FIDO_CRED_VERIFY(3)

💖 FIDO_CRED_VERIFY(3) 💖

okay bestie, buckle up, we're in the Library Functions Manual and this one is the vibe check for attestation signatures. the stars of the show are fido_cred_verify and fido_cred_verify_self — two functions whose whole job is to verify the attestation signature of a FIDO2 credential. yes queen, we're doing crypto forensics today ✨

🌸 NAME 🌸

fido_cred_verify, fido_cred_verify_self — verify the attestation signature of a FIDO2 credential

🎀 SYNOPSIS 🎀

#include <fido.h>

int
fido_cred_verify(const fido_cred_t *cred);

int
fido_cred_verify_self(const fido_cred_t *cred);

✨ DESCRIPTION ✨

so like, both fido_cred_verify() and fido_cred_verify_self() are here to verify whether the attestation signature chillin' inside cred actually matches the attributes of the credential. like, does the math check out, does the signature line up. that's the whole assignment 💅

⚠️ real talk bestie: before you use fido_cred_verify() or fido_cred_verify_self() in a sensitive context, the reader is strongly encouraged to make herself familiar with the FIDO2 credential attestation process as defined in the Web Authentication (webauthn) standard. do not skip the homework, i am begging 🙈

🔥 fido_cred_verify()

this one verifies whether the following attributes of cred have been attested by the holder of the private counterpart of the public key contained in the credential's x509 certificate:

• client data hash
• relying party ID
• credential ID
• type
• protection policy
• minimum PIN length
• resident/discoverable key attribute
• user verification attribute

and please note: the x509 certificate itself is not verified. nope. not it. that part is on you 🫶

the attestation statement formats supported by fido_cred_verify() are:

• packed
• fido-u2f
• tpm

the attestation type implemented by fido_cred_verify() is Basic Attestation. iconic behavior, no cap 👑

🦋 fido_cred_verify_self()

this one verifies whether these attributes of cred have been attested by the holder of the credential's private key:

• client data hash
• relying party ID
• credential ID
• type
• protection policy
• minimum PIN length
• resident/discoverable key attribute
• user verification attribute

the attestation statement formats supported by fido_cred_verify_self() are:

• packed
• fido-u2f

the attestation type implemented by fido_cred_verify_self() is Self Attestation. she's self-made, she's independent 💅✨

other attestation formats and types are not supported. that's the limit, that's the boundary, that's the whole entire perimeter. periodt. 💀

🌈 RETURN VALUES 🌈

the error codes returned by fido_cred_verify() and fido_cred_verify_self() are defined in <fido/err.h>. and if cred passes verification? then FIDO_OK is returned. slay. we love a happy ending 🎉

👑 SEE ALSO 👑

• fido_cred_new(3)
• fido_cred_set_authdata(3)

and that's the whole page bestie!! this lil bop came to you courtesy of Debian, dated May 23, 2018, living under the manual name FIDO_CRED_VERIFY(3). go forth, verify those attestation signatures, and stay iconic 💖🧚✨