checkpoint

This commit is contained in:
caschick221 2024-05-02 13:32:22 -04:00
parent 18507c7d79
commit e512edcde5

View File

@ -31,6 +31,9 @@ creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
On Windows, the native WebAuthn API will be used.
"""
import time
import fido2.webauthn
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client, WindowsClient, UserInteraction
from fido2.server import Fido2Server
@ -40,20 +43,25 @@ import ctypes
from fido2.ctap2 import Ctap2
REGISTER = False
gotAaguid = None
while True:
while True:
dev = next(CtapHidDevice.list_devices(), None)
dev = next(CtapHidDevice.list_devices(), None)
if dev:
ctap2 = Ctap2(dev)
ctap2 = Ctap2(dev)
info = ctap2.get_info()
gotAaguid = info.aaguid
print(str(gotAaguid))
break
info = ctap2.get_info()
aaguid = info.aaguid
print("Waiting for device...")
time.sleep(0.1)
print(str(aaguid))
# Handle user interaction
class CliInteraction(UserInteraction):
# Handle user interaction
class CliInteraction(UserInteraction):
def prompt_up(self):
print("\nTouch your authenticator device now...\n")
@ -63,14 +71,14 @@ class CliInteraction(UserInteraction):
def request_uv(self, permissions, rd_id):
print("User Verification required.")
return True
if REGISTER:
uv = "discouraged"
uv = "discouraged"
if WindowsClient.is_available() and not ctypes.windll.shell32.IsUserAnAdmin():
if WindowsClient.is_available() and not ctypes.windll.shell32.IsUserAnAdmin():
# Use the Windows WebAuthn API if available, and we're not running as admin
client = WindowsClient("https://example.com")
else:
else:
# Locate a device
dev = next(CtapHidDevice.list_devices(), None)
if dev is not None:
@ -97,46 +105,46 @@ else:
print("Authenticator supports User Verification")
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
user = {"id": b"user_id", "name": "A. User"}
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user, user_verification=uv, authenticator_attachment="cross-platform"
)
)
# Create a credential
result = client.make_credential(create_options["publicKey"])
# Create a credential
result = client.make_credential(create_options["publicKey"])
# Complete registration
auth_data = server.register_complete(
# Complete registration
auth_data = server.register_complete(
state, result.client_data, result.attestation_object
)
credentials = [auth_data.credential_data]
)
credentials = [auth_data.credential_data]
AAGUID = auth_data.credential_data.aaguid
cred_id = auth_data.credential_data.credential_id
pk_algo = auth_data.credential_data.public_key.ALGORITHM
pk_1 = auth_data.credential_data.public_key.get(1)
pk_3 = auth_data.credential_data.public_key.get(3)
pk__1 = auth_data.credential_data.public_key.get(-1)
pk__2 = auth_data.credential_data.public_key.get(-2)
pk__3 = auth_data.credential_data.public_key.get(-3)
AAGUID = auth_data.credential_data.aaguid
cred_id = auth_data.credential_data.credential_id
pk_algo = auth_data.credential_data.public_key.ALGORITHM
pk_1 = auth_data.credential_data.public_key.get(1)
pk_3 = auth_data.credential_data.public_key.get(3)
pk__1 = auth_data.credential_data.public_key.get(-1)
pk__2 = auth_data.credential_data.public_key.get(-2)
pk__3 = auth_data.credential_data.public_key.get(-3)
import psycopg2
import psycopg2
# Replace these variables with your connection parameters
dbname = "CNSA-276-FP-DAS"
user = "FP-DEV-USER"
password = "purchase-immortal-prescribe-repave-detention-seizing-candied-antiques-episode-list"
host = "postgres.eggtech.net"
# Replace these variables with your connection parameters
dbname = "CNSA-276-FP-DAS"
user = "FP-DEV-USER"
password = "purchase-immortal-prescribe-repave-detention-seizing-candied-antiques-episode-list"
host = "postgres.eggtech.net"
# Function to connect to the PostgreSQL database and insert data
def insert_data(aaguid, cred_id, pk_algo, pk_1, pk_3, pk__1, pk__2, pk__3):
# Function to connect to the PostgreSQL database and insert data
def insert_data(aaguid, cred_id, pk_algo, pk_1, pk_3, pk__1, pk__2, pk__3):
conn = None
try:
