Assertion : Signature does not match

[Talal0]

I am currently utilizing the fido2-net-lib within the context of Android/iOS Authentication/Assertion, where the process of Authentication and Assertion has been functioning as intended. However, I am encountering an issue specifically during the Assertion phase (using Huawei FIDO2), wherein I consistently receive the error message "Signature does not match."

To elaborate, the Authentication procedure proceeds without any complications, indicating that the interaction with the Huawei device is successful. Yet, upon attempting Assertion, despite employing Huawei FIDO2 and adhering meticulously to their official documentation for byte data conversion, I am unable to successfully assert using the fido2-net-lib.

In an effort to provide clarity, I would like to share sample data pertaining to both the Authentication and Assertion processes. It is noteworthy that when I utilize the Webauthn.io demo on the Huawei device, the Assertion process functions seamlessly.

Note: I have AppGallery huawei device (Huawei Y6p, Model: MED-LX9)

Attestation
{ "id": "ZDU3ZmQ2MGItNTdiYS00MGI1LTkxZWEtM2QwMTkzNmU1NDE5", "type": "public-key", "rawId": "ZDU3ZmQ2MGItNTdiYS00MGI1LTkxZWEtM2QwMTkzNmU1NDE5", "response": { "clientDataJSON": "eyJhbmRyb2lkUGFja2FnZU5hbWUiOiJjb20ud3MucGlzcCIsImNoYWxsZW5nZSI6IjdjN2VmYzI5MjMyYTQ4ODAwMjVkZWRmMTYyNjM3MTBiNTVkNTBiMmUwMTc1YWVlMjA5ZmQ3NDczZDYyMzNjOTIiLCJvcmlnaW4iOiJhbmRyb2lkOmFway1rZXktaGFzaDpYbW5ObzQ2eVhWdk1IMFN5MkJNMFBoX2Zoa3k2dGdjWXc0N1FtYmRwS3hFIiwidHlwZSI6IndlYmF1dGhuLmNyZWF0ZSJ9", "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVioe7eO1-fI3Si4Ni6jlzAO2QL7dQEyQqExKlELz8v10gVFAAAAAAECAwQFBgcIAQIDBAUGBwgAJGQ1N2ZkNjBiLTU3YmEtNDBiNS05MWVhLTNkMDE5MzZlNTQxOaUBAgMmIAEhWCA6mwPNifyw8iQedOV4hJ7QPRsA9X3IK1RjJqITsp64rCJYIGKmrcyu5phh1X_n0Y7tlOmMk6LQAge2APBm7BCb5fKW" } }

Assertion
{ "id": "ZDU3ZmQ2MGItNTdiYS00MGI1LTkxZWEtM2QwMTkzNmU1NDE5", "type": "public-key", "rawId": "ZDU3ZmQ2MGItNTdiYS00MGI1LTkxZWEtM2QwMTkzNmU1NDE5", "response": { "clientDataJSON": "eyJhbmRyb2lkUGFja2FnZU5hbWUiOiJjb20ud3MucGlzcCIsImNoYWxsZW5nZSI6IjhhMGFjZTQ1ZWU3OWJmNmVhNTQ1ODgwMzBiZDkxOGQ2NGY4MDI0Zjk0ZjQ2ZTc5MTIyMDczYzhlYmUwNDY0YzIiLCJvcmlnaW4iOiJhbmRyb2lkOmFway1rZXktaGFzaDpYbW5ObzQ2eVhWdk1IMFN5MkJNMFBoX2Zoa3k2dGdjWXc0N1FtYmRwS3hFIiwidHlwZSI6IndlYmF1dGhuLmdldCJ9", "authenticatorData": "e7eO1-fI3Si4Ni6jlzAO2QL7dQEyQqExKlELz8v10gUFAAAAAQ", "signature": "MEUCIGZ3Fgw4uqUqR7uY6UiVI6LHhcIpXcMB2h-YcsWCMCFUAiEAiLZ086wwS-vBbwYKnp9vR78fkLvZJoTh9aXPEwYM1z8", } }

Dart code

Authentication

`var clientDataEncoded =
base64Url.encode(utf8.encode(jsonEncode(ted))).replaceAll('/', '_');

  var attestedObjectEncoded = base64Url
      .encode(Uint8List.fromList(response.authenticatorAttestationResponse!
          .attestationObject as List<int>))
      .replaceAll('/', '_');

  var credentialIdEncoded = base64Url
      .encode(Uint8List.fromList(response
          .authenticatorAttestationResponse!.credentialId as List<int>))
      .replaceAll('/', '_');`

Assertion

`var authenticatorData = base64Url
.encode(response.assertionResponse!.authenticatorData as List)
.replaceAll('=', '');

  var credentialIdEncoded = base64Url
      .encode(response.assertionResponse!.credentialId as List<int>)
      .replaceAll('=', '');


  var signature = base64Url
      .encode(response.assertionResponse!.signature as List<int>)
      .replaceAll('=', '');`

[abergs]

I'll caveat this that I've never used dart and is not an android dev, but your base64url encding/decoding might be off?

