fido2-2.2.1/COPYING 0000644 0000000 0000000 00000002430 15220526030 010472 0 ustar 00 Copyright (c) 2018 Yubico AB
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
fido2-2.2.1/COPYING.APLv2 0000644 0000000 0000000 00000026136 15220526030 011366 0 ustar 00
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
fido2-2.2.1/COPYING.MPLv2 0000644 0000000 0000000 00000040526 15220526030 011401 0 ustar 00 Mozilla Public License Version 2.0
==================================
1. Definitions
--------------
1.1. "Contributor"
means each individual or legal entity that creates, contributes to
the creation of, or owns Covered Software.
1.2. "Contributor Version"
means the combination of the Contributions of others (if any) used
by a Contributor and that particular Contributor's Contribution.
1.3. "Contribution"
means Covered Software of a particular Contributor.
1.4. "Covered Software"
means Source Code Form to which the initial Contributor has attached
the notice in Exhibit A, the Executable Form of such Source Code
Form, and Modifications of such Source Code Form, in each case
including portions thereof.
1.5. "Incompatible With Secondary Licenses"
means
(a) that the initial Contributor has attached the notice described
in Exhibit B to the Covered Software; or
(b) that the Covered Software was made available under the terms of
version 1.1 or earlier of the License, but not also under the
terms of a Secondary License.
1.6. "Executable Form"
means any form of the work other than Source Code Form.
1.7. "Larger Work"
means a work that combines Covered Software with other material, in
a separate file or files, that is not Covered Software.
1.8. "License"
means this document.
1.9. "Licensable"
means having the right to grant, to the maximum extent possible,
whether at the time of the initial grant or subsequently, any and
all of the rights conveyed by this License.
1.10. "Modifications"
means any of the following:
(a) any file in Source Code Form that results from an addition to,
deletion from, or modification of the contents of Covered
Software; or
(b) any new file in Source Code Form that contains any Covered
Software.
1.11. "Patent Claims" of a Contributor
means any patent claim(s), including without limitation, method,
process, and apparatus claims, in any patent Licensable by such
Contributor that would be infringed, but for the grant of the
License, by the making, using, selling, offering for sale, having
made, import, or transfer of either its Contributions or its
Contributor Version.
1.12. "Secondary License"
means either the GNU General Public License, Version 2.0, the GNU
Lesser General Public License, Version 2.1, the GNU Affero General
Public License, Version 3.0, or any later versions of those
licenses.
1.13. "Source Code Form"
means the form of the work preferred for making modifications.
1.14. "You" (or "Your")
means an individual or a legal entity exercising rights under this
License. For legal entities, "You" includes any entity that
controls, is controlled by, or is under common control with You. For
purposes of this definition, "control" means (a) the power, direct
or indirect, to cause the direction or management of such entity,
whether by contract or otherwise, or (b) ownership of more than
fifty percent (50%) of the outstanding shares or beneficial
ownership of such entity.
2. License Grants and Conditions
--------------------------------
2.1. Grants
Each Contributor hereby grants You a world-wide, royalty-free,
non-exclusive license:
(a) under intellectual property rights (other than patent or trademark)
Licensable by such Contributor to use, reproduce, make available,
modify, display, perform, distribute, and otherwise exploit its
Contributions, either on an unmodified basis, with Modifications, or
as part of a Larger Work; and
(b) under Patent Claims of such Contributor to make, use, sell, offer
for sale, have made, import, and otherwise transfer either its
Contributions or its Contributor Version.
2.2. Effective Date
The licenses granted in Section 2.1 with respect to any Contribution
become effective for each Contribution on the date the Contributor first
distributes such Contribution.
2.3. Limitations on Grant Scope
The licenses granted in this Section 2 are the only rights granted under
this License. No additional rights or licenses will be implied from the
distribution or licensing of Covered Software under this License.
Notwithstanding Section 2.1(b) above, no patent license is granted by a
Contributor:
(a) for any code that a Contributor has removed from Covered Software;
or
(b) for infringements caused by: (i) Your and any other third party's
modifications of Covered Software, or (ii) the combination of its
Contributions with other software (except as part of its Contributor
Version); or
(c) under Patent Claims infringed by Covered Software in the absence of
its Contributions.
This License does not grant any rights in the trademarks, service marks,
or logos of any Contributor (except as may be necessary to comply with
the notice requirements in Section 3.4).
2.4. Subsequent Licenses
No Contributor makes additional grants as a result of Your choice to
distribute the Covered Software under a subsequent version of this
License (see Section 10.2) or under the terms of a Secondary License (if
permitted under the terms of Section 3.3).
2.5. Representation
Each Contributor represents that the Contributor believes its
Contributions are its original creation(s) or it has sufficient rights
to grant the rights to its Contributions conveyed by this License.
2.6. Fair Use
This License is not intended to limit any rights You have under
applicable copyright doctrines of fair use, fair dealing, or other
equivalents.
2.7. Conditions
Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
in Section 2.1.
3. Responsibilities
-------------------
3.1. Distribution of Source Form
All distribution of Covered Software in Source Code Form, including any
Modifications that You create or to which You contribute, must be under
the terms of this License. You must inform recipients that the Source
Code Form of the Covered Software is governed by the terms of this
License, and how they can obtain a copy of this License. You may not
attempt to alter or restrict the recipients' rights in the Source Code
Form.
3.2. Distribution of Executable Form
If You distribute Covered Software in Executable Form then:
(a) such Covered Software must also be made available in Source Code
Form, as described in Section 3.1, and You must inform recipients of
the Executable Form how they can obtain a copy of such Source Code
Form by reasonable means in a timely manner, at a charge no more
than the cost of distribution to the recipient; and
(b) You may distribute such Executable Form under the terms of this
License, or sublicense it under different terms, provided that the
license for the Executable Form does not attempt to limit or alter
the recipients' rights in the Source Code Form under this License.
3.3. Distribution of a Larger Work
You may create and distribute a Larger Work under terms of Your choice,
provided that You also comply with the requirements of this License for
the Covered Software. If the Larger Work is a combination of Covered
Software with a work governed by one or more Secondary Licenses, and the
Covered Software is not Incompatible With Secondary Licenses, this
License permits You to additionally distribute such Covered Software
under the terms of such Secondary License(s), so that the recipient of
the Larger Work may, at their option, further distribute the Covered
Software under the terms of either this License or such Secondary
License(s).
3.4. Notices
You may not remove or alter the substance of any license notices
(including copyright notices, patent notices, disclaimers of warranty,
or limitations of liability) contained within the Source Code Form of
the Covered Software, except that You may alter any license notices to
the extent required to remedy known factual inaccuracies.
3.5. Application of Additional Terms
You may choose to offer, and to charge a fee for, warranty, support,
indemnity or liability obligations to one or more recipients of Covered
Software. However, You may do so only on Your own behalf, and not on
behalf of any Contributor. You must make it absolutely clear that any
such warranty, support, indemnity, or liability obligation is offered by
You alone, and You hereby agree to indemnify every Contributor for any
liability incurred by such Contributor as a result of warranty, support,
indemnity or liability terms You offer. You may include additional
disclaimers of warranty and limitations of liability specific to any
jurisdiction.
4. Inability to Comply Due to Statute or Regulation
---------------------------------------------------
If it is impossible for You to comply with any of the terms of this
License with respect to some or all of the Covered Software due to
statute, judicial order, or regulation then You must: (a) comply with
the terms of this License to the maximum extent possible; and (b)
describe the limitations and the code they affect. Such description must
be placed in a text file included with all distributions of the Covered
Software under this License. Except to the extent prohibited by statute
or regulation, such description must be sufficiently detailed for a
recipient of ordinary skill to be able to understand it.
5. Termination
--------------
5.1. The rights granted under this License will terminate automatically
if You fail to comply with any of its terms. However, if You become
compliant, then the rights granted under this License from a particular
Contributor are reinstated (a) provisionally, unless and until such
Contributor explicitly and finally terminates Your grants, and (b) on an
ongoing basis, if such Contributor fails to notify You of the
non-compliance by some reasonable means prior to 60 days after You have
come back into compliance. Moreover, Your grants from a particular
Contributor are reinstated on an ongoing basis if such Contributor
notifies You of the non-compliance by some reasonable means, this is the
first time You have received notice of non-compliance with this License
from such Contributor, and You become compliant prior to 30 days after
Your receipt of the notice.
5.2. If You initiate litigation against any entity by asserting a patent
infringement claim (excluding declaratory judgment actions,
counter-claims, and cross-claims) alleging that a Contributor Version
directly or indirectly infringes any patent, then the rights granted to
You by any and all Contributors for the Covered Software under Section
2.1 of this License shall terminate.
5.3. In the event of termination under Sections 5.1 or 5.2 above, all
end user license agreements (excluding distributors and resellers) which
have been validly granted by You or Your distributors under this License
prior to termination shall survive termination.
************************************************************************
* *
* 6. Disclaimer of Warranty *
* ------------------------- *
* *
* Covered Software is provided under this License on an "as is" *
* basis, without warranty of any kind, either expressed, implied, or *
* statutory, including, without limitation, warranties that the *
* Covered Software is free of defects, merchantable, fit for a *
* particular purpose or non-infringing. The entire risk as to the *
* quality and performance of the Covered Software is with You. *
* Should any Covered Software prove defective in any respect, You *
* (not any Contributor) assume the cost of any necessary servicing, *
* repair, or correction. This disclaimer of warranty constitutes an *
* essential part of this License. No use of any Covered Software is *
* authorized under this License except under this disclaimer. *
* *
************************************************************************
************************************************************************
* *
* 7. Limitation of Liability *
* -------------------------- *
* *
* Under no circumstances and under no legal theory, whether tort *
* (including negligence), contract, or otherwise, shall any *
* Contributor, or anyone who distributes Covered Software as *
* permitted above, be liable to You for any direct, indirect, *
* special, incidental, or consequential damages of any character *
* including, without limitation, damages for lost profits, loss of *
* goodwill, work stoppage, computer failure or malfunction, or any *
* and all other commercial damages or losses, even if such party *
* shall have been informed of the possibility of such damages. This *
* limitation of liability shall not apply to liability for death or *
* personal injury resulting from such party's negligence to the *
* extent applicable law prohibits such limitation. Some *
* jurisdictions do not allow the exclusion or limitation of *
* incidental or consequential damages, so this exclusion and *
* limitation may not apply to You. *
* *
************************************************************************
8. Litigation
-------------
Any litigation relating to this License may be brought only in the
courts of a jurisdiction where the defendant maintains its principal
place of business and such litigation shall be governed by laws of that
jurisdiction, without reference to its conflict-of-law provisions.
Nothing in this Section shall prevent a party's ability to bring
cross-claims or counter-claims.
9. Miscellaneous
----------------
This License represents the complete agreement concerning the subject
matter hereof. If any provision of this License is held to be
unenforceable, such provision shall be reformed only to the extent
necessary to make it enforceable. Any law or regulation which provides
that the language of a contract shall be construed against the drafter
shall not be used to construe this License against a Contributor.
10. Versions of the License
---------------------------
10.1. New Versions
Mozilla Foundation is the license steward. Except as provided in Section
10.3, no one other than the license steward has the right to modify or
publish new versions of this License. Each version will be given a
distinguishing version number.
10.2. Effect of New Versions
You may distribute the Covered Software under the terms of the version
of the License under which You originally received the Covered Software,
or under the terms of any subsequent version published by the license
steward.
10.3. Modified Versions
If you create software not governed by this License, and you want to
create a new license for such software, you may create and use a
modified version of this License if you rename the license and remove
any references to the name of the license steward (except to note that
such modified license differs from this License).
10.4. Distributing Source Code Form that is Incompatible With Secondary
Licenses
If You choose to distribute Source Code Form that is Incompatible With
Secondary Licenses under the terms of this version of the License, the
notice described in Exhibit B of this License must be attached.
Exhibit A - Source Code Form License Notice
-------------------------------------------
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
If it is not possible or desirable to put the notice in a particular
file, then You may include the notice in a location (such as a LICENSE
file in a relevant directory) where a recipient would be likely to look
for such a notice.
You may add additional accurate notices of copyright ownership.
Exhibit B - "Incompatible With Secondary Licenses" Notice
---------------------------------------------------------
This Source Code Form is "Incompatible With Secondary Licenses", as
defined by the Mozilla Public License, v. 2.0.
fido2-2.2.1/NEWS 0000644 0000000 0000000 00000030112 15220526030 010134 0 ustar 00 * Version 2.2.1 (released 2026-06-29)
** Server example: Migrate build tool from poetry to uv.
** Fix: Correctly format att_obj in previewSign.
* Version 2.2.0 (released 2026-04-15)
** Restrict DLL search paths (YSA-2026-01).
** Add support for experimental previewSign extension:
https://yubicolabs.github.io/webauthn-sign-extension/4/#sctn-sign-extension
** Add support for PSL wildcard and exception rules to RP validation.
** Fix: WindowsClient hmac_secret extension raising Null pointer access error.
** Fix: TPM attestation certificate Subject field validation.
* Version 2.1.1 (released 2026-01-19)
** Fix: Platform detection in fido2.hid module for BSD's.
* Version 2.1.0 (released 2026-01-14)
** CTAP 2.3 support:
*** Add new GetInfo fields: enc_cred_store_state.
*** Add support for pinComplexityPolicy extension.
*** Add thirdPartyPayment bit to credman.
*** Check support for config subcommands.
** WebAuthn:
*** Allow UserEntity without 'name' field for improved spec compliance.
*** Update MDS3 dataclasses with new fields.
** Fido2Client:
*** Fallback to PIN after UV_BLOCKED error.
*** Improve preflight handling when message exceeds maximum size.
** WindowsClient:
*** Fix: Parse 'credentialProtectionPolicy' properly.
*** Update win_api.py from latest webauthn.h.
*** Add support for hmac-secret-mc extension.
*** Add support for hints.
** Development:
*** Switch from Poetry to uv for project management.
*** Add pyright and ty for improved type checking.
*** Replace bandit and flake8 with ruff for linting.
* Version 2.0.0 (released 2025-05-20)
** See also the migration guide: doc/Migration_1-2.adoc.
** Python 3.10 or later is now required.
** WebAuthn dataclasses have been updated to align with the WebAuthn Level 3
Working Draft. Constructors now require keyword arguments (`kwargs_only=True`),
and serialization to/from dictionaries is compatible with standardized JSON
formats.
** The `features.webauthn_json_mapping` flag has been removed, as its
behavior (standardized JSON mapping) is now default.
** `Fido2Client` and `WindowsClient` constructors now accept a
`ClientDataCollector` instance instead of `origin` and `verify` parameters.
** `WindowsClient` has been relocated to `fido2.client.windows`. Importing this
class on non-Windows platforms will now raise an `ImportError`.
** `Fido2Client` methods now return `RegistrationResponse` and
`AuthenticationResponse` objects, instead of raw attestation/assertion data.
** CTAP2/WebAuthn extension handling has been redesigned. `Fido2Client` now
expects a list of `Ctap2Extension` instances. Default behavior includes
extensions commonly supported by browsers.
** The `fido2.cbor` module's `load_x` and `dump_x` functions have been made
private (renamed with a leading underscore) and should not be used directly.
** Previously deprecated functions and APIs have been removed.
** The `__version__` attribute in `fido2/__init__.py` has been removed. Use
`importlib.metadata.version('fido2')` to get the package version.
** Add new GetInfo fields based on CTAP 2.2.
** Add support for Persistent PinUvAuthToken and encIdentifier.
** Add support for hmac-secret-mc and thirdPartyPayments exensions.
** Update COSE algorithm types.
** Building the library now requires Poetry version 2.0 or later.
* Version 1.2.0 (released 2024-11-27)
** Improved extension handling:
Several new extensions are now supported, both for Fido2Client and WindowsClient.
Extension APIs have been redesigned, and old APIs have been deprecated, slated for
removal in version 2.0.
*** Disable hmac-secret extension by default, preferring prf.
** Improved (de-)serialization of dataclasses to/from JSON-friendly dicts.
** Fido2Client:
*** Support allowCredentials/excludeCredentials of arbitrary length.
*** Handle PUAT_REQUIRED by re-attempting with PIN/UV.
** Allow localhost (and subdomains) to use http:// in RP ID verification by default.
** NFC: Support for Authenticators that return SW=61XX on SELECT.
** USB: Improve connection recovery and use more specific exceptions for errors.
** Fix: Handle residentKey=preferred properly.
** Fix: Handle Authentictors that do not pass extensions in GetInfo.
* Version 1.1.3 (released 2024-03-13)
** Fix USB HID issue on MacOS that sometimes caused a pause while waiting for a
timeout.
** Fix argument to CredProp extension where an enum value was required instead of
also allowing a string.
** Fix parsing of some key types (ES384, ES512) causing signature verification to fail.
** Deprecation: Calling websafe_decode with a bytes argument instead of str.
This will raise a TypeError in the next major version of the library.
* Version 1.1.2 (released 2023-07-06)
** Fix ClientPin usage for Authenticators that do not support passing a PIN.
** Fix: Handle correct CTAP response codes in authenticatorSelection.
* Version 1.1.1 (released 2023-04-05)
** Add community provided support for NetBSD.
** Bugfix: Don't set length for largeBlob when offset is 0.
** Bugfix: Remove print statement in webauthn parsing.
* Version 1.1.0 (released 2022-10-17)
** Bugfix: Fix name of "crossOrigin" in CollectedClientData.create().
** Bugfix: Some incorrect type hints in the MDS3 classes were fixed.
** Stricter checking of dataclass field types.
** Add support for JSON-serialization of WebAuthn data classes.
This changes the objects dict representation to align with new additions in the
WebAuthn specification. As this may break compatibility, the new behavior
requires explicit opt-in until python-fido2 2.0 is released.
** Update server example to use JSON serialization.
** Server: Add support for passing RegistrationResponse/AuthenticationResponse (or
their deserialized JSON data) to register_complete/authenticate_complete.
** Add new "hybrid" AuthenticatorTransport.
** Add new AuthenticatorData flags, and use 2-letter names as in the WebAuthn spec
(long names are still available as aliases).
* Version 1.0.0 (released 2022-06-08)
** First stable release.
* Version 1.0.0rc1 (released 2022-05-02)
** Release Candidate 1 of first stable release.
** Require Python 3.7 or later.
** APIs have updated to align with WebAuthn level 2.
** Several CTAP 2.1 features have been implemented.
* Version 0.9.3 (released 2021-11-09)
** Bugfix: Linux - Don't fail device discovery when hidraw doesn't support
HIDIOCGRAWUNIQ (Linux kernels before 5.6).
* Version 0.9.2 (released 2021-10-14)
** Support the latest Windows webauthn.h API (included in Windows 11).
** Add product name and serial number to HidDescriptors.
** Remove the need for the uhid-freebsd dependency on FreeBSD.
* Version 0.9.1 (released 2021-02-03)
** Add new CTAP error codes and improve handling of unknown codes.
* Version 0.9.0 (released 2021-01-20)
** Server: Attestation is now done in two parts (to align better with the spec):
First, type-specific validation is done to provide a trust chain.
Second, validation of the trust chain is done.
** Client: API changes to better support extensions.
*** Fido2Client can be configured with Ctap2Extensions to support.
*** Client.make_credential now returns a AuthenticatorAttestationResponse,
which holds the AttestationObject and ClientData, as well as any client
extension results for the credential.
*** Client.get_assertion now returns an AssertionSelection object, which is
used to select between multiple assertions, resulting in an
AuthenticatorAssertionResponse, which holds the ClientData, assertion
values, as well as any client extension results for the assertion.
** Renames: The CTAP1 and CTAP2 classes have been renamed to Ctap1 and Ctap2,
respectively. The old names currently work, but will be removed in the
future.
** ClientPin: The ClientPin API has been restructured to support multiple PIN
protocols, UV tokens, and token permissions.
** CTAP 2.1 PRE: Several new features have been added for CTAP 2.1, including
Credential Management, Bio Enrollment, Large Blobs, and Authenticator Config.
** HID: The platform specific HID code has been revamped and cleaned up.
* Version 0.8.1 (released 2019-11-25)
** Bugfix: WindowsClient.make_credential error when resident key requirement is
unspecified.
* Version 0.8.0 (released 2019-11-25)
** New fido2.webauthn classes modeled after the W3C WebAuthn spec introduced.
** CTAP2 send_cbor/make_credential/get_assertion and U2fClient
request/authenticate `timeout` arguments replaced with `event` used to
cancel a request.
** Fido2Client:
*** make_credential/get_assertion now take WebAuthn options objects.
*** timeout is now provided in ms in WebAuthn options objects. Event based
cancelation also available by passing an Event.
** Fido2Server:
*** ATTESTATION, USER_VERIFICATION, and AUTHENTICATOR_ATTACHMENT enums
have been replaced with fido2.webauthn classes.
*** RelyingParty has been replaced with PublicKeyCredentialRpEntity, and
name is no longer optional.
*** Options returned by register_begin/authenticate_begin now omit unspecified
values if they are optional, instead of filling in default values.
*** Fido2Server.allowed_algorithms now contains a list of
PublicKeyCredentialParameters instead of algorithm identifiers.
*** Fido2Server.timeout is now in ms and of type int.
** Support native WebAuthn API on Windows through WindowsClient.
* Version 0.7.3 (released 2019-10-24)
** Bugfix: Workaround for size of int on Python 2 on Windows.
* Version 0.7.2 (released 2019-10-24)
** Support for the TPM attestation format.
** Allow passing custom challenges to register/authenticate in Fido2Server.
** Bugfix: CTAP2 CANCEL command response handling fixed.
** Bugfix: Fido2Client fix handling of empty allow_list.
** Bugfix: Fix typo in CTAP2.get_assertions() causing it to fail.
* Version 0.7.1 (released 2019-09-20)
** Support for FreeBSD.
** Enforce canonical CBOR on Authenticator responses by default.
** PCSC: Support extended APDUs.
** Server: Verify that UP flag is set.
** U2FFido2Server: Implement AppID exclusion extension.
** U2FFido2Server: Allow custom U2F facet verification.
** Bugfix: U2FFido2Server.authenticate_complete now returns the result.
* Version 0.7.0 (released 2019-06-17)
** Add support for NFC devices using PCSC.
** Add support for the hmac-secret Authenticator extension.
** Honor max credential ID length and number of credentials to Authenticator.
** Add close() method to CTAP devices to explicitly release their resources.
* Version 0.6.0 (released 2019-05-10)
** Don't fail if CTAP2 Info contains unknown fields.
** Replace cbor loads/dumps functions with encode/decode/decode_from.
** Server: Add support for AuthenticatorAttachment.
** Server: Add support for more key algorithms.
** Client: Expose CTAP2 Info object as Fido2Client.info.
* Version 0.5.0 (released 2018-12-21)
** Changes to server classes, some backwards breaking.
** Add ability to authenticate U2F credentials by using the appid extension.
** Make verification of attestation more explicit.
** Add support for Android SafetyNet attestation.
** Make it easier to work with U2F/CTAP1 data formats.
* Version 0.4.0 (released 2018-09-27)
** Add classes for implementing a server.
** Various small changes, some affecting backwards compatibility.
* Version 0.3.0 (released 2018-04-13)
** Add conversion between string/int keys for AttestationObject.
** Replace internal Exceptions with built-in types.
** Bugfix: Don't use TimeoutError which isn't available on Python 2.
* Version 0.2.2 (released 2018-04-11)
** Bugfix: Better handling of unplugged devices on MacOS and avoid leaking threads.
* Version 0.2.1 (released 2018-04-10)
** Add server example.
** Parse AttestationObjects that use string keys (Webauthn).
** Fix bug in handling packets with the wrong channel id.
* Version 0.2.0 (released 2018-04-05)
** Changed name of project to python-fido2 to better reflect its scope.
** Added attestation and assertion verification methods.
** A lot of name changes, moved classes, etc.
** New example for multi-device use.
* Version 0.1.0 (released 2018-03-16)
** First beta release.
fido2-2.2.1/README.adoc 0000644 0000000 0000000 00000010432 15220526030 011225 0 ustar 00 == python-fido2
image:https://github.com/Yubico/python-fido2/workflows/build/badge.svg["Github actions build", link="https://github.com/Yubico/python-fido2/actions"]
Provides library functionality for communicating with a FIDO device over USB as
well as verifying attestation and assertion signatures.
NOTE: Version 2.0 is now released. For help with migration from version 1.x, see
link:doc/Migration_1-2.adoc[the migration guide].
This library aims to support the FIDO U2F and FIDO 2 protocols for
communicating with a USB authenticator via the Client-to-Authenticator Protocol
(CTAP 1 and 2). In addition to this low-level device access, classes defined in
the `fido2.client` and `fido2.server` modules implement higher level operations
which are useful when interfacing with an Authenticator, or when implementing
WebAuthn support for a Relying Party.
For usage, see the `examples/` directory and
link:https://developers.yubico.com/python-fido2/API_Documentation/[API documentation].
=== References
These links related to WebAuthn and FIDO2 can help you get started:
* Yubico WebAuthn/FIDO2 guide: https://developers.yubico.com/FIDO2/
* W3C WebAuthn specification: https://www.w3.org/TR/webauthn/
* FIDO specifications: https://fidoalliance.org/specifications/download/
=== License
This project, with the exception of the files mentioned below, is licensed
under the BSD 2-clause license.
See the _COPYING_ file for the full license text.
This project contains source code from pyu2f (https://github.com/google/pyu2f)
which is licensed under the Apache License, version 2.0.
These files are located in `fido2/hid/`.
See http://www.apache.org/licenses/LICENSE-2.0,
or the _COPYING.APLv2_ file for the full license text.
This project also bundles the public suffix list (https://publicsuffix.org)
which is licensed under the Mozilla Public License, version 2.0.
This file is stored as `fido2/public_suffix_list.dat`.
See https://mozilla.org/MPL/2.0/,
or the _COPYING.MPLv2_ file for the full license text.
=== Requirements
fido2 is compatible with Python 3.10 and later, and is tested on Windows, MacOS,
and Linux. Support for OpenBSD, FreeBSD, and NetBSD is provided as-is and
relies on community contributions.
=== Installation
fido2 is installable by running the following command:
pip install fido2
To install the dependencies required for communication with NFC authenticators,
instead use:
pip install fido2[pcsc]
Under Windows 10 (1903 or later) access to FIDO devices is restricted and
requires running as Administrator. This library can still be used when running
as non-administrator, via the `fido.client.WindowsClient` class. An example of
this is included in the file `examples/credential.py`.
Under Linux you will need to add a Udev rule to be able to access the FIDO
device, or run as root. For example, the Udev rule may contain the following:
----
#Udev rule for allowing HID access to Yubico devices for FIDO support.
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
MODE="0664", GROUP="plugdev", ATTRS{idVendor}=="1050"
----
There may be a package already available for your distribution that does this
for you, see:
https://support.yubico.com/hc/en-us/articles/360013708900-Using-Your-U2F-YubiKey-with-Linux
Under FreeBSD you will either need to run as root or add rules for your device
to /etc/devd.conf, which can be automated by installing security/u2f-devd:
# pkg install u2f-devd
==== Dependencies
This project depends on Cryptography. For instructions on installing this
dependency, see https://cryptography.io/en/latest/installation/.
NFC support is optionally available via PC/SC, using the pyscard library. For
instructions on installing this dependency, see
https://github.com/LudovicRousseau/pyscard/blob/master/INSTALL.md.
=== Development
For development of the library we use https://docs.astral.sh/uv/[uv].
Follow the uv Getting Started guide to install and configure it.
We also use https://pre-commit.com/[pre-commit] to run some scans on the code
prior to committing.
==== Running tests
While some tests can run on their own, most require a connected FIDO2 device to run.
WARNING: These tests are destructive, and will factory reset the device under test.
As a safety precaution, the tests will only run on a device that is in a newly reset
state, as far as the test runner can tell.
uv run pytest
fido2-2.2.1/examples/acr122u.py 0000644 0000000 0000000 00000004465 15220526030 013020 0 ustar 00 import time
from fido2.pcsc import CtapPcscDevice
class Acr122uPcscDevice(object):
def __init__(self, pcsc_device):
self.pcsc = pcsc_device
def reader_version(self):
"""
Get reader's version from reader
:return: string. Reader's version
"""
try:
result, sw1, sw2 = self.pcsc.apdu_exchange(b"\xff\x00\x48\x00\x00")
if len(result) > 0:
str_result = result + bytes([sw1]) + bytes([sw2])
str_result = str_result.decode("utf-8")
return str_result
except Exception as e:
print("Get version error:", e)
return "n/a"
def led_control(
self,
red=False,
green=False,
blink_count=0,
red_end_blink=False,
green_end_blink=False,
):
"""
Reader's led control
:param red: boolean. red led on
:param green: boolean. green let on
:param blink_count: int. if needs to blink value > 0. blinks count
:param red_end_blink: boolean.
state of red led at the end of blinking
:param green_end_blink: boolean.
state of green led at the end of blinking
:return:
"""
try:
if blink_count > 0:
cbyte = (
0b00001100
+ (0b01 if red_end_blink else 0b00)
+ (0b10 if green_end_blink else 0b00)
)
cbyte |= (0b01000000 if red else 0b00000000) + (
0b10000000 if green else 0b00000000
)
else:
cbyte = 0b00001100 + (0b01 if red else 0b00) + (0b10 if green else 0b00)
apdu = (
b"\xff\x00\x40"
+ bytes([cbyte & 0xFF])
+ b"\4"
+ b"\5\3"
+ bytes([blink_count])
+ b"\0"
)
self.pcsc.apdu_exchange(apdu)
except Exception as e:
print("LED control error:", e)
dev = next(CtapPcscDevice.list_devices())
print("CONNECT: %s" % dev)
pcsc_device = Acr122uPcscDevice(dev)
pcsc_device.led_control(False, True, 0)
print("version: %s" % pcsc_device.reader_version())
pcsc_device.led_control(True, False, 0)
time.sleep(1)
pcsc_device.led_control(False, True, 3)
fido2-2.2.1/examples/acr122usam.py 0000644 0000000 0000000 00000024611 15220526030 013514 0 ustar 00 # Copyright (c) 2019 Yubico AB
# Copyright (c) 2019 Oleg Moiseenko
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Sample work with reader:
ACR-122U-SAM or touchatag
drivers and manual link:
www.acs.com.hk/en/driver/100/acr122u-nfc-reader-with-sam-slot-proprietary/
"""
import time
from smartcard.Exceptions import CardConnectionException
from fido2.ctap1 import CTAP1
from fido2.pcsc import CtapPcscDevice
from fido2.utils import sha256
class Acr122uSamPcscDevice(CtapPcscDevice):
def __init__(self, connection, name):
self.ats = b""
self.vparity = False
self.max_block_len = 29
try:
super().__init__(connection, name)
except (CardConnectionException, ValueError):
pass
except Exception as e:
print(e.__class__)
# setup reader
if not self.set_auto_iso14443_4_activation():
raise Exception("Set automatic iso-14443-4 activation error")
if not self.set_default_retry_timeout():
raise Exception("Set default retry timeout error")
self.ats = self.get_ats()
if self.ats == b"":
raise Exception("No card in field")
self._select()
def apdu_plain(self, apdu, protocol=None):
"""Exchange data with reader.
