mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 04:43:53 +00:00
2ccfa855b2
Some highlights from NEWS entries: ** Improved OpenSSL 3.0 compatibility. ** Support for hidraw(4) on FreeBSD; gh#597. ** Improved support for FIDO 2.1 authenticators. PR: 273596 Relnotes: Yes Sponsored by: The FreeBSD Foundation
115 lines
3.6 KiB
Groff
115 lines
3.6 KiB
Groff
.\" Copyright (c) 2018-2021 Yubico AB. All rights reserved.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions are
|
|
.\" met:
|
|
.\"
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in
|
|
.\" the documentation and/or other materials provided with the
|
|
.\" distribution.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
.\" A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
.\" HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
.\" LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
.\" OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
.\"
|
|
.\" SPDX-License-Identifier: BSD-2-Clause
|
|
.\"
|
|
.Dd $Mdocdate: May 23 2018 $
|
|
.Dt FIDO_CRED_VERIFY 3
|
|
.Os
|
|
.Sh NAME
|
|
.Nm fido_cred_verify ,
|
|
.Nm fido_cred_verify_self
|
|
.Nd verify the attestation signature of a FIDO2 credential
|
|
.Sh SYNOPSIS
|
|
.In fido.h
|
|
.Ft int
|
|
.Fn fido_cred_verify "const fido_cred_t *cred"
|
|
.Ft int
|
|
.Fn fido_cred_verify_self "const fido_cred_t *cred"
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Fn fido_cred_verify
|
|
and
|
|
.Fn fido_cred_verify_self
|
|
functions verify whether the attestation signature contained in
|
|
.Fa cred
|
|
matches the attributes of the credential.
|
|
Before using
|
|
.Fn fido_cred_verify
|
|
or
|
|
.Fn fido_cred_verify_self
|
|
in a sensitive context, the reader is strongly encouraged to make
|
|
herself familiar with the FIDO2 credential attestation process
|
|
as defined in the Web Authentication (webauthn) standard.
|
|
.Pp
|
|
The
|
|
.Fn fido_cred_verify
|
|
function verifies whether the client data hash, relying party ID,
|
|
credential ID, type, protection policy, minimum PIN length, and
|
|
resident/discoverable key and user verification attributes of
|
|
.Fa cred
|
|
have been attested by the holder of the private counterpart of
|
|
the public key contained in the credential's x509 certificate.
|
|
.Pp
|
|
Please note that the x509 certificate itself is not verified.
|
|
.Pp
|
|
The attestation statement formats supported by
|
|
.Fn fido_cred_verify
|
|
are
|
|
.Em packed ,
|
|
.Em fido-u2f ,
|
|
and
|
|
.Em tpm .
|
|
The attestation type implemented by
|
|
.Fn fido_cred_verify
|
|
is
|
|
.Em Basic Attestation .
|
|
.Pp
|
|
The
|
|
.Fn fido_cred_verify_self
|
|
function verifies whether the client data hash, relying party ID,
|
|
credential ID, type, protection policy, minimum PIN length, and
|
|
resident/discoverable key and user verification attributes of
|
|
.Fa cred
|
|
have been attested by the holder of the credential's private key.
|
|
.Pp
|
|
The attestation statement formats supported by
|
|
.Fn fido_cred_verify_self
|
|
are
|
|
.Em packed
|
|
and
|
|
.Em fido-u2f .
|
|
The attestation type implemented by
|
|
.Fn fido_cred_verify_self
|
|
is
|
|
.Em Self Attestation .
|
|
.Pp
|
|
Other attestation formats and types are not supported.
|
|
.Sh RETURN VALUES
|
|
The error codes returned by
|
|
.Fn fido_cred_verify
|
|
and
|
|
.Fn fido_cred_verify_self
|
|
are defined in
|
|
.In fido/err.h .
|
|
If
|
|
.Fa cred
|
|
passes verification, then
|
|
.Dv FIDO_OK
|
|
is returned.
|
|
.Sh SEE ALSO
|
|
.Xr fido_cred_new 3 ,
|
|
.Xr fido_cred_set_authdata 3
|