Authentication Token (#3)

* rm .idea

* Upgrade dependencies to latest versions

Updated versions for `tokio`, `axum-server`, `tower-sessions`, and `serde_json`. These changes aim to leverage the latest features, improvements, and bug fixes provided by the newer versions, ensuring better stability and performance.

* Add EC signing key support and refactor session handling

Implemented EC signing key loading and verification to enhance security. Refactored session key retrieval and error handling for better clarity and maintainability. Updated documentation and configurations to include key generation and usage instructions.

* Add JWT authentication to finish_passkey_authentication

Introduce JWT token generation and response upon successful authentication. Refactor the registration state key to a constant and improve error logging. Update dependencies and project version to accommodate new functionalities.

* Add detailed error handling for JWT creation

Refactor token generation to include improved error handling and logging. Introduce `InvalidPEM` and `TokenCreationError` variants for better error descriptions. Enhance debugging with additional `println!` statements and add `Debug` trait to `Claims` struct.

* Switch to dedicated encoding key for JWTs

Refactored code to use a separate encoding key for JWT creation instead of deriving it from the signing key PEM. Updated the configuration and documentation to reflect these changes, and improved error handling related to key loading.

* Specify JWT algorithm explicitly and correct encoding key path

Explicitly set the JWT algorithm to ES256 in the token creation for clarity and security. Additionally, correct the path for the encoding key in the README to ensure proper configuration.

* Add JWT handling and validation

Introduced JWT creation and validation within the authentication flow to enhance security. Added necessary decoding key configuration and handling of token-based errors. Updated README with steps for creating and validating the new decoding key.

* Add MissingToken WebauthnError variant and handle HeaderValue

Introduced a new `MissingToken` variant to the `WebauthnError` enum to handle cases where JWT parsing into a `HeaderValue` fails. Updated the registration flow to return an error if the token cannot be converted appropriately.

* Fix response return and remove debug print

Ensure the response is returned correctly after setting the 'X-Auth-Token' header. Remove the unnecessary debug print statement to clean up the code.

* updated Algorithm::ES256 for decoding token

Updated error handling for token creation and decoding, renaming the TokenCreationError and enhancing TokenDecodingError to include detailed messages. This improves clarity and debugging capabilities in authentication processes.

* Disable JWT nbf and exp validation

Updated the JWT decode function to disable validation for `nbf` (not before) and `exp` (expiration) claims. This should prevent token decoding errors related to time-based validations.

* Add JWT fields to AttestationEntity

Introduce 'sub' and 'exp' fields to AttestationEntity struct to support JWT generation. This change includes setting these fields with user unique ID and an expiration timestamp.

* Refactor authentication token handling to use AccountToken

Replaced AttestationEntity with AccountToken to include passkey in the token structure. Updated all token-related logic to handle the new structure and added debug prints for improved traceability.

* Refactor credential counter update

Simplify the update of credential counters by replacing a map statement with an if let statement. Additionally, add a FIXME comment to integrate blockchain recording and replay attack checks in the future.

* Remove debug print statements in authentication module

Commented out various println! statements used for debugging in `src/authn.rs`. This cleanup enhances code readability and reduces potential information leaks.

.gitignore

@@ -19,5 +19,4 @@ Cargo.lock
 /target
 /.idea
 /apple-app-site-association.json
-/fullchain.pem
-/privkey.pem
+/*.pem

Cargo.toml

@@ -1,30 +1,37 @@
-# https://doc.rust-lang.org/cargo/reference/manifest.html
 [package]
 name = "authnz-rs"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 license = "BSD-2"
 rust-version = "1.80.0"
 
-# export RUSTFLAGS="-C target-cpu=native"
-# cargo build --release
 [profile.release]
 opt-level = 3
 lto = true
 codegen-units = 1
-# cargo flamegraph
-#debug = true
 
 [dependencies]
-tokio = { version = "1.39.2", features = ["rt", "rt-multi-thread", "macros", "fs"] }
+tokio = { version = "1.39.3", features = ["rt", "rt-multi-thread", "macros", "fs"] }
 tokio-native-tls = "0.3.1"
-axum = { version="0.7.5", features = ["http2", "tokio"] }
-axum-server = { version = "0.6.0", features = ["tls-rustls"] }
-webauthn-rs = { version="0.5.0", features = ["danger-allow-state-serialisation"] }
-tower = { version="0.4.13", features = ["full"] }
-tower-sessions = "0.12.2"
+axum = { version = "0.7.5", features = ["http2", "tokio"] }
+axum-server = { version = "0.7.1", features = ["tls-rustls"] }
+webauthn-rs = { version = "0.5.0", features = ["danger-allow-state-serialisation"] }
+tower = { version = "0.4.13", features = ["full"] }
+tower-sessions = "0.12.3"
 thiserror = "1.0.63"
 log = "0.4.22"
 serde = { version = "1.0.204", features = ["derive"] }
-serde_json = "1.0.121"
-env_logger ="0.11.5"
+serde_json = "1.0.127"
+env_logger = "0.11.5"
+pem = "3.0.4"
+base64 = "0.22.1"
+p256 = { version = "0.13.2", features = ["ecdsa"] }
+p384 = { version = "0.13.0", features = ["ecdsa"] }
+p521 = { version = "0.13.3", features = ["ecdsa"] }
+ecdsa = { version = "0.16.9", features = ["signing", "std"] }
+rand_core = { version = "0.6.4", features = ["std"] }
+sha2 = "0.10.8"
+rand = "0.8.5"
+uuid = { version = "1.10.0", features = ["v4"] }
+jsonwebtoken = { version = "9.3.0", features = ["use_pem"] }
+chrono = "0.4.38"

README.md

@@ -1,10 +1,60 @@
 # authnz-rs
-Authentication and Entitlement WebAuthn and Smart Contract 
+
+Authentication and Entitlement WebAuthn and Smart Contract
+
+## Getting Started
+
+### Prerequisites
+
+#### Create keys
+
+SIGN_KEY_PATH
+
+```shell
+openssl ecparam -genkey -name prime256v1 -noout -out signkey.pem
+```
+
+ENCODING_KEY_PATH
+
+```shell
+openssl ecparam -genkey -noout -name prime256v1 \
+    | openssl pkcs8 -topk8 -nocrypt -out encodekey.pem
+```
+
+DECODING_KEY_PATH
+
+```shell
+openssl ec -in encodekey.pem -pubout -out decodekey.pem
+```
+
+#### Verify keys
+
+```shell
+openssl ec -in signkey.pem -text -noout
+openssl ec -in encodekey.pem -text -noout
+openssl ec -in decodekey.pem -text -noout
+```
 
 ## Usage
 
 ```env
 export PORT=8443
 export TLS_CERT_PATH=/path/to/fullchain.pem
 export TLS_KEY_PATH=/path/to/privkey.pem
-```
+export SIGN_KEY_PATH=/path/to/signkey.pem
+export ENCODING_KEY_PATH=/path/to/encodekey.pem
+export DECODING_KEY_PATH=/path/to/decodekey.pem
+```
+
+## Notes
+
+The next steps to further improve the server:
+
+- Implement key rotation
+- Add an endpoint to retrieve public keys
+- Implement signature verification on the client-side
+- Enhance error handling and logging for key operations
+- Consider using a key management service for production environments
+- Implement secure key deletion
+- Add support for additional cryptographic algorithms as needed
+- Implement a mechanism to revoke or update signed tokens if necessary