:param apdu: byte string. data to exchange with card
:param protocol: protocol to exchange with card. usually set by default
:return: byte string. response from card
"""
# print('>> %s' % b2a_hex(apdu))
resp, sw1, sw2 = self._conn.transmit(list(iter(apdu)), protocol)
response = bytes(bytearray(resp))
# print('<< [0x%04x] %s' % (sw1 * 0x100 + sw2, b2a_hex(response)))
return response, sw1, sw2
def pseudo_apdu_ex(self, apdu, protocol=None):
req = b"\xff\x00\x00\x00" + bytes([len(apdu) & 0xFF]) + apdu
resp, sw1, sw2 = self.apdu_plain(req, protocol)
if sw1 != 0x61:
return resp, sw1, sw2
return self.apdu_plain(b"\xff\xc0\x00\x00" + bytes([sw2]), protocol)
# override base method
# commands in PN 532 User manual (UM0701-02)
# page 178. 7.4.5 DEP chaining mechanism
# page 136. 7.3.9 InCommunicateThru
# chaining ISO 14443-4:2001
# page 20. 7.5.2 Chaining
def apdu_exchange(self, apdu, protocol=None):
all_response = b""
alen = 0
while True:
vapdu = apdu[alen : alen + self.max_block_len]
# input chaining
chaining = alen + len(vapdu) < len(apdu)
vb = 0x02 | (0x01 if self.vparity else 0x00) | (0x10 if chaining else 0x00)
# 7.3.9 InCommunicateThru
resp, sw1, sw2 = self.pseudo_apdu_ex(
b"\xd4\x42" + bytes([vb]) + vapdu, protocol
)
self.vparity = not self.vparity
if len(resp) > 2 and resp[2] > 0:
print("Error: 0x%02x" % resp[2])
return b"", 0x6F, resp[2]
if sw1 != 0x90 or len(resp) < 3 or resp[0] != 0xD5 or resp[1] != 0x43:
return b"", 0x67, 0x00
alen += len(vapdu)
if not chaining:
break
if len(resp) > 3:
if resp[3] & 0x10 == 0:
return resp[4:-2], resp[-2], resp[-1]
else:
if resp[3] != 0xF2:
all_response = resp[4:]
else:
return b"", 0x90, 0x00
while True:
if len(resp) > 3 and resp[3] == 0xF2:
# WTX
answer = resp[3:5]
else:
# ACK
answer = bytes([0xA2 | (0x01 if self.vparity else 0x00)])
self.vparity = not self.vparity
# 7.3.9 InCommunicateThru
resp, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x42" + answer, protocol)
if len(resp) > 2 and resp[2] > 0:
print("Error: 0x%02x" % resp[2])
return b"", 0x6F, resp[2]
if sw1 != 0x90 or len(resp) < 3 or resp[0] != 0xD5 or resp[1] != 0x43:
return b"", 0x67, 0x00
response_chaining = len(resp) > 3 and resp[3] & 0x10 != 0
# if I block
if len(resp) > 3 and resp[3] & 0xE0 == 0x00:
all_response += resp[4:]
if not response_chaining:
break
return all_response[:-2], resp[-2], resp[-1]
def get_ats(self, verbose=False):
self.field_reset()
self.ats = b""
resp, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x4a\x01\x00")
if sw1 == 0x90 and len(resp) > 8 and resp[2] > 0x00:
if verbose:
print("ATQA 0x%02x%02x" % (resp[4], resp[5]))
print("SAK 0x%02x" % resp[6])
uid_len = resp[7]
if verbose:
print("UID [%d] %s" % (uid_len, resp[8 : 8 + uid_len].hex()))
self.ats = resp[8 + uid_len :]
if verbose:
print("ATS [%d] %s" % (len(self.ats), self.ats.hex()))
self.vparity = False
return self.ats
return b""
def set_default_retry_timeout(self):
result, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x32\x05\x00\x00\x00")
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x33":
print("set default retry time error")
return False
# 14443 timeout. UM0701-02 PN432 user manual. page 101.
# RFU, fATR_RES_Timeout, fRetryTimeout
# 0b 102ms, 0c - 204ms, 0d - 409ms, 0f - 1.6s
result, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x32\x02\x00\x0c\x0f")
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x33":
print("set fRetryTimeout error")
return False
return True
def set_auto_iso14443_4_activation(self, activate=True):
result, sw1, sw2 = self.pseudo_apdu_ex(
b"\xd4\x12" + bytes([0x34 if activate else 0x24])
)
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x13":
print("set automatic iso-14443-4 activation error")
return False
return True
def field_control(self, field_on=True):
result, sw1, sw2 = self.pseudo_apdu_ex(
b"\xd4\x32\x01" + bytes([0x01 if field_on else 0x00])
)
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x33":
print("set field state error")
return False
return True
def field_reset(self):
self.led_control(True, False)
result = self.field_control(False)
time.sleep(0.2)
result |= self.field_control(True)
self.led_control()
return result
def reader_version(self):
"""
Get reader's version from reader
:return: string. Reader's version
"""
try:
result, sw1, sw2 = self.apdu_plain(b"\xff\x00\x48\x00\x00")
if len(result) > 0:
str_result = result + bytes([sw1]) + bytes([sw2])
str_result = str_result.decode("utf-8")
return str_result
except Exception as e:
print("Get version error:", e)
return "n/a"
def led_control(
self,
red=False,
green=False,
blink_count=0,
red_end_blink=False,
green_end_blink=False,
):
"""
Reader's led control
:param red: boolean. red led on
:param green: boolean. green let on
:param blink_count: int. if needs to blink value > 0. blinks count
:param red_end_blink: boolean.
state of red led at the end of blinking
:param green_end_blink: boolean.
state of green led at the end of blinking
:return:
"""
try:
if blink_count > 0:
cbyte = (
0b00001100
+ (0b01 if red_end_blink else 0b00)
+ (0b10 if green_end_blink else 0b00)
)
cbyte |= (0b01000000 if red else 0b00000000) + (
0b10000000 if green else 0b00000000
)
else:
cbyte = 0b00001100 + (0b01 if red else 0b00) + (0b10 if green else 0b00)
apdu = (
b"\xff\x00\x40"
+ bytes([cbyte & 0xFF])
+ b"\4"
+ b"\5\3"
+ bytes([blink_count])
+ b"\0"
)
self.apdu_plain(apdu)
except Exception as e:
print("LED control error:", e)
dev = next(Acr122uSamPcscDevice.list_devices())
print("CONNECT: %s" % dev)
print("version: %s" % dev.reader_version())
print("atr: %s" % dev.get_atr().hex())
print("ats: %s" % dev.ats.hex())
# uncomment if you want to see parameters from card's selection
# dev.get_ats(True)
# dev._select()
dev.led_control(False, True, 0)
chal = sha256(b"AAA")
appid = sha256(b"BBB")
ctap1 = CTAP1(dev)
print("ctap1 version:", ctap1.get_version())
reg = ctap1.register(chal, appid)
print("u2f register:", reg)
reg.verify(appid, chal)
print("Register message verify OK")
auth = ctap1.authenticate(chal, appid, reg.key_handle)
print("u2f authenticate: ", auth)
res = auth.verify(appid, chal, reg.public_key)
print("Authenticate message verify OK")
dev.led_control()
fido2-2.2.1/examples/acr1252u.py 0000644 0000000 0000000 00000013045 15220526030 013077 0 ustar 00 import time
from fido2.pcsc import CtapPcscDevice
# control codes:
# 3225264 - magic number!!!
# 0x42000000 + 3500 - cross platform way
C_CODE = 3225264
class Acr1252uPcscDevice(object):
def __init__(self, pcsc_device):
self.pcsc = pcsc_device
def reader_version(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x18\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == len(res) - 5:
strres = res[5 : 5 + reslen].decode("utf-8")
return strres
except Exception as e:
print("Get version error:", e)
return "n/a"
def reader_serial_number(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x33\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == len(res) - 5:
strres = res[5 : 5 + reslen].decode("utf-8")
return strres
except Exception as e:
print("Get serial number error:", e)
return "n/a"
def led_control(self, red=False, green=False):
try:
cbyte = (0b01 if red else 0b00) + (0b10 if green else 0b00)
result = self.pcsc.control_exchange(
C_CODE, b"\xe0\x00\x00\x29\x01" + bytes([cbyte])
)
if len(result) > 0 and result.find(b"\xe1\x00\x00\x00") == 0:
result_length = result[4]
if result_length == 1:
ex_red = bool(result[5] & 0b01)
ex_green = bool(result[5] & 0b10)
return True, ex_red, ex_green
except Exception as e:
print("LED control error:", e)
return False, False, False
def led_status(self):
try:
result = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x29\x00")
if len(result) > 0 and result.find(b"\xe1\x00\x00\x00") == 0:
result_length = result[4]
if result_length == 1:
ex_red = bool(result[5] & 0b01)
ex_green = bool(result[5] & 0b10)
return True, ex_red, ex_green
except Exception as e:
print("LED status error:", e)
return False, False, False
def get_polling_settings(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x23\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Get polling settings error:", e)
return False, 0
def set_polling_settings(self, settings):
try:
res = self.pcsc.control_exchange(
C_CODE, b"\xe0\x00\x00\x23\x01" + bytes([settings & 0xFF])
)
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Set polling settings error:", e)
return False, 0
def get_picc_operation_parameter(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x20\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Get PICC Operating Parameter error:", e)
return False, 0
def set_picc_operation_parameter(self, param):
try:
res = self.pcsc.control_exchange(
C_CODE, b"\xe0\x00\x00\x20\x01" + bytes([param])
)
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Set PICC Operating Parameter error:", e)
return False, 0
dev = next(CtapPcscDevice.list_devices())
print("CONNECT: %s" % dev)
pcsc_device = Acr1252uPcscDevice(dev)
if pcsc_device is not None:
print("version: %s" % pcsc_device.reader_version())
print("serial number: %s" % pcsc_device.reader_serial_number())
print("")
result, settings = pcsc_device.set_polling_settings(0x8B)
print("write polling settings: %r 0x%x" % (result, settings))
result, settings = pcsc_device.get_polling_settings()
print("polling settings: %r 0x%x" % (result, settings))
set_desc = [
[0, "Auto PICC Polling"],
[1, "Turn off Antenna Field if no PICC is found"],
[2, "Turn off Antenna Field if the PICC is inactive"],
[3, "Activate the PICC when detected"],
[7, "Enforce ISO 14443-A Part 4"],
]
for x in set_desc:
print(x[1], "on" if settings & (1 << x[0]) else "off")
interval_desc = [250, 500, 1000, 2500]
print("PICC Poll Interval for PICC", interval_desc[(settings >> 4) & 0b11], "ms")
print("")
print(
"PICC operation parameter: %r 0x%x" % pcsc_device.get_picc_operation_parameter()
)
print("")
result, red, green = pcsc_device.led_control(True, False)
print("led control result:", result, "red:", red, "green:", green)
result, red, green = pcsc_device.led_status()
print("led state result:", result, "red:", red, "green:", green)
time.sleep(1)
pcsc_device.led_control(False, False)
fido2-2.2.1/examples/bio_enrollment.py 0000644 0000000 0000000 00000005634 15220526030 014650 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found over USB, and attempts to enroll a new
fingerprint. This requires that a PIN is already set.
NOTE: This uses a draft bio enrollment specification which is not yet final.
Consider this highly experimental.
"""
import sys
from getpass import getpass
from fido2.ctap2 import CaptureError, Ctap2, FPBioEnrollment
from fido2.ctap2.bio import BioEnrollment
from fido2.ctap2.pin import ClientPin
from fido2.hid import CtapHidDevice
pin = None
uv = "discouraged"
for dev in CtapHidDevice.list_devices():
try:
ctap = Ctap2(dev)
if BioEnrollment.is_supported(ctap.info):
break
except Exception: # noqa: S112
continue
else:
print("No Authenticator supporting bioEnroll found")
sys.exit(1)
if not ctap.info.options.get("clientPin"):
print("PIN not set for the device!")
sys.exit(1)
# Authenticate with PIN
print("Preparing to enroll a new fingerprint.")
pin = getpass("Please enter PIN: ")
client_pin = ClientPin(ctap)
pin_token = client_pin.get_pin_token(pin, ClientPin.PERMISSION.BIO_ENROLL)
bio = FPBioEnrollment(ctap, client_pin.protocol, pin_token)
print(bio.enumerate_enrollments())
# Start enrollment
enroller = bio.enroll()
template_id = None
while template_id is None:
print("Press your fingerprint against the sensor now...")
try:
template_id = enroller.capture()
print(enroller.remaining, "more scans needed.")
except CaptureError as e:
print(e)
bio.set_name(template_id, "Example")
print("Fingerprint registered successfully with ID:", template_id)
fido2-2.2.1/examples/cred_blob.py 0000644 0000000 0000000 00000006615 15220526030 013553 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports the CredBlob extension,
creates a new credential for it with the extension enabled, and stores some data.
"""
import os
import sys
from exampleutils import get_client
from fido2.server import Fido2Server
# Locate a suitable FIDO authenticator
client, info = get_client(lambda info: "credBlob" in info.extensions)
# Prefer UV token if supported
uv = "discouraged"
if info and (info.options.get("uv") or info.options.get("bioEnroll")):
uv = "preferred"
print("Authenticator is configured for User Verification")
server = Fido2Server({"id": "example.com", "name": "Example RP"})
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key_requirement="required",
user_verification=uv,
authenticator_attachment="cross-platform",
)
# Add CredBlob extension, attach data
blob = os.urandom(32) # 32 random bytes
# Create a credential
result = client.make_credential(
{
**create_options["publicKey"],
"extensions": {"credBlob": blob},
}
)
# Complete registration
auth_data = server.register_complete(state, result)
credentials = [auth_data.credential_data]
# CredBlob result:
if not auth_data.extensions.get("credBlob"):
print("Credential was registered, but credBlob was NOT saved.")
sys.exit(1)
print("New credential created, with the CredBlob extension.")
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin()
# Authenticate the credential
# Only one cred in allowCredentials, only one response.
result = client.get_assertion(
{
**request_options["publicKey"],
"extensions": {"getCredBlob": True},
}
).get_response(0)
blob_res = result.response.authenticator_data.extensions.get("credBlob")
if blob == blob_res:
print("Authenticated, got correct blob:", blob.hex())
else:
print(
"Authenticated, got incorrect blob! (was %s, expected %s)"
% (blob_res.hex(), blob.hex())
)
sys.exit(1)
fido2-2.2.1/examples/credential.py 0000644 0000000 0000000 00000006331 15220526030 013745 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
On Windows, the native WebAuthn API will be used.
"""
from exampleutils import get_client
from fido2.server import Fido2Server
# Locate a suitable FIDO authenticator
client, info = get_client()
# Prefer UV if supported and configured
if info and (info.options.get("uv") or info.options.get("bioEnroll")):
uv = "preferred"
print("Authenticator supports User Verification")
else:
uv = "discouraged"
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user, user_verification=uv, authenticator_attachment="cross-platform"
)
# Create a credential
result = client.make_credential(create_options["publicKey"])
# Complete registration
auth_data = server.register_complete(state, result)
credentials = [auth_data.credential_data]
print("New credential created!")
response = result.response
print("CLIENT DATA:", response.client_data)
print("ATTESTATION OBJECT:", response.attestation_object)
print()
print("CREDENTIAL DATA:", auth_data.credential_data)
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
# Authenticate the credential
results = client.get_assertion(request_options["publicKey"])
# Only one cred in allowCredentials, only one response.
result = results.get_response(0)
# Complete authenticator
server.authenticate_complete(state, credentials, result)
print("Credential authenticated!")
response = result.response
print("CLIENT DATA:", response.client_data)
print()
print("AUTH DATA:", response.authenticator_data)
fido2-2.2.1/examples/exampleutils.py 0000644 0000000 0000000 00000007360 15220526030 014352 0 ustar 00 # Copyright (c) 2024 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Utilities for common functionality used by several examples in this directory.
"""
import ctypes
from getpass import getpass
from fido2.client import DefaultClientDataCollector, Fido2Client, UserInteraction
from fido2.hid import CtapHidDevice
# Support NFC devices if we can
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
# Use the Windows WebAuthn API if available, and we're not running as admin
try:
from fido2.client.windows import WindowsClient
use_winclient = (
WindowsClient.is_available() and not ctypes.windll.shell32.IsUserAnAdmin()
)
except Exception:
use_winclient = False
# Handle user interaction via CLI prompts
class CliInteraction(UserInteraction):
def __init__(self):
self._pin = None
def prompt_up(self):
print("\nTouch your authenticator device now...\n")
def request_pin(self, permissions, rd_id):
if not self._pin:
self._pin = getpass("Enter PIN: ")
return self._pin
def request_uv(self, permissions, rd_id):
print("User Verification required.")
return True
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
def get_client(predicate=None, **kwargs):
"""Locate a CTAP device suitable for use.
If running on Windows as non-admin, the predicate check will be skipped and
a webauthn.dll based client will be returned.
Extra kwargs will be passed to the constructor of Fido2Client.
The client will be returned, with the CTAP2 Info, if available.
"""
client_data_collector = DefaultClientDataCollector("https://example.com")
if use_winclient:
return WindowsClient(client_data_collector), None
user_interaction = kwargs.pop("user_interaction", None) or CliInteraction()
# Locate a device
for dev in enumerate_devices():
# Set up a FIDO 2 client using the origin https://example.com
client = Fido2Client(
dev,
client_data_collector=client_data_collector,
user_interaction=user_interaction,
**kwargs,
)
# Check if it is suitable for use
if predicate is None or predicate(client.info):
return client, client.info
else:
raise ValueError("No suitable Authenticator found!")
fido2-2.2.1/examples/get_info.py 0000644 0000000 0000000 00000004704 15220526030 013427 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to each attached FIDO device, and:
1. If the device supports CBOR commands, perform a getInfo command.
2. If the device supports WINK, perform the wink command.
"""
from fido2.ctap2 import Ctap2
from fido2.hid import CAPABILITY, CtapHidDevice
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
for dev in enumerate_devices():
print("CONNECT: %s" % dev)
print("Product name: %s" % dev.product_name)
print("Serial number: %s" % dev.serial_number)
print("CTAPHID protocol version: %d" % dev.version)
if dev.capabilities & CAPABILITY.CBOR:
ctap2 = Ctap2(dev)
info = ctap2.get_info()
print("DEVICE INFO: %s" % info)
else:
print("Device does not support CBOR")
if dev.capabilities & CAPABILITY.WINK:
dev.wink()
print("WINK sent!")
else:
print("Device does not support WINK")
dev.close()
fido2-2.2.1/examples/hmac_secret.py 0000644 0000000 0000000 00000012651 15220526030 014112 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports the HmacSecret extension,
creates a new credential for it with the extension enabled, and uses it to
derive two separate secrets.
NOTE: This extension is not enabled by default as direct access to the extension
is now allowed in a browser setting. See also prf.py for an example which uses
the PRF extension which is enabled by default.
"""
import ctypes
import os
import sys
from exampleutils import CliInteraction, enumerate_devices
from fido2.client import DefaultClientDataCollector, Fido2Client
from fido2.ctap2.extensions import HmacSecretExtension
from fido2.server import Fido2Server
# Use the Windows WebAuthn API if available, and we're not running as admin
try:
from fido2.client.windows import WindowsClient
use_winclient = (
WindowsClient.is_available() and not ctypes.windll.shell32.IsUserAnAdmin()
)
except ImportError:
use_winclient = False
uv = "discouraged"
client_data_collector = DefaultClientDataCollector("https://example.com")
if use_winclient:
# Use the Windows WebAuthn API if available, and we're not running as admin
# By default only the PRF extension is allowed, we need to explicitly
# configure the client to allow hmac-secret
client = WindowsClient(client_data_collector, allow_hmac_secret=True)
else:
# Locate a device
for dev in enumerate_devices():
client = Fido2Client(
dev,
client_data_collector=client_data_collector,
user_interaction=CliInteraction(),
# By default only the PRF extension is allowed, we need to explicitly
# configure the client to allow hmac-secret
extensions=[HmacSecretExtension(allow_hmac_secret=True)],
)
if "hmac-secret" in client.info.extensions:
break
else:
print("No Authenticator with the HmacSecret extension found!")
sys.exit(1)
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="none")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key_requirement="discouraged",
user_verification=uv,
authenticator_attachment="cross-platform",
)
# Create a credential
result = client.make_credential(
{
**create_options["publicKey"],
"extensions": {"hmacCreateSecret": True},
}
)
# Complete registration
auth_data = server.register_complete(state, result)
credentials = [auth_data.credential_data]
# HmacSecret result:
if result.client_extension_results.get("hmacCreateSecret"):
print("New credential created, with HmacSecret")
else:
# This fails on Windows, but we might still be able to use hmac-secret even if
# the credential wasn't made with it, so keep going
print("Failed to create credential with HmacSecret, it might not work")
# Generate a salt for HmacSecret:
salt = os.urandom(32)
print("Authenticate with salt:", salt.hex())
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
# Authenticate the credential
result = client.get_assertion(
{
**request_options["publicKey"],
"extensions": {"hmacGetSecret": {"salt1": salt}},
}
)
# Only one cred in allowCredentials, only one response.
result = result.get_response(0)
output1 = result.client_extension_results.hmac_get_secret.output1
print("Authenticated, secret:", output1.hex())
# Authenticate again, using two salts to generate two secrets:
# Generate a second salt for HmacSecret:
salt2 = os.urandom(32)
print("Authenticate with second salt:", salt2.hex())
# The first salt is reused, which should result in the same secret.
result = client.get_assertion(
{
**request_options["publicKey"],
"extensions": {"hmacGetSecret": {"salt1": salt, "salt2": salt2}},
}
)
# Only one cred in allowCredentials, only one response.
result = result.get_response(0)
output = result.client_extension_results.hmac_get_secret
print("Old secret:", output.output1.hex())
print("New secret:", output.output2.hex())
fido2-2.2.1/examples/large_blobs.py 0000644 0000000 0000000 00000010010 15220526030 014073 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
On Windows, the native WebAuthn API will be used.
"""
import sys
from exampleutils import get_client
from fido2.server import Fido2Server
from fido2.utils import websafe_decode, websafe_encode
# Locate a suitable FIDO authenticator
client, info = get_client(lambda info: "largeBlobKey" in info.extensions)
# LargeBlob requires UV if it is configured
uv = "discouraged"
if info and info.options.get("clientPin"):
uv = "required"
server = Fido2Server({"id": "example.com", "name": "Example RP"})
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key_requirement="required",
user_verification=uv,
authenticator_attachment="cross-platform",
)
print("Creating a credential with LargeBlob support...")
# Create a credential
result = client.make_credential(
{
**create_options["publicKey"],
# Enable largeBlob
"extensions": {"largeBlob": {"support": "required"}},
}
)
# Complete registration
auth_data = server.register_complete(state, result)
credentials = [auth_data.credential_data]
if auth_data.is_user_verified():
# The WindowsClient doesn't know about authenticator config until now
uv = "required"
if not result.client_extension_results.get("largeBlob", {}).get("supported"):
print("Credential does not support largeBlob, failure!")
sys.exit(1)
print("Credential created! Writing a blob...")
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
# Authenticate the credential
selection = client.get_assertion(
{
**request_options["publicKey"],
# Write a large blob
"extensions": {
"largeBlob": {"write": websafe_encode(b"Here is some data to store!")}
},
}
)
# Only one cred in allowCredentials, only one response.
result = selection.get_response(0)
if not result.client_extension_results.get("largeBlob", {}).get("written"):
print("Failed to write blob!")
sys.exit(1)
print("Blob written! Reading back the blob...")
# Authenticate the credential
selection = client.get_assertion(
{
**request_options["publicKey"],
# Read the blob
"extensions": {"largeBlob": {"read": True}},
}
)
# Only one cred in allowCredentials, only one response.
result = selection.get_response(0)
print(
"Read blob:", websafe_decode(result.client_extension_results["largeBlob"]["blob"])
)
fido2-2.2.1/examples/multi_device.py 0000644 0000000 0000000 00000007234 15220526030 014307 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to each FIDO device found, and causes them all to blink until the user
triggers one to select it. A new credential is created for that authenticator,
and the operation is cancelled for the others.
"""
import sys
from getpass import getpass
from threading import Event, Thread
from fido2.client import (
ClientError,
DefaultClientDataCollector,
Fido2Client,
UserInteraction,
)
from fido2.hid import CtapHidDevice
# Locate a device
devs = list(CtapHidDevice.list_devices())
if not devs:
print("No FIDO device found")
sys.exit(1)
# Handle user interaction
class CliInteraction(UserInteraction):
def prompt_up(self):
print("\nTouch your authenticator device now...\n")
def request_pin(self, permissions, rd_id):
return getpass("Enter PIN: ")
def request_uv(self, permissions, rd_id):
print("User Verification required.")
return True
cli_interaction = CliInteraction()
clients = [
Fido2Client(
d,
client_data_collector=DefaultClientDataCollector("https://example.com"),
user_interaction=cli_interaction,
)
for d in devs
]
# Prepare parameters for makeCredential
rp = {"id": "example.com", "name": "Example RP"}
user = {"id": b"user_id", "name": "A. User"}
challenge = b"Y2hhbGxlbmdl"
cancel = Event()
selected = None
def select(client):
global selected
try:
client.selection(cancel)
selected = client
except ClientError as e:
if e.code != ClientError.ERR.TIMEOUT:
raise
else:
return
cancel.set()
print("\nTouch the authenticator you wish to use...\n")
threads = []
for client in clients:
t = Thread(target=select, args=(client,))
threads.append(t)
t.start()
for t in threads:
t.join()
if cancel.is_set():
print("Authenticator selected, making credential...")
result = selected.make_credential(
{
"rp": rp,
"user": user,
"challenge": challenge,
"pubKeyCredParams": [{"type": "public-key", "alg": -7}],
},
)
print("New credential created!")
response = result.response
print("ATTESTATION OBJECT:", response.attestation_object)
print()
print("CREDENTIAL DATA:", response.attestation_object.auth_data.credential_data)
else:
print("Operation timed out!")
fido2-2.2.1/examples/prf.py 0000644 0000000 0000000 00000011253 15220526030 012421 0 ustar 00 # Copyright (c) 2024 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports the PRF extension,
creates a new credential for it with the extension enabled, and uses it to
derive two separate secrets.
"""
import os
from exampleutils import get_client
from fido2.server import Fido2Server
from fido2.utils import websafe_encode
# Locate a suitable FIDO authenticator
client, _ = get_client(lambda info: "hmac-secret" in info.extensions)
uv = "discouraged"
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="none")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key_requirement="discouraged",
user_verification=uv,
authenticator_attachment="cross-platform",
)
# Generate salts for PRF:
salt = websafe_encode(os.urandom(32))
salt2 = websafe_encode(os.urandom(32))
# Create a credential
result = client.make_credential(
{
**create_options["publicKey"],
"extensions": {"prf": {"eval": {"first": salt, "second": salt2}}},
}
)
# Complete registration
auth_data = server.register_complete(state, result)
credential = auth_data.credential_data
# PRF result:
if result.client_extension_results.get("prf", {}).get("enabled"):
print("New credential created, with PRF")
else:
# This fails on Windows, but we might still be able to use prf even if
# the credential wasn't made with it, so keep going
print("Failed to create credential with PRF, it might not work")
# If created with UV, keep using UV
if auth_data.is_user_verified():
uv = "required"
print("First salt:", salt)
# Prepare parameters for getAssertion
credentials = [credential]
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
prf_results = result.client_extension_results.get("prf", {}).get("results")
if prf_results:
output1 = prf_results["first"]
print("Credential created, with salt. Secret:", output1)
else:
# Authenticate the credential
result = client.get_assertion(
{
**request_options["publicKey"],
"extensions": {"prf": {"eval": {"first": salt}}},
}
)
# Only one cred in allowCredentials, only one response.
response = result.get_response(0)
output1 = response.client_extension_results["prf"]["results"]["first"]
print("Authenticated, with salt. Secret:", output1)
# Authenticate again, using two salts to generate two secrets.
# This time we will use evalByCredential, which can be used if there are multiple
# credentials which use different salts. Here it is not needed, but provided for
# completeness of the example.
print("Authenticate with second salt:", salt2)
# The first salt is reused, which should result in the same secret.
result = client.get_assertion(
{
**request_options["publicKey"],
"extensions": {
"prf": {
"evalByCredential": {
websafe_encode(credential.credential_id): {
"first": salt,
"second": salt2,
}
}
}
},
}
)
# Only one cred in allowCredentials, only one response.
response = result.get_response(0)
output = response.client_extension_results["prf"]["results"]
print("Old secret:", output["first"])
print("New secret:", output["second"])
fido2-2.2.1/examples/resident_key.py 0000644 0000000 0000000 00000007320 15220526030 014317 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
On Windows, the native WebAuthn API will be used.
"""
from exampleutils import get_client
from fido2.server import Fido2Server
# Locate a suitable FIDO authenticator
client, info = get_client(lambda info: info.options.get("rk"))
# Prefer UV if supported and configured
uv = "discouraged"
if info and (info.options.get("uv") or info.options.get("bioEnroll")):
uv = "preferred"
print("Authenticator is configured for User Verification")
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key_requirement="required",
user_verification=uv,
authenticator_attachment="cross-platform",
)
# Create a credential
result = client.make_credential(
{
**create_options["publicKey"],
# This extension isn't needed, but can be used to verify that the created
# credential uses resident key
"extensions": {"credProps": True},
}
)
# Complete registration
auth_data = server.register_complete(state, result)
credentials = [auth_data.credential_data]
print("New credential created!")
response = result.response
print("CLIENT DATA:", response.client_data)
print("ATTESTATION OBJECT:", response.attestation_object)
print()
print("CREDENTIAL DATA:", auth_data.credential_data)
print()
print("Credential Properties:", result.client_extension_results.get("credProps"))
# credProps:
cred_props = result.client_extension_results.get("credProps")
print("CredProps", cred_props)
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(user_verification=uv)
# Authenticate the credential
selection = client.get_assertion(request_options["publicKey"])
result = selection.get_response(0) # There may be multiple responses, get the first.
# Complete authenticator
server.authenticate_complete(state, credentials, result)
print("Credential authenticated!")
response = result.response
print("USER ID:", response.user_handle)
print("CLIENT DATA:", response.client_data)
print()
print("AUTHENTICATOR DATA:", response.authenticator_data)
fido2-2.2.1/examples/server/README.adoc 0000644 0000000 0000000 00000003274 15220526030 014357 0 ustar 00 == WebAuthn Server Example
This example shows a minimal website that uses python-fido2 to implement
WebAuthn credential registration, and use.
=== Running
To run this sample, you will need `uv`. For instructions on installing
`uv`, see https://docs.astral.sh/uv/.
Run the following command in the `examples/server` directory to set up the
example:
$ uv sync
Once the environment has been created, you can run the server by running:
$ uv run server
When the server is running, use a browser supporting WebAuthn and open
http://localhost:5000 to access the website.
NOTE: Webauthn requires a secure context (HTTPS), which involves
obtaining a valid TLS certificate. However, most browsers also treat
http://localhost as a secure context. This example runs without TLS
as a demo, but otherwise you should always use HTTPS with a valid
certificate when using Webauthn.
=== Using the website
The site allows you to register a WebAuthn credential, and to authenticate it.
Credentials are only stored in memory, and stopping the server will cause it to
"forget" any registered credentials.
==== Registration
1. Click on the `Register` link to begin credential registration.
2. If not already inserted, insert your U2F/FIDO2 Authenticator now.
3. Touch the button to activate the Authenticator.
4. A popup will indicate whether the registration was successful. Click `OK`.
==== Authentication
NOTE: You must register a credential prior to authentication.
1. Click on the `Authenticate` link to begin authentication.
2. If not already inserted, insert your U2F/FIDO2 Authenticator now.
3. Touch the button to activate the Authenticator.
4. A popup will indicate whether the authentication was successful. Click `OK`.
fido2-2.2.1/examples/server/pyproject.toml 0000644 0000000 0000000 00000001030 15220526030 015472 0 ustar 00 [project]
name = "fido2-example-server"
version = "0.1.0"
description = "Example server for python-fido2"
authors = [
{ name = "Dain Nilsson", email = "dain@yubico.com" }
]
requires-python = ">=3.10, <4"
license = "Apache-2.0"
dependencies = [
"Flask>=2.0,<3",
"fido2",
]
[tool.uv.sources]
fido2 = { path = "../..", editable = true }
[tool.poetry]
packages = [
{ include = "server" },
]
[build-system]
requires = ["poetry-core>=2.0"]
build-backend = "poetry.core.masonry.api"
[project.scripts]
server = "server.server:main"
fido2-2.2.1/examples/server/server/__init__.py 0000644 0000000 0000000 00000000000 15220526030 016171 0 ustar 00 fido2-2.2.1/examples/server/server/server.py 0000644 0000000 0000000 00000007731 15220526030 015762 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Example demo server to use a supported web browser to call the WebAuthn APIs
to register and use a credential.
See the file README.adoc in this directory for details.
Navigate to http://localhost:5000 in a supported web browser.
"""
import os
from flask import Flask, abort, jsonify, redirect, request, session
from fido2.server import Fido2Server
from fido2.webauthn import PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity
app = Flask(__name__, static_url_path="")
app.secret_key = os.urandom(32) # Used for session.
rp = PublicKeyCredentialRpEntity(name="Demo server", id="localhost")
server = Fido2Server(rp)
# Registered credentials are stored globally, in memory only. Single user
# support, state is lost when the server terminates.
credentials = []
@app.route("/")
def index():
return redirect("/index.html")
@app.route("/api/register/begin", methods=["POST"])
def register_begin():
options, state = server.register_begin(
PublicKeyCredentialUserEntity(
id=b"user_id",
name="a_user",
display_name="A. User",
),
credentials,
user_verification="discouraged",
authenticator_attachment="cross-platform",
)
session["state"] = state
print("\n\n\n\n")
print(dict(options))
print("\n\n\n\n")
return jsonify(dict(options))
@app.route("/api/register/complete", methods=["POST"])
def register_complete():
response = request.json
print("RegistrationResponse:", response)
auth_data = server.register_complete(session["state"], response)
credentials.append(auth_data.credential_data)
print("REGISTERED CREDENTIAL:", auth_data.credential_data)
return jsonify({"status": "OK"})
@app.route("/api/authenticate/begin", methods=["POST"])
def authenticate_begin():
if not credentials:
abort(404)
options, state = server.authenticate_begin(credentials)
session["state"] = state
return jsonify(dict(options))
@app.route("/api/authenticate/complete", methods=["POST"])
def authenticate_complete():
if not credentials:
abort(404)
response = request.json
print("AuthenticationResponse:", response)
server.authenticate_complete(
session.pop("state"),
credentials,
response,
)
print("ASSERTION OK")
return jsonify({"status": "OK"})
def main():
print(__doc__)
# Note: using localhost without TLS, as some browsers do
# not allow Webauthn in case of TLS certificate errors.
# See https://lists.w3.org/Archives/Public/public-webauthn/2022Nov/0135.html
app.run(host="localhost", debug=False)
if __name__ == "__main__":
main()
fido2-2.2.1/examples/server/server/static/authenticate.html 0000644 0000000 0000000 00000003106 15220526030 020725 0 ustar 00
Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Authenticate using a credential
Click here to start
Touch your authenticator device now...
Cancel
fido2-2.2.1/examples/server/server/static/index.html 0000644 0000000 0000000 00000001071 15220526030 017355 0 ustar 00
Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Available actions
Register Authenticate Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Register a credential
Click here to start
Touch your authenticator device now...
