fido2.ctap2.extensions

Classes

`ExtensionProcessor`	Base class for CTAP2 extension processing.
`RegistrationExtensionProcessor`	Processing state for a CTAP2 extension, for single use.
`AuthenticationExtensionProcessor`	Processing state for a CTAP2 extension, for single use.
`Ctap2Extension`	Base class for CTAP2 extensions.
`HMACGetSecretInput`	Client inputs for hmac-secret.
`HMACGetSecretOutput`	Client outputs for hmac-secret.
`AuthenticatorExtensionsPRFValues`	Salt values for use with prf.
`AuthenticatorExtensionsPRFInputs`	Client inputs for prf.
`AuthenticatorExtensionsPRFOutputs`	Client outputs for prf.
`HmacSecretExtension`	Implements the Pseudo-random function (prf) and the hmac-secret CTAP2 extensions.
`AuthenticatorExtensionsLargeBlobInputs`	Client inputs for largeBlob.
`AuthenticatorExtensionsLargeBlobOutputs`	Client outputs for largeBlob.
`LargeBlobExtension`	Implements the Large Blob storage (largeBlob) WebAuthn extension.
`CredBlobExtension`	Implements the Credential Blob (credBlob) CTAP2 extension.
`CredProtectExtension`	Implements the Credential Protection CTAP2 extension.
`MinPinLengthExtension`	Implements the Minimum PIN Length (minPinLength) CTAP2 extension.
`CredentialPropertiesOutput`	Client outputs for credProps.
`CredPropsExtension`	Implements the Credential Properties (credProps) WebAuthn extension.

Module Contents

class fido2.ctap2.extensions.ExtensionProcessor(permissions=ClientPin.PERMISSION(0), inputs=None, outputs=None)[source]

Bases: abc.ABC

Base class for CTAP2 extension processing.

See: RegistrationExtensionProcessor and AuthenticationExtensionProcessor.

Parameters:

permissions (fido2.ctap2.pin.ClientPin.PERMISSION)
inputs (Optional[Dict[str, Any]])
outputs (Optional[Dict[str, Any]])

permissions

class fido2.ctap2.extensions.RegistrationExtensionProcessor(permissions=ClientPin.PERMISSION(0), inputs=None, outputs=None)[source]

Bases: ExtensionProcessor

Processing state for a CTAP2 extension, for single use.

The ExtensionProcessor holds state and logic for client processing of an extension, for a registration (MakeCredential) call.

Parameters:

permissions (fido2.ctap2.pin.ClientPin.PERMISSION) – PinUvAuthToken permissions required by the extension.
inputs (Optional[Dict[str, Any]]) – Default authenticator inputs, if prepare_inputs is not overridden.
outputs (Optional[Dict[str, Any]]) – Default client outputs, if prepare_outputs is not overridden.

prepare_inputs(pin_token)[source]

Prepare authenticator extension inputs, to be passed to the Authenenticator.

Parameters:: pin_token (Optional[bytes])
Return type:: Optional[Dict[str, Any]]

prepare_outputs(response, pin_token)[source]

Prepare client extension outputs, to be returned to the caller.

Parameters:

response (fido2.ctap2.base.AttestationResponse)
pin_token (Optional[bytes])

Return type:

Optional[Dict[str, Any]]

class fido2.ctap2.extensions.AuthenticationExtensionProcessor(permissions=ClientPin.PERMISSION(0), inputs=None, outputs=None)[source]

Bases: ExtensionProcessor

Processing state for a CTAP2 extension, for single use.

The ExtensionProcessor holds state and logic for client processing of an extension, for an authentication (GetAssertion) call.

Parameters:

permissions (fido2.ctap2.pin.ClientPin.PERMISSION) – PinUvAuthToken permissions required by the extension.
inputs (Optional[Dict[str, Any]]) – Default authenticator inputs, if prepare_inputs is not overridden.
outputs (Optional[Dict[str, Any]]) – Default client outputs, if prepare_outputs is not overridden.

prepare_inputs(selected, pin_token)[source]

Prepare authenticator extension inputs, to be passed to the Authenenticator.

