Upgrading webauthn 0.4 to 1

Breaking0.4.7 → 1.11.1Breaking3New15Changed9Fixed7Other2

Full comparison Back to webauthn

BreakingUpgrade verdict

3 breaking changes.

In plain terms

The list of transports (such as USB or NFC) is now read from the credential's response object instead of the credential itself.
The library now uses different internal data-handling tools, which changes how it behaves alongside other packages that use custom byte types for credential IDs and public keys.
The library has been rewritten, so code written for older versions will not work and must be updated.

Must act 3 items need code or config changes

Adds asn1crypto >=1.4.0, pydantic >=1.10.11.

Drops future, six.

Installs 11 packages in all (was 7).

What you must change

Breaking3

Moves the RegistrationCredential.transports property to RegistrationCredential.response.transports to match upcoming WebAuthn JSON serialization output.

RegistrationCredential.transportsRegistrationCredential.response.transports

1.8.0GitHub ReleaseSummarizedView source

Switches from Pydantic to attrs + cattrs, changing library behavior for projects using bytes subclasses for credential IDs and public keys.

attrscattrsPydantic

1.2.0GitHub ReleaseSummarizedView source

Replaces the library's API with an entirely new API.

1.0.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

removed: export WebAuthnAssertionOptions
removed: export WebAuthnAssertionResponse
removed: export WebAuthnCredential
removed: export WebAuthnMakeCredentialOptions
removed: export WebAuthnRegistrationResponse
removed: export WebAuthnUser
added: export base64url_to_bytes
added: export generate_authentication_options
added: export generate_registration_options
added: export options_to_json
added: export verify_authentication_response
added: export verify_registration_response

added: function generate_authentication_options(*, rp_id: str, challenge: Optional[bytes]=…, timeout: int=…, allow_credentials: Optional[List[PublicKeyCredentialDescriptor]]=…, user_verification: UserVerificationRequirement=…) -> PublicKeyCredentialRequestOptions

added: class VerifiedAuthentication(WebAuthnBaseModel)
added: field VerifiedAuthentication.credential_backed_up: bool
added: field VerifiedAuthentication.credential_device_type: CredentialDeviceType
added: field VerifiedAuthentication.credential_id: bytes
added: field VerifiedAuthentication.new_sign_count: int
added: function verify_authentication_response(*, credential: Union[str, dict, AuthenticationCredential], expected_challenge: bytes, expected_rp_id: str, expected_origin: Union[str, List[str]], credential_public_key: bytes, credential_current_sign_count: int, require_user_verification: bool=…) -> VerifiedAuthentication
added: variable expected_token_binding_statuses

removed: variable ATTESTATION_DATA_INCLUDED
removed: variable EXTENSION_DATA_INCLUDED
removed: variable USER_PRESENT
removed: variable USER_VERIFIED

added: export aaguid_to_string
added: export base64url_to_bytes
added: export bytes_to_base64url
added: export decode_credential_public_key
added: export decoded_public_key_to_cryptography
added: export generate_challenge
added: export generate_user_handle
added: export hash_by_alg
added: export json_loads_base64url_to_bytes
added: export options_to_json
added: export parse_attestation_object
added: export parse_authentication_credential_json
added: export parse_authenticator_data
added: export parse_backup_flags
added: export parse_cbor
added: export parse_client_data_json
added: export parse_registration_credential_json
added: export validate_certificate_chain
added: export verify_safetynet_timestamp
added: export verify_signature

added: function aaguid_to_string(val: bytes) -> str

added: function get_ec2_curve(crv_id: COSECRV) -> EllipticCurve
added: function get_ec2_sig_alg(alg_id: COSEAlgorithmIdentifier) -> EllipticCurveSignatureAlgorithm
added: function get_rsa_pkcs1_sig_alg(alg_id: COSEAlgorithmIdentifier) -> HashAlgorithm
added: function get_rsa_pss_sig_alg(alg_id: COSEAlgorithmIdentifier) -> HashAlgorithm
added: function is_rsa_pkcs(alg_id: COSEAlgorithmIdentifier) -> bool
added: function is_rsa_pss(alg_id: COSEAlgorithmIdentifier) -> bool