Cancel
fido2-2.2.1/examples/server/server/static/webauthn-json.browser-ponyfill.js 0000644 0000000 0000000 00000013372 15220526030 024025 0 ustar 00 // src/webauthn-json/base64url.ts
function base64urlToBuffer(baseurl64String) {
const padding = "==".slice(0, (4 - baseurl64String.length % 4) % 4);
const base64String = baseurl64String.replace(/-/g, "+").replace(/_/g, "/") + padding;
const str = atob(base64String);
const buffer = new ArrayBuffer(str.length);
const byteView = new Uint8Array(buffer);
for (let i = 0; i < str.length; i++) {
byteView[i] = str.charCodeAt(i);
}
return buffer;
}
function bufferToBase64url(buffer) {
const byteView = new Uint8Array(buffer);
let str = "";
for (const charCode of byteView) {
str += String.fromCharCode(charCode);
}
const base64String = btoa(str);
const base64urlString = base64String.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
return base64urlString;
}
// src/webauthn-json/convert.ts
var copyValue = "copy";
var convertValue = "convert";
function convert(conversionFn, schema, input) {
if (schema === copyValue) {
return input;
}
if (schema === convertValue) {
return conversionFn(input);
}
if (schema instanceof Array) {
return input.map((v) => convert(conversionFn, schema[0], v));
}
if (schema instanceof Object) {
const output = {};
for (const [key, schemaField] of Object.entries(schema)) {
if (schemaField.derive) {
const v = schemaField.derive(input);
if (v !== void 0) {
input[key] = v;
}
}
if (!(key in input)) {
if (schemaField.required) {
throw new Error(`Missing key: ${key}`);
}
continue;
}
if (input[key] == null) {
output[key] = null;
continue;
}
output[key] = convert(conversionFn, schemaField.schema, input[key]);
}
return output;
}
}
function derived(schema, derive) {
return {
required: true,
schema,
derive
};
}
function required(schema) {
return {
required: true,
schema
};
}
function optional(schema) {
return {
required: false,
schema
};
}
// src/webauthn-json/basic/schema.ts
var publicKeyCredentialDescriptorSchema = {
type: required(copyValue),
id: required(convertValue),
transports: optional(copyValue)
};
var simplifiedExtensionsSchema = {
appid: optional(copyValue),
appidExclude: optional(copyValue),
credProps: optional(copyValue)
};
var simplifiedClientExtensionResultsSchema = {
appid: optional(copyValue),
appidExclude: optional(copyValue),
credProps: optional(copyValue)
};
var credentialCreationOptions = {
publicKey: required({
rp: required(copyValue),
user: required({
id: required(convertValue),
name: required(copyValue),
displayName: required(copyValue)
}),
challenge: required(convertValue),
pubKeyCredParams: required(copyValue),
timeout: optional(copyValue),
excludeCredentials: optional([publicKeyCredentialDescriptorSchema]),
authenticatorSelection: optional(copyValue),
attestation: optional(copyValue),
extensions: optional(simplifiedExtensionsSchema)
}),
signal: optional(copyValue)
};
var publicKeyCredentialWithAttestation = {
type: required(copyValue),
id: required(copyValue),
rawId: required(convertValue),
authenticatorAttachment: optional(copyValue),
response: required({
clientDataJSON: required(convertValue),
attestationObject: required(convertValue),
transports: derived(copyValue, (response) => {
var _a;
return ((_a = response.getTransports) == null ? void 0 : _a.call(response)) || [];
})
}),
clientExtensionResults: derived(simplifiedClientExtensionResultsSchema, (pkc) => pkc.getClientExtensionResults())
};
var credentialRequestOptions = {
mediation: optional(copyValue),
publicKey: required({
challenge: required(convertValue),
timeout: optional(copyValue),
rpId: optional(copyValue),
allowCredentials: optional([publicKeyCredentialDescriptorSchema]),
userVerification: optional(copyValue),
extensions: optional(simplifiedExtensionsSchema)
}),
signal: optional(copyValue)
};
var publicKeyCredentialWithAssertion = {
type: required(copyValue),
id: required(copyValue),
rawId: required(convertValue),
authenticatorAttachment: optional(copyValue),
response: required({
clientDataJSON: required(convertValue),
authenticatorData: required(convertValue),
signature: required(convertValue),
userHandle: required(convertValue)
}),
clientExtensionResults: derived(simplifiedClientExtensionResultsSchema, (pkc) => pkc.getClientExtensionResults())
};
// src/webauthn-json/basic/api.ts
function createRequestFromJSON(requestJSON) {
return convert(base64urlToBuffer, credentialCreationOptions, requestJSON);
}
function createResponseToJSON(credential) {
return convert(bufferToBase64url, publicKeyCredentialWithAttestation, credential);
}
function getRequestFromJSON(requestJSON) {
return convert(base64urlToBuffer, credentialRequestOptions, requestJSON);
}
function getResponseToJSON(credential) {
return convert(bufferToBase64url, publicKeyCredentialWithAssertion, credential);
}
// src/webauthn-json/basic/supported.ts
function supported() {
return !!(navigator.credentials && navigator.credentials.create && navigator.credentials.get && window.PublicKeyCredential);
}
// src/webauthn-json/browser-ponyfill.ts
async function create(options) {
const response = await navigator.credentials.create(options);
response.toJSON = () => createResponseToJSON(response);
return response;
}
async function get(options) {
const response = await navigator.credentials.get(options);
response.toJSON = () => getResponseToJSON(response);
return response;
}
export {
create,
get,
createRequestFromJSON as parseCreationOptionsFromJSON,
getRequestFromJSON as parseRequestOptionsFromJSON,
supported
};
//# sourceMappingURL=webauthn-json.browser-ponyfill.js.map
fido2-2.2.1/examples/server/server/static/webauthn-json.browser-ponyfill.js.map 0000644 0000000 0000000 00000033044 15220526030 024577 0 ustar 00 {
"version": 3,
"sources": ["../../src/webauthn-json/base64url.ts", "../../src/webauthn-json/convert.ts", "../../src/webauthn-json/basic/schema.ts", "../../src/webauthn-json/basic/api.ts", "../../src/webauthn-json/basic/supported.ts", "../../src/webauthn-json/browser-ponyfill.ts"],
"sourcesContent": ["export type Base64urlString = string;\n\nexport function base64urlToBuffer(\n baseurl64String: Base64urlString,\n): ArrayBuffer {\n // Base64url to Base64\n const padding = \"==\".slice(0, (4 - (baseurl64String.length % 4)) % 4);\n const base64String =\n baseurl64String.replace(/-/g, \"+\").replace(/_/g, \"/\") + padding;\n\n // Base64 to binary string\n const str = atob(base64String);\n\n // Binary string to buffer\n const buffer = new ArrayBuffer(str.length);\n const byteView = new Uint8Array(buffer);\n for (let i = 0; i < str.length; i++) {\n byteView[i] = str.charCodeAt(i);\n }\n return buffer;\n}\n\nexport function bufferToBase64url(buffer: ArrayBuffer): Base64urlString {\n // Buffer to binary string\n const byteView = new Uint8Array(buffer);\n let str = \"\";\n for (const charCode of byteView) {\n str += String.fromCharCode(charCode);\n }\n\n // Binary string to base64\n const base64String = btoa(str);\n\n // Base64 to base64url\n // We assume that the base64url string is well-formed.\n const base64urlString = base64String\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"\");\n return base64urlString;\n}\n", "// We export these values in order so that they can be used to deduplicate\n// schema definitions in minified JS code.\n\nimport { Schema, SchemaProperty } from \"./schema-format\";\n\n// TODO: Parcel isn't deduplicating these values.\nexport const copyValue = \"copy\";\nexport const convertValue = \"convert\";\n\nexport function convert(\n conversionFn: (v: From) => To,\n schema: Schema,\n input: any,\n): any {\n if (schema === copyValue) {\n return input;\n }\n if (schema === convertValue) {\n return conversionFn(input);\n }\n if (schema instanceof Array) {\n return input.map((v: any) => convert(conversionFn, schema[0], v));\n }\n if (schema instanceof Object) {\n const output: any = {};\n for (const [key, schemaField] of Object.entries(schema)) {\n if (schemaField.derive) {\n const v = schemaField.derive(input);\n if (v !== undefined) {\n input[key] = v;\n }\n }\n\n if (!(key in input)) {\n if (schemaField.required) {\n throw new Error(`Missing key: ${key}`);\n }\n continue;\n }\n // Fields can be null (rather than missing or `undefined`), e.g. the\n // `userHandle` field of the `AuthenticatorAssertionResponse`:\n // https://www.w3.org/TR/webauthn/#iface-authenticatorassertionresponse\n if (input[key] == null) {\n output[key] = null;\n continue;\n }\n output[key] = convert(\n conversionFn,\n schemaField.schema,\n input[key],\n );\n }\n return output;\n }\n}\n\nexport function derived(\n schema: Schema,\n derive: (v: any) => any,\n): SchemaProperty {\n return {\n required: true,\n schema,\n derive,\n };\n}\n\nexport function required(schema: Schema): SchemaProperty {\n return {\n required: true,\n schema,\n };\n}\n\nexport function optional(schema: Schema): SchemaProperty {\n return {\n required: false,\n schema,\n };\n}\n", "import { Schema } from \"../schema-format\";\nimport {\n convertValue as convert,\n copyValue as copy,\n derived,\n optional,\n required,\n} from \"../convert\";\n\n// Shared by `create()` and `get()`.\n\nconst publicKeyCredentialDescriptorSchema: Schema = {\n type: required(copy),\n id: required(convert),\n transports: optional(copy),\n};\n\nconst simplifiedExtensionsSchema: Schema = {\n appid: optional(copy),\n appidExclude: optional(copy),\n credProps: optional(copy),\n};\n\nconst simplifiedClientExtensionResultsSchema = {\n appid: optional(copy),\n appidExclude: optional(copy),\n credProps: optional(copy),\n};\n\n// `navigator.create()` request\n\nexport const credentialCreationOptions: Schema = {\n publicKey: required({\n rp: required(copy),\n user: required({\n id: required(convert),\n name: required(copy),\n displayName: required(copy),\n }),\n\n challenge: required(convert),\n pubKeyCredParams: required(copy),\n\n timeout: optional(copy),\n excludeCredentials: optional([publicKeyCredentialDescriptorSchema]),\n authenticatorSelection: optional(copy),\n attestation: optional(copy),\n extensions: optional(simplifiedExtensionsSchema),\n }),\n signal: optional(copy),\n};\n\n// `navigator.create()` response\n\nexport const publicKeyCredentialWithAttestation: Schema = {\n type: required(copy),\n id: required(copy),\n rawId: required(convert),\n authenticatorAttachment: optional(copy),\n response: required({\n clientDataJSON: required(convert),\n attestationObject: required(convert),\n transports: derived(\n copy,\n (response: any) => response.getTransports?.() || [],\n ),\n }),\n clientExtensionResults: derived(\n simplifiedClientExtensionResultsSchema,\n (pkc: PublicKeyCredential) => pkc.getClientExtensionResults(),\n ),\n};\n\n// `navigator.get()` request\n\nexport const credentialRequestOptions: Schema = {\n mediation: optional(copy),\n publicKey: required({\n challenge: required(convert),\n timeout: optional(copy),\n rpId: optional(copy),\n allowCredentials: optional([publicKeyCredentialDescriptorSchema]),\n userVerification: optional(copy),\n extensions: optional(simplifiedExtensionsSchema),\n }),\n signal: optional(copy),\n};\n\n// `navigator.get()` response\n\nexport const publicKeyCredentialWithAssertion: Schema = {\n type: required(copy),\n id: required(copy),\n rawId: required(convert),\n authenticatorAttachment: optional(copy),\n response: required({\n clientDataJSON: required(convert),\n authenticatorData: required(convert),\n signature: required(convert),\n userHandle: required(convert),\n }),\n clientExtensionResults: derived(\n simplifiedClientExtensionResultsSchema,\n (pkc: PublicKeyCredential) => pkc.getClientExtensionResults(),\n ),\n};\n\nexport const schema: { [s: string]: Schema } = {\n credentialCreationOptions,\n publicKeyCredentialWithAttestation,\n credentialRequestOptions,\n publicKeyCredentialWithAssertion,\n};\n", "import { base64urlToBuffer, bufferToBase64url } from \"../base64url\";\nimport { convert } from \"../convert\";\nimport {\n CredentialCreationOptionsJSON,\n CredentialRequestOptionsJSON,\n PublicKeyCredentialWithAssertionJSON,\n PublicKeyCredentialWithAttestationJSON,\n} from \"./json\";\nimport {\n credentialCreationOptions,\n credentialRequestOptions,\n publicKeyCredentialWithAssertion,\n publicKeyCredentialWithAttestation,\n} from \"./schema\";\n\nexport function createRequestFromJSON(\n requestJSON: CredentialCreationOptionsJSON,\n): CredentialCreationOptions {\n return convert(base64urlToBuffer, credentialCreationOptions, requestJSON);\n}\n\nexport function createResponseToJSON(\n credential: PublicKeyCredential,\n): PublicKeyCredentialWithAttestationJSON {\n return convert(\n bufferToBase64url,\n publicKeyCredentialWithAttestation,\n credential,\n );\n}\n\nexport async function create(\n requestJSON: CredentialCreationOptionsJSON,\n): Promise {\n const credential = (await navigator.credentials.create(\n createRequestFromJSON(requestJSON),\n )) as PublicKeyCredential;\n return createResponseToJSON(credential);\n}\n\nexport function getRequestFromJSON(\n requestJSON: CredentialRequestOptionsJSON,\n): CredentialRequestOptions {\n return convert(base64urlToBuffer, credentialRequestOptions, requestJSON);\n}\n\nexport function getResponseToJSON(\n credential: PublicKeyCredential,\n): PublicKeyCredentialWithAssertionJSON {\n return convert(\n bufferToBase64url,\n publicKeyCredentialWithAssertion,\n credential,\n );\n}\n\nexport async function get(\n requestJSON: CredentialRequestOptionsJSON,\n): Promise {\n const credential = (await navigator.credentials.get(\n getRequestFromJSON(requestJSON),\n )) as PublicKeyCredential;\n return getResponseToJSON(credential);\n}\n\ndeclare global {\n interface Window {\n PublicKeyCredential: PublicKeyCredential | undefined;\n }\n}\n", "// This function does a simple check to test for the credential management API\n// functions we need, and an indication of public key credential authentication\n// support.\n// https://developers.google.com/web/updates/2018/03/webauthn-credential-management\n\nexport function supported(): boolean {\n return !!(\n navigator.credentials &&\n navigator.credentials.create &&\n navigator.credentials.get &&\n window.PublicKeyCredential\n );\n}\n", "import {\n createRequestFromJSON as parseCreationOptionsFromJSON,\n createResponseToJSON,\n getRequestFromJSON as parseRequestOptionsFromJSON,\n getResponseToJSON,\n} from \"./basic/api\";\nimport { supported } from \"./basic/supported\";\n\nimport {\n CredentialCreationOptionsJSON,\n CredentialRequestOptionsJSON,\n PublicKeyCredentialWithAssertionJSON as AuthenticationResponseJSON,\n PublicKeyCredentialWithAttestationJSON as RegistrationResponseJSON,\n} from \"./basic/json\";\n\nexport { parseCreationOptionsFromJSON, parseRequestOptionsFromJSON, supported };\nexport type {\n CredentialCreationOptionsJSON,\n CredentialRequestOptionsJSON,\n AuthenticationResponseJSON,\n RegistrationResponseJSON,\n};\n\nexport interface RegistrationPublicKeyCredential extends PublicKeyCredential {\n toJSON(): RegistrationResponseJSON;\n}\n\nexport async function create(\n options: CredentialCreationOptions,\n): Promise {\n const response = (await navigator.credentials.create(\n options,\n )) as RegistrationPublicKeyCredential;\n response.toJSON = () => createResponseToJSON(response);\n return response;\n}\n\nexport interface AuthenticationPublicKeyCredential extends PublicKeyCredential {\n toJSON(): AuthenticationResponseJSON;\n}\n\nexport async function get(\n options: CredentialRequestOptions,\n): Promise {\n const response = (await navigator.credentials.get(\n options,\n )) as AuthenticationPublicKeyCredential;\n response.toJSON = () => getResponseToJSON(response);\n return response;\n}\n"],
"mappings": ";AAEO,2BACL,iBACa;AAEb,QAAM,UAAU,KAAK,MAAM,GAAI,KAAK,gBAAgB,SAAS,KAAM;AACnE,QAAM,eACJ,gBAAgB,QAAQ,MAAM,KAAK,QAAQ,MAAM,OAAO;AAG1D,QAAM,MAAM,KAAK;AAGjB,QAAM,SAAS,IAAI,YAAY,IAAI;AACnC,QAAM,WAAW,IAAI,WAAW;AAChC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,aAAS,KAAK,IAAI,WAAW;AAAA;AAE/B,SAAO;AAAA;AAGF,2BAA2B,QAAsC;AAEtE,QAAM,WAAW,IAAI,WAAW;AAChC,MAAI,MAAM;AACV,aAAW,YAAY,UAAU;AAC/B,WAAO,OAAO,aAAa;AAAA;AAI7B,QAAM,eAAe,KAAK;AAI1B,QAAM,kBAAkB,aACrB,QAAQ,OAAO,KACf,QAAQ,OAAO,KACf,QAAQ,MAAM;AACjB,SAAO;AAAA;;;ACjCF,IAAM,YAAY;AAClB,IAAM,eAAe;AAErB,iBACL,cACA,QACA,OACK;AACL,MAAI,WAAW,WAAW;AACxB,WAAO;AAAA;AAET,MAAI,WAAW,cAAc;AAC3B,WAAO,aAAa;AAAA;AAEtB,MAAI,kBAAkB,OAAO;AAC3B,WAAO,MAAM,IAAI,CAAC,MAAW,QAAkB,cAAc,OAAO,IAAI;AAAA;AAE1E,MAAI,kBAAkB,QAAQ;AAC5B,UAAM,SAAc;AACpB,eAAW,CAAC,KAAK,gBAAgB,OAAO,QAAQ,SAAS;AACvD,UAAI,YAAY,QAAQ;AACtB,cAAM,IAAI,YAAY,OAAO;AAC7B,YAAI,MAAM,QAAW;AACnB,gBAAM,OAAO;AAAA;AAAA;AAIjB,UAAI,CAAE,QAAO,QAAQ;AACnB,YAAI,YAAY,UAAU;AACxB,gBAAM,IAAI,MAAM,gBAAgB;AAAA;AAElC;AAAA;AAKF,UAAI,MAAM,QAAQ,MAAM;AACtB,eAAO,OAAO;AACd;AAAA;AAEF,aAAO,OAAO,QACZ,cACA,YAAY,QACZ,MAAM;AAAA;AAGV,WAAO;AAAA;AAAA;AAIJ,iBACL,QACA,QACgB;AAChB,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA;AAAA;AAAA;AAIG,kBAAkB,QAAgC;AACvD,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA;AAAA;AAIG,kBAAkB,QAAgC;AACvD,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA;AAAA;;;AClEJ,IAAM,sCAA8C;AAAA,EAClD,MAAM,SAAS;AAAA,EACf,IAAI,SAAS;AAAA,EACb,YAAY,SAAS;AAAA;AAGvB,IAAM,6BAAqC;AAAA,EACzC,OAAO,SAAS;AAAA,EAChB,cAAc,SAAS;AAAA,EACvB,WAAW,SAAS;AAAA;AAGtB,IAAM,yCAAyC;AAAA,EAC7C,OAAO,SAAS;AAAA,EAChB,cAAc,SAAS;AAAA,EACvB,WAAW,SAAS;AAAA;AAKf,IAAM,4BAAoC;AAAA,EAC/C,WAAW,SAAS;AAAA,IAClB,IAAI,SAAS;AAAA,IACb,MAAM,SAAS;AAAA,MACb,IAAI,SAAS;AAAA,MACb,MAAM,SAAS;AAAA,MACf,aAAa,SAAS;AAAA;AAAA,IAGxB,WAAW,SAAS;AAAA,IACpB,kBAAkB,SAAS;AAAA,IAE3B,SAAS,SAAS;AAAA,IAClB,oBAAoB,SAAS,CAAC;AAAA,IAC9B,wBAAwB,SAAS;AAAA,IACjC,aAAa,SAAS;AAAA,IACtB,YAAY,SAAS;AAAA;AAAA,EAEvB,QAAQ,SAAS;AAAA;AAKZ,IAAM,qCAA6C;AAAA,EACxD,MAAM,SAAS;AAAA,EACf,IAAI,SAAS;AAAA,EACb,OAAO,SAAS;AAAA,EAChB,yBAAyB,SAAS;AAAA,EAClC,UAAU,SAAS;AAAA,IACjB,gBAAgB,SAAS;AAAA,IACzB,mBAAmB,SAAS;AAAA,IAC5B,YAAY,QACV,WACA,CAAC,aAAe;AAhEtB;AAgEyB,6BAAS,kBAAT,sCAA8B;AAAA;AAAA;AAAA,EAGrD,wBAAwB,QACtB,wCACA,CAAC,QAA6B,IAAI;AAAA;AAM/B,IAAM,2BAAmC;AAAA,EAC9C,WAAW,SAAS;AAAA,EACpB,WAAW,SAAS;AAAA,IAClB,WAAW,SAAS;AAAA,IACpB,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,IACf,kBAAkB,SAAS,CAAC;AAAA,IAC5B,kBAAkB,SAAS;AAAA,IAC3B,YAAY,SAAS;AAAA;AAAA,EAEvB,QAAQ,SAAS;AAAA;AAKZ,IAAM,mCAA2C;AAAA,EACtD,MAAM,SAAS;AAAA,EACf,IAAI,SAAS;AAAA,EACb,OAAO,SAAS;AAAA,EAChB,yBAAyB,SAAS;AAAA,EAClC,UAAU,SAAS;AAAA,IACjB,gBAAgB,SAAS;AAAA,IACzB,mBAAmB,SAAS;AAAA,IAC5B,WAAW,SAAS;AAAA,IACpB,YAAY,SAAS;AAAA;AAAA,EAEvB,wBAAwB,QACtB,wCACA,CAAC,QAA6B,IAAI;AAAA;;;ACxF/B,+BACL,aAC2B;AAC3B,SAAO,QAAQ,mBAAmB,2BAA2B;AAAA;AAGxD,8BACL,YACwC;AACxC,SAAO,QACL,mBACA,oCACA;AAAA;AAaG,4BACL,aAC0B;AAC1B,SAAO,QAAQ,mBAAmB,0BAA0B;AAAA;AAGvD,2BACL,YACsC;AACtC,SAAO,QACL,mBACA,kCACA;AAAA;;;AC/CG,qBAA8B;AACnC,SAAO,CAAC,CACN,WAAU,eACV,UAAU,YAAY,UACtB,UAAU,YAAY,OACtB,OAAO;AAAA;;;ACiBX,sBACE,SAC0C;AAC1C,QAAM,WAAY,MAAM,UAAU,YAAY,OAC5C;AAEF,WAAS,SAAS,MAAM,qBAAqB;AAC7C,SAAO;AAAA;AAOT,mBACE,SAC4C;AAC5C,QAAM,WAAY,MAAM,UAAU,YAAY,IAC5C;AAEF,WAAS,SAAS,MAAM,kBAAkB;AAC1C,SAAO;AAAA;",
"names": []
}
fido2-2.2.1/examples/server/uv.lock 0000644 0000000 0000000 00000212702 15220526030 014074 0 ustar 00 version = 1
revision = 3
requires-python = ">=3.10, <4"
[[package]]
name = "blinker"
version = "1.9.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/21/28/9b3f50ce0e048515135495f198351908d99540d69bfdc8c1d15b73dc55ce/blinker-1.9.0.tar.gz", hash = "sha256:b4ce2265a7abece45e7cc896e98dbebe6cead56bcf805a3d23136d145f5445bf", size = 22460, upload-time = "2024-11-08T17:25:47.436Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/10/cb/f2ad4230dc2eb1a74edf38f1a38b9b52277f75bef262d8908e60d957e13c/blinker-1.9.0-py3-none-any.whl", hash = "sha256:ba0efaa9080b619ff2f3459d1d500c57bddea4a6b424b60a91141db6fd2f08bc", size = 8458, upload-time = "2024-11-08T17:25:46.184Z" },
]
[[package]]
name = "cffi"
version = "2.0.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "pycparser", marker = "implementation_name != 'PyPy'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/93/d7/516d984057745a6cd96575eea814fe1edd6646ee6efd552fb7b0921dec83/cffi-2.0.0-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44", size = 184283, upload-time = "2025-09-08T23:22:08.01Z" },
{ url = "https://files.pythonhosted.org/packages/9e/84/ad6a0b408daa859246f57c03efd28e5dd1b33c21737c2db84cae8c237aa5/cffi-2.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49", size = 180504, upload-time = "2025-09-08T23:22:10.637Z" },
{ url = "https://files.pythonhosted.org/packages/50/bd/b1a6362b80628111e6653c961f987faa55262b4002fcec42308cad1db680/cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c", size = 208811, upload-time = "2025-09-08T23:22:12.267Z" },
{ url = "https://files.pythonhosted.org/packages/4f/27/6933a8b2562d7bd1fb595074cf99cc81fc3789f6a6c05cdabb46284a3188/cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb", size = 216402, upload-time = "2025-09-08T23:22:13.455Z" },
{ url = "https://files.pythonhosted.org/packages/05/eb/b86f2a2645b62adcfff53b0dd97e8dfafb5c8aa864bd0d9a2c2049a0d551/cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0", size = 203217, upload-time = "2025-09-08T23:22:14.596Z" },
{ url = "https://files.pythonhosted.org/packages/9f/e0/6cbe77a53acf5acc7c08cc186c9928864bd7c005f9efd0d126884858a5fe/cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4", size = 203079, upload-time = "2025-09-08T23:22:15.769Z" },
{ url = "https://files.pythonhosted.org/packages/98/29/9b366e70e243eb3d14a5cb488dfd3a0b6b2f1fb001a203f653b93ccfac88/cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453", size = 216475, upload-time = "2025-09-08T23:22:17.427Z" },
{ url = "https://files.pythonhosted.org/packages/21/7a/13b24e70d2f90a322f2900c5d8e1f14fa7e2a6b3332b7309ba7b2ba51a5a/cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495", size = 218829, upload-time = "2025-09-08T23:22:19.069Z" },
{ url = "https://files.pythonhosted.org/packages/60/99/c9dc110974c59cc981b1f5b66e1d8af8af764e00f0293266824d9c4254bc/cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5", size = 211211, upload-time = "2025-09-08T23:22:20.588Z" },
{ url = "https://files.pythonhosted.org/packages/49/72/ff2d12dbf21aca1b32a40ed792ee6b40f6dc3a9cf1644bd7ef6e95e0ac5e/cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb", size = 218036, upload-time = "2025-09-08T23:22:22.143Z" },
{ url = "https://files.pythonhosted.org/packages/e2/cc/027d7fb82e58c48ea717149b03bcadcbdc293553edb283af792bd4bcbb3f/cffi-2.0.0-cp310-cp310-win32.whl", hash = "sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a", size = 172184, upload-time = "2025-09-08T23:22:23.328Z" },
{ url = "https://files.pythonhosted.org/packages/33/fa/072dd15ae27fbb4e06b437eb6e944e75b068deb09e2a2826039e49ee2045/cffi-2.0.0-cp310-cp310-win_amd64.whl", hash = "sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739", size = 182790, upload-time = "2025-09-08T23:22:24.752Z" },
{ url = "https://files.pythonhosted.org/packages/12/4a/3dfd5f7850cbf0d06dc84ba9aa00db766b52ca38d8b86e3a38314d52498c/cffi-2.0.0-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe", size = 184344, upload-time = "2025-09-08T23:22:26.456Z" },
{ url = "https://files.pythonhosted.org/packages/4f/8b/f0e4c441227ba756aafbe78f117485b25bb26b1c059d01f137fa6d14896b/cffi-2.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c", size = 180560, upload-time = "2025-09-08T23:22:28.197Z" },
{ url = "https://files.pythonhosted.org/packages/b1/b7/1200d354378ef52ec227395d95c2576330fd22a869f7a70e88e1447eb234/cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92", size = 209613, upload-time = "2025-09-08T23:22:29.475Z" },
{ url = "https://files.pythonhosted.org/packages/b8/56/6033f5e86e8cc9bb629f0077ba71679508bdf54a9a5e112a3c0b91870332/cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93", size = 216476, upload-time = "2025-09-08T23:22:31.063Z" },
{ url = "https://files.pythonhosted.org/packages/dc/7f/55fecd70f7ece178db2f26128ec41430d8720f2d12ca97bf8f0a628207d5/cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5", size = 203374, upload-time = "2025-09-08T23:22:32.507Z" },
{ url = "https://files.pythonhosted.org/packages/84/ef/a7b77c8bdc0f77adc3b46888f1ad54be8f3b7821697a7b89126e829e676a/cffi-2.0.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664", size = 202597, upload-time = "2025-09-08T23:22:34.132Z" },
{ url = "https://files.pythonhosted.org/packages/d7/91/500d892b2bf36529a75b77958edfcd5ad8e2ce4064ce2ecfeab2125d72d1/cffi-2.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26", size = 215574, upload-time = "2025-09-08T23:22:35.443Z" },
{ url = "https://files.pythonhosted.org/packages/44/64/58f6255b62b101093d5df22dcb752596066c7e89dd725e0afaed242a61be/cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9", size = 218971, upload-time = "2025-09-08T23:22:36.805Z" },
{ url = "https://files.pythonhosted.org/packages/ab/49/fa72cebe2fd8a55fbe14956f9970fe8eb1ac59e5df042f603ef7c8ba0adc/cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414", size = 211972, upload-time = "2025-09-08T23:22:38.436Z" },
{ url = "https://files.pythonhosted.org/packages/0b/28/dd0967a76aab36731b6ebfe64dec4e981aff7e0608f60c2d46b46982607d/cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743", size = 217078, upload-time = "2025-09-08T23:22:39.776Z" },
{ url = "https://files.pythonhosted.org/packages/2b/c0/015b25184413d7ab0a410775fdb4a50fca20f5589b5dab1dbbfa3baad8ce/cffi-2.0.0-cp311-cp311-win32.whl", hash = "sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5", size = 172076, upload-time = "2025-09-08T23:22:40.95Z" },
{ url = "https://files.pythonhosted.org/packages/ae/8f/dc5531155e7070361eb1b7e4c1a9d896d0cb21c49f807a6c03fd63fc877e/cffi-2.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5", size = 182820, upload-time = "2025-09-08T23:22:42.463Z" },
{ url = "https://files.pythonhosted.org/packages/95/5c/1b493356429f9aecfd56bc171285a4c4ac8697f76e9bbbbb105e537853a1/cffi-2.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d", size = 177635, upload-time = "2025-09-08T23:22:43.623Z" },
{ url = "https://files.pythonhosted.org/packages/ea/47/4f61023ea636104d4f16ab488e268b93008c3d0bb76893b1b31db1f96802/cffi-2.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d", size = 185271, upload-time = "2025-09-08T23:22:44.795Z" },
{ url = "https://files.pythonhosted.org/packages/df/a2/781b623f57358e360d62cdd7a8c681f074a71d445418a776eef0aadb4ab4/cffi-2.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c", size = 181048, upload-time = "2025-09-08T23:22:45.938Z" },
{ url = "https://files.pythonhosted.org/packages/ff/df/a4f0fbd47331ceeba3d37c2e51e9dfc9722498becbeec2bd8bc856c9538a/cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe", size = 212529, upload-time = "2025-09-08T23:22:47.349Z" },
{ url = "https://files.pythonhosted.org/packages/d5/72/12b5f8d3865bf0f87cf1404d8c374e7487dcf097a1c91c436e72e6badd83/cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062", size = 220097, upload-time = "2025-09-08T23:22:48.677Z" },
{ url = "https://files.pythonhosted.org/packages/c2/95/7a135d52a50dfa7c882ab0ac17e8dc11cec9d55d2c18dda414c051c5e69e/cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e", size = 207983, upload-time = "2025-09-08T23:22:50.06Z" },
{ url = "https://files.pythonhosted.org/packages/3a/c8/15cb9ada8895957ea171c62dc78ff3e99159ee7adb13c0123c001a2546c1/cffi-2.0.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037", size = 206519, upload-time = "2025-09-08T23:22:51.364Z" },
{ url = "https://files.pythonhosted.org/packages/78/2d/7fa73dfa841b5ac06c7b8855cfc18622132e365f5b81d02230333ff26e9e/cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba", size = 219572, upload-time = "2025-09-08T23:22:52.902Z" },
{ url = "https://files.pythonhosted.org/packages/07/e0/267e57e387b4ca276b90f0434ff88b2c2241ad72b16d31836adddfd6031b/cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94", size = 222963, upload-time = "2025-09-08T23:22:54.518Z" },
{ url = "https://files.pythonhosted.org/packages/b6/75/1f2747525e06f53efbd878f4d03bac5b859cbc11c633d0fb81432d98a795/cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187", size = 221361, upload-time = "2025-09-08T23:22:55.867Z" },
{ url = "https://files.pythonhosted.org/packages/7b/2b/2b6435f76bfeb6bbf055596976da087377ede68df465419d192acf00c437/cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18", size = 172932, upload-time = "2025-09-08T23:22:57.188Z" },
{ url = "https://files.pythonhosted.org/packages/f8/ed/13bd4418627013bec4ed6e54283b1959cf6db888048c7cf4b4c3b5b36002/cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5", size = 183557, upload-time = "2025-09-08T23:22:58.351Z" },
{ url = "https://files.pythonhosted.org/packages/95/31/9f7f93ad2f8eff1dbc1c3656d7ca5bfd8fb52c9d786b4dcf19b2d02217fa/cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6", size = 177762, upload-time = "2025-09-08T23:22:59.668Z" },
{ url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
{ url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
{ url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
{ url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
{ url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
{ url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
{ url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
{ url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
{ url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
{ url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
{ url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
{ url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
{ url = "https://files.pythonhosted.org/packages/92/c4/3ce07396253a83250ee98564f8d7e9789fab8e58858f35d07a9a2c78de9f/cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5", size = 185320, upload-time = "2025-09-08T23:23:18.087Z" },
{ url = "https://files.pythonhosted.org/packages/59/dd/27e9fa567a23931c838c6b02d0764611c62290062a6d4e8ff7863daf9730/cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13", size = 181487, upload-time = "2025-09-08T23:23:19.622Z" },
{ url = "https://files.pythonhosted.org/packages/d6/43/0e822876f87ea8a4ef95442c3d766a06a51fc5298823f884ef87aaad168c/cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b", size = 220049, upload-time = "2025-09-08T23:23:20.853Z" },
{ url = "https://files.pythonhosted.org/packages/b4/89/76799151d9c2d2d1ead63c2429da9ea9d7aac304603de0c6e8764e6e8e70/cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c", size = 207793, upload-time = "2025-09-08T23:23:22.08Z" },
{ url = "https://files.pythonhosted.org/packages/bb/dd/3465b14bb9e24ee24cb88c9e3730f6de63111fffe513492bf8c808a3547e/cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef", size = 206300, upload-time = "2025-09-08T23:23:23.314Z" },
{ url = "https://files.pythonhosted.org/packages/47/d9/d83e293854571c877a92da46fdec39158f8d7e68da75bf73581225d28e90/cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775", size = 219244, upload-time = "2025-09-08T23:23:24.541Z" },
{ url = "https://files.pythonhosted.org/packages/2b/0f/1f177e3683aead2bb00f7679a16451d302c436b5cbf2505f0ea8146ef59e/cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205", size = 222828, upload-time = "2025-09-08T23:23:26.143Z" },
{ url = "https://files.pythonhosted.org/packages/c6/0f/cafacebd4b040e3119dcb32fed8bdef8dfe94da653155f9d0b9dc660166e/cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1", size = 220926, upload-time = "2025-09-08T23:23:27.873Z" },
{ url = "https://files.pythonhosted.org/packages/3e/aa/df335faa45b395396fcbc03de2dfcab242cd61a9900e914fe682a59170b1/cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f", size = 175328, upload-time = "2025-09-08T23:23:44.61Z" },
{ url = "https://files.pythonhosted.org/packages/bb/92/882c2d30831744296ce713f0feb4c1cd30f346ef747b530b5318715cc367/cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25", size = 185650, upload-time = "2025-09-08T23:23:45.848Z" },
{ url = "https://files.pythonhosted.org/packages/9f/2c/98ece204b9d35a7366b5b2c6539c350313ca13932143e79dc133ba757104/cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad", size = 180687, upload-time = "2025-09-08T23:23:47.105Z" },
{ url = "https://files.pythonhosted.org/packages/3e/61/c768e4d548bfa607abcda77423448df8c471f25dbe64fb2ef6d555eae006/cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9", size = 188773, upload-time = "2025-09-08T23:23:29.347Z" },
{ url = "https://files.pythonhosted.org/packages/2c/ea/5f76bce7cf6fcd0ab1a1058b5af899bfbef198bea4d5686da88471ea0336/cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d", size = 185013, upload-time = "2025-09-08T23:23:30.63Z" },
{ url = "https://files.pythonhosted.org/packages/be/b4/c56878d0d1755cf9caa54ba71e5d049479c52f9e4afc230f06822162ab2f/cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c", size = 221593, upload-time = "2025-09-08T23:23:31.91Z" },
{ url = "https://files.pythonhosted.org/packages/e0/0d/eb704606dfe8033e7128df5e90fee946bbcb64a04fcdaa97321309004000/cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8", size = 209354, upload-time = "2025-09-08T23:23:33.214Z" },
{ url = "https://files.pythonhosted.org/packages/d8/19/3c435d727b368ca475fb8742ab97c9cb13a0de600ce86f62eab7fa3eea60/cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc", size = 208480, upload-time = "2025-09-08T23:23:34.495Z" },
{ url = "https://files.pythonhosted.org/packages/d0/44/681604464ed9541673e486521497406fadcc15b5217c3e326b061696899a/cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592", size = 221584, upload-time = "2025-09-08T23:23:36.096Z" },
{ url = "https://files.pythonhosted.org/packages/25/8e/342a504ff018a2825d395d44d63a767dd8ebc927ebda557fecdaca3ac33a/cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512", size = 224443, upload-time = "2025-09-08T23:23:37.328Z" },
{ url = "https://files.pythonhosted.org/packages/e1/5e/b666bacbbc60fbf415ba9988324a132c9a7a0448a9a8f125074671c0f2c3/cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4", size = 223437, upload-time = "2025-09-08T23:23:38.945Z" },
{ url = "https://files.pythonhosted.org/packages/a0/1d/ec1a60bd1a10daa292d3cd6bb0b359a81607154fb8165f3ec95fe003b85c/cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e", size = 180487, upload-time = "2025-09-08T23:23:40.423Z" },
{ url = "https://files.pythonhosted.org/packages/bf/41/4c1168c74fac325c0c8156f04b6749c8b6a8f405bbf91413ba088359f60d/cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6", size = 191726, upload-time = "2025-09-08T23:23:41.742Z" },
{ url = "https://files.pythonhosted.org/packages/ae/3a/dbeec9d1ee0844c679f6bb5d6ad4e9f198b1224f4e7a32825f47f6192b0c/cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9", size = 184195, upload-time = "2025-09-08T23:23:43.004Z" },
]
[[package]]
name = "click"
version = "8.4.2"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "colorama", marker = "sys_platform == 'win32'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/76/d4/81420972a676e8ffea40450d8c8c92943e7218a78fe9b64359836cc9876b/click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6", size = 338000, upload-time = "2026-06-24T17:45:15.148Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/fb/e2/79c688af8b210d232694e31e59da9f6ec747bae31c3f5946e4e9b98860d5/click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76", size = 119243, upload-time = "2026-06-24T17:45:13.73Z" },
