search

MasterKale / SimpleWebAuthn

WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.
https://simplewebauthn.dev
MIT License
1.62k stars 137 forks source link

Fix IBM identifier in `TPM_MANUFACTURERS` #604

Closed MasterKale closed 2 months ago

MasterKale commented 2 months ago

Describe the issue

The TPM spec says that TPMManufacturer values in a TPM attestation should use capital letters exclusively:

The value of the TPMManufacturer attribute MUST be the ASCII representation of the hexadecimal value of the 4 byte vendor identifier defined in the TCG Vendor ID Registry[3]. Each byte is represented individually as a two digit unsigned hexadecimal number using the characters 0-9 and A-F. The result is concatenated together to form an 8 character name which is appended after the lower-case ASCII characters “id:”.

For example, the vendorId 0x12 0x34 0x56 0xEF would be encoded as “id:123456EF”.

The identifier for IBM has included a lowercase "d" for a while now. I should fix that. See here:

https://github.com/MasterKale/SimpleWebAuthn/blob/dc70416e781c9ab11625ba9afbf092809391874e/packages/server/src/registration/verifications/tpm/constants.ts#L117

MasterKale commented 2 months ago

Frustratingly the lowercase letter is present in this other spec listing manufacturer IDs:

https://trustedcomputinggroup.org/wp-content/uploads/TCG-TPM-Vendor-ID-Registry-Family-1.2-and-2.0-Version-1.06-Revision-0.96_pub.pdf

Screenshot 2024-09-10 at 2 35 44 PM

A couple of options here:

  1. Update the existing entry so IBM has a single entry with 'id:49424D00'
  2. Add a new entry for IBM with 'id:49424D00' (so IBM ends up with two entries)
  3. Do some bytes comparison via string manipulation on the values after id:

Option 2 is looking pretty good to me 🤔