added: class AuthorizationList(Sequence)
added: class Integers(SetOf)
added: class KeyDescription(Sequence)
added: class KeyOrigin(int, Enum)
added: class KeyPurpose(int, Enum)
added: class RootOfTrust(Sequence)
added: class SecurityLevel(Enumerated)
added: class VerifiedBootState(Enumerated)
added: field KeyOrigin.DERIVED
added: field KeyOrigin.GENERATED
added: field KeyOrigin.IMPORTED
added: field KeyOrigin.UNKNOWN
added: field KeyPurpose.DECRYPT
added: field KeyPurpose.DERIVE_KEY
added: field KeyPurpose.ENCRYPT
added: field KeyPurpose.SIGN
added: field KeyPurpose.VERIFY
added: field KeyPurpose.WRAP_KEY

added: function base64url_to_bytes(val: str) -> bytes

added: function bytes_to_base64url(val: bytes) -> str

added: class COSEAlgorithmIdentifier(int, Enum)
added: class COSECRV(int, Enum)
added: class COSEKTY(int, Enum)
added: class COSEKey(int, Enum)
added: field COSEAlgorithmIdentifier.ECDSA_SHA_256
added: field COSEAlgorithmIdentifier.ECDSA_SHA_512
added: field COSEAlgorithmIdentifier.EDDSA
added: field COSEAlgorithmIdentifier.RSASSA_PKCS1_v1_5_SHA_1
added: field COSEAlgorithmIdentifier.RSASSA_PKCS1_v1_5_SHA_256
added: field COSEAlgorithmIdentifier.RSASSA_PKCS1_v1_5_SHA_384
added: field COSEAlgorithmIdentifier.RSASSA_PKCS1_v1_5_SHA_512
added: field COSEAlgorithmIdentifier.RSASSA_PSS_SHA_256
added: field COSEAlgorithmIdentifier.RSASSA_PSS_SHA_384
added: field COSEAlgorithmIdentifier.RSASSA_PSS_SHA_512
added: field COSECRV.ED25519
added: field COSECRV.P256
added: field COSECRV.P384
added: field COSECRV.P521
added: field COSEKTY.EC2
added: field COSEKTY.OKP
added: field COSEKTY.RSA
added: field COSEKey.ALG
added: field COSEKey.CRV
added: field COSEKey.E
added: field COSEKey.KTY
added: field COSEKey.N
added: field COSEKey.X
added: field COSEKey.Y

added: class DecodedEC2PublicKey(BaseModel)
added: class DecodedOKPPublicKey(BaseModel)
added: class DecodedRSAPublicKey(BaseModel)
added: field DecodedEC2PublicKey.alg: COSEAlgorithmIdentifier
added: field DecodedEC2PublicKey.crv: COSECRV
added: field DecodedEC2PublicKey.kty: COSEKTY
added: field DecodedEC2PublicKey.x: bytes
added: field DecodedEC2PublicKey.y: bytes
added: field DecodedOKPPublicKey.alg: COSEAlgorithmIdentifier
added: field DecodedOKPPublicKey.crv: COSECRV
added: field DecodedOKPPublicKey.kty: COSEKTY
added: field DecodedOKPPublicKey.x: bytes
added: field DecodedRSAPublicKey.alg: COSEAlgorithmIdentifier
added: field DecodedRSAPublicKey.e: bytes
added: field DecodedRSAPublicKey.kty: COSEKTY
added: field DecodedRSAPublicKey.n: bytes
added: function decode_credential_public_key(key: bytes) -> Union[DecodedOKPPublicKey, DecodedEC2PublicKey, DecodedRSAPublicKey]

added: function decoded_public_key_to_cryptography(public_key: Union[DecodedOKPPublicKey, DecodedEC2PublicKey, DecodedRSAPublicKey]) -> Union[Ed25519PublicKey, EllipticCurvePublicKey, RSAPublicKey]

added: class InvalidAuthenticationResponse(Exception)
added: class InvalidAuthenticatorDataStructure(Exception)
added: class InvalidBackupFlags(Exception)
added: class InvalidCBORData(Exception)
added: class InvalidCertificateChain(Exception)
added: class InvalidClientDataJSONStructure(Exception)
added: class InvalidPublicKeyStructure(Exception)
added: class InvalidRegistrationResponse(Exception)
added: class InvalidTPMCertInfoStructure(Exception)
added: class InvalidTPMPubAreaStructure(Exception)
added: class SignatureVerificationException(Exception)
added: class UnsupportedAlgorithm(Exception)
added: class UnsupportedEC2Curve(Exception)
added: class UnsupportedPublicKey(Exception)
added: class UnsupportedPublicKeyType(Exception)