]
[[package]]
name = "colorama"
version = "0.4.6"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
]
[[package]]
name = "cryptography"
version = "49.0.0"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
{ name = "typing-extensions", marker = "python_full_version < '3.11'" },
]
sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/9b/22/adf66990e63584a68dfb50c24f48a125c07b1699899381c8151e63ed458c/cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db", size = 4032100, upload-time = "2026-06-12T20:02:32.143Z" },
{ url = "https://files.pythonhosted.org/packages/09/41/3797cfaf69cae04a13ee78ebd83f0678d9c02b4779d21ce24445326f1a69/cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db", size = 4692978, upload-time = "2026-06-12T20:01:21.305Z" },
{ url = "https://files.pythonhosted.org/packages/e6/8b/43011f7ebe515a8aa20d61f290a326cd890c2e738e16e59eaff8d9c3a412/cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325", size = 4716422, upload-time = "2026-06-12T20:01:48.566Z" },
{ url = "https://files.pythonhosted.org/packages/4a/91/01ce7303a4579e6d3a6abef01bd322848e9ea7a219adcabc5048b9033571/cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2", size = 4700503, upload-time = "2026-06-12T20:02:47.091Z" },
{ url = "https://files.pythonhosted.org/packages/62/99/a2c95cf8293f07491e9e27c20cc4dcd18176d944e674679adeb1d0173fd6/cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b", size = 5309779, upload-time = "2026-06-12T20:02:08.987Z" },
{ url = "https://files.pythonhosted.org/packages/20/2c/0622f20ff02b2ef32558733443805dc82fd4c275be01b2d19d14676f3a1b/cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6", size = 4749683, upload-time = "2026-06-12T20:02:03.335Z" },
{ url = "https://files.pythonhosted.org/packages/a3/5b/c5246635d5fd3b64e0d45ae10e99fd32fe9676a79915ccfe5a61ba9af1a5/cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c", size = 4337874, upload-time = "2026-06-12T20:02:54.323Z" },
{ url = "https://files.pythonhosted.org/packages/6d/88/05563c7fe2e914e87d1a536d06fe83e66b4e1d95cb593e05aea375531da8/cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7", size = 4700283, upload-time = "2026-06-12T20:01:34.822Z" },
{ url = "https://files.pythonhosted.org/packages/c4/b6/d7696e4e890d6ae1469935164c9e5215c557671cb78d6e3f458ccceaa632/cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68", size = 5265844, upload-time = "2026-06-12T20:01:24.09Z" },
{ url = "https://files.pythonhosted.org/packages/a9/3c/f3ad17eecc1a57b0ba236dc01f90e783c51f4a2f35f64777cc4f47a184b2/cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9", size = 4749290, upload-time = "2026-06-12T20:01:30.848Z" },
{ url = "https://files.pythonhosted.org/packages/4f/01/339573cf1023163a400b0b5d16f6d507de413b9f60be6fd1b77feeaf6737/cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f", size = 4834612, upload-time = "2026-06-12T20:01:29.246Z" },
{ url = "https://files.pythonhosted.org/packages/71/fd/577302e213a1be9468f92d1afef66fcf1ef83d516819d9992ca547f592bd/cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459", size = 4980804, upload-time = "2026-06-12T20:01:42.853Z" },
{ url = "https://files.pythonhosted.org/packages/1f/09/f42b1d190c5ba75f72062a387f8030d1d75f6ab035788f1d9c4b01de6525/cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e", size = 3810026, upload-time = "2026-06-12T20:02:39.262Z" },
{ url = "https://files.pythonhosted.org/packages/ec/9e/db72b3ae7fc9cfad53e630e56c6ae83b9b6ff0bf3718ffb8012d20b3aabf/cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7", size = 4013892, upload-time = "2026-06-12T20:02:10.735Z" },
{ url = "https://files.pythonhosted.org/packages/86/12/c48a424f38db03027be9f7ed5c7dc5de9933dbee992865f98b13727a009d/cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d", size = 4678835, upload-time = "2026-06-12T20:02:48.743Z" },
{ url = "https://files.pythonhosted.org/packages/68/28/8a3ad4653662c93fc44dc4e5d8fd374c25c42e07b34bbfbadf49cf57a5a8/cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa", size = 4697239, upload-time = "2026-06-12T20:02:56.03Z" },
{ url = "https://files.pythonhosted.org/packages/a8/b2/2193fc74f81aee4f9b62733133b73b5176718932ed8f2e4b03fa040480a6/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb", size = 4685593, upload-time = "2026-06-12T20:02:50.666Z" },
{ url = "https://files.pythonhosted.org/packages/47/f1/1d3eaa243bfc5de4a187b22aa8c048b3e4980bfbe830ac46e6bac2e66947/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d", size = 5289961, upload-time = "2026-06-12T20:01:46.468Z" },
{ url = "https://files.pythonhosted.org/packages/58/39/2d51306721330c486495853eda1c567880ff036de15a14c4b74f399934af/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561", size = 4731145, upload-time = "2026-06-12T20:02:16.832Z" },
{ url = "https://files.pythonhosted.org/packages/17/50/983e838c7fd0d87fd8c969bcdd328edaf5f756e38df5281637424c155873/cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122", size = 4321719, upload-time = "2026-06-12T20:02:52.611Z" },
{ url = "https://files.pythonhosted.org/packages/a7/f5/8f571d7e27c55bce9f76f026143bcb1e040a4233149ecca0bea5fa5dd5f7/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505", size = 4685209, upload-time = "2026-06-12T20:02:07.282Z" },
{ url = "https://files.pythonhosted.org/packages/e7/84/0e27016a6fc5a0886f797018b26aa42f40c09a82332bff77822a451deaaa/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866", size = 5246285, upload-time = "2026-06-12T20:01:32.439Z" },
{ url = "https://files.pythonhosted.org/packages/11/2d/5e1fb307cb5931881516b464c98774b3f2c36b5d4bb9a2830253cf553cad/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8", size = 4730441, upload-time = "2026-06-12T20:02:01.469Z" },
{ url = "https://files.pythonhosted.org/packages/e4/c0/bff5a02ee731d207d6a1ed51732549d8c53d2bc8da1d10ec6f2844201d68/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3", size = 4815869, upload-time = "2026-06-12T20:01:36.574Z" },
{ url = "https://files.pythonhosted.org/packages/b9/26/814681d14248d95d73d5c3eea0c39a94eb8302df966f670a2c60de90974b/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27", size = 4960948, upload-time = "2026-06-12T20:02:18.688Z" },
{ url = "https://files.pythonhosted.org/packages/4c/fe/93ecac273d3738939d023612ad12cca9a3740a5345d69fda04134c43fd96/cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61", size = 3799153, upload-time = "2026-06-12T20:01:39.059Z" },
{ url = "https://files.pythonhosted.org/packages/19/2a/5bb823f5bedcf80718cea7fbc95ec5515cca3769633c4b01a32be7f30e7c/cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a", size = 4025947, upload-time = "2026-06-12T20:01:25.745Z" },
{ url = "https://files.pythonhosted.org/packages/3d/df/40577043ca124e17012f408ddddaeb213b856336ac82ddb3bc915f39e29f/cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4", size = 4692429, upload-time = "2026-06-12T20:01:53.628Z" },
{ url = "https://files.pythonhosted.org/packages/2c/99/2d13299eb3dd27b02dcfaafcc91d6b5cb3329f7cbd6d8f51921acd566c1a/cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18", size = 4700968, upload-time = "2026-06-12T20:02:45.383Z" },
{ url = "https://files.pythonhosted.org/packages/a5/4d/9c0cd02f95e2602dd5e563da149ee0830abef3537be8b34dc56281ebe27a/cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69", size = 4697758, upload-time = "2026-06-12T20:01:41.13Z" },
{ url = "https://files.pythonhosted.org/packages/24/01/186c825898477d77e2324d5360fefe622ff1d8d1963ec0554e2cada8ec77/cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64", size = 5298863, upload-time = "2026-06-12T20:02:24.579Z" },
{ url = "https://files.pythonhosted.org/packages/b8/7b/62cbbab75d0659865bf0273790031544a0b16c8072d258f9428dcd8190dc/cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21", size = 4735983, upload-time = "2026-06-12T20:01:50.14Z" },
{ url = "https://files.pythonhosted.org/packages/6c/72/3e798c064bc39e471008075d0f9bc9daf77a80879c092e4a8e170c585ed4/cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9", size = 4334173, upload-time = "2026-06-12T20:01:44.743Z" },
{ url = "https://files.pythonhosted.org/packages/f0/ee/6fca21d1ac73e06f8bef71940abfd4d2f6472b4bca284d770f32bd4086f6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc", size = 4697298, upload-time = "2026-06-12T20:02:20.918Z" },
{ url = "https://files.pythonhosted.org/packages/67/d0/a5fcd3515f0bae49a7b6d0413cc1bdccdcc1fc0047037a0d480642cdc5d6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8", size = 5254338, upload-time = "2026-06-12T20:02:22.737Z" },
{ url = "https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36", size = 4735650, upload-time = "2026-06-12T20:02:41.389Z" },
{ url = "https://files.pythonhosted.org/packages/6c/a0/db537264e234f7273a73ec020873d6d6b39dfd8a53db78b550ca8320440e/cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e", size = 4834820, upload-time = "2026-06-12T20:01:51.847Z" },
{ url = "https://files.pythonhosted.org/packages/93/77/8df9eb486495979bccecd1062e2eaf435250e84437040295b57d09048b0b/cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b", size = 4967968, upload-time = "2026-06-12T20:02:12.524Z" },
{ url = "https://files.pythonhosted.org/packages/c2/e6/f60198ea8d9dfa15fff9ed4ca02ce362f6eadd9ba757dcc50634c4257b63/cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001", size = 3785547, upload-time = "2026-06-12T20:02:26.847Z" },
{ url = "https://files.pythonhosted.org/packages/63/d3/4a83af35d65e3fad632c926fad684c193ea4398569ccb0bbbc7fe8f5dc9a/cryptography-49.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b", size = 3993685, upload-time = "2026-06-12T20:02:14.883Z" },
{ url = "https://files.pythonhosted.org/packages/d6/a7/f9dac0ab7f80368c56993a7bf638ef9935f825c91902798481fac0898138/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838", size = 4676239, upload-time = "2026-06-12T20:02:28.793Z" },
{ url = "https://files.pythonhosted.org/packages/d7/70/2ba3769dd0ae167e2f33dfa9592d45db6ff9a61d62ca1a5b3d1bdd09068f/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5", size = 4715584, upload-time = "2026-06-12T20:01:27.495Z" },
{ url = "https://files.pythonhosted.org/packages/94/64/2923570ac1c0bd3a737aa366ac3abbbbde273042308b8cde95e2364a6e6a/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615", size = 4675885, upload-time = "2026-06-12T20:01:55.49Z" },
{ url = "https://files.pythonhosted.org/packages/ab/f8/614dc7e051418cfe53d55173c1e24c6b0085e89996fe90508c2fdf769aef/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6", size = 4715449, upload-time = "2026-06-12T20:02:05.469Z" },
{ url = "https://files.pythonhosted.org/packages/aa/50/a9caea39ad19c431c1a3f8a31114df65b260cdfe67786b6c7e7c040c4c44/cryptography-49.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6", size = 3783731, upload-time = "2026-06-12T20:02:43.319Z" },
]
[[package]]
name = "fido2"
version = "2.2.1.dev0"
source = { editable = "../../" }
dependencies = [
{ name = "cryptography" },
]
[package.metadata]
requires-dist = [
{ name = "cryptography", specifier = ">=2.6,!=35,<52" },
{ name = "pyscard", marker = "extra == 'pcsc'", specifier = ">=1.9,<3" },
]
provides-extras = ["pcsc"]
[package.metadata.requires-dev]
dev = [
{ name = "pytest", specifier = ">=9.0,<10" },
{ name = "sphinx", marker = "python_full_version >= '3.11'", specifier = ">=9.0,<10" },
{ name = "sphinx-autoapi", specifier = ">=3.3.3,<4" },
{ name = "sphinx-rtd-theme", specifier = ">=3,<4" },
]
[[package]]
name = "fido2-example-server"
version = "0.1.0"
source = { editable = "." }
dependencies = [
{ name = "fido2" },
{ name = "flask" },
]
[package.metadata]
requires-dist = [
{ name = "fido2", editable = "../../" },
{ name = "flask", specifier = ">=2.0,<3" },
]
[[package]]
name = "flask"
version = "2.3.3"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "blinker" },
{ name = "click" },
{ name = "itsdangerous" },
{ name = "jinja2" },
{ name = "werkzeug" },
]
sdist = { url = "https://files.pythonhosted.org/packages/46/b7/4ace17e37abd9c21715dea5ee11774a25e404c486a7893fa18e764326ead/flask-2.3.3.tar.gz", hash = "sha256:09c347a92aa7ff4a8e7f3206795f30d826654baf38b873d0744cd571ca609efc", size = 672756, upload-time = "2023-08-21T19:52:35.012Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/fd/56/26f0be8adc2b4257df20c1c4260ddd0aa396cf8e75d90ab2f7ff99bc34f9/flask-2.3.3-py3-none-any.whl", hash = "sha256:f69fcd559dc907ed196ab9df0e48471709175e696d6e698dd4dbe940f96ce66b", size = 96112, upload-time = "2023-08-21T19:52:33.115Z" },
]
[[package]]
name = "itsdangerous"
version = "2.2.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/9c/cb/8ac0172223afbccb63986cc25049b154ecfb5e85932587206f42317be31d/itsdangerous-2.2.0.tar.gz", hash = "sha256:e0050c0b7da1eea53ffaf149c0cfbb5c6e2e2b69c4bef22c81fa6eb73e5f6173", size = 54410, upload-time = "2024-04-16T21:28:15.614Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/04/96/92447566d16df59b2a776c0fb82dbc4d9e07cd95062562af01e408583fc4/itsdangerous-2.2.0-py3-none-any.whl", hash = "sha256:c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef", size = 16234, upload-time = "2024-04-16T21:28:14.499Z" },
]
[[package]]
name = "jinja2"
version = "3.1.6"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "markupsafe" },
]
sdist = { url = "https://files.pythonhosted.org/packages/df/bf/f7da0350254c0ed7c72f3e33cef02e048281fec7ecec5f032d4aac52226b/jinja2-3.1.6.tar.gz", hash = "sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d", size = 245115, upload-time = "2025-03-05T20:05:02.478Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/62/a1/3d680cbfd5f4b8f15abc1d571870c5fc3e594bb582bc3b64ea099db13e56/jinja2-3.1.6-py3-none-any.whl", hash = "sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67", size = 134899, upload-time = "2025-03-05T20:05:00.369Z" },
]
[[package]]
name = "markupsafe"
version = "3.0.3"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/7e/99/7690b6d4034fffd95959cbe0c02de8deb3098cc577c67bb6a24fe5d7caa7/markupsafe-3.0.3.tar.gz", hash = "sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698", size = 80313, upload-time = "2025-09-27T18:37:40.426Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/e8/4b/3541d44f3937ba468b75da9eebcae497dcf67adb65caa16760b0a6807ebb/markupsafe-3.0.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:2f981d352f04553a7171b8e44369f2af4055f888dfb147d55e42d29e29e74559", size = 11631, upload-time = "2025-09-27T18:36:05.558Z" },
{ url = "https://files.pythonhosted.org/packages/98/1b/fbd8eed11021cabd9226c37342fa6ca4e8a98d8188a8d9b66740494960e4/markupsafe-3.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:e1c1493fb6e50ab01d20a22826e57520f1284df32f2d8601fdd90b6304601419", size = 12057, upload-time = "2025-09-27T18:36:07.165Z" },
{ url = "https://files.pythonhosted.org/packages/40/01/e560d658dc0bb8ab762670ece35281dec7b6c1b33f5fbc09ebb57a185519/markupsafe-3.0.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1ba88449deb3de88bd40044603fafffb7bc2b055d626a330323a9ed736661695", size = 22050, upload-time = "2025-09-27T18:36:08.005Z" },
{ url = "https://files.pythonhosted.org/packages/af/cd/ce6e848bbf2c32314c9b237839119c5a564a59725b53157c856e90937b7a/markupsafe-3.0.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f42d0984e947b8adf7dd6dde396e720934d12c506ce84eea8476409563607591", size = 20681, upload-time = "2025-09-27T18:36:08.881Z" },
{ url = "https://files.pythonhosted.org/packages/c9/2a/b5c12c809f1c3045c4d580b035a743d12fcde53cf685dbc44660826308da/markupsafe-3.0.3-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c0c0b3ade1c0b13b936d7970b1d37a57acde9199dc2aecc4c336773e1d86049c", size = 20705, upload-time = "2025-09-27T18:36:10.131Z" },
{ url = "https://files.pythonhosted.org/packages/cf/e3/9427a68c82728d0a88c50f890d0fc072a1484de2f3ac1ad0bfc1a7214fd5/markupsafe-3.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f", size = 21524, upload-time = "2025-09-27T18:36:11.324Z" },
{ url = "https://files.pythonhosted.org/packages/bc/36/23578f29e9e582a4d0278e009b38081dbe363c5e7165113fad546918a232/markupsafe-3.0.3-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:d2ee202e79d8ed691ceebae8e0486bd9a2cd4794cec4824e1c99b6f5009502f6", size = 20282, upload-time = "2025-09-27T18:36:12.573Z" },
{ url = "https://files.pythonhosted.org/packages/56/21/dca11354e756ebd03e036bd8ad58d6d7168c80ce1fe5e75218e4945cbab7/markupsafe-3.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:177b5253b2834fe3678cb4a5f0059808258584c559193998be2601324fdeafb1", size = 20745, upload-time = "2025-09-27T18:36:13.504Z" },
{ url = "https://files.pythonhosted.org/packages/87/99/faba9369a7ad6e4d10b6a5fbf71fa2a188fe4a593b15f0963b73859a1bbd/markupsafe-3.0.3-cp310-cp310-win32.whl", hash = "sha256:2a15a08b17dd94c53a1da0438822d70ebcd13f8c3a95abe3a9ef9f11a94830aa", size = 14571, upload-time = "2025-09-27T18:36:14.779Z" },
{ url = "https://files.pythonhosted.org/packages/d6/25/55dc3ab959917602c96985cb1253efaa4ff42f71194bddeb61eb7278b8be/markupsafe-3.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:c4ffb7ebf07cfe8931028e3e4c85f0357459a3f9f9490886198848f4fa002ec8", size = 15056, upload-time = "2025-09-27T18:36:16.125Z" },
{ url = "https://files.pythonhosted.org/packages/d0/9e/0a02226640c255d1da0b8d12e24ac2aa6734da68bff14c05dd53b94a0fc3/markupsafe-3.0.3-cp310-cp310-win_arm64.whl", hash = "sha256:e2103a929dfa2fcaf9bb4e7c091983a49c9ac3b19c9061b6d5427dd7d14d81a1", size = 13932, upload-time = "2025-09-27T18:36:17.311Z" },
{ url = "https://files.pythonhosted.org/packages/08/db/fefacb2136439fc8dd20e797950e749aa1f4997ed584c62cfb8ef7c2be0e/markupsafe-3.0.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1cc7ea17a6824959616c525620e387f6dd30fec8cb44f649e31712db02123dad", size = 11631, upload-time = "2025-09-27T18:36:18.185Z" },
{ url = "https://files.pythonhosted.org/packages/e1/2e/5898933336b61975ce9dc04decbc0a7f2fee78c30353c5efba7f2d6ff27a/markupsafe-3.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a", size = 12058, upload-time = "2025-09-27T18:36:19.444Z" },
{ url = "https://files.pythonhosted.org/packages/1d/09/adf2df3699d87d1d8184038df46a9c80d78c0148492323f4693df54e17bb/markupsafe-3.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50", size = 24287, upload-time = "2025-09-27T18:36:20.768Z" },
{ url = "https://files.pythonhosted.org/packages/30/ac/0273f6fcb5f42e314c6d8cd99effae6a5354604d461b8d392b5ec9530a54/markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf", size = 22940, upload-time = "2025-09-27T18:36:22.249Z" },
{ url = "https://files.pythonhosted.org/packages/19/ae/31c1be199ef767124c042c6c3e904da327a2f7f0cd63a0337e1eca2967a8/markupsafe-3.0.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f", size = 21887, upload-time = "2025-09-27T18:36:23.535Z" },
{ url = "https://files.pythonhosted.org/packages/b2/76/7edcab99d5349a4532a459e1fe64f0b0467a3365056ae550d3bcf3f79e1e/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a", size = 23692, upload-time = "2025-09-27T18:36:24.823Z" },
{ url = "https://files.pythonhosted.org/packages/a4/28/6e74cdd26d7514849143d69f0bf2399f929c37dc2b31e6829fd2045b2765/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115", size = 21471, upload-time = "2025-09-27T18:36:25.95Z" },
{ url = "https://files.pythonhosted.org/packages/62/7e/a145f36a5c2945673e590850a6f8014318d5577ed7e5920a4b3448e0865d/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a", size = 22923, upload-time = "2025-09-27T18:36:27.109Z" },
{ url = "https://files.pythonhosted.org/packages/0f/62/d9c46a7f5c9adbeeeda52f5b8d802e1094e9717705a645efc71b0913a0a8/markupsafe-3.0.3-cp311-cp311-win32.whl", hash = "sha256:0db14f5dafddbb6d9208827849fad01f1a2609380add406671a26386cdf15a19", size = 14572, upload-time = "2025-09-27T18:36:28.045Z" },
{ url = "https://files.pythonhosted.org/packages/83/8a/4414c03d3f891739326e1783338e48fb49781cc915b2e0ee052aa490d586/markupsafe-3.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:de8a88e63464af587c950061a5e6a67d3632e36df62b986892331d4620a35c01", size = 15077, upload-time = "2025-09-27T18:36:29.025Z" },
{ url = "https://files.pythonhosted.org/packages/35/73/893072b42e6862f319b5207adc9ae06070f095b358655f077f69a35601f0/markupsafe-3.0.3-cp311-cp311-win_arm64.whl", hash = "sha256:3b562dd9e9ea93f13d53989d23a7e775fdfd1066c33494ff43f5418bc8c58a5c", size = 13876, upload-time = "2025-09-27T18:36:29.954Z" },
{ url = "https://files.pythonhosted.org/packages/5a/72/147da192e38635ada20e0a2e1a51cf8823d2119ce8883f7053879c2199b5/markupsafe-3.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d53197da72cc091b024dd97249dfc7794d6a56530370992a5e1a08983ad9230e", size = 11615, upload-time = "2025-09-27T18:36:30.854Z" },
{ url = "https://files.pythonhosted.org/packages/9a/81/7e4e08678a1f98521201c3079f77db69fb552acd56067661f8c2f534a718/markupsafe-3.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce", size = 12020, upload-time = "2025-09-27T18:36:31.971Z" },
{ url = "https://files.pythonhosted.org/packages/1e/2c/799f4742efc39633a1b54a92eec4082e4f815314869865d876824c257c1e/markupsafe-3.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d", size = 24332, upload-time = "2025-09-27T18:36:32.813Z" },
{ url = "https://files.pythonhosted.org/packages/3c/2e/8d0c2ab90a8c1d9a24f0399058ab8519a3279d1bd4289511d74e909f060e/markupsafe-3.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d", size = 22947, upload-time = "2025-09-27T18:36:33.86Z" },
{ url = "https://files.pythonhosted.org/packages/2c/54/887f3092a85238093a0b2154bd629c89444f395618842e8b0c41783898ea/markupsafe-3.0.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a", size = 21962, upload-time = "2025-09-27T18:36:35.099Z" },
{ url = "https://files.pythonhosted.org/packages/c9/2f/336b8c7b6f4a4d95e91119dc8521402461b74a485558d8f238a68312f11c/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b", size = 23760, upload-time = "2025-09-27T18:36:36.001Z" },
{ url = "https://files.pythonhosted.org/packages/32/43/67935f2b7e4982ffb50a4d169b724d74b62a3964bc1a9a527f5ac4f1ee2b/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f", size = 21529, upload-time = "2025-09-27T18:36:36.906Z" },
{ url = "https://files.pythonhosted.org/packages/89/e0/4486f11e51bbba8b0c041098859e869e304d1c261e59244baa3d295d47b7/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b", size = 23015, upload-time = "2025-09-27T18:36:37.868Z" },
{ url = "https://files.pythonhosted.org/packages/2f/e1/78ee7a023dac597a5825441ebd17170785a9dab23de95d2c7508ade94e0e/markupsafe-3.0.3-cp312-cp312-win32.whl", hash = "sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d", size = 14540, upload-time = "2025-09-27T18:36:38.761Z" },
{ url = "https://files.pythonhosted.org/packages/aa/5b/bec5aa9bbbb2c946ca2733ef9c4ca91c91b6a24580193e891b5f7dbe8e1e/markupsafe-3.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c", size = 15105, upload-time = "2025-09-27T18:36:39.701Z" },
{ url = "https://files.pythonhosted.org/packages/e5/f1/216fc1bbfd74011693a4fd837e7026152e89c4bcf3e77b6692fba9923123/markupsafe-3.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f", size = 13906, upload-time = "2025-09-27T18:36:40.689Z" },
{ url = "https://files.pythonhosted.org/packages/38/2f/907b9c7bbba283e68f20259574b13d005c121a0fa4c175f9bed27c4597ff/markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795", size = 11622, upload-time = "2025-09-27T18:36:41.777Z" },
{ url = "https://files.pythonhosted.org/packages/9c/d9/5f7756922cdd676869eca1c4e3c0cd0df60ed30199ffd775e319089cb3ed/markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219", size = 12029, upload-time = "2025-09-27T18:36:43.257Z" },
{ url = "https://files.pythonhosted.org/packages/00/07/575a68c754943058c78f30db02ee03a64b3c638586fba6a6dd56830b30a3/markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6", size = 24374, upload-time = "2025-09-27T18:36:44.508Z" },
{ url = "https://files.pythonhosted.org/packages/a9/21/9b05698b46f218fc0e118e1f8168395c65c8a2c750ae2bab54fc4bd4e0e8/markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676", size = 22980, upload-time = "2025-09-27T18:36:45.385Z" },
{ url = "https://files.pythonhosted.org/packages/7f/71/544260864f893f18b6827315b988c146b559391e6e7e8f7252839b1b846a/markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9", size = 21990, upload-time = "2025-09-27T18:36:46.916Z" },
{ url = "https://files.pythonhosted.org/packages/c2/28/b50fc2f74d1ad761af2f5dcce7492648b983d00a65b8c0e0cb457c82ebbe/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1", size = 23784, upload-time = "2025-09-27T18:36:47.884Z" },
{ url = "https://files.pythonhosted.org/packages/ed/76/104b2aa106a208da8b17a2fb72e033a5a9d7073c68f7e508b94916ed47a9/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc", size = 21588, upload-time = "2025-09-27T18:36:48.82Z" },
{ url = "https://files.pythonhosted.org/packages/b5/99/16a5eb2d140087ebd97180d95249b00a03aa87e29cc224056274f2e45fd6/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12", size = 23041, upload-time = "2025-09-27T18:36:49.797Z" },
{ url = "https://files.pythonhosted.org/packages/19/bc/e7140ed90c5d61d77cea142eed9f9c303f4c4806f60a1044c13e3f1471d0/markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed", size = 14543, upload-time = "2025-09-27T18:36:51.584Z" },
{ url = "https://files.pythonhosted.org/packages/05/73/c4abe620b841b6b791f2edc248f556900667a5a1cf023a6646967ae98335/markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5", size = 15113, upload-time = "2025-09-27T18:36:52.537Z" },
{ url = "https://files.pythonhosted.org/packages/f0/3a/fa34a0f7cfef23cf9500d68cb7c32dd64ffd58a12b09225fb03dd37d5b80/markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485", size = 13911, upload-time = "2025-09-27T18:36:53.513Z" },
{ url = "https://files.pythonhosted.org/packages/e4/d7/e05cd7efe43a88a17a37b3ae96e79a19e846f3f456fe79c57ca61356ef01/markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73", size = 11658, upload-time = "2025-09-27T18:36:54.819Z" },
{ url = "https://files.pythonhosted.org/packages/99/9e/e412117548182ce2148bdeacdda3bb494260c0b0184360fe0d56389b523b/markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37", size = 12066, upload-time = "2025-09-27T18:36:55.714Z" },
{ url = "https://files.pythonhosted.org/packages/bc/e6/fa0ffcda717ef64a5108eaa7b4f5ed28d56122c9a6d70ab8b72f9f715c80/markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19", size = 25639, upload-time = "2025-09-27T18:36:56.908Z" },
{ url = "https://files.pythonhosted.org/packages/96/ec/2102e881fe9d25fc16cb4b25d5f5cde50970967ffa5dddafdb771237062d/markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025", size = 23569, upload-time = "2025-09-27T18:36:57.913Z" },
{ url = "https://files.pythonhosted.org/packages/4b/30/6f2fce1f1f205fc9323255b216ca8a235b15860c34b6798f810f05828e32/markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6", size = 23284, upload-time = "2025-09-27T18:36:58.833Z" },
{ url = "https://files.pythonhosted.org/packages/58/47/4a0ccea4ab9f5dcb6f79c0236d954acb382202721e704223a8aafa38b5c8/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f", size = 24801, upload-time = "2025-09-27T18:36:59.739Z" },
{ url = "https://files.pythonhosted.org/packages/6a/70/3780e9b72180b6fecb83a4814d84c3bf4b4ae4bf0b19c27196104149734c/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb", size = 22769, upload-time = "2025-09-27T18:37:00.719Z" },
{ url = "https://files.pythonhosted.org/packages/98/c5/c03c7f4125180fc215220c035beac6b9cb684bc7a067c84fc69414d315f5/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009", size = 23642, upload-time = "2025-09-27T18:37:01.673Z" },
{ url = "https://files.pythonhosted.org/packages/80/d6/2d1b89f6ca4bff1036499b1e29a1d02d282259f3681540e16563f27ebc23/markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354", size = 14612, upload-time = "2025-09-27T18:37:02.639Z" },
{ url = "https://files.pythonhosted.org/packages/2b/98/e48a4bfba0a0ffcf9925fe2d69240bfaa19c6f7507b8cd09c70684a53c1e/markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218", size = 15200, upload-time = "2025-09-27T18:37:03.582Z" },
{ url = "https://files.pythonhosted.org/packages/0e/72/e3cc540f351f316e9ed0f092757459afbc595824ca724cbc5a5d4263713f/markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287", size = 13973, upload-time = "2025-09-27T18:37:04.929Z" },
{ url = "https://files.pythonhosted.org/packages/33/8a/8e42d4838cd89b7dde187011e97fe6c3af66d8c044997d2183fbd6d31352/markupsafe-3.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe", size = 11619, upload-time = "2025-09-27T18:37:06.342Z" },
{ url = "https://files.pythonhosted.org/packages/b5/64/7660f8a4a8e53c924d0fa05dc3a55c9cee10bbd82b11c5afb27d44b096ce/markupsafe-3.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026", size = 12029, upload-time = "2025-09-27T18:37:07.213Z" },
{ url = "https://files.pythonhosted.org/packages/da/ef/e648bfd021127bef5fa12e1720ffed0c6cbb8310c8d9bea7266337ff06de/markupsafe-3.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737", size = 24408, upload-time = "2025-09-27T18:37:09.572Z" },
{ url = "https://files.pythonhosted.org/packages/41/3c/a36c2450754618e62008bf7435ccb0f88053e07592e6028a34776213d877/markupsafe-3.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97", size = 23005, upload-time = "2025-09-27T18:37:10.58Z" },
{ url = "https://files.pythonhosted.org/packages/bc/20/b7fdf89a8456b099837cd1dc21974632a02a999ec9bf7ca3e490aacd98e7/markupsafe-3.0.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d", size = 22048, upload-time = "2025-09-27T18:37:11.547Z" },
{ url = "https://files.pythonhosted.org/packages/9a/a7/591f592afdc734f47db08a75793a55d7fbcc6902a723ae4cfbab61010cc5/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda", size = 23821, upload-time = "2025-09-27T18:37:12.48Z" },
{ url = "https://files.pythonhosted.org/packages/7d/33/45b24e4f44195b26521bc6f1a82197118f74df348556594bd2262bda1038/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf", size = 21606, upload-time = "2025-09-27T18:37:13.485Z" },
{ url = "https://files.pythonhosted.org/packages/ff/0e/53dfaca23a69fbfbbf17a4b64072090e70717344c52eaaaa9c5ddff1e5f0/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe", size = 23043, upload-time = "2025-09-27T18:37:14.408Z" },
{ url = "https://files.pythonhosted.org/packages/46/11/f333a06fc16236d5238bfe74daccbca41459dcd8d1fa952e8fbd5dccfb70/markupsafe-3.0.3-cp314-cp314-win32.whl", hash = "sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9", size = 14747, upload-time = "2025-09-27T18:37:15.36Z" },
{ url = "https://files.pythonhosted.org/packages/28/52/182836104b33b444e400b14f797212f720cbc9ed6ba34c800639d154e821/markupsafe-3.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581", size = 15341, upload-time = "2025-09-27T18:37:16.496Z" },
{ url = "https://files.pythonhosted.org/packages/6f/18/acf23e91bd94fd7b3031558b1f013adfa21a8e407a3fdb32745538730382/markupsafe-3.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4", size = 14073, upload-time = "2025-09-27T18:37:17.476Z" },
{ url = "https://files.pythonhosted.org/packages/3c/f0/57689aa4076e1b43b15fdfa646b04653969d50cf30c32a102762be2485da/markupsafe-3.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab", size = 11661, upload-time = "2025-09-27T18:37:18.453Z" },
{ url = "https://files.pythonhosted.org/packages/89/c3/2e67a7ca217c6912985ec766c6393b636fb0c2344443ff9d91404dc4c79f/markupsafe-3.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175", size = 12069, upload-time = "2025-09-27T18:37:19.332Z" },
{ url = "https://files.pythonhosted.org/packages/f0/00/be561dce4e6ca66b15276e184ce4b8aec61fe83662cce2f7d72bd3249d28/markupsafe-3.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634", size = 25670, upload-time = "2025-09-27T18:37:20.245Z" },
{ url = "https://files.pythonhosted.org/packages/50/09/c419f6f5a92e5fadde27efd190eca90f05e1261b10dbd8cbcb39cd8ea1dc/markupsafe-3.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50", size = 23598, upload-time = "2025-09-27T18:37:21.177Z" },
{ url = "https://files.pythonhosted.org/packages/22/44/a0681611106e0b2921b3033fc19bc53323e0b50bc70cffdd19f7d679bb66/markupsafe-3.0.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e", size = 23261, upload-time = "2025-09-27T18:37:22.167Z" },
{ url = "https://files.pythonhosted.org/packages/5f/57/1b0b3f100259dc9fffe780cfb60d4be71375510e435efec3d116b6436d43/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5", size = 24835, upload-time = "2025-09-27T18:37:23.296Z" },
{ url = "https://files.pythonhosted.org/packages/26/6a/4bf6d0c97c4920f1597cc14dd720705eca0bf7c787aebc6bb4d1bead5388/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523", size = 22733, upload-time = "2025-09-27T18:37:24.237Z" },
{ url = "https://files.pythonhosted.org/packages/14/c7/ca723101509b518797fedc2fdf79ba57f886b4aca8a7d31857ba3ee8281f/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc", size = 23672, upload-time = "2025-09-27T18:37:25.271Z" },
{ url = "https://files.pythonhosted.org/packages/fb/df/5bd7a48c256faecd1d36edc13133e51397e41b73bb77e1a69deab746ebac/markupsafe-3.0.3-cp314-cp314t-win32.whl", hash = "sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d", size = 14819, upload-time = "2025-09-27T18:37:26.285Z" },
{ url = "https://files.pythonhosted.org/packages/1a/8a/0402ba61a2f16038b48b39bccca271134be00c5c9f0f623208399333c448/markupsafe-3.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9", size = 15426, upload-time = "2025-09-27T18:37:27.316Z" },
{ url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
]
[[package]]
name = "pycparser"
version = "3.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
]
[[package]]
name = "typing-extensions"
version = "4.15.0"
source = { registry = "https://pypi.org/simple" }
sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
]
[[package]]
name = "werkzeug"
version = "3.1.8"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "markupsafe" },
]
sdist = { url = "https://files.pythonhosted.org/packages/dd/b2/381be8cfdee792dd117872481b6e378f85c957dd7c5bca38897b08f765fd/werkzeug-3.1.8.tar.gz", hash = "sha256:9bad61a4268dac112f1c5cd4630a56ede601b6ed420300677a869083d70a4c44", size = 875852, upload-time = "2026-04-02T18:49:14.268Z" }
wheels = [
{ url = "https://files.pythonhosted.org/packages/93/8c/2e650f2afeb7ee576912636c23ddb621c91ac6a98e66dc8d29c3c69446e1/werkzeug-3.1.8-py3-none-any.whl", hash = "sha256:63a77fb8892bf28ebc3178683445222aa500e48ebad5ec77b0ad80f8726b1f50", size = 226459, upload-time = "2026-04-02T18:49:12.72Z" },
]
fido2-2.2.1/examples/sign_arkg.py 0000644 0000000 0000000 00000011570 15220526030 013600 0 ustar 00 # Copyright (c) 2024 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports the sign extension,
creates a new credential for it with the extension enabled, and uses it to
derive two separate secrets.