Parameters:

selected (Optional[fido2.webauthn.PublicKeyCredentialDescriptor])
pin_token (Optional[bytes])

Return type:

Optional[Dict[str, Any]]

prepare_outputs(response, pin_token)[source]

Prepare client extension outputs, to be returned to the caller.

Parameters:

response (fido2.ctap2.base.AssertionResponse)
pin_token (Optional[bytes])

Return type:

Optional[Dict[str, Any]]

class fido2.ctap2.extensions.Ctap2Extension(ctap=None)[source]

Bases: abc.ABC

Base class for CTAP2 extensions.

As of python-fido2 1.2 these instances can be used for multiple requests and should be invoked via the make_credential and get_assertion methods. Subclasses are instantiated for a single request, if the Authenticator supports the extension.

From python-fido2 2.0 the following methods will be fully removed:: get_create_permissions, process_create_input, process_create_output, process_create_input_with_permissions, get_get_permissions, process_get_input, process_get_output, process_get_input_with_permissions.
The following changes will also be made:: __init__() will no longer allow passing a ctap2 instance. is_supported() will require a ctap2 instance to be passed. NAME and ctap will be removed.

Parameters:: ctap (Optional[fido2.ctap2.base.Ctap2])

NAME: str = None

property ctap: fido2.ctap2.base.Ctap2

Return type:: fido2.ctap2.base.Ctap2

is_supported(ctap=None)[source]

Whether or not the extension is supported by the authenticator.

Parameters:: ctap (Optional[fido2.ctap2.base.Ctap2])
Return type:: bool

make_credential(ctap, options, pin_protocol)[source]

Start client extension processing for registration.

Parameters:

ctap (fido2.ctap2.base.Ctap2)
options (fido2.webauthn.PublicKeyCredentialCreationOptions)
pin_protocol (Optional[fido2.ctap2.pin.PinProtocol])

Return type:

Optional[RegistrationExtensionProcessor]

get_assertion(ctap, options, pin_protocol)[source]

Start client extension processing for authentication.

Parameters:

ctap (fido2.ctap2.base.Ctap2)
options (fido2.webauthn.PublicKeyCredentialRequestOptions)
pin_protocol (Optional[fido2.ctap2.pin.PinProtocol])

Return type:

Optional[AuthenticationExtensionProcessor]

get_create_permissions(inputs)[source]

Get PinUvAuthToken permissions required for Registration.

Deprecated since version 1.2.0: Implement make_credential() instead.

Parameters:: inputs (Dict[str, Any])
Return type:: fido2.ctap2.pin.ClientPin.PERMISSION

process_create_input(inputs)[source]

Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

Parameters:: inputs (Dict[str, Any])
Return type:: Any

process_create_input_with_permissions(inputs)[source]

Deprecated since version 1.2.0: Implement make_credential() instead.

Parameters:: inputs (Dict[str, Any])
Return type:: Tuple[Any, fido2.ctap2.pin.ClientPin.PERMISSION]

process_create_output(attestation_response, token, pin_protocol)[source]

Return client extension output given attestation_response, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

Parameters:

attestation_response (fido2.ctap2.base.AttestationResponse)
token (Optional[bytes])
pin_protocol (Optional[fido2.ctap2.pin.PinProtocol])

Return type:

Optional[Dict[str, Any]]

get_get_permissions(inputs)[source]

Deprecated since version 1.2.0: Implement get_assertion() instead.

Parameters:: inputs (Dict[str, Any])
Return type:: fido2.ctap2.pin.ClientPin.PERMISSION

process_get_input(inputs)[source]

Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement get_assertion() instead.

Parameters:: inputs (Dict[str, Any])
Return type:: Any

process_get_input_with_permissions(inputs)[source]

Deprecated since version 1.2.0: Implement get_assertion() instead.

