FIDO2 / WebAuthn Level 3 と CTAP2 公開鍵暗号による
リアルタイム中間者フィッシング（AiTM）防止プロトコル実装

#![no_std]
#![forbid(unsafe_code)]

pub const FLAG_USER_PRESENT: u8 = 0x01; — Bit 0: UP
pub const FLAG_USER_VERIFIED: u8 = 0x04; — Bit 2: UV
pub const FLAG_BACKUP_ELIGIBLE: u8 = 0x08; — Bit 3: BE
pub const FLAG_BACKUP_STATE: u8 = 0x10; — Bit 4: BS
pub const FLAG_ATTESTED_CRED_DATA: u8 = 0x40; — Bit 6: AT

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct VerifiedAssertionHeader {
    pub rp_id_hash: [u8; 32],
    pub flags: u8,
    pub sign_count: u32,
    pub is_backup_synced: bool,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum WebAuthnVerifyError {
    AuthDataTooShort(usize),
    RpIdHashMismatch,
    UserPresenceMissing,
    UserVerificationMissing,
    BackupStateInconsistent,
    ClonedAuthenticatorDetected { previous: u32, received: u32 },
    ChallengeMismatch,
}

/// Constant-time 32-byte slice comparison to eliminate timing side-channels (CWE-208).
#[inline]
pub const fn ct_eq_32(a: &[u8; 32], b: &[u8; 32]) -> bool {
    let mut diff: u8 = 0;
    let mut i = 0;
    while i < 32 {
        diff |= a[i] ^ b[i];
        i += 1;
    }
    diff == 0
}

/// Verifies a W3C WebAuthn Level 3 `authenticatorData` binary payload (minimum 37 bytes)
/// against expected `SHA-256(rp_id)`, strict `UP | UV` requirements, `BE/BS` consistency,
/// and monotonic `signCount` anti-cloning invariants.
pub const fn verify_webauthn_authenticator_data(
    raw_auth_data: &[u8],
    expected_rp_id_sha256: &[u8; 32],
    stored_sign_count: u32,
    require_uv: bool,
) -> Result<VerifiedAssertionHeader, WebAuthnVerifyError> {
    if raw_auth_data.len() < 37 {
        return Err(WebAuthnVerifyError::AuthDataTooShort(raw_auth_data.len()));
    }

    let mut rp_id_hash = [0u8; 32];
    let mut i = 0;
    while i < 32 {
        rp_id_hash[i] = raw_auth_data[i];
        i += 1;
    }

    if !ct_eq_32(&rp_id_hash, expected_rp_id_sha256) {
        return Err(WebAuthnVerifyError::RpIdHashMismatch);
    }

    let flags = raw_auth_data[32];
    if (flags & FLAG_USER_PRESENT) == 0 {
        return Err(WebAuthnVerifyError::UserPresenceMissing);
    }
    if require_uv && (flags & FLAG_USER_VERIFIED) == 0 {
        return Err(WebAuthnVerifyError::UserVerificationMissing);
    }

    // WebAuthn Level 3 invariant: BS (Bit 4) cannot be 1 if BE (Bit 3) is 0
    let be = (flags & FLAG_BACKUP_ELIGIBLE) != 0;
    let bs = (flags & FLAG_BACKUP_STATE) != 0;
    if !be && bs {
        return Err(WebAuthnVerifyError::BackupStateInconsistent);
    }

    let sign_count = u32::from_be_bytes([
        raw_auth_data[33],
        raw_auth_data[34],
        raw_auth_data[35],
        raw_auth_data[36],
    ]);

    if (stored_sign_count != 0 || sign_count != 0) && sign_count <= stored_sign_count {
        return Err(WebAuthnVerifyError::ClonedAuthenticatorDetected {
            previous: stored_sign_count,
            received: sign_count,
        });
    }

    Ok(VerifiedAssertionHeader {
        rp_id_hash,
        flags,
        sign_count,
        is_backup_synced: bs,
    })
}