Migrating U2F to WebAuthn gem in Ruby, where to get the parameters for AuthenticatorAttestationResponse

Question

I have a couple of questions about the WebAuthn gem and the use of U2fMigrator. I hope someone can point me in the right direction about it. I am in the step just after converting my old U2F credentials using U2fMigrator.

migrated_credential = WebAuthn::U2fMigrator.new(
        app_id: my_domain,
        certificate: u2f_registration.certificate,
        key_handle: u2f_registration.key_handle,
        public_key: u2f_registration.binary_public_key,
        counter: u2f_registration.counter
)

The documentation says: “U2fMigrator class quacks like WebAuthn::AuthenticatorAttestationResponse” but without verify implementation.

Does that mean I need to create an instance of this AuthenticatorAttestationResponse for authentication?

If so. Where I should get this data from?

assertion_response = WebAuthn::AuthenticatorAssertionResponse.new(
        credential_id: '',
        authenticator_data: '',
        client_data_json: '',
        signature: '',
 )

I am guessing that will allow me to authenticate the new migrated credentials like this:

assertion_response.verify(
        WebAuthn::Credential.options_for_get(:extensions => { appid: my_domain }).challenge,
        allowed_creadentials: migrated_credential.credential,
        rp_id: my_domain
)

And also, I am guessing I don't need to re-register these credentials yet.

I am following this documentation:

UPDATE 1

I've found this cool explanation in this guide

I will dig into it and I'll post the solution if I can find it.

UPDATE 2

I've spent the whole week trying to get the authenticatorAssertionResponse

from

Unfortunately, I only get a message saying I don't have a key registered:

I'm passing through the extension and appid where the U2F credential was registered originally. I wonder if it stoped working now the deprecation is complete.

score 0 · Answer 1 · answered Feb 06 '22 at 00:06

U2fMigrator is instantiated with data that's already stored in your database. Instances of it respond to the same methods as AuthenticatorAttestationResponse, except it misses a verify method since the data was already verified in the past. In other words: the migrator behaves nearly the same as a freshly WebAuthn registered authenticator and it is meant to be used as such.

Does that mean I need to create an instance of this AuthenticatorAttestationResponse for authentication?

Yes. The AuthenticatorAttestationResponse is instantiated with browser data from the WebAuthn navigator.credentials.get call. This in itself is unrelated to the U2F migration question, except for the part where the data comes from for its verify method. This comes either from a migrator instance (in the "real time conversion" approach) or is retrieved from the database.

Hope that makes sense, PRs welcome to improve the docs!

Migrating U2F to WebAuthn gem in Ruby, where to get the parameters for AuthenticatorAttestationResponse

1 Answers1