パスワードを覚える時代は終わりへ
フィッシング耐性を備えた「パスキー」の仕組みと設定手順

#![forbid(unsafe_code)]

pub const FLAG_USER_PRESENT: u8 = 0b0000_0001;
pub const FLAG_USER_VERIFIED: u8 = 0b0000_0100;
pub const FLAG_BACKUP_ELIGIBLE: u8 = 0b0000_1000;
pub const FLAG_BACKUP_STATE: u8 = 0b0001_0000;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ParsedAuthenticatorData {
    pub rp_id_hash: [u8; 32],
    pub flags: u8,
    pub sign_count: u32,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum WebAuthnVerifyError {
    BufferTooShort,
    RpIdHashMismatch,
    UserNotPresent,
    UserNotVerified,
    CloneDetected { received: u32, stored: u32 },
}

#[inline]
fn constant_time_eq_32(a: &[u8; 32], b: &[u8; 32]) -> bool {
    let mut diff = 0u8;
    let mut i = 0;
    while i < 32 {
        diff |= a[i] ^ b[i];
        i += 1;
    }
    diff == 0
}

pub fn verify_authenticator_data(
    raw: &[u8],
    expected_rp_id_hash: &[u8; 32],
    stored_sign_count: u32,
    require_uv: bool,
) -> Result<ParsedAuthenticatorData, WebAuthnVerifyError> {
    if raw.len() < 37 {
        return Err(WebAuthnVerifyError::BufferTooShort);
    }

    let mut rp_id_hash = [0u8; 32];
    rp_id_hash.copy_from_slice(&raw[0..32]);

    if !constant_time_eq_32(&rp_id_hash, expected_rp_id_hash) {
        return Err(WebAuthnVerifyError::RpIdHashMismatch);
    }

    let flags = raw[32];
    if (flags & FLAG_USER_PRESENT) == 0 {
        return Err(WebAuthnVerifyError::UserNotPresent);
    }
    if require_uv && (flags & FLAG_USER_VERIFIED) == 0 {
        return Err(WebAuthnVerifyError::UserNotVerified);
    }

    let sign_count = u32::from_be_bytes([raw[33], raw[34], raw[35], raw[36]]);
    if (sign_count != 0 || stored_sign_count != 0) && sign_count <= stored_sign_count {
        return Err(WebAuthnVerifyError::CloneDetected {
            received: sign_count,
            stored: stored_sign_count,
        });
    }

    Ok(ParsedAuthenticatorData {
        rp_id_hash,
        flags,
        sign_count,
    })
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_aitm_phishing_rp_id_mismatch_is_rejected() {
        let expected_hash = [0xAA; 32];
        let mut raw = [0u8; 37];
        raw[0..32].copy_from_slice(&[0xBB; 32]); — Phishing proxy hash
        raw[32] = FLAG_USER_PRESENT | FLAG_USER_VERIFIED;
        raw[33..37].copy_from_slice(&10u32.to_be_bytes());

        assert_eq!(
            verify_authenticator_data(&raw, &expected_hash, 9, true),
            Err(WebAuthnVerifyError::RpIdHashMismatch)
        );
    }
}