added: function generate_challenge(length: int=…) -> bytes

added: function generate_user_handle() -> bytes

added: function hash_by_alg(to_hash: bytes, alg: Optional[COSEAlgorithmIdentifier]=…) -> bytes
added: variable SHA_1
added: variable SHA_256
added: variable SHA_384
added: variable SHA_512

added: function json_loads_base64url_to_bytes(input: Union[str, bytes]) -> Any

added: variable apple_webauthn_root_ca
added: variable globalsign_r2
added: variable globalsign_root_ca
added: variable google_hardware_attestation_root_1
added: variable google_hardware_attestation_root_2

added: function options_to_json(options: Union[PublicKeyCredentialCreationOptions, PublicKeyCredentialRequestOptions]) -> str

added: function parse_attestation_object(val: bytes) -> AttestationObject

added: function parse_attestation_statement(val: dict) -> AttestationStatement

added: function parse_authentication_credential_json(json_val: Union[str, dict]) -> AuthenticationCredential

added: function parse_authenticator_data(val: bytes) -> AuthenticatorData

added: class ParsedBackupFlags(BaseModel)
added: field ParsedBackupFlags.credential_backed_up: bool
added: field ParsedBackupFlags.credential_device_type: CredentialDeviceType
added: function parse_backup_flags(flags: AuthenticatorDataFlags) -> ParsedBackupFlags

added: function parse_cbor(data: bytes) -> Any

added: function parse_client_data_json(val: bytes) -> CollectedClientData

added: function parse_registration_credential_json(json_val: Union[str, dict]) -> RegistrationCredential

