Skip to main content

verify_authentication

webauthn_kit::protocol

Function verify_authentication 

Source 
pub fn verify_authentication(
    params: &AuthenticationParams,
) -> Result<AuthenticationResult, WebauthnError>
Expand description

Verify an authentication response with full CTAP2/COSE signature verification.

Verification steps, in order:

  1. Credential ID membership in allowed_credential_ids.
  2. clientDataJSON validation (challenge echo, type == "webauthn.get", origin allow-list, optional rpId cross-check).
  3. Authenticator data parsing and rpIdHash comparison.
  4. User Presence flag + credential-policy flag enforcement (UV, backup).
  5. Sign-count freshness (check_sign_count).
  6. ring signature verification over authenticatorData || SHA-256(clientDataJSON).

§Security notes / threat assumptions

  • challenge_bytes must be consumed from single-use storage before this call; this module does not (and cannot) detect a challenge used twice.
  • On success the caller MUST persist AuthenticationResult::new_sign_count (ideally compare-and-swap) before considering the user logged in.
  • UV is enforced per params.policy.user_verification (UserVerificationPolicy::Required rejects UV-clear assertions); backup eligibility per params.policy.backup. The BE/BS flags are always reported on the result.

§Requirements

REQ-WA-002, REQ-WA-101, REQ-WA-102, REQ-WA-103, REQ-WA-104, REQ-WA-105, REQ-WA-106, REQ-WA-111, REQ-WA-114, REQ-WA-116, REQ-WA-142, REQ-WA-144

Returns the verified authentication data.