Use MDS 3.0 version to download metadata TOC blob for fido2 server implementation

[maduvena]

Details here - https://fidoalliance.org/metadata/

No need of authorization, There is no need to download individual metadata anymore. New MDS3 BLOB contains ALL metadata statements in one JSON.

We just need to download it at first run (or at install time). And re-download when it will expire (date specified in jwt)

[maduvena]

Sub- task

• [x] feat(jans-fido2) : All authenticators listed in rogueList and rogueListHash in metadata blob - MUST be ignored by FIDO server
• [x] feat(jans-fido2) : FIDO server MUST ignore all authenticators with invalid status - StatusReport in metadata blob has status field
• [ ] Support for ED25519 , RS1
• [x] feat(jans-fido2) : CRL check for all authenticators
• [ ] feat(jans-fido2) : Make MDS and attestation optional

[Milton-Ch]

Sub- task

• [x] feat(jans-fido2) : All authenticators listed in rogueList and rogueListHash in metadata blob - MUST be ignored by FIDO server
• [x] feat(jans-fido2) : FIDO server MUST ignore all authenticators with invalid status - StatusReport in metadata blob has status field
• [ ] Support for ED256 - currently JOSE library doesnt support it https://fidoalliance.org/specs/mds/fido-metadata-statement-v3.0-ps-20210518.html Section 3.9 from the document
• [x] feat(jans-fido2) : CRL check for all authenticators
• [ ] feat(jans-fido2) : Make MDS and attestation optional

We have done an analysis of subtask 1, for now it is not necessary to implement it for some reasons:

• The documentation is not very clear.
• And currently, when we find a new version of the TOC file, we restart the cache and do the whole loading process, performing the validations according to the specifications.
• If the cache was not restarted, we would have to go through the list of entries in the TOC file and delete the ones we loaded in the cache (but we don't do that).
• Finally, I checked the certified open source projects and can't find any implementation of rogueList.

[yurem]

I agree with @Milton-Ch about this. Also, I think this part might be keep for compatibility reasons in MDS 3. I found some notes about rogue List in very old UAF documentation: https://fidoalliance.org/specs/fido-uaf-v1.1-id-20170202/FIDO-UAF-COMPLETE-v1.1-id-20170202.pdf which just copied to MDS 3.0 spec without adding any additional description.

[yackermann]

rogueList can be ignored, as it is for legacy ECDAA attestation, and was never implemented.