"""
import sys
from exampleutils import get_client
from fido2 import cbor
from fido2.cose import ESP256_SPLIT_ARKG_PLACEHOLDER, CoseKey
from fido2.ctap2.extensions import PreviewSignExtension
from fido2.server import Fido2Server
from fido2.utils import sha256, websafe_decode, websafe_encode
uv = "discouraged"
# Locate a suitable FIDO authenticator
client, info = get_client(
lambda info: PreviewSignExtension.NAME in info.extensions,
extensions=[PreviewSignExtension()],
)
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="none")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key_requirement="discouraged",
user_verification=uv,
authenticator_attachment="cross-platform",
)
# Create a credential
result = client.make_credential(
{
**create_options["publicKey"],
"extensions": {
PreviewSignExtension.NAME: {
"generateKey": {"algorithms": [ESP256_SPLIT_ARKG_PLACEHOLDER]}
}
},
}
)
# Complete registration
auth_data = server.register_complete(state, result)
credentials = [auth_data.credential_data]
print("New credential created, with the sign extension.")
# sign result:
sign_result = result.client_extension_results.previewSign
print("CREATE sign result", sign_result)
sign_key = sign_result.generated_key
if not sign_key:
print(
"Failed to create credential with sign extension",
result.client_extension_results,
)
sys.exit(1)
# Extension output contains master public key
pk = CoseKey.parse(
cbor.decode(websafe_decode(sign_key["publicKey"]))
) # COSE key in bytes
print("public key", pk)
# Master public key contains blinding and KEM keys
# ARKG derive_public_key uses these
print("Blinding public key", pk.pk_bl)
print("KEM public key", pk.pk_kem)
# Arbitrary bytestring used for ctx, ikm
ctx = b"my-ctx-here"
ikm = b"my-ikm-here"
# Derived public key to verify with, and kh to send to Authenticator
pk2, args = pk.derive_public_key(ikm, ctx)
print("Derived public key", pk2)
print("COSE_Sign_Args for derived key", args)
# Prepare a message to sign
message = b"New message"
ph_data = sha256(message)
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
# Authenticate the credential
result = client.get_assertion(
{
**request_options["publicKey"],
# Add extension outputs. We have only 1 credential in allowCredentials
"extensions": {
PreviewSignExtension.NAME: {
"signByCredential": {
websafe_encode(credentials[0].credential_id): {
"keyHandle": sign_key.key_handle,
"tbs": ph_data,
"additionalArgs": cbor.encode(args),
},
},
}
},
}
)
# Only one cred in allowCredentials, only one response.
result = result.get_response(0)
sign_result = result.client_extension_results[PreviewSignExtension.NAME]
print("GET sign result", sign_result)
# Response contains a signature over message
signature = sign_result.get("signature")
print("Test verify signature", signature)
pk2.verify(message, websafe_decode(signature))
print("Signature verified with derived public key!")
fido2-2.2.1/examples/u2f_nfc.py 0000644 0000000 0000000 00000001742 15220526030 013156 0 ustar 00 import sys
from fido2.ctap1 import Ctap1
from fido2.pcsc import CtapPcscDevice
from fido2.utils import sha256
dev = next(CtapPcscDevice.list_devices(), None)
if not dev:
print("No NFC u2f device found")
sys.exit(1)
chal = sha256(b"AAA")
appid = sha256(b"BBB")
ctap1 = Ctap1(dev)
print("version:", ctap1.get_version())
# True - make extended APDU and send it to key
# ISO 7816-3:2006. page 33, 12.1.3 Decoding conventions for command APDUs
# ISO 7816-3:2006. page 34, 12.2 Command-response pair transmission by T=0
# False - make group of short (less than 255 bytes length) APDU
# and send them to key. ISO 7816-3:2005, page 9, 5.1.1.1 Command chaining
dev.use_ext_apdu = False
reg = ctap1.register(chal, appid)
print("register:", reg)
reg.verify(appid, chal)
print("Register message verify OK")
auth = ctap1.authenticate(chal, appid, reg.key_handle)
print("authenticate result: ", auth)
res = auth.verify(appid, chal, reg.public_key)
print("Authenticate message verify OK")
fido2-2.2.1/examples/verify_attestation.py 0000644 0000000 0000000 00000010316 15220526030 015554 0 ustar 00 # Copyright (c) 2021 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
This example shows how to use an AttestationVerifier to only allow credentials signed
by a specific CA.
It connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and verifies that attestation is signed by the
Yubico FIDO root CA (this will only work for Yubico devices).
On Windows, the native WebAuthn API will be used.
"""
from base64 import b64decode
from exampleutils import get_client
from fido2.attestation import AttestationVerifier
from fido2.server import Fido2Server
# Official Yubico root CA for FIDO Authenticators
YUBICO_CA = b64decode(
"""
MIIDHjCCAgagAwIBAgIEG0BT9zANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZ
dWJpY28gVTJGIFJvb3QgQ0EgU2VyaWFsIDQ1NzIwMDYzMTAgFw0xNDA4MDEwMDAw
MDBaGA8yMDUwMDkwNDAwMDAwMFowLjEsMCoGA1UEAxMjWXViaWNvIFUyRiBSb290
IENBIFNlcmlhbCA0NTcyMDA2MzEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC/jwYuhBVlqaiYWEMsrWFisgJ+PtM91eSrpI4TK7U53mwCIawSDHy8vUmk
5N2KAj9abvT9NP5SMS1hQi3usxoYGonXQgfO6ZXyUA9a+KAkqdFnBnlyugSeCOep
8EdZFfsaRFtMjkwz5Gcz2Py4vIYvCdMHPtwaz0bVuzneueIEz6TnQjE63Rdt2zbw
nebwTG5ZybeWSwbzy+BJ34ZHcUhPAY89yJQXuE0IzMZFcEBbPNRbWECRKgjq//qT
9nmDOFVlSRCt2wiqPSzluwn+v+suQEBsUjTGMEd25tKXXTkNW21wIWbxeSyUoTXw
LvGS6xlwQSgNpk2qXYwf8iXg7VWZAgMBAAGjQjBAMB0GA1UdDgQWBBQgIvz0bNGJ
hjgpToksyKpP9xv9oDAPBgNVHRMECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAN
BgkqhkiG9w0BAQsFAAOCAQEAjvjuOMDSa+JXFCLyBKsycXtBVZsJ4Ue3LbaEsPY4
MYN/hIQ5ZM5p7EjfcnMG4CtYkNsfNHc0AhBLdq45rnT87q/6O3vUEtNMafbhU6kt
hX7Y+9XFN9NpmYxr+ekVY5xOxi8h9JDIgoMP4VB1uS0aunL1IGqrNooL9mmFnL2k
LVVee6/VR6C5+KSTCMCWppMuJIZII2v9o4dkoZ8Y7QRjQlLfYzd3qGtKbw7xaF1U
sG/5xUb/Btwb2X2g4InpiB/yt/3CpQXpiWX/K4mBvUKiGn05ZsqeY1gx4g0xLBqc
U9psmyPzK+Vsgw2jeRQ5JlKDyqE0hebfC1tvFu0CCrJFcw==
"""
)
class YubicoAttestationVerifier(AttestationVerifier):
"""Example implementation of an AttestationVerifier.
This simple example will attempt to verify all trust paths using the Yubico CA.
A real implementation can use the information in the attestation result, or the
authenticator data, to determine which CA should be used to verify the path.
"""
def ca_lookup(self, result, auth_data):
return YUBICO_CA
# Locate a suitable FIDO authenticator
client, _ = get_client()
server = Fido2Server(
{"id": "example.com", "name": "Example RP"},
attestation="direct",
verify_attestation=YubicoAttestationVerifier(),
)
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user, user_verification="discouraged", authenticator_attachment="cross-platform"
)
# Create a credential
result = client.make_credential(create_options["publicKey"])
# Complete registration
auth_data = server.register_complete(state, result)
credentials = [auth_data.credential_data]
print("New credential created, attestation verified!")
print("Yubico device AAGUID:", auth_data.credential_data.aaguid.hex())
fido2-2.2.1/examples/verify_attestation_mds3.py 0000644 0000000 0000000 00000011724 15220526030 016506 0 ustar 00 # Copyright (c) 2021 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
This example shows how to use the FIDO MDS to only allow authenticators for which
metadata is available.
It connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and verifies that attestation is correctly signed
and valid according to its metadata statement.
On Windows, the native WebAuthn API will be used.
NOTE: You need to retrieve a MDS3 blob to run this example.
See https://fidoalliance.org/metadata/ for more info.
"""
import sys
from base64 import b64decode
from exampleutils import get_client
from fido2.attestation import UntrustedAttestation
from fido2.mds3 import MdsAttestationVerifier, parse_blob
from fido2.server import Fido2Server
# Load the root CA used to sign the Metadata Statement blob
ca = b64decode(
"""
MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG
A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8
RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT
gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm
KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd
QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ
XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw
DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o
LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU
RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp
jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK
6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX
mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs
Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
WD9f"""
)
# Parse the MDS3 blob
if len(sys.argv) != 2:
print("This example requires a FIDO MDS3 metadata blob, which you can get here:")
print("https://fidoalliance.org/metadata/")
print()
print("USAGE: python verify_attestation_mds3.py blob.jwt")
sys.exit(1)
with open(sys.argv[1], "rb") as f:
metadata = parse_blob(f.read(), ca)
# The verifier is used to query for data in the blob and to verify attestation.
# We could optionally pass a filter function to only allow specific authenticators.
mds = MdsAttestationVerifier(metadata)
# Locate a suitable FIDO authenticator
client, _ = get_client()
# The MDS verifier is passed to the server to verify that new credentials registered
# exist in the MDS blob, else the registration will fail.
server = Fido2Server(
{"id": "example.com", "name": "Example RP"},
attestation="direct",
verify_attestation=mds,
)
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user, user_verification="discouraged", authenticator_attachment="cross-platform"
)
# Create a credential
result = client.make_credential(create_options["publicKey"])
# Complete registration
try:
auth_data = server.register_complete(state, result)
print("Registration completed")
# mds can also be used to get the metadata for the Authenticator,
# regardless of if it was used to verify the attestation or not:
response = result.response
entry = mds.find_entry(response.attestation_object, response.client_data.hash)
print("Authenticator description:", entry.metadata_statement.description)
except UntrustedAttestation:
print("Authenticator metadata not found")
fido2-2.2.1/fido2/__init__.py 0000644 0000000 0000000 00000002533 15220526030 012557 0 ustar 00 # Copyright (c) 2013 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
fido2-2.2.1/fido2/arkg.py 0000644 0000000 0000000 00000034557 15220526030 011757 0 ustar 00 # Copyright (c) 2024 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
import struct
from dataclasses import dataclass
from typing import Sequence, Tuple
from cryptography.hazmat.primitives.asymmetric.ec import (
ECDH,
EllipticCurve,
EllipticCurvePrivateKey,
EllipticCurvePublicKey,
EllipticCurvePublicNumbers,
derive_private_key,
)
from cryptography.hazmat.primitives.hashes import Hash, HashAlgorithm
from cryptography.hazmat.primitives.hmac import HMAC
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
from .utils import bytes2int
"""
WARNING: This module and these algorithms are currently in DRAFT.
They are to be considered experimental, and NOT part of the stable API of this library.
This module implements the Asynchronous Remote Key Generation (ARKG) algorithm,
as specified in https://www.ietf.org/archive/id/draft-bradleylundberg-cfrg-arkg-08.html
"""
@dataclass(frozen=True)
class _CurveParams:
"""Weierstrass curve parameters needed for EC point addition."""
prime: int
a: int
_CURVE_PARAMS: dict[str, _CurveParams] = {
"secp256r1": _CurveParams(
prime=0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF,
a=0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC,
),
}
def _params_for_curve(curve: EllipticCurve) -> _CurveParams:
"""Look up curve parameters, or raise ValueError for unsupported curves."""
try:
return _CURVE_PARAMS[curve.name]
except KeyError:
raise ValueError(f"Unsupported curve: {curve.name}")
def _strxor(a: bytes, b: bytes) -> bytes:
return bytes(a[i] ^ b[i] for i in range(len(a)))
def _point_add(
p1: EllipticCurvePublicKey, p2: EllipticCurvePublicKey
) -> EllipticCurvePublicKey:
"""Add two EC points. Both points must be on the same supported curve."""
if p1.curve.name != p2.curve.name:
raise ValueError("Cannot add points from different curves")
params = _params_for_curve(p1.curve)
n1 = p1.public_numbers()
n2 = p2.public_numbers()
x1, y1 = n1.x, n1.y
x2, y2 = n2.x, n2.y
p = params.prime
if x1 == x2 and y1 == y2:
lam = (3 * x1 * x1 + params.a) * pow(2 * y1, -1, p) % p
else:
lam = (y2 - y1) * pow(x2 - x1, -1, p) % p
x3 = (lam * lam - x1 - x2) % p
y3 = (lam * (x1 - x3) - y1) % p
return EllipticCurvePublicNumbers(x3, y3, p1.curve).public_key()
@dataclass
class _HTF:
"""
hash_to_field(msg, count)
Parameters:
- DST, a domain separation tag (see Section 3.1).
- F, a finite field of characteristic p and order q = p^m.
- p, the characteristic of F (see immediately above).
- m, the extension degree of F, m >= 1 (see immediately above).
- L = ceil((ceil(log2(p)) + k) / 8), where k is the security
parameter of the suite (e.g., k = 128).
- expand_message, a function that expands a byte string and
domain separation tag into a uniformly random byte string
(see Section 5.3).
"""
DST: bytes
p: int
# m: int - is always 1
L: int
Hash: HashAlgorithm
# expand_message is always xmd
def expand_message_xmd(self, msg: bytes, len_in_bytes: int):
"""
expand_message_xmd(msg, DST, len_in_bytes)
Parameters:
- H, a hash function (see requirements above).
- b_in_bytes, b / 8 for b the output size of H in bits.
For example, for b = 256, b_in_bytes = 32.
- s_in_bytes, the input block size of H, measured in bytes (see
discussion above). For example, for SHA-256, s_in_bytes = 64.
Input:
- msg, a byte string.
- DST, a byte string of at most 255 bytes.
See below for information on using longer DSTs.
- len_in_bytes, the length of the requested output in bytes,
not greater than the lesser of (255 * b_in_bytes) or 2^16-1.
Output:
- uniform_bytes, a byte string.
Steps:
1. ell = ceil(len_in_bytes / b_in_bytes)
2. ABORT if ell > 255 or len_in_bytes > 65535 or len(DST) > 255
3. DST_prime = DST || I2OSP(len(DST), 1)
4. Z_pad = I2OSP(0, s_in_bytes)
5. l_i_b_str = I2OSP(len_in_bytes, 2)
6. msg_prime = Z_pad || msg || l_i_b_str || I2OSP(0, 1) || DST_prime
7. b_0 = H(msg_prime)
8. b_1 = H(b_0 || I2OSP(1, 1) || DST_prime)
9. for i in (2, ..., ell):
10. b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime)
11. uniform_bytes = b_1 || ... || b_ell
12. return substr(uniform_bytes, 0, len_in_bytes)
"""
b_in_bytes = self.Hash.digest_size
ell = -(-len_in_bytes // b_in_bytes)
if ell > 255 or len_in_bytes > 65535 or len(self.DST) > 255:
raise ValueError("Invalid size of input/output")
dst_prime = self.DST + struct.pack(">B", len(self.DST))
assert self.Hash.block_size is not None # noqa: S101
z_pad = b"\x00" * self.Hash.block_size
l_i_b_str = struct.pack(">H", len_in_bytes)
msg_prime = z_pad + msg + l_i_b_str + b"\x00" + dst_prime
d = Hash(self.Hash)
d.update(msg_prime)
b_0 = d.finalize()
b_xor = b_0
uniform_bytes = bytearray()
for i in range(1, ell + 1):
d = Hash(self.Hash)
d.update(b_xor + struct.pack(">B", i) + dst_prime)
b_i = d.finalize()
uniform_bytes.extend(b_i)
b_xor = _strxor(b_0, b_i)
return bytes(uniform_bytes[:len_in_bytes])
def hash_to_field(self, msg: bytes, count: int) -> Sequence[int]:
"""
hash_to_field(msg, count)
Input:
- msg, a byte string containing the message to hash.
- count, the number of elements of F to output.
Output:
- (u_0, ..., u_(count - 1)), a list of field elements.
Steps:
1. len_in_bytes = count * m * L
2. uniform_bytes = expand_message(msg, DST, len_in_bytes)
3. for i in (0, ..., count - 1):
4. for j in (0, ..., m - 1):
5. elm_offset = L * (j + i * m)
6. tv = substr(uniform_bytes, elm_offset, L)
7. e_j = OS2IP(tv) mod p
8. u_i = (e_0, ..., e_(m - 1))
9. return (u_0, ..., u_(count - 1))
"""
# Only implemented for m = 1
uniform_bytes = self.expand_message_xmd(msg, count * self.L)
elements = list()
for i in range(count):
offset = self.L * i
tv = uniform_bytes[offset : offset + self.L]
e_j = bytes2int(tv) % self.p
elements.append(e_j)
return elements
@dataclass
class _BL:
crv: EllipticCurve
Hash: HashAlgorithm
DST_ext: bytes
def prf(self, ikm_tau: bytes, ctx: bytes) -> int:
"""
BL-PRF(ikm_tau, ctx) -> tau
DST_tau = 'ARKG-BL-EC.' || DST_ext || ctx
tau = hash_to_field(tau, 1) with the parameters:
DST: DST_tau
F: GF(N), the scalar field
of the prime order subgroup of crv
p: N
m: 1
L: The L defined in hash-to-crv-suite
expand_message: The expand_message function
defined in hash-to-crv-suite
"""
dst_tau = b"ARKG-BL-EC." + self.DST_ext + ctx
htf = _HTF(dst_tau, self.crv.group_order, 48, self.Hash)
tau = htf.hash_to_field(ikm_tau, 1)[0]
return tau
def blind_public_key(
self, pk: EllipticCurvePublicKey, tau: int
) -> EllipticCurvePublicKey:
"""
BL-Blind-Public-Key(pk, tau) -> pk_tau
pk_tau = pk + tau * G
"""
tau_g = derive_private_key(tau, self.crv).public_key()
return _point_add(pk, tau_g)
@dataclass
class _KEM:
crv: EllipticCurve
Hash: HashAlgorithm
DST_ext: bytes
def sub_kem_derive_key_pair(self, ikm: bytes) -> EllipticCurvePrivateKey:
"""
Sub-Kem-Derive-Key-Pair(ikm) -> (pk, sk)
sk = hash_to_field(ikm, 1) with the parameters:
DST: 'ARKG-KEM-ECDH-KG.' || DST_ext
F: GF(N), the scalar field
of the prime order subgroup of crv
p: N
m: 1
L: The L defined in hash-to-crv-suite
expand_message: The expand_message function
defined in hash-to-crv-suite
pk = sk * G
"""
htf = _HTF(
b"ARKG-KEM-ECDH-KG." + self.DST_ext,
self.crv.group_order,
48,
self.Hash,
)
sk = htf.hash_to_field(ikm, 1)[0]
return derive_private_key(sk, self.crv)
def sub_kem_encaps(
self, pk: EllipticCurvePublicKey, ikm: bytes, ctx: bytes
) -> Tuple[bytes, bytes]:
"""
ECDH(pk, sk) represents the compact output of ECDH [RFC6090]
using public key (curve point) pk and private key (exponent) sk.
G is the generator of the prime order subgroup of crv.
N is the order of G.
Sub-Kem-Encaps(pk, ikm, ctx) -> (k, c)
(pk', sk') = Sub-Kem-Derive-Key-Pair(ikm)
k = ECDH(pk, sk')
c = Elliptic-Curve-Point-to-Octet-String(pk')
"""
sk_prime = self.sub_kem_derive_key_pair(ikm)
pk_prime = sk_prime.public_key()
k = sk_prime.exchange(ECDH(), pk)
c = pk_prime.public_bytes(Encoding.X962, PublicFormat.UncompressedPoint)
return k, c
def encaps(
self, pk: EllipticCurvePublicKey, ikm: bytes, ctx: bytes
) -> Tuple[bytes, bytes]:
"""
KEM-Encaps(pk, ikm, ctx) -> (k, c)
ctx_sub = 'ARKG-KEM-HMAC.' || DST_ext || ctx
(k', c') = Sub-Kem-Encaps(pk, ikm, ctx_sub)
prk = HKDF-Extract with the arguments:
Hash: Hash
salt: not set
IKM: k'
mk = HKDF-Expand with the arguments:
Hash: Hash
PRK: prk
info: 'ARKG-KEM-HMAC-mac.' || DST_ext || ctx
L: L
t = HMAC-Hash-128(K=mk, text=c')
k = HKDF-Expand with the arguments:
Hash: Hash
PRK: prk
info: 'ARKG-KEM-HMAC-shared.' || DST_ext || ctx
L: The length of k' in octets.
c = t || c'
"""
ctx_sub = b"ARKG-KEM-HMAC." + self.DST_ext + ctx
k_prime, c_prime = self.sub_kem_encaps(pk, ikm, ctx_sub)
mk = HKDF(
self.Hash,
self.Hash.digest_size,
None,
b"ARKG-KEM-HMAC-mac." + self.DST_ext + ctx,
).derive(k_prime)
hmac = HMAC(mk, self.Hash)
hmac.update(c_prime)
t = hmac.finalize()[:16] # Truncate to 128-bit
k = HKDF(
self.Hash,
len(k_prime),
None,
b"ARKG-KEM-HMAC-shared." + self.DST_ext + ctx,
).derive(k_prime)
c = t + c_prime
return k, c
@dataclass
class _ARKG:
"""
ARKG instance parameters:
BL A key blinding scheme.
KEM A key encapsulation mechanism.
"""
bl: _BL
kem: _KEM
def derive_public_key(
self,
pk_bl: EllipticCurvePublicKey,
pk_kem: EllipticCurvePublicKey,
ikm: bytes,
ctx: bytes,
) -> Tuple[EllipticCurvePublicKey, bytes]:
"""
ARKG-Derive-Public-Key((pk_bl, pk_kem), ikm, ctx) -> (pk', kh)
ARKG instance parameters:
BL A key blinding scheme.
KEM A key encapsulation mechanism.
Inputs:
pk_bl A key blinding public key.
pk_kem A key encapsulation public key.
ikm Input entropy for KEM encapsulation.
ctx An octet string of length at most 64,
containing optional context and
application specific information
(can be a zero-length string).
Output:
pk' A blinded public key.
kh A key handle for deriving the blinded
private key sk' corresponding to pk'.
The output (pk', kh) is calculated as follows:
if LEN(ctx) > 64:
Abort with an error.
ctx' = I2OSP(LEN(ctx), 1) || ctx
ctx_bl = 'ARKG-Derive-Key-BL.' || ctx'
ctx_kem = 'ARKG-Derive-Key-KEM.' || ctx'
(ikm_tau, c) = KEM-Encaps(pk_kem, ikm, ctx_kem)
tau = BL-PRF(ikm_tau, ctx_bl)
pk' = BL-Blind-Public-Key(pk_bl, tau)
kh = c
"""
if len(ctx) > 64:
raise ValueError("Context too long, should be at most 64 bytes")
ctx_prime = struct.pack(">B", len(ctx)) + ctx
ctx_bl = b"ARKG-Derive-Key-BL." + ctx_prime
ctx_kem = b"ARKG-Derive-Key-KEM." + ctx_prime
ikm_tau, c = self.kem.encaps(pk_kem, ikm, ctx_kem)
tau = self.bl.prf(ikm_tau, ctx_bl)
pk_prime = self.bl.blind_public_key(pk_bl, tau)
kh = c
return pk_prime, kh
fido2-2.2.1/fido2/attestation/__init__.py 0000644 0000000 0000000 00000003571 15220526030 015121 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from .android import AndroidSafetynetAttestation # noqa: F401
from .apple import AppleAttestation # noqa: F401
from .base import ( # noqa: F401
Attestation,
AttestationResult,
AttestationType,
AttestationVerifier,
InvalidData,
InvalidSignature,
NoneAttestation,
UnsupportedAttestation,
UnsupportedType,
UntrustedAttestation,
verify_x509_chain,
)
from .packed import PackedAttestation # noqa: F401
from .tpm import TpmAttestation # noqa: F401
from .u2f import FidoU2FAttestation # noqa: F401
fido2-2.2.1/fido2/attestation/android.py 0000644 0000000 0000000 00000006025 15220526030 014777 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import json
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.constant_time import bytes_eq
from ..cose import CoseKey
from ..utils import sha256, websafe_decode
from .base import (
Attestation,
AttestationResult,
AttestationType,
InvalidData,
catch_builtins,
)
class AndroidSafetynetAttestation(Attestation):
FORMAT = "android-safetynet"
def __init__(self, allow_rooted: bool = False):
self.allow_rooted = allow_rooted
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
jwt = statement["response"]
header, payload, sig = (websafe_decode(x) for x in jwt.split(b"."))
data = json.loads(payload.decode("utf8"))
if not self.allow_rooted and data["ctsProfileMatch"] is not True:
raise InvalidData("ctsProfileMatch must be true!")
expected_nonce = sha256(auth_data + client_data_hash)
if not bytes_eq(expected_nonce, websafe_decode(data["nonce"])):
raise InvalidData("Nonce does not match!")
data = json.loads(header.decode("utf8"))
x5c = [websafe_decode(x) for x in data["x5c"]]
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
cn = cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)
if cn[0].value != "attest.android.com":
raise InvalidData("Certificate not issued to attest.android.com!")
CoseKey.for_name(data["alg"]).from_cryptography_key(cert.public_key()).verify(
jwt.rsplit(b".", 1)[0], sig
)
return AttestationResult(AttestationType.BASIC, x5c)
fido2-2.2.1/fido2/attestation/apple.py 0000644 0000000 0000000 00000004556 15220526030 014467 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.constant_time import bytes_eq
from ..utils import sha256
from .base import (
Attestation,
AttestationResult,
AttestationType,
InvalidData,
catch_builtins,
)
OID_APPLE = x509.ObjectIdentifier("1.2.840.113635.100.8.2")
class AppleAttestation(Attestation):
FORMAT = "apple"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
x5c = statement["x5c"]
expected_nonce = sha256(auth_data + client_data_hash)
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
ext = cert.extensions.get_extension_for_oid(OID_APPLE)
# Sequence of single element of octet string
ext_nonce = ext.value.public_bytes()[6:]
if not bytes_eq(expected_nonce, ext_nonce):
raise InvalidData("Nonce does not match!")
return AttestationResult(AttestationType.ANON_CA, x5c)
fido2-2.2.1/fido2/attestation/base.py 0000644 0000000 0000000 00000021105 15220526030 014265 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import abc
from dataclasses import dataclass
from enum import IntEnum, unique
from functools import wraps
from typing import Any, Mapping, Sequence, cast
from cryptography import x509
from cryptography.exceptions import InvalidSignature as _InvalidSignature
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec, padding, rsa
from ..webauthn import AttestationObject, AuthenticatorData
class InvalidAttestation(Exception):
"""Base exception for attestation-related errors."""
class InvalidData(InvalidAttestation):
"""Attestation contains invalid data."""
class InvalidSignature(InvalidAttestation):
"""The signature of the attestation could not be verified."""
class UntrustedAttestation(InvalidAttestation):
"""The CA of the attestation is not trusted."""
class UnsupportedType(InvalidAttestation):
"""The attestation format is not supported."""
def __init__(self, auth_data, fmt=None):
super().__init__(
f'Attestation format "{fmt}" is not supported'
if fmt
else "This attestation format is not supported!"