added: function pem_cert_bytes_to_open_ssl_x509(cert: bytes) -> X509

added: function snake_case_to_camel_case(snake_case: str) -> str

added: class AttestationConveyancePreference(str, Enum)
added: class AttestationFormat(str, Enum)
added: class AttestationObject(WebAuthnBaseModel)
added: class AttestationStatement(WebAuthnBaseModel)
added: class AttestedCredentialData(WebAuthnBaseModel)
added: class AuthenticationCredential(WebAuthnBaseModel)
added: class AuthenticatorAssertionResponse(WebAuthnBaseModel)
added: class AuthenticatorAttachment(str, Enum)
added: class AuthenticatorAttestationResponse(WebAuthnBaseModel)
added: class AuthenticatorData(WebAuthnBaseModel)
added: class AuthenticatorDataFlags(WebAuthnBaseModel)
added: class AuthenticatorSelectionCriteria(WebAuthnBaseModel)
added: class AuthenticatorTransport(str, Enum)
added: class ClientDataType(str, Enum)
added: class CollectedClientData(WebAuthnBaseModel)
added: class CredentialDeviceType(str, Enum)
added: class PublicKeyCredentialCreationOptions(WebAuthnBaseModel)
added: class PublicKeyCredentialDescriptor(WebAuthnBaseModel)
added: class PublicKeyCredentialParameters(WebAuthnBaseModel)
added: class PublicKeyCredentialRequestOptions(WebAuthnBaseModel)
added: class PublicKeyCredentialRpEntity(WebAuthnBaseModel)
added: class PublicKeyCredentialType(str, Enum)
added: class PublicKeyCredentialUserEntity(WebAuthnBaseModel)
added: class RegistrationCredential(WebAuthnBaseModel)
added: class ResidentKeyRequirement(str, Enum)
added: class TokenBinding(WebAuthnBaseModel)
added: class TokenBindingStatus(str, Enum)
added: class UserVerificationRequirement(str, Enum)
added: class WebAuthnBaseModel(BaseModel)
added: class WebAuthnBaseModel.Config
added: field AttestationConveyancePreference.DIRECT
added: field AttestationConveyancePreference.ENTERPRISE
added: field AttestationConveyancePreference.INDIRECT
added: field AttestationConveyancePreference.NONE
added: field AttestationFormat.ANDROID_KEY
added: field AttestationFormat.ANDROID_SAFETYNET
added: field AttestationFormat.APPLE
added: field AttestationFormat.FIDO_U2F
added: field AttestationFormat.NONE
added: field AttestationFormat.PACKED
added: field AttestationFormat.TPM
added: field AttestationObject.att_stmt: AttestationStatement
added: field AttestationObject.auth_data: AuthenticatorData
added: field AttestationObject.fmt: AttestationFormat
added: field AttestationStatement.alg: Optional[COSEAlgorithmIdentifier]
added: field AttestationStatement.cert_info: Optional[bytes]
added: field AttestationStatement.pub_area: Optional[bytes]
added: field AttestationStatement.response: Optional[bytes]
added: field AttestationStatement.sig: Optional[bytes]
added: field AttestationStatement.ver: Optional[str]
added: field AttestationStatement.x5c: Optional[List[bytes]]
added: field AttestedCredentialData.aaguid: bytes
added: field AttestedCredentialData.credential_id: bytes
added: field AttestedCredentialData.credential_public_key: bytes
added: field AuthenticationCredential.authenticator_attachment: Optional[AuthenticatorAttachment]
added: field AuthenticationCredential.id: str
added: field AuthenticationCredential.raw_id: bytes
added: field AuthenticationCredential.response: AuthenticatorAssertionResponse
added: field AuthenticationCredential.type: Literal[PublicKeyCredentialType.PUBLIC_KEY]
added: field AuthenticatorAssertionResponse.authenticator_data: bytes
added: field AuthenticatorAssertionResponse.client_data_json: bytes
added: field AuthenticatorAssertionResponse.signature: bytes
added: field AuthenticatorAssertionResponse.user_handle: Optional[bytes]
added: field AuthenticatorAttachment.CROSS_PLATFORM
added: field AuthenticatorAttachment.PLATFORM
added: field AuthenticatorAttestationResponse.attestation_object: bytes
added: field AuthenticatorAttestationResponse.client_data_json: bytes
added: field AuthenticatorAttestationResponse.transports: Optional[List[AuthenticatorTransport]]
added: field AuthenticatorData.attested_credential_data: Optional[AttestedCredentialData]
added: field AuthenticatorData.extensions: Optional[bytes]
added: field AuthenticatorData.flags: AuthenticatorDataFlags
added: field AuthenticatorData.rp_id_hash: bytes
added: field AuthenticatorData.sign_count: int
added: field AuthenticatorDataFlags.at: bool
