@@ -54,6 +54,7 @@ public class U2FServerReferenceImpl implements U2FServer {
5454 // TODO: use these for channel id checks in verifyBrowserData
5555 @ SuppressWarnings ("unused" )
5656 private static final String CHANNEL_ID_PARAM = "cid_pubkey" ;
57+
5758 @ SuppressWarnings ("unused" )
5859 private static final String UNUSED_CHANNEL_ID = "" ;
5960
@@ -64,8 +65,8 @@ public class U2FServerReferenceImpl implements U2FServer {
6465 private final Crypto cryto ;
6566 private final Set <String > allowedOrigins ;
6667
67- public U2FServerReferenceImpl (ChallengeGenerator challengeGenerator ,
68- DataStore dataStore , Crypto cryto , Set <String > origins ) {
68+ public U2FServerReferenceImpl (ChallengeGenerator challengeGenerator , DataStore dataStore ,
69+ Crypto cryto , Set <String > origins ) {
6970 this .challengeGenerator = challengeGenerator ;
7071 this .dataStore = dataStore ;
7172 this .cryto = cryto ;
@@ -93,8 +94,8 @@ public RegistrationRequest getRegistrationRequest(String accountName, String app
9394 }
9495
9596 @ Override
96- public SecurityKeyData processRegistrationResponse (RegistrationResponse registrationResponse ,
97- long currentTimeInMillis ) throws U2FException {
97+ public SecurityKeyData processRegistrationResponse (
98+ RegistrationResponse registrationResponse , long currentTimeInMillis ) throws U2FException {
9899 Log .info (">> processRegistrationResponse" );
99100
100101 String sessionId = registrationResponse .getSessionId ();
@@ -146,15 +147,16 @@ public SecurityKeyData processRegistrationResponse(RegistrationResponse registra
146147
147148 byte [] appIdSha256 = cryto .computeSha256 (appId .getBytes ());
148149 byte [] clientDataSha256 = cryto .computeSha256 (clientData .getBytes ());
149- byte [] signedBytes = RawMessageCodec .encodeRegistrationSignedBytes (appIdSha256 , clientDataSha256 ,
150- keyHandle , userPublicKey );
150+ byte [] signedBytes = RawMessageCodec .encodeRegistrationSignedBytes (
151+ appIdSha256 , clientDataSha256 , keyHandle , userPublicKey );
151152
152153 Set <X509Certificate > trustedCertificates = dataStore .getTrustedCertificates ();
153154 if (!trustedCertificates .contains (attestationCertificate )) {
154155 Log .warning ("attestion cert is not trusted" );
155156 }
156157
157- verifyBrowserData (new JsonParser ().parse (clientData ), "navigator.id.finishEnrollment" , sessionData );
158+ verifyBrowserData (
159+ new JsonParser ().parse (clientData ), "navigator.id.finishEnrollment" , sessionData );
158160
159161 Log .info ("Verifying signature of bytes " + Hex .encodeHexString (signedBytes ));
160162 if (!cryto .verifySignature (attestationCertificate , signedBytes , signature )) {
@@ -184,9 +186,8 @@ public U2fSignRequest getSignRequest(String accountName, String appId) throws U2
184186 ImmutableList .Builder <RegisteredKey > registeredKeys = ImmutableList .builder ();
185187 Log .info (" challenge: " + Hex .encodeHexString (challenge ));
186188 for (SecurityKeyData securityKeyData : securityKeyDataList ) {
187-
188- SignSessionData sessionData = new SignSessionData (accountName , appId ,
189- challenge , securityKeyData .getPublicKey ());
189+ SignSessionData sessionData =
190+ new SignSessionData (accountName , appId , challenge , securityKeyData .getPublicKey ());
190191 String sessionId = dataStore .storeSessionData (sessionData );
191192
192193 byte [] keyHandle = securityKeyData .getKeyHandle ();
@@ -198,8 +199,8 @@ public U2fSignRequest getSignRequest(String accountName, String appId) throws U2
198199 String keyHandleBase64 = Base64 .encodeBase64URLSafeString (keyHandle );
199200
200201 Log .info ("<< getRegisteredKey " + accountName );
201- registeredKeys .add (new RegisteredKey ( U2FConsts . U2F_V2 , keyHandleBase64 , transports , appId ,
202- sessionId ));
202+ registeredKeys .add (
203+ new RegisteredKey ( U2FConsts . U2F_V2 , keyHandleBase64 , transports , appId , sessionId ));
203204 }
204205
205206 return new U2fSignRequest (challengeBase64 , registeredKeys .build ());