)
self.auth_data = auth_data
self.fmt = fmt
@unique
class AttestationType(IntEnum):
"""Supported attestation types."""
BASIC = 1
SELF = 2
ATT_CA = 3
ANON_CA = 4
NONE = 0
@dataclass
class AttestationResult:
"""The result of verifying an attestation."""
attestation_type: AttestationType
trust_path: list[bytes]
def catch_builtins(f):
"""Utility decoractor to wrap common exceptions related to InvalidData."""
@wraps(f)
def inner(*args, **kwargs):
try:
return f(*args, **kwargs)
except (ValueError, KeyError, IndexError) as e:
raise InvalidData(e)
return inner
@catch_builtins
def verify_x509_chain(chain: list[bytes]) -> None:
"""Verifies a chain of certificates.
Checks that the first item in the chain is signed by the next, and so on.
The first item is the leaf, the last is the root.
"""
certs = [x509.load_der_x509_certificate(der, default_backend()) for der in chain]
cert = certs.pop(0)
while certs:
child = cert
cert = certs.pop(0)
pub = cert.public_key()
try:
if isinstance(pub, rsa.RSAPublicKey):
assert child.signature_hash_algorithm is not None # noqa: S101
pub.verify(
child.signature,
child.tbs_certificate_bytes,
padding.PKCS1v15(),
child.signature_hash_algorithm,
)
elif isinstance(pub, ec.EllipticCurvePublicKey):
assert child.signature_hash_algorithm is not None # noqa: S101
pub.verify(
child.signature,
child.tbs_certificate_bytes,
ec.ECDSA(child.signature_hash_algorithm),
)
else:
raise ValueError("Unsupported signature key type")
except _InvalidSignature:
raise InvalidSignature()
class Attestation(abc.ABC):
"""Implements verification of a specific attestation type."""
@abc.abstractmethod
def verify(
self,
statement: Mapping[str, Any],
auth_data: AuthenticatorData,
client_data_hash: bytes,
) -> AttestationResult:
"""Verifies attestation statement.
:return: An AttestationResult if successful.
"""
@staticmethod
def for_type(fmt: str) -> type[Attestation]:
"""Get an Attestation subclass type for the given format."""
for cls in Attestation.__subclasses__():
if getattr(cls, "FORMAT", None) == fmt:
return cls
class TypedUnsupportedAttestation(UnsupportedAttestation):
def __init__(self):
super().__init__(fmt)
return TypedUnsupportedAttestation
class UnsupportedAttestation(Attestation):
def __init__(self, fmt=None):
self.fmt = fmt
def verify(self, statement, auth_data, client_data_hash):
raise UnsupportedType(auth_data, self.fmt)
class NoneAttestation(Attestation):
FORMAT = "none"
def verify(self, statement, auth_data, client_data_hash):
if statement != {}:
raise InvalidData("None Attestation requires empty statement.")
return AttestationResult(AttestationType.NONE, [])
def _validate_cert_common(cert):
if cert.version != x509.Version.v3:
raise InvalidData("Attestation certificate must use version 3!")
try:
bc = cert.extensions.get_extension_for_class(x509.BasicConstraints)
if bc.value.ca:
raise InvalidData("Attestation certificate must have CA=false!")
except x509.ExtensionNotFound:
raise InvalidData("Attestation certificate must have Basic Constraints!")
def _default_attestations():
return [
cast(type[Any], cls)()
for cls in Attestation.__subclasses__()
if getattr(cls, "FORMAT", "none") != "none"
]
class AttestationVerifier(abc.ABC):
"""Base class for verifying attestation.
Override the ca_lookup method to provide a trusted root certificate used
to verify the trust path from the attestation.
"""
def __init__(self, attestation_types: Sequence[Attestation] | None = None):
self._attestation_types = attestation_types or _default_attestations()
@abc.abstractmethod
def ca_lookup(
self, attestation_result: AttestationResult, auth_data: AuthenticatorData
) -> bytes | None:
"""Lookup a CA certificate to be used to verify a trust path.
:param attestation_result: The result of the attestation
:param auth_data: The AuthenticatorData from the registration
"""
raise NotImplementedError()
def verify_attestation(
self, attestation_object: AttestationObject, client_data_hash: bytes
) -> None:
"""Verify attestation.
:param attestation_object: dict containing attestation data.
:param client_data_hash: SHA256 hash of the ClientData bytes.
"""
att_verifier: Attestation = UnsupportedAttestation(attestation_object.fmt)
for at in self._attestation_types:
if getattr(at, "FORMAT", None) == attestation_object.fmt:
att_verifier = at
break
# An unsupported format causes an exception to be thrown, which
# includes the auth_data. The caller may choose to handle this case
# and allow the registration.
result = att_verifier.verify(
attestation_object.att_stmt,
attestation_object.auth_data,
client_data_hash,
)
# Lookup CA to use for trust path verification
ca = self.ca_lookup(result, attestation_object.auth_data)
if not ca:
raise UntrustedAttestation("No root found for Authenticator")
# Validate the trust chain
try:
verify_x509_chain(result.trust_path + [ca])
except InvalidSignature as e:
raise UntrustedAttestation(e)
def __call__(self, *args):
"""Allows passing an instance to Fido2Server as verify_attestation"""
self.verify_attestation(*args)
fido2-2.2.1/fido2/attestation/packed.py 0000644 0000000 0000000 00000010342 15220526030 014603 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
from cryptography import x509
from cryptography.exceptions import InvalidSignature as _InvalidSignature
from cryptography.hazmat.backends import default_backend
from ..cose import CoseKey
from .base import (
Attestation,
AttestationResult,
AttestationType,
InvalidData,
InvalidSignature,
_validate_cert_common,
catch_builtins,
)
OID_AAGUID = x509.ObjectIdentifier("1.3.6.1.4.1.45724.1.1.4")
def _validate_packed_cert(cert, aaguid):
# https://www.w3.org/TR/webauthn/#packed-attestation-cert-requirements
_validate_cert_common(cert)
c = cert.subject.get_attributes_for_oid(x509.NameOID.COUNTRY_NAME)
if not c:
raise InvalidData("Subject must have C set!")
o = cert.subject.get_attributes_for_oid(x509.NameOID.ORGANIZATION_NAME)
if not o:
raise InvalidData("Subject must have O set!")
ous = cert.subject.get_attributes_for_oid(x509.NameOID.ORGANIZATIONAL_UNIT_NAME)
if not ous:
raise InvalidData('Subject must have OU = "Authenticator Attestation"!')
ou = ous[0]
if ou.value != "Authenticator Attestation":
raise InvalidData('Subject must have OU = "Authenticator Attestation"!')
cn = cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)
if not cn:
raise InvalidData("Subject must have CN set!")
try:
ext = cert.extensions.get_extension_for_oid(OID_AAGUID)
if ext.critical:
raise InvalidData("AAGUID extension must not be marked as critical")
ext_aaguid = ext.value.value[2:]
if ext_aaguid != aaguid:
raise InvalidData(
"AAGUID in Authenticator data does not match attestation certificate!"
)
except x509.ExtensionNotFound:
pass # If missing, ignore
class PackedAttestation(Attestation):
FORMAT = "packed"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
if "ecdaaKeyId" in statement:
raise NotImplementedError("ECDAA not implemented")
alg = statement["alg"]
x5c = statement.get("x5c")
assert auth_data.credential_data is not None # noqa: S101
if x5c:
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
_validate_packed_cert(cert, auth_data.credential_data.aaguid)
pub_key = CoseKey.for_alg(alg).from_cryptography_key(cert.public_key())
att_type = AttestationType.BASIC
else:
pub_key = CoseKey.parse(auth_data.credential_data.public_key)
if pub_key.ALGORITHM != alg:
raise InvalidData("Wrong algorithm of public key!")
att_type = AttestationType.SELF
try:
pub_key.verify(auth_data + client_data_hash, statement["sig"])
return AttestationResult(att_type, x5c or [])
except _InvalidSignature:
raise InvalidSignature()
fido2-2.2.1/fido2/attestation/tpm.py 0000644 0000000 0000000 00000046102 15220526030 014157 0 ustar 00 # -*- coding: utf-8 -*-
# Copyright (c) 2019 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import struct
from dataclasses import dataclass
from enum import IntEnum, unique
from typing import TypeAlias, cast
from cryptography import x509
from cryptography.exceptions import InvalidSignature as _InvalidSignature
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec, rsa
from ..cose import CoseKey
from ..utils import ByteBuffer, bytes2int
from .base import (
Attestation,
AttestationResult,
AttestationType,
InvalidData,
InvalidSignature,
_validate_cert_common,
catch_builtins,
)
TPM_ALG_NULL = 0x0010
OID_AIK_CERTIFICATE = x509.ObjectIdentifier("2.23.133.8.3")
@unique
class TpmRsaScheme(IntEnum):
RSASSA = 0x0014
RSAPSS = 0x0016
OAEP = 0x0017
RSAES = 0x0015
@unique
class TpmAlgAsym(IntEnum):
RSA = 0x0001
ECC = 0x0023
@unique
class TpmAlgHash(IntEnum):
SHA1 = 0x0004
SHA256 = 0x000B
SHA384 = 0x000C
SHA512 = 0x000D
def _hash_alg(self) -> hashes.HashAlgorithm:
if self == TpmAlgHash.SHA1:
return hashes.SHA1() # noqa: S303
elif self == TpmAlgHash.SHA256:
return hashes.SHA256()
elif self == TpmAlgHash.SHA384:
return hashes.SHA384()
elif self == TpmAlgHash.SHA512:
return hashes.SHA512()
raise NotImplementedError(f"_hash_alg is not implemented for {self!r}")
@dataclass
class TpmsCertifyInfo:
name: bytes
qualified_name: bytes
TPM_GENERATED_VALUE = b"\xffTCG"
TPM_ST_ATTEST_CERTIFY = b"\x80\x17"
@dataclass
class TpmAttestationFormat:
"""the signature data is defined by [TPMv2-Part2] Section 10.12.8 (TPMS_ATTEST)
as:
TPM_GENERATED_VALUE (0xff544347 aka "\xffTCG")
TPMI_ST_ATTEST - always TPM_ST_ATTEST_CERTIFY (0x8017)
because signing procedure defines it should call TPM_Certify
[TPMv2-Part3] Section 18.2
TPM2B_NAME
size (uint16)
name (size long)
TPM2B_DATA
size (uint16)
name (size long)
TPMS_CLOCK_INFO
clock (uint64)
resetCount (uint32)
restartCount (uint32)
safe (byte) 1 yes, 0 no
firmwareVersion uint64
attested TPMS_CERTIFY_INFO (because TPM_ST_ATTEST_CERTIFY)
name TPM2B_NAME
qualified_name TPM2B_NAME
See:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf
"""
name: bytes
data: bytes
clock_info: tuple[int, int, int, bool]
firmware_version: int
attested: TpmsCertifyInfo
@classmethod
def parse(cls, data: bytes) -> TpmAttestationFormat:
reader = ByteBuffer(data)
generated_value = reader.read(4)
# Verify that magic is set to TPM_GENERATED_VALUE.
# see https://w3c.github.io/webauthn/#sctn-tpm-attestation
# verification procedure
if generated_value != TPM_GENERATED_VALUE:
raise ValueError("generated value field is invalid")
# Verify that type is set to TPM_ST_ATTEST_CERTIFY.
# see https://w3c.github.io/webauthn/#sctn-tpm-attestation
# verification procedure
tpmi_st_attest = reader.read(2)
if tpmi_st_attest != TPM_ST_ATTEST_CERTIFY:
raise ValueError("tpmi_st_attest field is invalid")
try:
name = reader.read(reader.unpack("!H"))
data = reader.read(reader.unpack("!H"))
clock = reader.unpack("!Q")
reset_count = reader.unpack("!L")
restart_count = reader.unpack("!L")
safe_value = reader.unpack("B")
if safe_value not in (0, 1):
raise ValueError(f"invalid value 0x{safe_value:x} for boolean")
safe = safe_value == 1
firmware_version = reader.unpack("!Q")
attested_name = reader.read(reader.unpack("!H"))
attested_qualified_name = reader.read(reader.unpack("!H"))
except struct.error as e:
raise ValueError(e)
return cls(
name=name,
data=data,
clock_info=(clock, reset_count, restart_count, safe),
firmware_version=firmware_version,
attested=TpmsCertifyInfo(
name=attested_name, qualified_name=attested_qualified_name
),
)
@dataclass
class TpmsRsaParms:
"""Parse TPMS_RSA_PARMS struct
See:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 12.2.3.5
"""
symmetric: int
scheme: int
key_bits: int
exponent: int
@classmethod
def parse(cls, reader, attributes):
symmetric = reader.unpack("!H")
restricted_decryption = attributes & (
ATTRIBUTES.RESTRICTED | ATTRIBUTES.DECRYPT
)
is_restricted_decryption_key = restricted_decryption == (
ATTRIBUTES.DECRYPT | ATTRIBUTES.RESTRICTED
)
if not is_restricted_decryption_key and symmetric != TPM_ALG_NULL:
# if the key is not a restricted decryption key, this field
# shall be set to TPM_ALG_NULL.
raise ValueError("symmetric is expected to be NULL")
# Otherwise should be set to a supported symmetric algorithm, keysize and mode
# TODO(baloo): Should we have non-null value here, do we expect more data?
scheme = reader.unpack("!H")
restricted_sign = attributes & (ATTRIBUTES.RESTRICTED | ATTRIBUTES.SIGN_ENCRYPT)
is_unrestricted_signing_key = restricted_sign == ATTRIBUTES.SIGN_ENCRYPT
if is_unrestricted_signing_key and scheme not in (
TPM_ALG_NULL,
TpmRsaScheme.RSASSA,
TpmRsaScheme.RSAPSS,
):
raise ValueError(
"key is an unrestricted signing key, scheme is "
"expected to be TPM_ALG_RSAPSS, TPM_ALG_RSASSA, "
"or TPM_ALG_NULL"
)
is_restricted_signing_key = restricted_sign == (
ATTRIBUTES.RESTRICTED | ATTRIBUTES.SIGN_ENCRYPT
)
if is_restricted_signing_key and scheme not in (
TpmRsaScheme.RSASSA,
TpmRsaScheme.RSAPSS,
):
raise ValueError(
"key is a restricted signing key, scheme is "
"expected to be TPM_ALG_RSAPSS, or TPM_ALG_RSASSA"
)
is_unrestricted_decryption_key = restricted_decryption == ATTRIBUTES.DECRYPT
if is_unrestricted_decryption_key and scheme not in (
TpmRsaScheme.OAEP,
TpmRsaScheme.RSAES,
TPM_ALG_NULL,
):
raise ValueError(
"key is an unrestricted decryption key, scheme is "
"expected to be TPM_ALG_RSAES, TPM_ALG_OAEP, or "
"TPM_ALG_NULL"
)
if is_restricted_decryption_key and scheme not in (TPM_ALG_NULL,):
raise ValueError(
"key is an restricted decryption key, scheme is "
"expected to be TPM_ALG_NULL"
)
key_bits = reader.unpack("!H")
exponent = reader.unpack("!L")
if exponent == 0:
# When zero, indicates that the exponent is the default of 2^16 + 1
exponent = (2**16) + 1
return cls(symmetric, scheme, key_bits, exponent)
class Tpm2bPublicKeyRsa(bytes):
@classmethod
def parse(cls, reader: ByteBuffer) -> Tpm2bPublicKeyRsa:
return cls(reader.read(reader.unpack("!H")))
@unique
class TpmEccCurve(IntEnum):
"""TPM_ECC_CURVE
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 6.4
"""
NONE = 0x0000
NIST_P192 = 0x0001
NIST_P224 = 0x0002
NIST_P256 = 0x0003
NIST_P384 = 0x0004
NIST_P521 = 0x0005
BN_P256 = 0x0010
BN_P638 = 0x0011
SM2_P256 = 0x0020
def to_curve(self) -> ec.EllipticCurve:
if self == TpmEccCurve.NONE:
raise ValueError("No such curve")
elif self == TpmEccCurve.NIST_P192:
return ec.SECP192R1()
elif self == TpmEccCurve.NIST_P224:
return ec.SECP224R1()
elif self == TpmEccCurve.NIST_P256:
return ec.SECP256R1()
elif self == TpmEccCurve.NIST_P384:
return ec.SECP384R1()
elif self == TpmEccCurve.NIST_P521:
return ec.SECP521R1()
raise ValueError("curve is not supported", self)
@unique
class TpmiAlgKdf(IntEnum):
"""TPMI_ALG_KDF
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 9.28
"""
NULL = TPM_ALG_NULL
KDF1_SP800_56A = 0x0020
KDF2 = 0x0021
KDF1_SP800_108 = 0x0022
@dataclass
class TpmsEccParms:
symmetric: int
scheme: int
curve_id: TpmEccCurve
kdf: TpmiAlgKdf
@classmethod
def parse(cls, reader: ByteBuffer) -> TpmsEccParms:
symmetric = reader.unpack("!H")
scheme = reader.unpack("!H")
if symmetric != TPM_ALG_NULL:
raise ValueError("symmetric is expected to be NULL")
if scheme != TPM_ALG_NULL:
raise ValueError("scheme is expected to be NULL")
curve_id = TpmEccCurve(reader.unpack("!H"))
kdf_scheme = TpmiAlgKdf(reader.unpack("!H"))
return cls(symmetric, scheme, curve_id, kdf_scheme)
@dataclass
class TpmsEccPoint:
"""TPMS_ECC_POINT
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
Section 11.2.5.2
"""
x: bytes
y: bytes
@classmethod
def parse(cls, reader: ByteBuffer) -> TpmsEccPoint:
x = reader.read(reader.unpack("!H"))
y = reader.read(reader.unpack("!H"))
return cls(x, y)
@unique
class ATTRIBUTES(IntEnum):
"""Object attributes
see section 8.3
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
"""
FIXED_TPM = 1 << 1
ST_CLEAR = 1 << 2
FIXED_PARENT = 1 << 4
SENSITIVE_DATA_ORIGIN = 1 << 5
USER_WITH_AUTH = 1 << 6
ADMIN_WITH_POLICY = 1 << 7
NO_DA = 1 << 10
ENCRYPTED_DUPLICATION = 1 << 11
RESTRICTED = 1 << 16
DECRYPT = 1 << 17
SIGN_ENCRYPT = 1 << 18
SHALL_BE_ZERO = (
(1 << 0) # 0 Reserved
| (1 << 3) # 3 Reserved
| (0x3 << 8) # 9:8 Reserved
| (0xF << 12) # 15:12 Reserved
| ((0xFFFFFFFF << 19) & (2**32 - 1)) # 31:19 Reserved
)
_PublicKey: TypeAlias = rsa.RSAPublicKey | ec.EllipticCurvePublicKey
_Parameters = TpmsRsaParms | TpmsEccParms
_Unique = Tpm2bPublicKeyRsa | TpmsEccPoint
@dataclass
class TpmPublicFormat:
"""the public area structure is defined by [TPMv2-Part2] Section 12.2.4
(TPMT_PUBLIC)
as:
TPMI_ALG_PUBLIC - type
TPMI_ALG_HASH - nameAlg
or + to indicate TPM_ALG_NULL
TPMA_OBJECT - objectAttributes
TPM2B_DIGEST - authPolicy
TPMU_PUBLIC_PARMS - type parameters
TPMU_PUBLIC_ID - uniq
See:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
"""
sign_alg: TpmAlgAsym
name_alg: TpmAlgHash
attributes: int
auth_policy: bytes
parameters: _Parameters
unique: _Unique
data: bytes
@classmethod
def parse(cls, data: bytes) -> TpmPublicFormat:
reader = ByteBuffer(data)
sign_alg = TpmAlgAsym(reader.unpack("!H"))
name_alg = TpmAlgHash(reader.unpack("!H"))
attributes = reader.unpack("!L")
if attributes & ATTRIBUTES.SHALL_BE_ZERO != 0:
raise ValueError(f"attributes is not formated correctly: 0x{attributes:x}")
auth_policy = reader.read(reader.unpack("!H"))
if sign_alg == TpmAlgAsym.RSA:
parameters: _Parameters = TpmsRsaParms.parse(reader, attributes)
unique: _Unique = Tpm2bPublicKeyRsa.parse(reader)
elif sign_alg == TpmAlgAsym.ECC:
parameters = TpmsEccParms.parse(reader)
unique = TpmsEccPoint.parse(reader)
else:
raise NotImplementedError(f"sign alg {sign_alg:x} is not supported")
rest = reader.read()
if len(rest) != 0:
raise ValueError("there should not be any data left in buffer")
return cls(
sign_alg, name_alg, attributes, auth_policy, parameters, unique, data
)
def public_key(self) -> _PublicKey:
if self.sign_alg == TpmAlgAsym.RSA:
exponent = cast(TpmsRsaParms, self.parameters).exponent
modulus = bytes2int(cast(Tpm2bPublicKeyRsa, self.unique))
return rsa.RSAPublicNumbers(exponent, modulus).public_key(default_backend())
elif self.sign_alg == TpmAlgAsym.ECC:
unique = cast(TpmsEccPoint, self.unique)
return ec.EllipticCurvePublicNumbers(
bytes2int(unique.x),
bytes2int(unique.y),
cast(TpmsEccParms, self.parameters).curve_id.to_curve(),
).public_key(default_backend())
raise NotImplementedError(f"public_key not implemented for {self.sign_alg!r}")
def name(self) -> bytes:
"""
Computing Entity Names
see:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf
section 16 Names
Name ≔ nameAlg || HnameAlg (handle→nvPublicArea)
where
nameAlg algorithm used to compute Name
HnameAlg hash using the nameAlg parameter in the NV Index location
associated with handle
nvPublicArea contents of the TPMS_NV_PUBLIC associated with handle
"""
output = struct.pack("!H", self.name_alg)
digest = hashes.Hash(self.name_alg._hash_alg(), backend=default_backend())
digest.update(self.data)
output += digest.finalize()
return output
def _validate_tpm_cert(cert):
# https://www.w3.org/TR/webauthn/#tpm-cert-requirements
_validate_cert_common(cert)
if len(cert.subject) > 0:
raise InvalidData("Certificate should not have Subject")
s = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
if not s:
raise InvalidData("Certificate should have SubjectAlternativeName")
ext = cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)
has_aik = [x == OID_AIK_CERTIFICATE for x in ext.value]
if True not in has_aik:
raise InvalidData(
'Extended key usage MUST contain the "joint-iso-itu-t(2) '
"internationalorganizations(23) 133 tcg-kp(8) "
'tcg-kp-AIKCertificate(3)" OID.'
)
class TpmAttestation(Attestation):
FORMAT = "tpm"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
if "ecdaaKeyId" in statement:
raise NotImplementedError("ECDAA not implemented")
alg = statement["alg"]
x5c = statement["x5c"]
cert_info = statement["certInfo"]
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
_validate_tpm_cert(cert)
pub_key = CoseKey.for_alg(alg).from_cryptography_key(cert.public_key())
try:
pub_area = TpmPublicFormat.parse(statement["pubArea"])
except Exception as e:
raise InvalidData("unable to parse pubArea", e)
# Verify that the public key specified by the parameters and unique
# fields of pubArea is identical to the credentialPublicKey in the
# attestedCredentialData in authenticatorData.
assert auth_data.credential_data is not None # noqa: S101
if (
auth_data.credential_data.public_key.from_cryptography_key(
pub_area.public_key()
)
!= auth_data.credential_data.public_key
):
raise InvalidSignature(
"attestation pubArea does not match attestedCredentialData"
)
try:
# TpmAttestationFormat.parse is reponsible for:
# Verify that magic is set to TPM_GENERATED_VALUE.
# Verify that type is set to TPM_ST_ATTEST_CERTIFY.
tpm = TpmAttestationFormat.parse(cert_info)
# Verify that extraData is set to the hash of attToBeSigned
# using the hash algorithm employed in "alg".
att_to_be_signed = auth_data + client_data_hash
hash_alg = pub_key._HASH_ALG # type: ignore
digest = hashes.Hash(hash_alg, backend=default_backend())
digest.update(att_to_be_signed)
data = digest.finalize()
if tpm.data != data:
raise InvalidSignature(
"attestation does not sign for authData and ClientData"
)
# Verify that attested contains a TPMS_CERTIFY_INFO structure as
# specified in [TPMv2-Part2] section 10.12.3, whose name field
# contains a valid Name for pubArea, as computed using the
# algorithm in the nameAlg field of pubArea using the procedure
# specified in [TPMv2-Part1] section 16.
# [TPMv2-Part2]:
# https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
# [TPMv2-Part1]:
# https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf
if tpm.attested.name != pub_area.name():
raise InvalidData(
"TPMS_CERTIFY_INFO does not include a valid name for pubArea"
)
pub_key.verify(cert_info, statement["sig"])
return AttestationResult(AttestationType.ATT_CA, x5c)
except _InvalidSignature:
raise InvalidSignature("signature of certInfo does not match")
fido2-2.2.1/fido2/attestation/u2f.py 0000644 0000000 0000000 00000005312 15220526030 014051 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
from cryptography import x509
from cryptography.exceptions import InvalidSignature as _InvalidSignature
from cryptography.hazmat.backends import default_backend
from ..cose import ES256
from .base import (
Attestation,
AttestationResult,
AttestationType,
InvalidSignature,
catch_builtins,
)
class FidoU2FAttestation(Attestation):
FORMAT = "fido-u2f"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
cd = auth_data.credential_data
assert cd is not None # noqa: S101
pk = b"\x04" + cd.public_key[-2] + cd.public_key[-3]
x5c = statement["x5c"]
FidoU2FAttestation.verify_signature(
auth_data.rp_id_hash,
client_data_hash,
cd.credential_id,
pk,
x5c[0],
statement["sig"],
)
return AttestationResult(AttestationType.BASIC, x5c)
@staticmethod
def verify_signature(
app_param, client_param, key_handle, public_key, cert_bytes, signature
):
m = b"\0" + app_param + client_param + key_handle + public_key
cert = x509.load_der_x509_certificate(cert_bytes, default_backend())
try:
ES256.from_cryptography_key(cert.public_key()).verify(m, signature)
except _InvalidSignature:
raise InvalidSignature()
fido2-2.2.1/fido2/cbor.py 0000644 0000000 0000000 00000013332 15220526030 011744 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Minimal CBOR implementation supporting a subset of functionality and types
required for FIDO 2 CTAP.
Use the :func:`encode`, :func:`decode` and :func:`decode_from` functions to encode
and decode objects to/from CBOR.
"""
from __future__ import annotations
import struct
from types import UnionType
from typing import Any, Callable, Mapping, Sequence, TypeAlias
CborType: TypeAlias = int | bool | str | bytes | Sequence[Any] | Mapping[Any, Any]
# TODO: Requires Python 3.12, replace with collections.abc.Buffer
Buffer: TypeAlias = bytes | bytearray | memoryview
def _dump_int(data: int, mt: int = 0) -> bytes:
if data < 0:
mt = 1
data = -1 - data
mt = mt << 5
fmt: str
args: tuple[int, ...]
if data <= 23:
fmt, args = ">B", (mt | data,)
elif data <= 0xFF:
fmt, args = ">BB", (mt | 24, data)
elif data <= 0xFFFF:
fmt, args = ">BH", (mt | 25, data)
elif data <= 0xFFFFFFFF:
fmt, args = ">BI", (mt | 26, data)
else:
fmt, args = ">BQ", (mt | 27, data)
return struct.pack(fmt, *args)
def _dump_bool(data: bool) -> bytes:
return b"\xf5" if data else b"\xf4"
def _dump_list(data: Sequence[CborType]) -> bytes:
return _dump_int(len(data), mt=4) + b"".join([encode(x) for x in data])
def _sort_keys(entry):
key = entry[0]
return key[0], len(key), key
def _dump_dict(data: Mapping[CborType, CborType]) -> bytes:
items = [(encode(k), encode(v)) for k, v in data.items()]
items.sort(key=_sort_keys)
return _dump_int(len(items), mt=5) + b"".join([k + v for (k, v) in items])
def _dump_bytes(data: bytes) -> bytes:
return _dump_int(len(data), mt=2) + data
def _dump_text(data: str) -> bytes:
data_bytes = data.encode("utf8")
return _dump_int(len(data_bytes), mt=3) + data_bytes
_SERIALIZERS: Sequence[tuple[type | UnionType, Callable[[Any], bytes]]] = [
(bool, _dump_bool),
(int, _dump_int),
(str, _dump_text),
(Buffer, _dump_bytes),
(Mapping, _dump_dict),
(Sequence, _dump_list),
]
def _load_int(ai: int, data: bytes) -> tuple[int, bytes]:
if ai < 24:
return ai, data
elif ai == 24:
return data[0], data[1:]
elif ai == 25:
return struct.unpack_from(">H", data)[0], data[2:]
elif ai == 26:
return struct.unpack_from(">I", data)[0], data[4:]
elif ai == 27:
return struct.unpack_from(">Q", data)[0], data[8:]
raise ValueError("Invalid additional information")
def _load_nint(ai: int, data: bytes) -> tuple[int, bytes]:
val, rest = _load_int(ai, data)
return -1 - val, rest
def _load_bool(ai: int, data: bytes) -> tuple[bool, bytes]:
return ai == 21, data
def _load_bytes(ai: int, data: bytes) -> tuple[bytes, bytes]:
ln, data = _load_int(ai, data)
return data[:ln], data[ln:]
def _load_text(ai: int, data: bytes) -> tuple[str, bytes]:
enc, rest = _load_bytes(ai, data)
return enc.decode("utf8"), rest
def _load_array(ai: int, data: bytes) -> tuple[Sequence[CborType], bytes]:
ln, data = _load_int(ai, data)
values = []
for i in range(ln):
val, data = decode_from(data)
values.append(val)
return values, data
def _load_map(ai: int, data: bytes) -> tuple[Mapping[CborType, CborType], bytes]:
ln, data = _load_int(ai, data)
values = {}
for i in range(ln):
k, data = decode_from(data)
v, data = decode_from(data)
values[k] = v
return values, data
_DESERIALIZERS = {
0: _load_int,
1: _load_nint,
2: _load_bytes,
3: _load_text,
4: _load_array,
5: _load_map,
7: _load_bool,
}
def encode(data: CborType) -> bytes:
"""Encodes data to a CBOR byte string."""
for k, v in _SERIALIZERS:
if isinstance(data, k):
return v(data)
raise ValueError(f"Unsupported value: {data!r}")
def decode_from(data: bytes) -> tuple[Any, bytes]:
"""Decodes a CBOR-encoded value from the start of a byte string.
Additional data after a valid CBOR object is returned as well.
:return: The decoded object, and any remaining data."""
fb = data[0]
return _DESERIALIZERS[fb >> 5](fb & 0b11111, data[1:])
def decode(data) -> CborType:
"""Decodes data from a CBOR-encoded byte string.
Also validates that no extra data follows the encoded object.
"""
value, rest = decode_from(data)
if rest != b"":
raise ValueError("Extraneous data")
return value
fido2-2.2.1/fido2/client/__init__.py 0000644 0000000 0000000 00000116724 15220526030 014045 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import abc
import logging
from dataclasses import replace
from enum import IntEnum, unique
from threading import Event, Timer
from typing import Any, Callable, Mapping, Sequence, overload
from urllib.parse import urlparse
from ..cose import ES256
from ..ctap import CtapDevice, CtapError
from ..ctap1 import APDU, ApduError, Ctap1
from ..ctap2 import AssertionResponse, Ctap2, Info
from ..ctap2.extensions import (
_DEFAULT_EXTENSIONS,
AuthenticationExtensionProcessor,
Ctap2Extension,
RegistrationExtensionProcessor,
)
from ..ctap2.pin import ClientPin, PinProtocol
from ..hid import STATUS
from ..rpid import verify_rp_id
from ..utils import sha256
from ..webauthn import (
Aaguid,
AttestationConveyancePreference,
AttestationObject,
AuthenticationExtensionsClientOutputs,
AuthenticationResponse,
AuthenticatorAssertionResponse,
AuthenticatorAttachment,
AuthenticatorAttestationResponse,
AuthenticatorSelectionCriteria,
CollectedClientData,
PublicKeyCredentialCreationOptions,
PublicKeyCredentialDescriptor,
PublicKeyCredentialRequestOptions,
PublicKeyCredentialType,
RegistrationResponse,
ResidentKeyRequirement,
UserVerificationRequirement,
_as_cbor,
)
logger = logging.getLogger(__name__)
class ClientError(Exception):
"""Base error raised by clients."""
@unique
class ERR(IntEnum):
"""Error codes for ClientError."""