added: field AuthenticatorDataFlags.be: bool
added: field AuthenticatorDataFlags.bs: bool
added: field AuthenticatorDataFlags.ed: bool
added: field AuthenticatorDataFlags.up: bool
added: field AuthenticatorDataFlags.uv: bool
added: field AuthenticatorSelectionCriteria.authenticator_attachment: Optional[AuthenticatorAttachment]
added: field AuthenticatorSelectionCriteria.require_resident_key: Optional[bool]
added: field AuthenticatorSelectionCriteria.resident_key: Optional[ResidentKeyRequirement]
added: field AuthenticatorSelectionCriteria.user_verification: Optional[UserVerificationRequirement]
added: field AuthenticatorTransport.BLE
added: field AuthenticatorTransport.CABLE
added: field AuthenticatorTransport.HYBRID
added: field AuthenticatorTransport.INTERNAL
added: field AuthenticatorTransport.NFC
added: field AuthenticatorTransport.USB
added: field ClientDataType.WEBAUTHN_CREATE
added: field ClientDataType.WEBAUTHN_GET
added: field CollectedClientData.challenge: bytes
added: field CollectedClientData.cross_origin: Optional[bool]
added: field CollectedClientData.origin: str
added: field CollectedClientData.token_binding: Optional[TokenBinding]
added: field CollectedClientData.type: ClientDataType
added: field CredentialDeviceType.MULTI_DEVICE
added: field CredentialDeviceType.SINGLE_DEVICE
added: field PublicKeyCredentialCreationOptions.attestation: AttestationConveyancePreference
added: field PublicKeyCredentialCreationOptions.authenticator_selection: Optional[AuthenticatorSelectionCriteria]
added: field PublicKeyCredentialCreationOptions.challenge: bytes
added: field PublicKeyCredentialCreationOptions.exclude_credentials: Optional[List[PublicKeyCredentialDescriptor]]
added: field PublicKeyCredentialCreationOptions.pub_key_cred_params: List[PublicKeyCredentialParameters]
added: field PublicKeyCredentialCreationOptions.rp: PublicKeyCredentialRpEntity
added: field PublicKeyCredentialCreationOptions.timeout: Optional[int]
added: field PublicKeyCredentialCreationOptions.user: PublicKeyCredentialUserEntity
added: field PublicKeyCredentialDescriptor.id: bytes
added: field PublicKeyCredentialDescriptor.transports: Optional[List[AuthenticatorTransport]]
added: field PublicKeyCredentialDescriptor.type: Literal[PublicKeyCredentialType.PUBLIC_KEY]
added: field PublicKeyCredentialParameters.alg: COSEAlgorithmIdentifier
added: field PublicKeyCredentialParameters.type: Literal['public-key']
added: field PublicKeyCredentialRequestOptions.allow_credentials: Optional[List[PublicKeyCredentialDescriptor]]
added: field PublicKeyCredentialRequestOptions.challenge: bytes
added: field PublicKeyCredentialRequestOptions.rp_id: Optional[str]
added: field PublicKeyCredentialRequestOptions.timeout: Optional[int]
added: field PublicKeyCredentialRequestOptions.user_verification: Optional[UserVerificationRequirement]
added: field PublicKeyCredentialRpEntity.id: Optional[str]
added: field PublicKeyCredentialRpEntity.name: str
added: field PublicKeyCredentialType.PUBLIC_KEY
added: field PublicKeyCredentialUserEntity.display_name: str
added: field PublicKeyCredentialUserEntity.id: bytes
added: field PublicKeyCredentialUserEntity.name: str
added: field RegistrationCredential.authenticator_attachment: Optional[AuthenticatorAttachment]
added: field RegistrationCredential.id: str
added: field RegistrationCredential.raw_id: bytes
added: field RegistrationCredential.response: AuthenticatorAttestationResponse
added: field RegistrationCredential.type: Literal[PublicKeyCredentialType.PUBLIC_KEY]
added: field ResidentKeyRequirement.DISCOURAGED
added: field ResidentKeyRequirement.PREFERRED
added: field ResidentKeyRequirement.REQUIRED
added: field TokenBinding.id: Optional[str]
added: field TokenBinding.status: TokenBindingStatus
added: field TokenBindingStatus.PRESENT
added: field TokenBindingStatus.SUPPORTED
added: field UserVerificationRequirement.DISCOURAGED
added: field UserVerificationRequirement.PREFERRED
added: field UserVerificationRequirement.REQUIRED
added: field WebAuthnBaseModel.Config.alias_generator
added: field WebAuthnBaseModel.Config.allow_population_by_field_name
added: field WebAuthnBaseModel.Config.json_encoders
added: field WebAuthnBaseModel.Config.json_loads
added: field WebAuthnBaseModel.model_config
added: variable PYDANTIC_V2

