The default MDS could not be parsed and verified as of June 3, 2023

Describe the issue

As of June 3, 2023, MetadataService could not initialize metadata from the default FIDO Alliance MDS ('https://mds.fidoalliance.org/).

Reproduction Steps

On an empty nodejs env
Initiate MetadataService with MetadataService.initialize().
After the promise is resolved, try to get a statement for a well-known aaguid that exists in https://mds.fidoalliance.org with MetadataService.getStatement('ee882879-721c-4913-9775-3dfcce97072a')
Get an undefined value.

Expected behavior

...

Get a statement object about existing aaguid.

Code Samples + WebAuthn Options and Responses

Logs of the MetadataService are:

  SimpleWebAuthn:MetadataService MetadataService is REFRESHING +0ms
  SimpleWebAuthn:MetadataService Could not download BLOB from https://mds.fidoalliance.org/: Error: BLOB certificate path could not be validated: Too big integer
    at BaseMetadataService.downloadBlob (REDACTED/SimpleWebAuthn/packages/server/src/services/metadataService.ts:233:13)
    at BaseMetadataService.initialize (REDACTED/SimpleWebAuthn/packages/server/src/services/metadataService.ts:112:11)
    at Object.<anonymous> (REDACTED/SimpleWebAuthn/packages/server/src/services/metadataService.test.ts:14:5) +1s
  SimpleWebAuthn:MetadataService Cached 0 statements from 0 metadata server(s) +8ms
  SimpleWebAuthn:MetadataService MetadataService is READY +0ms

Here is a test code that might be helpful for reproduction. The fetch was not mocked intentionally to receive actual Metadata BLOB.

metadataService.test.ts

```ts import fetch from 'cross-fetch'; import { MetadataService, BaseMetadataService } from './metadataService'; describe('Get known aaguid metadata statement for live metadata BLOB', () => { test('should return actual statement for a known aagiud', async () => { const service = new BaseMetadataService(); await service.initialize(); const statement = await service.getStatement('ee882879-721c-4913-9775-3dfcce97072a'); console.log('statement', statement); expect(statement).toBeDefined(); }); }); ```

Dependencies

OS: MacOS 13.4
Browser: Not Applicable
Authenticator: Not Applicable

SimpleWebAuthn Libraries

$ npm list --depth=0 | grep @simplewebauthn
├── @simplewebauthn/server@7.2.0
# ...

Additional context

The investigation showed that certificate normalization missed the case when PEM includes extra whitespaces, which was the case for one of the certificates in the path (notice the leading whitespace chars at the beginning of each line:

After fixing this locally by modifying convertPEMToBytes helper, I found another error:

SimpleWebAuthn:MetadataService MetadataService is REFRESHING +0ms
SimpleWebAuthn:MetadataService Could not download BLOB from https://mds.fidoalliance.org/: Error: JWT verification with public key of kty 3 is not supported by this method
at verifyJWT (REDACTED/SimpleWebAuthn/packages/server/src/metadata/verifyJWT.ts:31:9)
at BaseMetadataService.downloadBlob (REDACTED/SimpleWebAuthn/packages/server/src/services/metadataService.ts:238:37)
at BaseMetadataService.initialize (REDACTED/SimpleWebAuthn/packages/server/src/services/metadataService.ts:112:11)
at Object.<anonymous> (REDACTED/SimpleWebAuthn/packages/server/src/services/metadataService.test.ts:13:5) +2s
SimpleWebAuthn:MetadataService Cached 0 statements from 0 metadata server(s) +7ms
SimpleWebAuthn:MetadataService MetadataService is READY +0ms

It seems that the official FIDO MDN now using RSA instead of the expected EC2.

After locally modifying verifyJWT helper to support RSA using isoCrypto/verifyRSA.ts, metadata was successfully validated, and metadata for sample AAGUID was obtained.

These modifications could be looked at here: https://github.com/MasterKale/SimpleWebAuthn/compare/master...WorldThirteen:SimpleWebAuthn:w13-metadata-service-june-fix?expand=1

@MasterKale, would you like to receive a PR with the fixes I mentioned in the "Additional context" section?

MasterKale / SimpleWebAuthn