scottbrady91 / fido2-poc

FIDO2 & WebAuthn Proof of Concept

I help developers learn OAuth and web security.

I'm an Engineering Manager at ClearBank and a Pluralsight Author. I specialize in IdentityServer and all things Authentication, Identity, OAuth, and OpenID Connect.

In my day job at ClearBank, I'm an Engineering Manager for one of the Faster Payments teams. I'm currently taking a break from the identity world to focus on my leadership skills.

Previously at 10x Banking, I was a combination of team lead and technical product manager, leading a team of experienced IAM specialists while also championing identity standards and helping with design & architecture. Before that, at Rock Solid Knowledge, I created identity solutions for customers and developed commercial IdentityServer products. This allowed me to play with older protocols such as SAML & WS-Federation and cutting-edge technologies such as FIDO2.

I mainly work with C# and ASP.NET Core, but otherwise, I dabble with languages such as Kotlin, Go, and Typescript.

I sometimes make an appearance on the speaking circuit, whether it's user groups, conferences, or recorded.

👨‍🔧 Website: scottbrady91.com

🐤 Twitter: @scottbrady91

💼 LinkedIn: scottbrady91

🧑 Timeline: my Polywork timeline

fido2-poc's Issues

Nice implementation.. but doesn't work.

Counter value comes back as incorrect:

Counterbuf 0,0,4,166

Counter 2785280000

Also:
var isValid = ecDsa.VerifyData(sigBase, DeserializeSignature(sig), HashAlgorithmName.SHA256);

comes back as False even though it's just been registered.

Use the .net ASN reader instead of parsing it manually

Instead of parsing the EcDSA signature in DeserializeSignature() (in AccountController.cs) you could use the build-in .net AsnReader.

You only have to do this für EcDSA. RSA and EdDSA use the signature without any parsing. The odd behaviour of EcDSA is for compatibility reasons with the original U2F spec.

                var s = Base64Url.Decode(signature);
                var reader = new AsnReader(s, AsnEncodingRules.DER);
                var sequence = reader.ReadSequence(Asn1Tag.Sequence);
                var r = sequence.ReadIntegerBytes(Asn1Tag.Integer);
                var s = sequence.ReadIntegerBytes(Asn1Tag.Integer);

                // remove negative flags
                if (r.Span[0] == 0x0)
                {
                    r = r[1..];
                }

                if (s.Span[0] == 0x0)
                {
                    s = s[1..];
                }

                // combine r and s
                var signature = new byte[r.Length + s.Length];
                var signatureSpan = signature.AsSpan();
                r.Span.CopyTo(signatureSpan);
                s.Span.CopyTo(signatureSpan[r.Length..]);

                return signature;

navigator.credentials.create undefined error while executing js

create api is not called..
it gives this error while exeuting java script--
"TypeError: Cannot read property 'create' of undefined"