added: export parse_cert_info
added: export parse_pub_area

added: function parse_cert_info(val: bytes) -> TPMCertInfo

added: function parse_pub_area(val: bytes) -> TPMPubArea

added: class TPMCertInfo
added: class TPMCertInfoAttested
added: class TPMCertInfoClockInfo
added: class TPMManufacturerInfo
added: class TPMPubArea
added: class TPMPubAreaObjectAttributes
added: class TPMPubAreaParametersECC
added: class TPMPubAreaParametersRSA
added: class TPMPubAreaUnique
added: class TPM_ALG(str, Enum)
added: class TPM_ECC_CURVE(str, Enum)
added: class TPM_ST(str, Enum)
added: constructor TPMCertInfoAttested(attested_name: bytes, qualified_name: bytes)
added: constructor TPMCertInfoClockInfo(clock_info: bytes)
added: constructor TPMPubAreaObjectAttributes(object_attributes: bytes)
added: constructor TPMPubAreaParametersECC(params: bytes)
added: constructor TPMPubAreaParametersRSA(params: bytes)
added: constructor TPMPubAreaUnique(unique: bytes, alg_type: TPM_ALG)
added: field TPMCertInfo.attested: TPMCertInfoAttested
added: field TPMCertInfo.clock_info: TPMCertInfoClockInfo
added: field TPMCertInfo.extra_data: bytes
added: field TPMCertInfo.firmware_version: bytes
added: field TPMCertInfo.magic: bytes
added: field TPMCertInfo.qualified_signer: bytes
added: field TPMCertInfo.type: TPM_ST
added: field TPMCertInfoAttested.name: bytes
added: field TPMCertInfoAttested.name_alg: TPM_ALG
added: field TPMCertInfoAttested.name_alg_bytes: bytes
added: field TPMCertInfoAttested.qualified_name: bytes
added: field TPMCertInfoClockInfo.clock: bytes
added: field TPMCertInfoClockInfo.reset_count: int
added: field TPMCertInfoClockInfo.restart_count: int
added: field TPMCertInfoClockInfo.safe: bool
added: field TPMManufacturerInfo.id: str
added: field TPMManufacturerInfo.name: str
added: field TPMPubArea.auth_policy: bytes
added: field TPMPubArea.name_alg: TPM_ALG
added: field TPMPubArea.object_attributes: TPMPubAreaObjectAttributes
added: field TPMPubArea.parameters: Union[TPMPubAreaParametersRSA, TPMPubAreaParametersECC]
added: field TPMPubArea.type: TPM_ALG
added: field TPMPubArea.unique: TPMPubAreaUnique
added: field TPMPubAreaObjectAttributes.admin_with_policy: bool
added: field TPMPubAreaObjectAttributes.decrypt: bool
added: field TPMPubAreaObjectAttributes.encrypted_duplication: bool
added: field TPMPubAreaObjectAttributes.fixed_parent: bool
added: field TPMPubAreaObjectAttributes.fixed_tpm: bool
added: field TPMPubAreaObjectAttributes.no_da: bool
added: field TPMPubAreaObjectAttributes.restricted: bool
added: field TPMPubAreaObjectAttributes.sensitive_data_origin: bool
added: field TPMPubAreaObjectAttributes.sign_or_encrypt: bool
added: field TPMPubAreaObjectAttributes.st_clear: bool
added: field TPMPubAreaObjectAttributes.user_with_auth: bool
added: field TPMPubAreaParametersECC.curve_id: TPM_ECC_CURVE
added: field TPMPubAreaParametersECC.kdf: TPM_ALG
added: field TPMPubAreaParametersECC.scheme: TPM_ALG
added: field TPMPubAreaParametersECC.symmetric: TPM_ALG
added: field TPMPubAreaParametersRSA.exponent: bytes
added: field TPMPubAreaParametersRSA.key_bits: bytes
added: field TPMPubAreaParametersRSA.scheme: TPM_ALG
added: field TPMPubAreaParametersRSA.symmetric: TPM_ALG
added: field TPMPubAreaUnique.value: bytes
added: field TPM_ALG.AES
added: field TPM_ALG.CAMELLIA
added: field TPM_ALG.CBC
added: field TPM_ALG.CFB
added: field TPM_ALG.CTR
added: field TPM_ALG.ECB
added: field TPM_ALG.ECC
added: field TPM_ALG.ECDAA
added: field TPM_ALG.ECDH
added: field TPM_ALG.ECDSA
added: field TPM_ALG.ECMQV
added: field TPM_ALG.ECSCHNORR
added: field TPM_ALG.ERROR
added: field TPM_ALG.HMAC
added: field TPM_ALG.KDF1_SP800_108
added: field TPM_ALG.KDF1_SP800_56A
added: field TPM_ALG.KDF2
added: field TPM_ALG.KEYEDHASH
added: field TPM_ALG.MGF1
added: field TPM_ALG.NULL
added: field TPM_ALG.OAEP
added: field TPM_ALG.OFB
added: field TPM_ALG.RSA
added: field TPM_ALG.RSAES
added: field TPM_ALG.RSAPSS
added: field TPM_ALG.RSASSA
added: field TPM_ALG.SHA1
added: field TPM_ALG.SHA256
added: field TPM_ALG.SHA384
added: field TPM_ALG.SHA512
added: field TPM_ALG.SM2
added: field TPM_ALG.SM3_256
added: field TPM_ALG.SM4
added: field TPM_ALG.SYMCIPHER
added: field TPM_ALG.XOR
added: field TPM_ECC_CURVE.BN_P256
added: field TPM_ECC_CURVE.BN_P638
added: field TPM_ECC_CURVE.NIST_P192
added: field TPM_ECC_CURVE.NIST_P224
added: field TPM_ECC_CURVE.NIST_P256
added: field TPM_ECC_CURVE.NIST_P384
added: field TPM_ECC_CURVE.NIST_P521
added: field TPM_ECC_CURVE.NONE
added: field TPM_ECC_CURVE.SM2_P256
added: field TPM_ST.ATTEST_CERTIFY
added: field TPM_ST.ATTEST_COMMAND_AUDIT
added: field TPM_ST.ATTEST_CREATION
added: field TPM_ST.ATTEST_NV
added: field TPM_ST.ATTEST_QUOTE
added: field TPM_ST.ATTEST_SESSION_AUDIT
added: field TPM_ST.ATTEST_TIME
added: field TPM_ST.AUTH_SECRET
added: field TPM_ST.AUTH_SIGNED
added: field TPM_ST.CREATION
added: field TPM_ST.FU_MANIFEST
added: field TPM_ST.HASHCHECK
added: field TPM_ST.NO_SESSIONS
added: field TPM_ST.NULL
added: field TPM_ST.RSP_COMMAND
added: field TPM_ST.SESSIONS
added: field TPM_ST.VERIFIED
added: variable TPM_ALG_COSE_ALG_MAP: Mapping[TPM_ALG, COSEAlgorithmIdentifier]
added: variable TPM_ALG_MAP: Mapping[bytes, TPM_ALG]
added: variable TPM_ECC_CURVE_COSE_CRV_MAP: Mapping[TPM_ECC_CURVE, COSECRV]
added: variable TPM_ECC_CURVE_MAP: Mapping[bytes, TPM_ECC_CURVE]
added: variable TPM_MANUFACTURERS: Mapping[str, TPMManufacturerInfo]
added: variable TPM_ST_MAP: Mapping[bytes, TPM_ST]