OTHER_ERROR = 1
BAD_REQUEST = 2
CONFIGURATION_UNSUPPORTED = 3
DEVICE_INELIGIBLE = 4
TIMEOUT = 5
def __call__(self, cause=None):
return ClientError(self, cause)
def __init__(self, code, cause=None):
self.code = ClientError.ERR(code)
self.cause = cause
def __repr__(self):
r = "Client error: {0} - {0.name}".format(self.code)
if self.cause:
r += f" (cause: {self.cause})"
return r
def _ctap2client_err(e, err_cls=ClientError):
if e.code in [CtapError.ERR.CREDENTIAL_EXCLUDED, CtapError.ERR.NO_CREDENTIALS]:
ce = ClientError.ERR.DEVICE_INELIGIBLE
elif e.code in [
CtapError.ERR.KEEPALIVE_CANCEL,
CtapError.ERR.ACTION_TIMEOUT,
CtapError.ERR.USER_ACTION_TIMEOUT,
]:
ce = ClientError.ERR.TIMEOUT
elif e.code in [
CtapError.ERR.UNSUPPORTED_ALGORITHM,
CtapError.ERR.UNSUPPORTED_OPTION,
CtapError.ERR.KEY_STORE_FULL,
]:
ce = ClientError.ERR.CONFIGURATION_UNSUPPORTED
elif e.code in [
CtapError.ERR.INVALID_COMMAND,
CtapError.ERR.CBOR_UNEXPECTED_TYPE,
CtapError.ERR.INVALID_CBOR,
CtapError.ERR.MISSING_PARAMETER,
CtapError.ERR.INVALID_OPTION,
CtapError.ERR.PUAT_REQUIRED,
CtapError.ERR.PIN_INVALID,
CtapError.ERR.PIN_BLOCKED,
CtapError.ERR.PIN_NOT_SET,
CtapError.ERR.PIN_POLICY_VIOLATION,
CtapError.ERR.PIN_TOKEN_EXPIRED,
CtapError.ERR.PIN_AUTH_INVALID,
CtapError.ERR.PIN_AUTH_BLOCKED,
CtapError.ERR.REQUEST_TOO_LARGE,
CtapError.ERR.OPERATION_DENIED,
]:
ce = ClientError.ERR.BAD_REQUEST
else:
ce = ClientError.ERR.OTHER_ERROR
return err_cls(ce, e)
class PinRequiredError(ClientError):
"""Raised when a call cannot be completed without providing PIN."""
def __init__(
self, code=ClientError.ERR.BAD_REQUEST, cause="PIN required but not provided"
):
super().__init__(code, cause)
def _call_polling(poll_delay, event, on_keepalive, func, *args, **kwargs):
event = event or Event()
while not event.is_set():
try:
return func(*args, **kwargs)
except ApduError as e:
if e.code == APDU.USE_NOT_SATISFIED:
if on_keepalive:
on_keepalive(STATUS.UPNEEDED)
on_keepalive = None
event.wait(poll_delay)
else:
raise ClientError.ERR.OTHER_ERROR(e)
except CtapError as e:
raise _ctap2client_err(e)
raise ClientError.ERR.TIMEOUT()
class AssertionSelection:
"""GetAssertion result holding one or more assertions.
Since multiple assertions may be retured by Fido2Client.get_assertion, this result
is returned which can be used to select a specific response to get.
"""
def __init__(
self,
client_data: CollectedClientData,
assertions: Sequence[AssertionResponse],
extension_results: Mapping[str, Any] = {},
):
self._client_data = client_data
self._assertions = assertions
self._extension_results = extension_results
def get_assertions(self) -> Sequence[AssertionResponse]:
"""Get the raw AssertionResponses available to inspect before selecting one."""
return self._assertions
def _get_extension_results(self, assertion: AssertionResponse) -> Mapping[str, Any]:
return self._extension_results
def get_response(self, index: int) -> AuthenticationResponse:
"""Get a single response."""
assertion = self._assertions[index]
return AuthenticationResponse(
raw_id=assertion.credential["id"],
response=AuthenticatorAssertionResponse(
client_data=self._client_data,
authenticator_data=assertion.auth_data,
signature=assertion.signature,
user_handle=assertion.user["id"] if assertion.user else None,
),
authenticator_attachment=AuthenticatorAttachment.CROSS_PLATFORM,
client_extension_results=AuthenticationExtensionsClientOutputs(
self._get_extension_results(assertion)
),
type=PublicKeyCredentialType.PUBLIC_KEY,
)
class WebAuthnClient(abc.ABC):
"""Base class for a WebAuthn client, supporting registration and authentication."""
@abc.abstractmethod
def make_credential(
self,
options: PublicKeyCredentialCreationOptions,
event: Event | None = None,
) -> RegistrationResponse:
"""Creates a credential.
:param options: PublicKeyCredentialCreationOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
raise NotImplementedError()
@abc.abstractmethod
def get_assertion(
self,
options: PublicKeyCredentialRequestOptions,
event: Event | None = None,
) -> AssertionSelection:
"""Get an assertion.
:param options: PublicKeyCredentialRequestOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
raise NotImplementedError()
class UserInteraction:
"""Provides user interaction to the Client.
Users of Fido2Client should subclass this to implement asking the user to perform
specific actions, such as entering a PIN or touching their"""
def prompt_up(self) -> None:
"""Called when the authenticator is awaiting a user presence check."""
logger.info("User Presence check required.")
def request_pin(
self, permissions: ClientPin.PERMISSION, rp_id: str | None
) -> str | None:
"""Called when the client requires a PIN from the user.
Should return a PIN, or None/Empty to cancel."""
logger.info("PIN requested, but UserInteraction does not support it.")
return None
def request_uv(self, permissions: ClientPin.PERMISSION, rp_id: str | None) -> bool:
"""Called when the client is about to request UV from the user.
Should return True if allowed, or False to cancel."""
logger.info("User Verification requested.")
return True
class ClientDataCollector(abc.ABC):
"""Provides client data and logic to the Client.
Users should subclass this to implement custom behavior for determining the origin,
validating the RP ID, and providing client data for a request.
"""
@abc.abstractmethod
def collect_client_data(
self,
options: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,
) -> tuple[CollectedClientData, str]:
"""Called when the client is preparing a request.
Should return a CollectedClientData object with the client data for the request,
as well as the RP ID of the credential.
"""
class DefaultClientDataCollector(ClientDataCollector):
"""Default implementation of ClientDataProvider.
This implementation uses a fixed origin, it can be subclassed to customize specific
behavior.
"""
def __init__(self, origin: str, verify: Callable[[str, str], bool] = verify_rp_id):
self._origin = origin
self._verify = verify
def get_rp_id(
self,
options: PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions,
origin: str,
) -> str:
"""Get the RP ID for the given options and origin."""
if isinstance(options, PublicKeyCredentialCreationOptions):
rp_id = options.rp.id
elif isinstance(options, PublicKeyCredentialRequestOptions):
rp_id = options.rp_id
else:
raise ValueError("Invalid options type.")
if rp_id is None:
url = urlparse(origin)
if url.scheme != "https" or not url.netloc:
raise ClientError.ERR.BAD_REQUEST(
"RP ID required for non-https origin."
)
return url.netloc
else:
return rp_id
def verify_rp_id(self, rp_id: str, origin: str) -> None:
"""Verify the RP ID for the given origin."""
try:
if self._verify(rp_id, origin):
return
except Exception: # noqa: S110
pass # Fall through to ClientError
raise ClientError.ERR.BAD_REQUEST()
def get_request_type(self, options) -> str:
"""Get the request type for the given options."""
if isinstance(options, PublicKeyCredentialCreationOptions):
return CollectedClientData.TYPE.CREATE
elif isinstance(options, PublicKeyCredentialRequestOptions):
return CollectedClientData.TYPE.GET
else:
raise ValueError("Invalid options type.")
def collect_client_data(self, options):
# Get the effective RP ID from the request options, falling back to the origin
rp_id = self.get_rp_id(options, self._origin)
# Validate that the RP ID is valid for the given origin
self.verify_rp_id(rp_id, self._origin)
# Construct the client data
return (
CollectedClientData.create(
type=self.get_request_type(options),
origin=self._origin,
challenge=options.challenge,
),
rp_id,
)
def _user_keepalive(user_interaction):
def on_keepalive(status):
if status == STATUS.UPNEEDED: # Waiting for touch
user_interaction.prompt_up()
return on_keepalive
class _ClientBackend(abc.ABC):
info: Info
@abc.abstractmethod
def selection(self, event: Event | None) -> None:
raise NotImplementedError()
@abc.abstractmethod
def do_make_credential(
self,
options: PublicKeyCredentialCreationOptions,
client_data: CollectedClientData,
rp_id: str,
enterprise_rpid_list: Sequence[str] | None,
event: Event,
) -> RegistrationResponse:
raise NotImplementedError()
@abc.abstractmethod
def do_get_assertion(
self,
options: PublicKeyCredentialRequestOptions,
client_data: CollectedClientData,
rp_id: str,
event: Event,
) -> AssertionSelection:
raise NotImplementedError()
class _Ctap1ClientBackend(_ClientBackend):
def __init__(self, device: CtapDevice, user_interaction: UserInteraction):
self.ctap1 = Ctap1(device)
self.info = Info(versions=["U2F_V2"], extensions=[], aaguid=Aaguid.NONE)
self._poll_delay = 0.25
self._on_keepalive = _user_keepalive(user_interaction)
def selection(self, event):
_call_polling(
self._poll_delay,
event,
None,
self.ctap1.register,
b"\0" * 32,
b"\0" * 32,
)
def do_make_credential(
self,
options,
client_data,
rp_id,
enterprise_rpid_list,
event,
):
key_params = options.pub_key_cred_params
exclude_list = options.exclude_credentials
selection = options.authenticator_selection or AuthenticatorSelectionCriteria()
rk = selection.require_resident_key
user_verification = selection.user_verification
if (
rk
or user_verification == UserVerificationRequirement.REQUIRED
or ES256.ALGORITHM not in [p.alg for p in key_params]
or options.attestation == AttestationConveyancePreference.ENTERPRISE
):
raise CtapError(CtapError.ERR.UNSUPPORTED_OPTION)
app_param = sha256(rp_id.encode())
dummy_param = b"\0" * 32
for cred in exclude_list or []:
key_handle = cred.id
try:
self.ctap1.authenticate(dummy_param, app_param, key_handle, True)
raise ClientError.ERR.OTHER_ERROR() # Shouldn't happen
except ApduError as e:
if e.code == APDU.USE_NOT_SATISFIED:
_call_polling(
self._poll_delay,
event,
self._on_keepalive,
self.ctap1.register,
dummy_param,
dummy_param,
)
raise ClientError.ERR.DEVICE_INELIGIBLE()
att_obj = AttestationObject.from_ctap1(
app_param,
_call_polling(
self._poll_delay,
event,
self._on_keepalive,
self.ctap1.register,
client_data.hash,
app_param,
),
)
credential = att_obj.auth_data.credential_data
assert credential is not None # noqa: S101
return RegistrationResponse(
raw_id=credential.credential_id,
response=AuthenticatorAttestationResponse(
client_data=client_data, attestation_object=att_obj
),
authenticator_attachment=AuthenticatorAttachment.CROSS_PLATFORM,
client_extension_results=AuthenticationExtensionsClientOutputs({}),
type=PublicKeyCredentialType.PUBLIC_KEY,
)
def do_get_assertion(
self,
options,
client_data,
rp_id,
event,
):
allow_list = options.allow_credentials
user_verification = options.user_verification
if user_verification == UserVerificationRequirement.REQUIRED or not allow_list:
raise CtapError(CtapError.ERR.UNSUPPORTED_OPTION)
app_param = sha256(rp_id.encode())
client_param = client_data.hash
for cred in allow_list:
try:
auth_resp = _call_polling(
self._poll_delay,
event,
self._on_keepalive,
self.ctap1.authenticate,
client_param,
app_param,
cred.id,
)
assertions = [
AssertionResponse.from_ctap1(app_param, _as_cbor(cred), auth_resp)
]
return AssertionSelection(client_data, assertions)
except ClientError as e:
if e.code == ClientError.ERR.TIMEOUT:
raise # Other errors are ignored so we move to the next.
raise ClientError.ERR.DEVICE_INELIGIBLE()
class _Ctap2ClientAssertionSelection(AssertionSelection):
def __init__(
self,
client_data: CollectedClientData,
assertions: Sequence[AssertionResponse],
extensions: Sequence[AuthenticationExtensionProcessor],
pin_token: bytes | None,
):
super().__init__(client_data, assertions)
self._extensions = extensions
self._pin_token = pin_token
def _get_extension_results(self, assertion):
# Process extension outputs
extension_outputs = {}
try:
for ext in self._extensions:
output = ext.prepare_outputs(assertion, self._pin_token)
if output:
extension_outputs.update(output)
except ValueError as e:
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(e)
return extension_outputs
@overload
def _cbor_list(values: Sequence) -> list: ...
@overload
def _cbor_list(values: None) -> None: ...
def _cbor_list(values):
if not values:
return None
return [_as_cbor(v) for v in values]
class _Ctap2ClientBackend(_ClientBackend):
def __init__(
self,
device: CtapDevice,
user_interaction: UserInteraction,
extensions: Sequence[Ctap2Extension],
):
self.ctap2 = Ctap2(device)
self.info = self.ctap2.info
self._extensions = extensions
self.user_interaction = user_interaction
def _filter_creds(
self, rp_id, cred_list, pin_protocol, pin_token, event, on_keepalive
):
# Use fresh info
info = self.ctap2.get_info()
# Filter out credential IDs which are too long
max_len = info.max_cred_id_length
if max_len:
cred_list = [c for c in cred_list if len(c.id) <= max_len]
client_data_hash = b"\0" * 32
if pin_token:
pin_auth = pin_protocol.authenticate(pin_token, client_data_hash)
version = pin_protocol.VERSION
else:
pin_auth = None
version = None
max_creds = info.max_creds_in_list or 1
while cred_list:
chunk = cred_list[:max_creds]
try:
assertions = self.ctap2.get_assertions(
rp_id,
client_data_hash,
_cbor_list(chunk),
None,
{"up": False},
pin_auth,
version,
event=event,
on_keepalive=on_keepalive,
)
if len(chunk) == 1:
# Credential ID might be omitted from assertions
return chunk[0]
else:
return PublicKeyCredentialDescriptor(**assertions[0].credential)
except CtapError as e:
match e.code:
case CtapError.ERR.REQUEST_TOO_LARGE if max_creds > 1:
# Message is too large, try smaller chunks
max_creds -= 1
case CtapError.ERR.NO_CREDENTIALS:
# All creds in chunk are discarded
cred_list = cred_list[max_creds:]
case _:
raise
# No matches found
return None
def selection(self, event):
if "FIDO_2_1" in self.ctap2.info.versions:
self.ctap2.selection(event=event)
else:
# Selection not supported, make dummy credential instead
try:
self.ctap2.make_credential(
b"\0" * 32,
{"id": "example.com", "name": "example.com"},
{"id": b"dummy", "name": "dummy"},
[{"type": "public-key", "alg": -7}],
pin_uv_param=b"",
event=event,
)
except CtapError as e:
if e.code in (
CtapError.ERR.PIN_NOT_SET,
CtapError.ERR.PIN_INVALID,
CtapError.ERR.PIN_AUTH_INVALID,
):
return
raise
def _should_use_uv(self, info, user_verification, permissions):
uv_supported = any(k in info.options for k in ("uv", "clientPin", "bioEnroll"))
uv_configured = any(
info.options.get(k) for k in ("uv", "clientPin", "bioEnroll")
)
mc = ClientPin.PERMISSION.MAKE_CREDENTIAL & permissions != 0
additional_perms = permissions & ~(
ClientPin.PERMISSION.MAKE_CREDENTIAL | ClientPin.PERMISSION.GET_ASSERTION
)
if (
user_verification == UserVerificationRequirement.REQUIRED
or (
user_verification in (UserVerificationRequirement.PREFERRED, None)
and uv_supported
)
or info.options.get("alwaysUv")
):
if not uv_configured:
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(
"User verification not configured/supported"
)
return True
elif mc and uv_configured and not info.options.get("makeCredUvNotRqd"):
return True
elif uv_configured and additional_perms:
return True
return False
def _get_token(
self,
info,
client_pin,
permissions,
rp_id,
event,
on_keepalive,
allow_internal_uv,
allow_uv,
):
# Prefer UV
if allow_uv and info.options.get("uv"):
if ClientPin.is_token_supported(info):
if self.user_interaction.request_uv(permissions, rp_id):
return client_pin.get_uv_token(
permissions, rp_id, event, on_keepalive
)
elif allow_internal_uv:
if self.user_interaction.request_uv(permissions, rp_id):
return None # No token, use uv=True
# PIN if UV not supported/allowed.
if info.options.get("clientPin"):
pin = self.user_interaction.request_pin(permissions, rp_id)
if pin:
return client_pin.get_pin_token(pin, permissions, rp_id)
raise PinRequiredError()
# Client PIN not configured.
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(
"User verification not configured"
)
def _get_auth_params(
self,
pin_protocol,
rp_id,
user_verification,
permissions,
allow_uv,
event,
on_keepalive,
):
info = self.ctap2.get_info()
pin_token = None
internal_uv = False
if self._should_use_uv(info, user_verification, permissions):
client_pin = ClientPin(self.ctap2, pin_protocol)
allow_internal_uv = (
permissions
& ~(
ClientPin.PERMISSION.MAKE_CREDENTIAL
| ClientPin.PERMISSION.GET_ASSERTION
)
== 0
)
pin_token = self._get_token(
info,
client_pin,
permissions,
rp_id,
event,
on_keepalive,
allow_internal_uv,
allow_uv,
)
if not pin_token:
internal_uv = True
return pin_token, internal_uv
def do_make_credential(
self,
options,
client_data,
rp_id,
enterprise_rpid_list,
event,
):
user = options.user
key_params = options.pub_key_cred_params
exclude_list = options.exclude_credentials
selection = options.authenticator_selection or AuthenticatorSelectionCriteria()
user_verification = selection.user_verification
on_keepalive = _user_keepalive(self.user_interaction)
info = self.ctap2.get_info()
# Handle enterprise attestation
enterprise_attestation = None
if options.attestation == AttestationConveyancePreference.ENTERPRISE:
if info.options.get("ep"):
if enterprise_rpid_list is not None:
# Platform facilitated
if rp_id in enterprise_rpid_list:
enterprise_attestation = 2
else:
# Vendor facilitated
enterprise_attestation = 1
# Negotiate PIN/UV protocol version
for proto in ClientPin.PROTOCOLS:
if proto.VERSION in info.pin_uv_protocols:
pin_protocol: PinProtocol | None = proto()
break
else:
pin_protocol = None
used_extensions: list[RegistrationExtensionProcessor] = []
allow_uv = True
def _do_make():
# Gather UV permissions
permissions = ClientPin.PERMISSION.MAKE_CREDENTIAL
if exclude_list:
# We need this for filtering the exclude_list
permissions |= ClientPin.PERMISSION.GET_ASSERTION
# Initialize extensions and add extension permissions
used_extensions.clear()
for e in self._extensions:
ext = e.make_credential(self.ctap2, options, pin_protocol)
if ext:
used_extensions.append(ext)
permissions |= ext.permissions
# Handle auth
pin_token, internal_uv = self._get_auth_params(
pin_protocol,
rp_id,
user_verification,
permissions,
allow_uv,
event,
on_keepalive,
)
if exclude_list:
exclude_cred = self._filter_creds(
rp_id, exclude_list, pin_protocol, pin_token, event, on_keepalive
)
# We know the request will fail if exclude_cred is not None here
# BUT DO NOT FAIL EARLY! We still need to prompt for UP, so we keep
# processing the request
else:
exclude_cred = None
# Process extensions
extension_inputs = {}
try:
for ext in used_extensions:
auth_input = ext.prepare_inputs(pin_token)
if auth_input:
extension_inputs.update(auth_input)
except ValueError as e:
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(e)
can_rk = info.options.get("rk")
rk = selection.resident_key == ResidentKeyRequirement.REQUIRED or (
selection.resident_key == ResidentKeyRequirement.PREFERRED and can_rk
)
if not (rk or internal_uv):
opts = None
else:
opts = {}
if rk:
if not can_rk:
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(
"Resident key not supported"
)
opts["rk"] = True
if internal_uv:
opts["uv"] = True
# Calculate pin_auth
client_data_hash = client_data.hash
if pin_protocol and pin_token:
pin_auth: tuple[bytes | None, int | None] = (
pin_protocol.authenticate(pin_token, client_data_hash),
pin_protocol.VERSION,
)
else:
pin_auth = (None, None)
# Perform make credential
return (
self.ctap2.make_credential(
client_data_hash,
_as_cbor(replace(options.rp, id=rp_id)),
_as_cbor(user),
_cbor_list(key_params),
[_as_cbor(exclude_cred)] if exclude_cred else None,
extension_inputs or None,
opts,
*pin_auth,
enterprise_attestation,
event=event,
on_keepalive=on_keepalive,
),
pin_token,
)
dev = self.ctap2.device
reconnected = False
while True:
try:
att_resp, pin_token = _do_make()
break
except CtapError as e:
# The Authenticator may still require UV, try again
if (
e.code == CtapError.ERR.PUAT_REQUIRED
and user_verification == UserVerificationRequirement.DISCOURAGED
):
user_verification = UserVerificationRequirement.REQUIRED
continue
# UV may be blocked, try again (once) with PIN
if e.code == CtapError.ERR.UV_BLOCKED and allow_uv:
allow_uv = False
continue
# NFC may require reconnect
connect = getattr(dev, "connect", None)
if (
e.code == CtapError.ERR.PIN_AUTH_BLOCKED
and connect
and not reconnected
):
dev.close()
connect()
reconnected = True # We only want to try this once
continue
raise
# Process extension outputs
extension_outputs = {}
try:
for ext in used_extensions:
output = ext.prepare_outputs(att_resp, pin_token)
if output is not None:
extension_outputs.update(output)
except ValueError as e:
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(e)
att_obj = AttestationObject.create(
att_resp.fmt, att_resp.auth_data, att_resp.att_stmt
)
credential = att_obj.auth_data.credential_data
assert credential is not None # noqa: S101
return RegistrationResponse(
raw_id=credential.credential_id,
response=AuthenticatorAttestationResponse(
client_data=client_data, attestation_object=att_obj
),
authenticator_attachment=AuthenticatorAttachment.CROSS_PLATFORM,
client_extension_results=AuthenticationExtensionsClientOutputs(
extension_outputs
),
type=PublicKeyCredentialType.PUBLIC_KEY,
)
def do_get_assertion(
self,
options,
client_data,
rp_id,
event,
):
rp_id = options.rp_id
allow_list = options.allow_credentials
user_verification = options.user_verification
on_keepalive = _user_keepalive(self.user_interaction)
# Negotiate PIN/UV protocol version
for proto in ClientPin.PROTOCOLS:
if proto.VERSION in self.info.pin_uv_protocols:
pin_protocol: PinProtocol | None = proto()
break
else:
pin_protocol = None
allow_uv = True
def _do_auth():
# Gather UV permissions
permissions = ClientPin.PERMISSION.GET_ASSERTION
# Initialize extensions and add extension permissions
used_extensions = []
for e in self._extensions:
ext = e.get_assertion(self.ctap2, options, pin_protocol)
if ext:
used_extensions.append(ext)
permissions |= ext.permissions
# Handle auth
pin_token, internal_uv = self._get_auth_params(
pin_protocol,
rp_id,
user_verification,
permissions,
allow_uv,
event,
on_keepalive,
)
if allow_list:
selected_cred = self._filter_creds(
rp_id, allow_list, pin_protocol, pin_token, event, on_keepalive
)
# We know the request will fail if selected_cred is None here
# BUT DO NOT FAIL EARLY! We still need to prompt for UP, so we keep
# processing the request
else:
selected_cred = None
# Process extensions
extension_inputs = {}
try:
for ext in used_extensions:
inputs = ext.prepare_inputs(selected_cred, pin_token)
if inputs:
extension_inputs.update(inputs)
except ValueError as e:
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(e)
opts = {"uv": True} if internal_uv else None
# Calculate pin_auth
client_data_hash = client_data.hash
if pin_protocol and pin_token:
pin_auth: tuple[bytes | None, int | None] = (
pin_protocol.authenticate(pin_token, client_data_hash),
pin_protocol.VERSION,
)
else:
pin_auth = (None, None)
if allow_list and not selected_cred:
# We still need to send a dummy value if there was an allow_list
# but no matches were found:
selected_cred = PublicKeyCredentialDescriptor(
type=allow_list[0].type, id=b"\0"
)
# Perform get assertion
assertions = self.ctap2.get_assertions(
rp_id,
client_data_hash,
[_as_cbor(selected_cred)] if selected_cred else None,
extension_inputs or None,
opts,
*pin_auth,
event=event,
on_keepalive=on_keepalive,
)
return _Ctap2ClientAssertionSelection(
client_data, assertions, used_extensions, pin_token
)
dev = self.ctap2.device
reconnected = False
while True:
try:
return _do_auth()
except CtapError as e:
# The Authenticator may still require UV, try again
if (
e.code == CtapError.ERR.PUAT_REQUIRED
and user_verification == UserVerificationRequirement.DISCOURAGED
):
user_verification = UserVerificationRequirement.REQUIRED
continue
# UV may be blocked, try again (once) with PIN
if e.code == CtapError.ERR.UV_BLOCKED and allow_uv:
allow_uv = False
continue
# NFC may require reconnect
connect = getattr(dev, "connect", None)
if (
e.code == CtapError.ERR.PIN_AUTH_BLOCKED
and connect
and not reconnected
):
dev.close()
connect()
reconnected = True # We only want to try this once
continue
raise
class Fido2Client(WebAuthnClient):
"""WebAuthn-like client implementation.
The client allows registration and authentication of WebAuthn credentials against
an Authenticator using CTAP (1 or 2).
:param device: CtapDevice to use.
:param str origin: The origin to use.
:param verify: Function to verify an RP ID for a given origin.
"""
def __init__(
self,
device: CtapDevice,
client_data_collector: ClientDataCollector,
user_interaction: UserInteraction = UserInteraction(),
extensions: Sequence[Ctap2Extension] = _DEFAULT_EXTENSIONS,
):
self._client_data_collector = client_data_collector
# TODO: Decide how to configure this list.
self._enterprise_rpid_list: Sequence[str] | None = None
try:
self._backend: _ClientBackend = _Ctap2ClientBackend(
device, user_interaction, extensions
)
except (ValueError, CtapError):
self._backend = _Ctap1ClientBackend(device, user_interaction)
@property
def info(self) -> Info:
return self._backend.info
def selection(self, event: Event | None = None) -> None:
try:
self._backend.selection(event)
except CtapError as e:
raise _ctap2client_err(e)
def make_credential(
self,
options: PublicKeyCredentialCreationOptions,
event: Event | None = None,
) -> RegistrationResponse:
"""Creates a credential.
:param options: PublicKeyCredentialCreationOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
options = PublicKeyCredentialCreationOptions.from_dict(options)
event = event or Event()
if options.timeout:
timer = Timer(options.timeout / 1000, event.set)
timer.daemon = True
timer.start()
else:
timer = None
# Gather client data, RP ID from client
client_data, rp_id = self._client_data_collector.collect_client_data(options)
logger.debug(f"Register a new credential for RP ID: {rp_id}")
try:
return self._backend.do_make_credential(
options,
client_data,
rp_id,
self._enterprise_rpid_list,
event,
)
except CtapError as e:
raise _ctap2client_err(e)
finally:
if timer:
timer.cancel()
def get_assertion(
self,
options: PublicKeyCredentialRequestOptions,
event: Event | None = None,
) -> AssertionSelection:
"""Get an assertion.
:param options: PublicKeyCredentialRequestOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
options = PublicKeyCredentialRequestOptions.from_dict(options)
event = event or Event()
if options.timeout:
timer = Timer(options.timeout / 1000, event.set)
timer.daemon = True
timer.start()
else:
timer = None
# Gather client data, RP ID from client
client_data, rp_id = self._client_data_collector.collect_client_data(options)
logger.debug(f"Assert a credential for RP ID: {rp_id}")
try:
return self._backend.do_get_assertion(
options,
client_data,
rp_id,
event,
)
except CtapError as e:
raise _ctap2client_err(e)
finally:
if timer:
timer.cancel()
fido2-2.2.1/fido2/client/win_api.py 0000644 0000000 0000000 00000076175 15220526030 013741 0 ustar 00 # Copyright (c) 2019 Onica Group LLC.
# Modified work Copyright 2019 Yubico.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Structs based on Microsoft's WebAuthN API.
https://github.com/microsoft/webauthn
Definitions taken from https://github.com/microsoft/webauthn/blob/master/webauthn.h
"""
# With the ctypes.Structure a lot of the property names
# will be invalid, and when creating the __init__ methods
# we do not need to call super() for the Structure class
#
# pylint: disable=invalid-name, super-init-not-called, too-few-public-methods
from __future__ import annotations
import ctypes
from ctypes.wintypes import BOOL, DWORD, HWND, LONG, LPCWSTR, WORD
from enum import IntEnum, unique
from typing import Any, Mapping, Sequence, cast
# Not implemented: Platform credentials support, listing of built-in authenticators
LOAD_LIBRARY_SEARCH_SYSTEM32 = 0x00000800
PBYTE = ctypes.POINTER(ctypes.c_ubyte) # Different from wintypes.PBYTE, which is signed
PCWSTR = ctypes.c_wchar_p
PVOID = ctypes.c_void_p
class BytesProperty:
"""Property for structs storing byte arrays as DWORD + PBYTE.
Allows for easy reading/writing to struct fields using Python bytes objects.
"""
def __init__(self, name: str):
self.cbName = "cb" + name
self.pbName = "pb" + name
def __get__(self, instance, owner):
return bytes(
bytearray(getattr(instance, self.pbName)[: getattr(instance, self.cbName)])
)
def __set__(self, instance, value: bytes | None):
ln = len(value) if value else 0
buffer = ctypes.create_string_buffer(value) if value else 0
setattr(instance, self.cbName, ln)
setattr(instance, self.pbName, ctypes.cast(buffer, PBYTE))
class GUID(ctypes.Structure):
"""GUID Type in C++."""
_fields_ = [
("Data1", ctypes.c_ulong),
("Data2", ctypes.c_ushort),
("Data3", ctypes.c_ushort),
("Data4", ctypes.c_ubyte * 8),
]
def __str__(self):
return "{%08X-%04X-%04X-%04X-%012X}" % (
self.Data1,
self.Data2,
self.Data3,
self.Data4[0] * 256 + self.Data4[1],
self.Data4[2] * (256**5)
+ self.Data4[3] * (256**4)
+ self.Data4[4] * (256**3)
+ self.Data4[5] * (256**2)
+ self.Data4[6] * 256
+ self.Data4[7],
)
class _FromString:
@classmethod
def from_string(cls, value: str):
return getattr(cls, value.upper().replace("-", "_"))
@unique
class WebAuthNUserVerificationRequirement(_FromString, IntEnum):
"""Maps to WEBAUTHN_USER_VERIFICATION_REQUIREMENT_*."""
ANY = 0
REQUIRED = 1
PREFERRED = 2
DISCOURAGED = 3
@unique
class WebAuthNAttestationConveyancePreference(_FromString, IntEnum):
"""Maps to WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_*."""
ANY = 0
NONE = 1
INDIRECT = 2
DIRECT = 3
@unique
class WebAuthNAuthenticatorAttachment(_FromString, IntEnum):
"""Maps to WEBAUTHN_AUTHENTICATOR_ATTACHMENT_*."""
ANY = 0
PLATFORM = 1
CROSS_PLATFORM = 2
CROSS_PLATFORM_U2F_V2 = 3
@unique
class WebAuthNCTAPTransport(_FromString, IntEnum):
"""Maps to WEBAUTHN_CTAP_TRANSPORT_*."""
ANY = 0x00000000
USB = 0x00000001
NFC = 0x00000002
BLE = 0x00000004
TEST = 0x00000008
INTERNAL = 0x00000010
HYBRID = 0x00000020
SMART_CARD = 0x00000040
FLAGS_MASK = 0x0000007F
@unique
class WebAuthNEnterpriseAttestation(_FromString, IntEnum):
"""Maps to WEBAUTHN_ENTERPRISE_ATTESTATION_*."""
NONE = 0
VENDOR_FACILITATED = 1
PLATFORM_MANAGED = 2
@unique
class WebAuthNLargeBlobSupport(_FromString, IntEnum):
"""Maps to WEBAUTHN_LARGE_BLOB_SUPPORT_*."""
NONE = 0
REQUIRED = 1
PREFERRED = 2
@unique
class WebAuthNLargeBlobOperation(_FromString, IntEnum):
"""Maps to WEBAUTHN_LARGE_BLOB_OPERATION_*."""
NONE = 0
GET = 1
SET = 2
DELETE = 3
@unique
class WebAuthNUserVerification(_FromString, IntEnum):
"""Maps to WEBAUTHN_USER_VERIFICATION_*."""
ANY = 0
OPTIONAL = 1
OPTIONAL_WITH_CREDENTIAL_ID_LIST = 2
REQUIRED = 3
class WebAuthNCoseCredentialParameter(ctypes.Structure):
"""Maps to WEBAUTHN_COSE_CREDENTIAL_PARAMETER Struct.
:param cred_params: Dict of Credential parameters.
"""
_fields_ = [
("dwVersion", DWORD),
("pwszCredentialType", LPCWSTR),
("lAlg", LONG),
]
def __init__(self, cred_params: Mapping[str, Any]):
self.dwVersion = get_version(self.__class__.__name__)
self.pwszCredentialType = cred_params["type"]
self.lAlg = cred_params["alg"]
class WebAuthNCoseCredentialParameters(ctypes.Structure):
"""Maps to WEBAUTHN_COSE_CREDENTIAL_PARAMETERS Struct.
:param params: List of Credential parameter dicts.
"""
_fields_ = [
("cCredentialParameters", DWORD),
("pCredentialParameters", ctypes.POINTER(WebAuthNCoseCredentialParameter)),
]
def __init__(self, params: Sequence[Mapping[str, Any]]):
self.cCredentialParameters = len(params)
self.pCredentialParameters = (WebAuthNCoseCredentialParameter * len(params))(
*(WebAuthNCoseCredentialParameter(param) for param in params)
)
class WebAuthNClientData(ctypes.Structure):
"""Maps to WEBAUTHN_CLIENT_DATA Struct.
:param client_data_json: ClientData serialized as JSON bytes.
"""
_fields_ = [
("dwVersion", DWORD),
("cbClientDataJSON", DWORD),
("pbClientDataJSON", PBYTE),
("pwszHashAlgId", LPCWSTR),
]
client_data_json = BytesProperty("ClientDataJSON")
def __init__(self, client_data_json: bytes):
self.dwVersion = get_version(self.__class__.__name__)
self.client_data_json = client_data_json
self.pwszHashAlgId = "SHA-256"
class WebAuthNRpEntityInformation(ctypes.Structure):
"""Maps to WEBAUTHN_RP_ENTITY_INFORMATION Struct.