# Connect to the PostgreSQL server
@ -162,8 +170,8 @@ def insert_data(aaguid, cred_id, pk_algo, pk_1, pk_3, pk__1, pk__2, pk__3):
if conn is not None:
conn.close()
# Assuming auth_data is defined and you've extracted your data as you've shown above
insert_data(
# Assuming auth_data is defined and you've extracted your data as you've shown above
insert_data(
AAGUID,
cred_id,
pk_algo,
@ -172,29 +180,115 @@ insert_data(
pk__1,
pk__2,
pk__3
)
)
print("New credential created!")
print("New credential created!")
print("CLIENT DATA:", result.client_data)
print("ATTESTATION OBJECT:", result.attestation_object)
print()
print("CREDENTIAL DATA:", auth_data.credential_data)
print("CLIENT DATA:", result.client_data)
print("ATTESTATION OBJECT:", result.attestation_object)
print()
print("CREDENTIAL DATA:", auth_data.credential_data)
else:
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
uv = "discouraged"
# Set up a FIDO 2 client using the origin https://example.com
client = Fido2Client(dev, "https://example.com", user_interaction=CliInteraction())
import psycopg2
# Replace these variables with your connection parameters
dbname = "CNSA-276-FP-DAS"
user = "FP-DEV-USER"
password = "purchase-immortal-prescribe-repave-detention-seizing-candied-antiques-episode-list"
host = "postgres.eggtech.net"
# Define the SQL query for retrieving data
select_query = '''
SELECT "AAGUID", credential_id, pk_algo, pk_1, pk_3, pk_neg1, pk_neg2, pk_neg3
FROM credential_data
WHERE "AAGUID" = %s;
'''
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
# Function to connect to the PostgreSQL database and retrieve data
def fetch_data(aaguid):
conn = None
try:
# Connect to the PostgreSQL server
conn = psycopg2.connect(dbname=dbname, user=user, password=password, host=host)
cur = conn.cursor()
# Authenticate the credential
result = client.get_assertion(request_options["publicKey"])
# Execute the SQL query
cur.execute(select_query, (gotAaguid,))
# Only one cred in allowCredentials, only one response.
result = result.get_response(0)
# Fetch the results
result = cur.fetchone()
if result:
data = {
"AAGUID": result[0],
"credential_id": result[1],
"pk_algo": result[2],
"pk_1": result[3],
"pk_3": result[4],
"pk_neg1": result[5],
"pk_neg2": result[6],
"pk_neg3": result[7]
}
return data
else:
print("No data found for AAGUID:", aaguid)
return None
# Complete authenticator
server.authenticate_complete(
# Close communication with the database
cur.close()
except (Exception, psycopg2.DatabaseError) as error:
print(error)
finally:
if conn is not None:
conn.close()
# Example usage: Fetch data for a specific AAGUID and store in variables
aaguid_data = fetch_data("your_specific_aaguid_here")
if aaguid_data:
# Store each piece of data into a separate variable
testa = aaguid_data["AAGUID"]
cred_id = aaguid_data["credential_id"]
pk_algo = aaguid_data["pk_algo"]
pk_1 = aaguid_data["pk_1"]
pk_3 = aaguid_data["pk_3"]
pk_neg1 = aaguid_data["pk_neg1"]
pk_neg2 = aaguid_data["pk_neg2"]
pk_neg3 = aaguid_data["pk_neg3"]
auth_data = fido2.webauthn.AttestedCredentialData(testa, cred_id, pk_algo)
# auth_data.aaguid = AAGUID
# auth_data.credential_id = cred_id
# auth_data.public_key.ALGORITHM= pk_algo
# auth_data.public_key.setdefault(1, pk_1)
# auth_data.public_key.setdefault(3, pk_3)
# auth_data.public_key.setdefault(-1, pk__1)
# auth_data.public_key.setdefault(-2, pk__2)
# auth_data.public_key.setdefault(-3,pk__3)
credentials = [auth_data]
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
# Authenticate the credential
result = client.get_assertion(request_options["publicKey"])
# Only one cred in allowCredentials, only one response.
result = result.get_response(0)
# Complete authenticator
server.authenticate_complete(
state,
credentials,
@ -202,10 +296,10 @@ server.authenticate_complete(
result.client_data,
result.authenticator_data,
result.signature,
)
)
print("Credential authenticated!")
print("Credential authenticated!")
print("CLIENT DATA:", result.client_data)
print()
print("AUTH DATA:", result.authenticator_data)
print("CLIENT DATA:", result.client_data)
print()
print("AUTH DATA:", result.authenticator_data)