WebAuthnVerifyError> {
    if raw.len() < 37 {
        return Err(WebAuthnVerifyError::BufferTooShort);
    }
    let rp_id_hash: &[u8; 32] = raw[0..32].try_into().unwrap();

    // Constant-time 32-byte comparison to prevent timing side-channels
    let mut diff: u8 = 0;
    for i in 0..32 {
        diff |= rp_id_hash[i] ^ expected_rp_id_hash[i];
    }
    if diff != 0 {
        return Err(WebAuthnVerifyError::RpIdHashMismatch);
    }

    let flags = raw[32];
    if (flags & FLAG_USER_PRESENT) == 0 {
        return Err(WebAuthnVerifyError::UserPresenceRequired);
    }
    if require_user_verification && (flags & FLAG_USER_VERIFIED) == 0 {
        return Err(WebAuthnVerifyError::UserVerificationRequired);
    }

    let sign_count = u32::from_be_bytes([raw[33], raw[34], raw[35], raw[36]]);
    if (sign_count > 0 || stored_sign_count > 0) && sign_count <= stored_sign_count {
        return Err(WebAuthnVerifyError::ClonedAuthenticatorSuspected {
            stored: stored_sign_count,
            received: sign_count,
        });
    }

    Ok(ParsedAuthData {
        rp_id_hash,
        flags,
        sign_count,
    })
}