added: function validate_certificate_chain(*, x5c: List[bytes], pem_root_certs_bytes: Optional[List[bytes]]=…) -> bool

added: function verify_safetynet_timestamp(timestamp_ms: int) -> None

added: function verify_signature(*, public_key: Union[EllipticCurvePublicKey, RSAPublicKey, Ed25519PublicKey, DSAPublicKey, Ed448PublicKey, X25519PublicKey, X448PublicKey], signature_alg: COSEAlgorithmIdentifier, signature: bytes, data: bytes) -> None

added: function verify_android_key(*, attestation_statement: AttestationStatement, attestation_object: bytes, client_data_json: bytes, credential_public_key: bytes, pem_root_certs_bytes: List[bytes]) -> bool

added: class SafetyNetJWSHeader(WebAuthnBaseModel)
added: class SafetyNetJWSPayload(WebAuthnBaseModel)
added: field SafetyNetJWSHeader.alg: str
added: field SafetyNetJWSHeader.x5c: List[str]
added: field SafetyNetJWSPayload.apk_certificate_digest_sha256: List[str]
added: field SafetyNetJWSPayload.apk_digest_sha256: str
added: field SafetyNetJWSPayload.apk_package_name: str
added: field SafetyNetJWSPayload.basic_integrity: bool
added: field SafetyNetJWSPayload.cts_profile_match: bool
added: field SafetyNetJWSPayload.nonce: str
added: field SafetyNetJWSPayload.timestamp_ms: int
added: function verify_android_safetynet(*, attestation_statement: AttestationStatement, attestation_object: bytes, client_data_json: bytes, pem_root_certs_bytes: List[bytes], verify_timestamp_ms: bool=…) -> bool

added: function verify_apple(*, attestation_statement: AttestationStatement, attestation_object: bytes, client_data_json: bytes, credential_public_key: bytes, pem_root_certs_bytes: List[bytes]) -> bool

added: function verify_fido_u2f(*, attestation_statement: AttestationStatement, client_data_json: bytes, rp_id_hash: bytes, credential_id: bytes, credential_public_key: bytes, aaguid: bytes, pem_root_certs_bytes: List[bytes]) -> bool

added: function verify_packed(*, attestation_statement: AttestationStatement, attestation_object: bytes, client_data_json: bytes, credential_public_key: bytes, pem_root_certs_bytes: List[bytes]) -> bool

added: function verify_tpm(*, attestation_statement: AttestationStatement, attestation_object: bytes, client_data_json: bytes, credential_public_key: bytes, pem_root_certs_bytes: List[bytes]) -> bool