Parameters:: inputs (Dict[str, Any])
Return type:: Tuple[Any, fido2.ctap2.pin.ClientPin.PERMISSION]

process_get_output(assertion_response, token, pin_protocol)[source]

Return client extension output given assertion_response, or None.

Deprecated since version 1.2.0: Implement get_assertion() instead.

Parameters:

assertion_response (fido2.ctap2.base.AssertionResponse)
token (Optional[bytes])
pin_protocol (Optional[fido2.ctap2.pin.PinProtocol])

Return type:

Optional[Dict[str, Any]]

class fido2.ctap2.extensions.HMACGetSecretInput[source]

Bases: fido2.utils._JsonDataObject

Client inputs for hmac-secret.

salt1: bytes

salt2: bytes | None = None

class fido2.ctap2.extensions.HMACGetSecretOutput[source]

Bases: fido2.utils._JsonDataObject

Client outputs for hmac-secret.

output1: bytes

output2: bytes | None = None

class fido2.ctap2.extensions.AuthenticatorExtensionsPRFValues[source]

Bases: fido2.utils._JsonDataObject

Salt values for use with prf.

first: bytes

second: bytes | None = None

class fido2.ctap2.extensions.AuthenticatorExtensionsPRFInputs[source]

Bases: fido2.utils._JsonDataObject

Client inputs for prf.

eval: AuthenticatorExtensionsPRFValues | None = None

eval_by_credential: Mapping[str, AuthenticatorExtensionsPRFValues] | None = None

class fido2.ctap2.extensions.AuthenticatorExtensionsPRFOutputs[source]

Bases: fido2.utils._JsonDataObject

Client outputs for prf.

enabled: bool | None = None

results: AuthenticatorExtensionsPRFValues | None = None

class fido2.ctap2.extensions.HmacSecretExtension(ctap=None, pin_protocol=None, allow_hmac_secret=False)[source]

Bases: Ctap2Extension

Implements the Pseudo-random function (prf) and the hmac-secret CTAP2 extensions.

The hmac-secret extension is not directly available to clients by default, instead the prf extension is used.

https://www.w3.org/TR/webauthn-3/#prf-extension

https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-hmac-secret-extension

Parameters:: allow_hmac_secret – Set to True to allow hmac-secret, in addition to prf.

NAME = 'hmac-secret'

SALT_LEN = 32

pin_protocol

make_credential(ctap, options, pin_protocol)[source]: Start client extension processing for registration.

get_assertion(ctap, options, pin_protocol)[source]: Start client extension processing for authentication.

process_create_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

process_create_output(attestation_response, *args, **kwargs)[source]: Return client extension output given attestation_response, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

process_get_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement get_assertion() instead.

process_get_output(assertion_response, *args, **kwargs)[source]: Return client extension output given assertion_response, or None.

Deprecated since version 1.2.0: Implement get_assertion() instead.

class fido2.ctap2.extensions.AuthenticatorExtensionsLargeBlobInputs[source]

Bases: fido2.utils._JsonDataObject

Client inputs for largeBlob.

support: str | None = None

read: bool | None = None

write: bytes | None = None

class fido2.ctap2.extensions.AuthenticatorExtensionsLargeBlobOutputs[source]

Bases: fido2.utils._JsonDataObject

Client outputs for largeBlob.

supported: bool | None = None

blob: bytes | None = None

written: bool | None = None

class fido2.ctap2.extensions.LargeBlobExtension(ctap=None)[source]

Bases: Ctap2Extension

Implements the Large Blob storage (largeBlob) WebAuthn extension.

https://www.w3.org/TR/webauthn-3/#sctn-large-blob-extension

Parameters:: ctap (Optional[fido2.ctap2.base.Ctap2])

NAME = 'largeBlobKey'

is_supported(ctap=None)[source]: Whether or not the extension is supported by the authenticator.

make_credential(ctap, options, pin_protocol)[source]: Start client extension processing for registration.

get_assertion(ctap, options, pin_protocol)[source]: Start client extension processing for authentication.

process_create_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

process_create_output(attestation_response, *args, **kwargs)[source]: Return client extension output given attestation_response, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

get_get_permissions(inputs)[source]: Deprecated since version 1.2.0: Implement get_assertion() instead.

process_get_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement get_assertion() instead.

process_get_output(assertion_response, token, pin_protocol)[source]: Return client extension output given assertion_response, or None.