Perhaps this would work better?

import 'dart:convert';

void main() {
  // Example base64url-encoded string
  String base64urlString = 'SGVsbG8sIHdvcmxkIQ';

  // Convert base64url to base64
  String base64String = _base64urlToBase64(base64urlString);
  print('Base64 string: $base64String'); // Output: Base64 string: SGVsbG8sIHdvcmxkIQ==

  // Convert base64 to base64url
  String base64urlStringFromBase64 = _base64ToBase64url(base64String);
  print('Base64url string: $base64urlStringFromBase64'); // Output: Base64url string: SGVsbG8sIHdvcmxkIQ
}

String _base64urlToBase64(String base64urlString) {
  switch (base64urlString.length % 4) {
    case 0:
      break;
    case 2:
      base64urlString += '==';
      break;
    case 3:
      base64urlString += '=';
      break;
    default:
      throw Exception('Invalid base64url string');
  }
  return base64urlString.replaceAll('-', '+').replaceAll('_', '/');
}

String _base64ToBase64url(String base64String) {
  return base64String.replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
}

[Talal0]

@abergs tried this conversion but the issue is same

[Talal0]

@abergs Webauthn.io demo is working with this device. Please respond with what I'm missing.

REGISTRATION OPTIONS
{ "rp": { "name": "webauthn.io", "id": "webauthn.io" }, "user": { "id": "rjHThhzgK-UOPnPJ56xevKYwItz-0LK-1f43Q8y-p94", "name": "Alex", "displayName": "Alex" }, "challenge": "c53CQk_8vVYYZWNqmjl2ijsL3tb6g7rXvh4YiofaeMWHNiCEiEmXffgHNt7cPxXt5qI_UECFlI0h9yeOucbYGg", "pubKeyCredParams": [ { "type": "public-key", "alg": -7 }, { "type": "public-key", "alg": -257 } ], "timeout": 60000, "excludeCredentials": [], "authenticatorSelection": { "residentKey": "preferred", "requireResidentKey": false, "userVerification": "preferred" }, "attestation": "none", "hints": [], "extensions": { "credProps": true } }

REGISTRATION RESPONSE

{ "id": "ODVlNjBhMmEtODJhMi00Y2UwLWEzOWYtYWU5N2UyMjc5MDdm", "rawId": "ODVlNjBhMmEtODJhMi00Y2UwLWEzOWYtYWU5N2UyMjc5MDdm", "response": { "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViodKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvBFAAAAAAECAwQFBgcIAQIDBAUGBwgAJDg1ZTYwYTJhLTgyYTItNGNlMC1hMzlmLWFlOTdlMjI3OTA3ZqUBAgMmIAEhWCBJpOtHTE7uKEYGvnh0wOUUPKj73RZpcCSzipjJL47ttCJYIDHTrWo4bSp2mVTLEzwsgyDISVGCfI-Ao2JZCpa5me4q", "clientDataJSON": "eyJjaGFsbGVuZ2UiOiJjNTNDUWtfOHZWWVlaV05xbWpsMmlqc0wzdGI2ZzdyWHZoNFlpb2ZhZU1XSE5pQ0VpRW1YZmZnSE50N2NQeFh0NXFJX1VFQ0ZsSTBoOXllT3VjYllHZyIsIm9yaWdpbiI6Imh0dHBzOi8vd2ViYXV0aG4uaW8iLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0", "transports": [], "publicKeyAlgorithm": 0, "authenticatorData": "" }, "type": "public-key", "clientExtensionResults": {} }

AUTHENTICATION OPTIONS

{ "challenge": "APxyHEumfr3W1XfP2fSUdUQZXouyY_YHrkRGy-kCBE3tfqplaEe79rYdxcfz6lXxzRKfEr8i_JU0T6d2CRSeug", "timeout": 60000, "rpId": "webauthn.io", "allowCredentials": [ { "id": "ODVlNjBhMmEtODJhMi00Y2UwLWEzOWYtYWU5N2UyMjc5MDdm", "type": "public-key" } ], "userVerification": "preferred" }

AUTHENTICATION RESPONSE

{ "id": "ODVlNjBhMmEtODJhMi00Y2UwLWEzOWYtYWU5N2UyMjc5MDdm", "rawId": "ODVlNjBhMmEtODJhMi00Y2UwLWEzOWYtYWU5N2UyMjc5MDdm", "response": { "authenticatorData": "dKbqkhPJnC90siSSsyDPQCYqlMGpUKA5fyklC2CEHvAFAAAAAQ", "clientDataJSON": "eyJjaGFsbGVuZ2UiOiJBUHh5SEV1bWZyM1cxWGZQMmZTVWRVUVpYb3V5WV9ZSHJrUkd5LWtDQkUzdGZxcGxhRWU3OXJZZHhjZno2bFh4elJLZkVyOGlfSlUwVDZkMkNSU2V1ZyIsIm9yaWdpbiI6Imh0dHBzOi8vd2ViYXV0aG4uaW8iLCJ0eXBlIjoid2ViYXV0aG4uZ2V0In0", "signature": "MEUCIQCnRN8rsZPfxWFy2ZIxvXXBrWA3XrLGUZ_laQEG1flE5QIgOIkQlKPuOx1gbd3mN6cnQ9wdi1oF8e-VpXJIp36v144" }, "type": "public-key", "clientExtensionResults": {} }

[abergs]

@Talal0 Were you able to solve this?