added: function generate_registration_options(*, rp_id: str, rp_name: str, user_id: str, user_name: str, user_display_name: Optional[str]=…, challenge: Optional[bytes]=…, timeout: int=…, attestation: AttestationConveyancePreference=…, authenticator_selection: Optional[AuthenticatorSelectionCriteria]=…, exclude_credentials: Optional[List[PublicKeyCredentialDescriptor]]=…, supported_pub_key_algs: Optional…
added: variable default_supported_pub_key_algs
added: variable default_supported_pub_key_params

added: class VerifiedRegistration(WebAuthnBaseModel)
added: field VerifiedRegistration.aaguid: str
added: field VerifiedRegistration.attestation_object: bytes
added: field VerifiedRegistration.credential_backed_up: bool
added: field VerifiedRegistration.credential_device_type: CredentialDeviceType
added: field VerifiedRegistration.credential_id: bytes
added: field VerifiedRegistration.credential_public_key: bytes
added: field VerifiedRegistration.credential_type: PublicKeyCredentialType
added: field VerifiedRegistration.fmt: AttestationFormat
added: field VerifiedRegistration.sign_count: int
added: field VerifiedRegistration.user_verified: bool
added: function verify_registration_response(*, credential: Union[str, dict, RegistrationCredential], expected_challenge: bytes, expected_rp_id: str, expected_origin: Union[str, List[str]], require_user_verification: bool=…, supported_pub_key_algs: List[COSEAlgorithmIdentifier]=…, pem_root_certs_bytes_by_fmt: Optional[Mapping[AttestationFormat, List[bytes]]]=…) -> VerifiedRegistration
added: variable expected_token_binding_statuses

removed: class AuthenticationRejectedException(Exception)
removed: class COSEKeyException(Exception)
removed: class RegistrationRejectedException(Exception)
removed: class WebAuthnAssertionOptions(object)
removed: class WebAuthnAssertionResponse(object)
removed: class WebAuthnCredential(object)
removed: class WebAuthnMakeCredentialOptions(object)
removed: class WebAuthnRegistrationResponse(object)
removed: class WebAuthnUser(object)
removed: class WebAuthnUserDataMissing(Exception)
removed: constructor WebAuthnAssertionOptions(webauthn_user, challenge, timeout=…, userVerification=…)
removed: constructor WebAuthnAssertionResponse(webauthn_user, assertion_response, challenge, origin, allow_credentials=…, uv_required=…, expected_assertion_client_extensions=…, expected_assertion_authenticator_extensions=…)
removed: constructor WebAuthnCredential(rp_id, origin, credential_id, public_key, sign_count)
removed: constructor WebAuthnMakeCredentialOptions(challenge, rp_name, rp_id, user_id, username, display_name, icon_url, timeout=…, attestation=…, user_verification=…)
removed: constructor WebAuthnRegistrationResponse(rp_id, origin, registration_response, challenge, trust_anchor_dir=…, trusted_attestation_cert_required=…, self_attestation_permitted=…, none_attestation_permitted=…, uv_required=…, expected_registration_client_extensions=…, expected_registration_authenticator_extensions=…)
removed: constructor WebAuthnUser(user_id, username, display_name, icon_url, credential_id, public_key, sign_count, rp_id)
removed: method WebAuthnAssertionResponse.verify()
removed: method WebAuthnRegistrationResponse.verify()
removed: property WebAuthnAssertionOptions.assertion_dict
removed: property WebAuthnAssertionOptions.json
removed: property WebAuthnMakeCredentialOptions.json
removed: property WebAuthnMakeCredentialOptions.registration_dict
removed: variable AT_ATTESTATION_CA
removed: variable AT_BASIC
removed: variable AT_ECDAA
removed: variable AT_FMT_FIDO_U2F
removed: variable AT_FMT_NONE
removed: variable AT_FMT_PACKED
removed: variable AT_NONE
removed: variable AT_SELF_ATTESTATION
removed: variable COSE_ALG_ES256
removed: variable COSE_ALG_PS256
removed: variable COSE_ALG_RS256
removed: variable DEFAULT_AUTHENTICATOR_EXTENSIONS
removed: variable DEFAULT_CLIENT_EXTENSIONS
removed: variable DEFAULT_TRUST_ANCHOR_DIR
removed: variable SUPPORTED_ATTESTATION_FORMATS
removed: variable SUPPORTED_ATTESTATION_TYPES
removed: variable TYPE_CREATE
removed: variable TYPE_GET