Deprecated since version 1.2.0: Implement get_assertion() instead.

class fido2.ctap2.extensions.CredBlobExtension(ctap=None)[source]

Bases: Ctap2Extension

Implements the Credential Blob (credBlob) CTAP2 extension.

https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credBlob-extension

Parameters:: ctap (Optional[fido2.ctap2.base.Ctap2])

NAME = 'credBlob'

make_credential(ctap, options, pin_protocol)[source]: Start client extension processing for registration.

get_assertion(ctap, options, pin_protocol)[source]: Start client extension processing for authentication.

process_create_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

process_get_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement get_assertion() instead.

class fido2.ctap2.extensions.CredProtectExtension(ctap=None)[source]

Bases: Ctap2Extension

Implements the Credential Protection CTAP2 extension.

https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credProtect-extension

Parameters:: ctap (Optional[fido2.ctap2.base.Ctap2])

class POLICY(*args, **kwds)[source]

Bases: enum.Enum

Create a collection of name/value pairs.

Example enumeration:

>>> class Color(Enum):
...     RED = 1
...     BLUE = 2
...     GREEN = 3

Access them by:

attribute access:
```
>>> Color.RED
<Color.RED: 1>
```
value lookup:
```
>>> Color(1)
<Color.RED: 1>
```
name lookup:
```
>>> Color['RED']
<Color.RED: 1>
```

Enumerations can be iterated over, and know how many members they have:

>>> len(Color)
3

>>> list(Color)
[<Color.RED: 1>, <Color.BLUE: 2>, <Color.GREEN: 3>]

Methods can be added to enumerations, and members can have their own attributes – see the documentation for details.

OPTIONAL = 'userVerificationOptional'

OPTIONAL_WITH_LIST = 'userVerificationOptionalWithCredentialIDList'

REQUIRED = 'userVerificationRequired'

NAME = 'credProtect'

make_credential(ctap, options, pin_protocol)[source]: Start client extension processing for registration.

process_create_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

class fido2.ctap2.extensions.MinPinLengthExtension(ctap=None)[source]

Bases: Ctap2Extension

Implements the Minimum PIN Length (minPinLength) CTAP2 extension.

https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-minpinlength-extension

Parameters:: ctap (Optional[fido2.ctap2.base.Ctap2])

NAME = 'minPinLength'

is_supported(ctap=None)[source]: Whether or not the extension is supported by the authenticator.

make_credential(ctap, options, pin_protocol)[source]: Start client extension processing for registration.

process_create_input(inputs)[source]: Returns a value to include in the authenticator extension input, or None.

Deprecated since version 1.2.0: Implement make_credential() instead.

class fido2.ctap2.extensions.CredentialPropertiesOutput[source]

Bases: fido2.utils._JsonDataObject

Client outputs for credProps.

rk: bool | None = None

class fido2.ctap2.extensions.CredPropsExtension(ctap=None)[source]

Bases: Ctap2Extension

Implements the Credential Properties (credProps) WebAuthn extension.

https://www.w3.org/TR/webauthn-3/#sctn-authenticator-credential-properties-extension

Parameters:: ctap (Optional[fido2.ctap2.base.Ctap2])

NAME = 'credProps'

is_supported(ctap=None)[source]: Whether or not the extension is supported by the authenticator.

make_credential(ctap, options, pin_protocol)[source]: Start client extension processing for registration.