@@ -244,9 +245,11 @@ public SecurityKeyData processSignResponse(SignResponse signResponse) throws U2F
244245 Log .info (" browserData: " + browserData );
245246 Log .info (" rawSignData: " + Hex .encodeHexString (rawSignData ));
246247
247- verifyBrowserData (new JsonParser ().parse (browserData ), "navigator.id.getAssertion" , sessionData );
248+ verifyBrowserData (
249+ new JsonParser ().parse (browserData ), "navigator.id.getAssertion" , sessionData );
248250
249- AuthenticateResponse authenticateResponse = RawMessageCodec .decodeAuthenticateResponse (rawSignData );
251+ AuthenticateResponse authenticateResponse =
252+ RawMessageCodec .decodeAuthenticateResponse (rawSignData );
250253 byte userPresence = authenticateResponse .getUserPresence ();
251254 int counter = authenticateResponse .getCounter ();
252255 byte [] signature = authenticateResponse .getSignature ();
@@ -256,7 +259,7 @@ public SecurityKeyData processSignResponse(SignResponse signResponse) throws U2F
256259 Log .info (" counter: " + counter );
257260 Log .info (" signature: " + Hex .encodeHexString (signature ));
258261
259- if ((userPresence & UserPresenceVerifier .USER_PRESENT_FLAG ) == 0 ) {
262+ if ((userPresence & UserPresenceVerifier .USER_PRESENT_FLAG ) == 0 ) {
260263 throw new U2FException ("User presence invalid during authentication" );
261264 }
262265
@@ -266,24 +269,24 @@ public SecurityKeyData processSignResponse(SignResponse signResponse) throws U2F
266269
267270 byte [] appIdSha256 = cryto .computeSha256 (appId .getBytes ());
268271 byte [] browserDataSha256 = cryto .computeSha256 (browserData .getBytes ());
269- byte [] signedBytes = RawMessageCodec .encodeAuthenticateSignedBytes (appIdSha256 , userPresence ,
270- counter , browserDataSha256 );
272+ byte [] signedBytes = RawMessageCodec .encodeAuthenticateSignedBytes (
273+ appIdSha256 , userPresence , counter , browserDataSha256 );
271274
272275 Log .info ("Verifying signature of bytes " + Hex .encodeHexString (signedBytes ));
273- if (!cryto .verifySignature (cryto . decodePublicKey ( securityKeyData . getPublicKey ()), signedBytes ,
274- signature )) {
276+ if (!cryto .verifySignature (
277+ cryto . decodePublicKey ( securityKeyData . getPublicKey ()), signedBytes , signature )) {
275278 throw new U2FException ("Signature is invalid" );
276279 }
277280
278- dataStore .updateSecurityKeyCounter (sessionData .getAccountName (), securityKeyData .getPublicKey (), counter );
281+ dataStore .updateSecurityKeyCounter (
282+ sessionData .getAccountName (), securityKeyData .getPublicKey (), counter );
279283
280284 Log .info ("<< processSignResponse" );
281285 return securityKeyData ;
282286 }
283287
284- private void verifyBrowserData (JsonElement browserDataAsElement ,
285- String messageType , EnrollSessionData sessionData ) throws U2FException {
286-
288+ private void verifyBrowserData (JsonElement browserDataAsElement , String messageType ,
289+ EnrollSessionData sessionData ) throws U2FException {
287290 if (!browserDataAsElement .isJsonObject ()) {
288291 throw new U2FException ("browserdata has wrong format" );
289292 }
@@ -322,9 +325,8 @@ private void verifyBrowserData(JsonElement browserDataAsElement,
322325
323326 private void verifyOrigin (String origin ) throws U2FException {
324327 if (!allowedOrigins .contains (canonicalizeOrigin (origin ))) {
325- throw new U2FException (origin +
326- " is not a recognized home origin for this backend" +
327- Joiner .on (", " ).join (allowedOrigins ));
328+ throw new U2FException (origin + " is not a recognized home origin for this backend"
329+ + Joiner .on (", " ).join (allowedOrigins ));
328330 }
329331 }
330332
@@ -334,8 +336,7 @@ public List<SecurityKeyData> getAllSecurityKeys(String accountName) {
334336 }
335337
336338 @ Override
337- public void removeSecurityKey (String accountName , byte [] publicKey )
338- throws U2FException {
339+ public void removeSecurityKey (String accountName , byte [] publicKey ) throws U2FException {
339340 dataStore .removeSecuityKey (accountName , publicKey );
340341 }
341342
0 commit comments