:param rp: Dict of RP information.
"""
_fields_ = [
("dwVersion", DWORD),
("pwszId", PCWSTR),
("pwszName", PCWSTR),
("pwszIcon", PCWSTR),
]
def __init__(self, rp: Mapping[str, Any]):
self.dwVersion = get_version(self.__class__.__name__)
self.pwszId = rp["id"]
self.pwszName = rp["name"]
self.pwszIcon = rp.get("icon")
class WebAuthNUserEntityInformation(ctypes.Structure):
"""Maps to WEBAUTHN_USER_ENTITY_INFORMATION Struct.
:param user: Dict of User information.
"""
_fields_ = [
("dwVersion", DWORD),
("cbId", DWORD),
("pbId", PBYTE),
("pwszName", PCWSTR),
("pwszIcon", PCWSTR),
("pwszDisplayName", PCWSTR),
]
id = BytesProperty("Id")
def __init__(self, user: Mapping[str, Any]):
self.dwVersion = get_version(self.__class__.__name__)
self.id = user["id"]
self.pwszName = user["name"]
self.pwszIcon = user.get("icon")
self.pwszDisplayName = user.get("displayName")
class WebAuthNCredentialEx(ctypes.Structure):
"""Maps to WEBAUTHN_CREDENTIAL_EX Struct.
:param cred: Dict of Credential Descriptor data.
"""
_fields_ = [
("dwVersion", DWORD),
("cbId", DWORD),
("pbId", PBYTE),
("pwszCredentialType", LPCWSTR),
("dwTransports", DWORD),
]
id = BytesProperty("Id")
def __init__(self, cred: Mapping[str, Any]):
self.dwVersion = get_version(self.__class__.__name__)
self.id = cred["id"]
self.pwszCredentialType = cred["type"]
self.dwTransports = WebAuthNCTAPTransport[cred.get("transport", "ANY")]
class WebAuthNCredentialList(ctypes.Structure):
"""Maps to WEBAUTHN_CREDENTIAL_LIST Struct.
:param credentials: List of dict of Credential Descriptor data.
"""
_fields_ = [
("cCredentials", DWORD),
("ppCredentials", ctypes.POINTER(ctypes.POINTER(WebAuthNCredentialEx))),
]
def __init__(self, credentials: Sequence[Mapping[str, Any]]):
self.cCredentials = len(credentials)
self.ppCredentials = (ctypes.POINTER(WebAuthNCredentialEx) * len(credentials))(
*(ctypes.pointer(WebAuthNCredentialEx(cred)) for cred in credentials)
)
class WebAuthNHmacSecretSalt(ctypes.Structure):
_fields_ = [
("cbFirst", DWORD),
("pbFirst", PBYTE),
("cbSecond", DWORD),
("pbSecond", PBYTE),
]
first = BytesProperty("First")
second = BytesProperty("Second")
def __init__(self, first: bytes, second: bytes | None = None):
self.first = first
self.second = second
class WebAuthNCredWithHmacSecretSalt(ctypes.Structure):
_fields_ = [
("cbCredID", DWORD),
("pbCredID", PBYTE),
("pHmacSecretSalt", ctypes.POINTER(WebAuthNHmacSecretSalt)),
]
cred_id = BytesProperty("CredID")
def __init__(self, cred_id: bytes, salt: WebAuthNHmacSecretSalt):
self.cred_id = cred_id
self.pHmacSecretSalt = ctypes.pointer(salt)
class WebAuthNHmacSecretSaltValues(ctypes.Structure):
_fields_ = [
("pGlobalHmacSalt", ctypes.POINTER(WebAuthNHmacSecretSalt)),
("cCredWithHmacSecretSaltList", DWORD),
("pCredWithHmacSecretSaltList", ctypes.POINTER(WebAuthNCredWithHmacSecretSalt)),
]
def __init__(
self,
global_salt: WebAuthNHmacSecretSalt | None,
credential_salts: Sequence[WebAuthNCredWithHmacSecretSalt] = [],
):
if global_salt:
self.pGlobalHmacSalt = ctypes.pointer(global_salt)
self.cCredWithHmacSecretSaltList = len(credential_salts)
self.pCredWithHmacSecretSaltList = (
WebAuthNCredWithHmacSecretSalt * len(credential_salts)
)(*credential_salts)
class WebAuthNCredProtectExtensionIn(ctypes.Structure):
"""Maps to WEBAUTHN_CRED_PROTECT_EXTENSION_IN Struct."""
_fields_ = [
("dwCredProtect", DWORD),
("bRequireCredProtect", BOOL),
]
def __init__(
self, cred_protect: WebAuthNUserVerification, require_cred_protect: bool
):
self.dwCredProtect = cred_protect
self.bRequireCredProtect = require_cred_protect
class WebAuthNCredBlobExtension(ctypes.Structure):
_fields_ = [
("cbCredBlob", DWORD),
("pbCredBlob", PBYTE),
]
cred_blob = BytesProperty("CredBlob")
def __init__(self, blob: bytes):
self.cred_blob = blob
class WebAuthNExtension(ctypes.Structure):
"""Maps to WEBAUTHN_EXTENSION Struct."""
_fields_ = [
("pwszExtensionIdentifier", LPCWSTR),
("cbExtension", DWORD),
("pvExtension", PVOID),
]
def __init__(self, identifier: str, value: Any):
self.pwszExtensionIdentifier = identifier
self.cbExtension = ctypes.sizeof(value)
self.pvExtension = ctypes.cast(ctypes.pointer(value), PVOID)
class WebAuthNExtensions(ctypes.Structure):
"""Maps to WEBAUTHN_EXTENSIONS Struct."""
_fields_ = [
("cExtensions", DWORD),
("pExtensions", ctypes.POINTER(WebAuthNExtension)),
]
def __init__(self, extensions: Sequence[WebAuthNExtension]):
self.cExtensions = len(extensions)
self.pExtensions = (WebAuthNExtension * len(extensions))(*extensions)
class WebAuthNCredential(ctypes.Structure):
"""Maps to WEBAUTHN_CREDENTIAL Struct.
:param cred: Dict of Credential Descriptor data.
"""
_fields_ = [
("dwVersion", DWORD),
("cbId", DWORD),
("pbId", PBYTE),
("pwszCredentialType", LPCWSTR),
]
id = BytesProperty("Id")
def __init__(self, cred: Mapping[str, Any]):
self.id = cred["id"]
self.pwszCredentialType = cred["type"]
class WebAuthNCredentials(ctypes.Structure):
"""Maps to WEBAUTHN_CREDENTIALS Struct.
:param credentials: List of dict of Credential Descriptor data.
"""
_fields_ = [
("cCredentials", DWORD),
("pCredentials", ctypes.POINTER(WebAuthNCredential)),
]
def __init__(self, credentials: Sequence[Mapping[str, Any]]):
self.cCredentials = len(credentials)
self.pCredentials = (WebAuthNCredential * len(credentials))(
*(WebAuthNCredential(cred) for cred in credentials)
)
class CtapCborHybridStorageLinkedData(ctypes.Structure):
"""Maps to CTAPCBOR_HYBRID_STORAGE_LINKED_DATA Struct."""
_fields_ = [
("dwVersion", DWORD),
("cbContactId", DWORD),
("pbContactId", PBYTE),
("cbLinkId", DWORD),
("pbLinkId", PBYTE),
("cbLinkSecret", DWORD),
("pbLinkSecret", PBYTE),
("cbPublicKey", DWORD),
("pbPublicKey", PBYTE),
("pwszAuthenticatorName", PCWSTR),
("wEncodedTunnelServerDomain", WORD),
] # TODO
contact_id = BytesProperty("ContactId")
link_id = BytesProperty("LinkId")
link_secret = BytesProperty("LinkSecret")
public_key = BytesProperty("PublicKey")
class WebAuthNGetAssertionOptions(ctypes.Structure):
"""Maps to WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS Struct.
:param timeout: Time that the operation is expected to complete within.
This is used as guidance, and can be overridden by the platform.
:param attachment: Platform vs Cross-Platform
Authenticators.
:param uv_requirement: User Verification Requirement.
:param credentials: Allowed Credentials List.
"""
_fields_ = [
("dwVersion", DWORD),
("dwTimeoutMilliseconds", DWORD),
("CredentialList", WebAuthNCredentials),
("Extensions", WebAuthNExtensions),
("dwAuthenticatorAttachment", DWORD),
("dwUserVerificationRequirement", DWORD),
("dwFlags", DWORD),
# Version 2 additions
("pwszU2fAppId", PCWSTR),
("pbU2fAppId", ctypes.POINTER(BOOL)),
# Version 3 additions
("pCancellationId", ctypes.POINTER(GUID)),
# Version 4 additions
("pAllowCredentialList", ctypes.POINTER(WebAuthNCredentialList)),
# Version 5 additions
("dwCredLargeBlobOperation", DWORD),
("cbCredLargeBlob", DWORD),
("pbCredLargeBlob", PBYTE),
# Version 6 additions
("pHmacSecretSaltValues", ctypes.POINTER(WebAuthNHmacSecretSaltValues)),
("bBrowserInPrivateMode", BOOL),
# Version 7 additions
("pLinkedDevice", ctypes.POINTER(CtapCborHybridStorageLinkedData)),
("bAutoFill", BOOL),
("cbJsonExt", DWORD),
("pbJsonExt", PBYTE),
# Version 8 additions
("cCredentialHints", DWORD),
("ppwszCredentialHints", ctypes.POINTER(PCWSTR)),
# Version 9 additions
("pwszRemoteWebOrigin", PCWSTR),
("cbPublicKeyCredentialRequestOptionsJSON", DWORD),
("pbPublicKeyCredentialRequestOptionsJSON", PBYTE),
("cbAuthenticatorId", DWORD),
("pbAuthenticatorId", PBYTE),
]
cred_large_blob = BytesProperty("CredLargeBlob")
json_ext = BytesProperty("JsonExt")
public_key_credential_request_options_json = BytesProperty(
"PublicKeyCredentialRequestOptionsJSON"
)
authenticator_id = BytesProperty("AuthenticatorId")
def __init__(
self,
timeout: int = 0,
attachment: int = WebAuthNAuthenticatorAttachment.ANY,
uv_requirement: int = WebAuthNUserVerificationRequirement.DISCOURAGED,
credentials: Sequence[Mapping[str, Any]] = [],
cancellationId: GUID | None = None,
cred_large_blob_operation: int = WebAuthNLargeBlobOperation.NONE,
cred_large_blob: bytes | None = None,
hmac_secret_salts: WebAuthNHmacSecretSaltValues | None = None,
extensions: Sequence[WebAuthNExtension] = [],
flags: int = 0,
u2f_appid: str | None = None,
u2f_appid_used: BOOL | None = None,
credential_hints: Sequence[str] | None = None,
remote_web_origin: str | None = None,
public_key_credential_request_options_json: bytes | None = None,
authenticator_id: bytes | None = None,
):
self.dwVersion = get_version(self.__class__.__name__)
self.dwTimeoutMilliseconds = timeout
self.dwAuthenticatorAttachment = attachment
self.dwUserVerificationRequirement = uv_requirement
self.dwFlags = flags
if extensions:
self.Extensions = WebAuthNExtensions(extensions)
if self.dwVersion >= 2:
self.pwszU2fAppId = u2f_appid
if u2f_appid_used is not None:
self.pbU2fAppId = ctypes.pointer(u2f_appid_used)
if self.dwVersion >= 3 and cancellationId:
self.pCancellationId = ctypes.pointer(cancellationId)
if self.dwVersion >= 4:
clist = WebAuthNCredentialList(credentials)
self.pAllowCredentialList = ctypes.pointer(clist)
else:
self.CredentialList = WebAuthNCredentials(credentials)
if self.dwVersion >= 5:
self.dwCredLargeBlobOperation = cred_large_blob_operation
self.cred_large_blob = cred_large_blob
if self.dwVersion >= 6 and hmac_secret_salts:
self.pHmacSecretSaltValues = ctypes.pointer(hmac_secret_salts)
if self.dwVersion >= 8 and credential_hints:
self.cCredentialHints = len(credential_hints)
# Keep array alive by storing on instance
self._credential_hints_array = (PCWSTR * len(credential_hints))(
*credential_hints
)
self.ppwszCredentialHints = self._credential_hints_array
if self.dwVersion >= 9:
self.pwszRemoteWebOrigin = remote_web_origin
self.public_key_credential_request_options_json = (
public_key_credential_request_options_json
)
self.authenticator_id = authenticator_id
class WebAuthNAssertion(ctypes.Structure):
"""Maps to WEBAUTHN_ASSERTION Struct."""
_fields_ = [
("dwVersion", DWORD),
("cbAuthenticatorData", DWORD),
("pbAuthenticatorData", PBYTE),
("cbSignature", DWORD),
("pbSignature", PBYTE),
("Credential", WebAuthNCredential),
("cbUserId", DWORD),
("pbUserId", PBYTE),
# Version 2 additions
("Extensions", WebAuthNExtensions),
("cbCredLargeBlob", DWORD),
("pbCredLargeBlob", PBYTE),
("dwCredLargeBlobStatus", DWORD),
# Version 3 additions
("pHmacSecret", ctypes.POINTER(WebAuthNHmacSecretSalt)),
# Version 4 additions
("dwUsedTransports", DWORD),
# Version 5 additions
("cbUnsignedExtensionOutputs", DWORD),
("pbUnsignedExtensionOutputs", PBYTE),
# Version 6 additions
("cbClientDataJSON", DWORD),
("pbClientDataJSON", PBYTE),
("cbAuthenticationResponseJSON", DWORD),
("pbAuthenticationResponseJSON", PBYTE),
]
auth_data = BytesProperty("AuthenticatorData")
signature = BytesProperty("Signature")
user_id = BytesProperty("UserId")
cred_large_blob = BytesProperty("CredLargeBlob")
unsigned_extension_outputs = BytesProperty("UnsignedExtensionOutputs")
client_data_json = BytesProperty("ClientDataJSON")
authentication_response_json = BytesProperty("AuthenticationResponseJSON")
def __del__(self):
WEBAUTHN.WebAuthNFreeAssertion(ctypes.byref(self))
class WebAuthNMakeCredentialOptions(ctypes.Structure):
"""maps to WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS Struct.
:param timeout: Time that the operation is expected to complete within.This
is used as guidance, and can be overridden by the platform.
:param require_resident_key: Require key to be resident or not.
:param attachment: Platform vs Cross-Platform
Authenticators.
:param user_verification_requirement: User
Verification Requirement.
:param attestation_convoyence:
Attestation Conveyance Preference.
:param credentials: Credentials used for exclusion.
"""
_fields_ = [
("dwVersion", DWORD),
("dwTimeoutMilliseconds", DWORD),
("CredentialList", WebAuthNCredentials),
("Extensions", WebAuthNExtensions),
("dwAuthenticatorAttachment", DWORD),
("bRequireResidentKey", BOOL),
("dwUserVerificationRequirement", DWORD),
("dwAttestationConveyancePreference", DWORD),
("dwFlags", DWORD),
# Version 2 additions
("pCancellationId", ctypes.POINTER(GUID)),
# Version 3 additions
("pExcludeCredentialList", ctypes.POINTER(WebAuthNCredentialList)),
# Version 4 additions
("dwEnterpriseAttestation", DWORD),
("dwLargeBlobSupport", DWORD),
("bPreferResidentKey", BOOL),
# Version 5 additions
("bBrowserInPrivateMode", BOOL),
# Version 6 additions
("bEnablePrf", BOOL),
# Version 7 additions
("pLinkedDevice", ctypes.POINTER(CtapCborHybridStorageLinkedData)),
("cbJsonExt", DWORD),
("pbJsonExt", PBYTE),
# Version 8 additions
("pPRFGlobalEval", ctypes.POINTER(WebAuthNHmacSecretSalt)),
("cCredentialHints", DWORD),
("ppwszCredentialHints", ctypes.POINTER(PCWSTR)),
("bThirdPartyPayment", BOOL),
# Version 9 additions
("pwszRemoteWebOrigin", PCWSTR),
("cbPublicKeyCredentialCreationOptionsJSON", DWORD),
("pbPublicKeyCredentialCreationOptionsJSON", PBYTE),
("cbAuthenticatorId", DWORD),
("pbAuthenticatorId", PBYTE),
]
json_ext = BytesProperty("JsonExt")
public_key_credential_creation_options_json = BytesProperty(
"PublicKeyCredentialCreationOptionsJSON"
)
authenticator_id = BytesProperty("AuthenticatorId")
def __init__(
self,
timeout: int = 0,
require_resident_key: bool = False,
attachment: int = WebAuthNAuthenticatorAttachment.ANY,
uv_requirement: int = WebAuthNUserVerificationRequirement.DISCOURAGED,
attestation_convoyence: int = WebAuthNAttestationConveyancePreference.ANY,
credentials: Sequence[Mapping[str, Any]] = [],
cancellationId: GUID | None = None,
enterprise_attestation: int = WebAuthNEnterpriseAttestation.NONE,
large_blob_support: int = WebAuthNLargeBlobSupport.NONE,
prefer_resident_key: bool = False,
enable_prf: bool = False,
extensions: Sequence[WebAuthNExtension] = [],
prf_global_eval: WebAuthNHmacSecretSalt | None = None,
credential_hints: Sequence[str] | None = None,
third_party_payment: bool = False,
remote_web_origin: str | None = None,
public_key_credential_creation_options_json: bytes | None = None,
authenticator_id: bytes | None = None,
):
self.dwVersion = get_version(self.__class__.__name__)
self.dwTimeoutMilliseconds = timeout
self.bRequireResidentKey = require_resident_key
self.dwAuthenticatorAttachment = attachment
self.dwUserVerificationRequirement = uv_requirement
self.dwAttestationConveyancePreference = attestation_convoyence
if extensions:
self.Extensions = WebAuthNExtensions(extensions)
if self.dwVersion >= 2 and cancellationId:
self.pCancellationId = ctypes.pointer(cancellationId)
if self.dwVersion >= 3:
self.pExcludeCredentialList = ctypes.pointer(
WebAuthNCredentialList(credentials)
)
else:
self.CredentialList = WebAuthNCredentials(credentials)
if self.dwVersion >= 4:
self.dwEnterpriseAttestation = enterprise_attestation
self.dwLargeBlobSupport = large_blob_support
self.bPreferResidentKey = prefer_resident_key
if self.dwVersion >= 6:
self.bEnablePrf = enable_prf
if self.dwVersion >= 8:
if prf_global_eval is not None:
self.pPRFGlobalEval = ctypes.pointer(prf_global_eval)
if credential_hints:
self.cCredentialHints = len(credential_hints)
self._credential_hints_array = (PCWSTR * len(credential_hints))(
*credential_hints
)
self.ppwszCredentialHints = self._credential_hints_array
self.bThirdPartyPayment = third_party_payment
if self.dwVersion >= 9:
self.pwszRemoteWebOrigin = remote_web_origin
self.public_key_credential_creation_options_json = (
public_key_credential_creation_options_json
)
self.authenticator_id = authenticator_id
class WebAuthNCredentialAttestation(ctypes.Structure):
"""Maps to WEBAUTHN_CREDENTIAL_ATTESTATION Struct."""
_fields_ = [
("dwVersion", DWORD),
("pwszFormatType", LPCWSTR),
("cbAuthenticatorData", DWORD),
("pbAuthenticatorData", PBYTE),
("cbAttestation", DWORD),
("pbAttestation", PBYTE),
("dwAttestationDecodeType", DWORD),
("pvAttestationDecode", PBYTE),
("cbAttestationObject", DWORD),
("pbAttestationObject", PBYTE),
("cbCredentialId", DWORD),
("pbCredentialId", PBYTE),
# Version 2 additions
("Extensions", WebAuthNExtensions),
# Version 3 additions
("dwUsedTransport", DWORD),
# Version 4 additions
("bEpAtt", BOOL),
("bLargeBlobSupported", BOOL),
("bResidentKey", BOOL),
# Version 5 additions
("bPrfEnabled", BOOL),
# Version 6 additions
("cbUnsignedExtensionOutputs", DWORD),
("pbUnsignedExtensionOutputs", PBYTE),
# Version 7 additions
("pHmacSecret", ctypes.POINTER(WebAuthNHmacSecretSalt)),
("bThirdPartyPayment", BOOL),
# Version 8 additions
("dwTransports", DWORD),
("cbClientDataJSON", DWORD),
("pbClientDataJSON", PBYTE),
("cbRegistrationResponseJSON", DWORD),
("pbRegistrationResponseJSON", PBYTE),
]
auth_data = BytesProperty("AuthenticatorData")
attestation = BytesProperty("Attestation")
attestation_object = BytesProperty("AttestationObject")
credential_id = BytesProperty("CredentialId")
unsigned_extension_outputs = BytesProperty("UnsignedExtensionOutputs")
client_data_json = BytesProperty("ClientDataJSON")
registration_response_json = BytesProperty("RegistrationResponseJSON")
def __del__(self):
WEBAUTHN.WebAuthNFreeCredentialAttestation(ctypes.byref(self))
HRESULT = cast(Any, ctypes).HRESULT
WEBAUTHN = cast(Any, ctypes).WinDLL("webauthn", winmode=LOAD_LIBRARY_SEARCH_SYSTEM32)
WEBAUTHN_API_VERSION = WEBAUTHN.WebAuthNGetApiVersionNumber()
WEBAUTHN.WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable.argtypes = [
ctypes.POINTER(ctypes.c_bool)
]
WEBAUTHN.WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable.restype = HRESULT
WEBAUTHN.WebAuthNAuthenticatorMakeCredential.argtypes = [
HWND,
ctypes.POINTER(WebAuthNRpEntityInformation),
ctypes.POINTER(WebAuthNUserEntityInformation),
ctypes.POINTER(WebAuthNCoseCredentialParameters),
ctypes.POINTER(WebAuthNClientData),
ctypes.POINTER(WebAuthNMakeCredentialOptions),
ctypes.POINTER(ctypes.POINTER(WebAuthNCredentialAttestation)),
]
WEBAUTHN.WebAuthNAuthenticatorMakeCredential.restype = HRESULT
WEBAUTHN.WebAuthNAuthenticatorGetAssertion.argtypes = [
HWND,
LPCWSTR,
ctypes.POINTER(WebAuthNClientData),
ctypes.POINTER(WebAuthNGetAssertionOptions),
ctypes.POINTER(ctypes.POINTER(WebAuthNAssertion)),
]
WEBAUTHN.WebAuthNAuthenticatorGetAssertion.restype = HRESULT
WEBAUTHN.WebAuthNFreeCredentialAttestation.argtypes = [
ctypes.POINTER(WebAuthNCredentialAttestation)
]
WEBAUTHN.WebAuthNFreeAssertion.argtypes = [ctypes.POINTER(WebAuthNAssertion)]
WEBAUTHN.WebAuthNGetCancellationId.argtypes = [ctypes.POINTER(GUID)]
WEBAUTHN.WebAuthNGetCancellationId.restype = HRESULT
WEBAUTHN.WebAuthNCancelCurrentOperation.argtypes = [ctypes.POINTER(GUID)]
WEBAUTHN.WebAuthNCancelCurrentOperation.restype = HRESULT
WEBAUTHN.WebAuthNGetErrorName.argtypes = [HRESULT]
WEBAUTHN.WebAuthNGetErrorName.restype = PCWSTR
WEBAUTHN_STRUCT_VERSIONS: Mapping[int, Mapping[str, int]] = {
1: {
"WebAuthNRpEntityInformation": 1,
"WebAuthNUserEntityInformation": 1,
"WebAuthNClientData": 1,
"WebAuthNCoseCredentialParameter": 1,
"WebAuthNCredential": 1,
"WebAuthNCredentialEx": 1,
"WebAuthNMakeCredentialOptions": 3,
"WebAuthNGetAssertionOptions": 4,
"WebAuthNCommonAttestation": 1,
"WebAuthNCredentialAttestation": 3,
"WebAuthNAssertion": 1,
},
2: {},
3: {
"WebAuthNMakeCredentialOptions": 4,
"WebAuthNGetAssertionOptions": 5,
"WebAuthNCredentialAttestation": 4,
"WebAuthNAssertion": 2,
},
4: {
"WebAuthNMakeCredentialOptions": 5,
"WebAuthNGetAssertionOptions": 6,
"WebAuthNAssertion": 3,
"WebAuthNCredentialDetails": 1, # Not implemented
},
5: {
"WebAuthNCredentialDetails": 2,
},
6: {
"WebAuthNMakeCredentialOptions": 6,
"WebAuthNCredentialAttestation": 5,
"WebAuthNAssertion": 4,
},
7: {
"WebAuthNMakeCredentialOptions": 7,
"WebAuthNGetAssertionOptions": 7,
"WebAuthNCredentialAttestation": 6,
"WebAuthNAssertion": 5,
},
8: {
"WebAuthNMakeCredentialOptions": 8,
"WebAuthNCredentialDetails": 3,
"WebAuthNCredentialAttestation": 7,
"WebAuthNGetAssertionOptions": 8,
},
9: {
"WebAuthNMakeCredentialOptions": 9,
"WebAuthNGetAssertionOptions": 9,
"WebAuthNAssertion": 6,
"WebAuthNCredentialDetails": 4,
"WebAuthNCredentialAttestation": 8,
"WebAuthNAuthenticatorDetails": 1, # Not implemented
},
}
def get_version(class_name: str) -> int:
"""Get version of struct.
:param str class_name: Struct class name.
:returns: Version of Struct to use.
:rtype: int
"""
for api_version in range(WEBAUTHN_API_VERSION, 0, -1):
if (
api_version in WEBAUTHN_STRUCT_VERSIONS
and class_name in WEBAUTHN_STRUCT_VERSIONS[api_version]
):
return WEBAUTHN_STRUCT_VERSIONS[api_version][class_name]
raise ValueError("Unknown class name")
fido2-2.2.1/fido2/client/windows.py 0000644 0000000 0000000 00000047430 15220526030 013775 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import ctypes
import logging
from threading import Thread
from typing import Any, Mapping, Sequence, cast
from ..ctap2 import AssertionResponse
from ..ctap2.extensions import (
AuthenticatorExtensionsLargeBlobInputs,
AuthenticatorExtensionsLargeBlobOutputs,
AuthenticatorExtensionsPRFInputs,
AuthenticatorExtensionsPRFOutputs,
CredentialPropertiesOutput,
CredProtectExtension,
HMACGetSecretInput,
HMACGetSecretOutput,
)
from ..utils import _JsonDataObject, websafe_decode
from ..webauthn import (
AttestationConveyancePreference,
AttestationObject,
AuthenticationExtensionsClientOutputs,
AuthenticatorAttachment,
AuthenticatorAttestationResponse,
AuthenticatorData,
AuthenticatorSelectionCriteria,
PublicKeyCredentialCreationOptions,
PublicKeyCredentialRequestOptions,
PublicKeyCredentialType,
RegistrationResponse,
ResidentKeyRequirement,
_as_cbor,
)
from . import (
AssertionSelection,
ClientDataCollector,
ClientError,
WebAuthnClient,
_cbor_list,
)
from .win_api import (
BOOL,
GUID,
WEBAUTHN,
WEBAUTHN_API_VERSION,
WebAuthNAssertion,
WebAuthNAttestationConveyancePreference,
WebAuthNAuthenticatorAttachment,
WebAuthNClientData,
WebAuthNCoseCredentialParameters,
WebAuthNCredBlobExtension,
WebAuthNCredentialAttestation,
WebAuthNCredProtectExtensionIn,
WebAuthNCredWithHmacSecretSalt,
WebAuthNEnterpriseAttestation,
WebAuthNExtension,
WebAuthNGetAssertionOptions,
WebAuthNHmacSecretSalt,
WebAuthNHmacSecretSaltValues,
WebAuthNLargeBlobOperation,
WebAuthNLargeBlobSupport,
WebAuthNMakeCredentialOptions,
WebAuthNRpEntityInformation,
WebAuthNUserEntityInformation,
WebAuthNUserVerification,
WebAuthNUserVerificationRequirement,
)
logger = logging.getLogger(__name__)
LOAD_LIBRARY_SEARCH_SYSTEM32 = 0x00000800
user32 = cast(Any, ctypes).WinDLL("user32", winmode=LOAD_LIBRARY_SEARCH_SYSTEM32)
_extension_output_types: dict[str, type[_JsonDataObject]] = {
"hmacGetSecret": HMACGetSecretOutput,
"prf": AuthenticatorExtensionsPRFOutputs,
"largeBlob": AuthenticatorExtensionsLargeBlobOutputs,
"credProps": CredentialPropertiesOutput,
}
def _wrap_ext(key, value):
if key in _extension_output_types:
return _extension_output_types[key].from_dict(value)
return value
class CancelThread(Thread):
def __init__(self, event):
super().__init__()
self.daemon = True
self._completed = False
self.event = event
self.guid = GUID()
WEBAUTHN.WebAuthNGetCancellationId(ctypes.byref(self.guid))
def run(self):
self.event.wait()
if not self._completed:
WEBAUTHN.WebAuthNCancelCurrentOperation(ctypes.byref(self.guid))
def complete(self):
self._completed = True
self.event.set()
self.join()
class WindowsClient(WebAuthnClient):
"""Fido2Client-like class using the Windows WebAuthn API.
Note: This class only works on Windows 10 19H1 or later. This is also when Windows
started restricting access to FIDO devices, causing the standard client classes to
require admin priveleges to run (unlike this one).
:param str origin: The origin to use.
:param verify: Function to verify an RP ID for a given origin.
:param ctypes.wintypes.HWND handle: (optional) Window reference to use.
"""
def __init__(
self,
client_data_collector: ClientDataCollector,
handle=None,
allow_hmac_secret=False,
):
self.handle = handle or user32.GetForegroundWindow()
self._client_data_collector = client_data_collector
self._allow_hmac_secret = allow_hmac_secret
# TODO: Decide how to configure this list.
self._enterprise_rpid_list: Sequence[str] | None = None
@staticmethod
def is_available() -> bool:
return WEBAUTHN_API_VERSION > 0
def make_credential(self, options, event=None):
"""Create a credential using Windows WebAuthN APIs.
:param options: PublicKeyCredentialCreationOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
options = PublicKeyCredentialCreationOptions.from_dict(options)
# Gather client data, RP ID from client
client_data, rp_id = self._client_data_collector.collect_client_data(options)
logger.debug(f"Register a new credential for RP ID: {rp_id}")
selection = options.authenticator_selection or AuthenticatorSelectionCriteria()
resident_key = selection.resident_key or ResidentKeyRequirement.DISCOURAGED
enterprise_attestation = WebAuthNEnterpriseAttestation.NONE
if options.attestation == AttestationConveyancePreference.ENTERPRISE:
attestation = WebAuthNAttestationConveyancePreference.ANY
if self._enterprise_rpid_list is not None:
# Platform facilitated
if options.rp.id in self._enterprise_rpid_list:
enterprise_attestation = (
WebAuthNEnterpriseAttestation.PLATFORM_MANAGED
)
else:
# Vendor facilitated
enterprise_attestation = (
WebAuthNEnterpriseAttestation.VENDOR_FACILITATED
)
else:
attestation = WebAuthNAttestationConveyancePreference.from_string(
options.attestation or "none"
)
win_extensions = []
large_blob_support = WebAuthNLargeBlobSupport.NONE
enable_prf = False
hmac_salts = None
if options.extensions:
if "credentialProtectionPolicy" in options.extensions:
win_extensions.append(
WebAuthNExtension(
"credProtect",
WebAuthNCredProtectExtensionIn(
WebAuthNUserVerification(
CredProtectExtension.POLICY.str2int(
options.extensions["credentialProtectionPolicy"]
)
),
options.extensions.get(
"enforceCredentialProtectionPolicy", False
),
),
)
)
if "credBlob" in options.extensions:
win_extensions.append(
WebAuthNExtension(
"credBlob",
WebAuthNCredBlobExtension(options.extensions["credBlob"]),
)
)
if "largeBlob" in options.extensions:
large_blob_support = WebAuthNLargeBlobSupport.from_string(
options.extensions["largeBlob"].get("support", "none")
)
if options.extensions.get("minPinLength", True):
win_extensions.append(WebAuthNExtension("minPinLength", BOOL(True)))
prf = AuthenticatorExtensionsPRFInputs.from_dict(
cast(Mapping | None, options.extensions.get("prf"))
)
if prf:
enable_prf = True
win_extensions.append(WebAuthNExtension("hmac-secret", BOOL(True)))
if prf.eval:
hmac_salts = WebAuthNHmacSecretSalt(prf.eval.first, prf.eval.second)
elif "hmacCreateSecret" in options.extensions and self._allow_hmac_secret:
win_extensions.append(WebAuthNExtension("hmac-secret", BOOL(True)))
hmac_get_secret = HMACGetSecretInput.from_dict(
cast(Mapping | None, options.extensions.get("hmacGetSecret"))
)
if hmac_get_secret:
hmac_salts = WebAuthNHmacSecretSalt(
hmac_get_secret.salt1, hmac_get_secret.salt2
)
if event:
timer = CancelThread(event)
timer.start()
else:
timer = None
attestation_pointer = ctypes.POINTER(WebAuthNCredentialAttestation)()
try:
WEBAUTHN.WebAuthNAuthenticatorMakeCredential(
self.handle,
ctypes.byref(WebAuthNRpEntityInformation(_as_cbor(options.rp))),
ctypes.byref(WebAuthNUserEntityInformation(_as_cbor(options.user))),
ctypes.byref(
WebAuthNCoseCredentialParameters(
_cbor_list(options.pub_key_cred_params)
)
),
ctypes.byref(WebAuthNClientData(client_data)),
ctypes.byref(
WebAuthNMakeCredentialOptions(
options.timeout or 0,
resident_key == ResidentKeyRequirement.REQUIRED,
WebAuthNAuthenticatorAttachment.from_string(
selection.authenticator_attachment or "any"
),
WebAuthNUserVerificationRequirement.from_string(
selection.user_verification or "discouraged"
),
attestation,
_cbor_list(options.exclude_credentials) or [],
timer.guid if timer else None,
enterprise_attestation,
large_blob_support,
resident_key == ResidentKeyRequirement.PREFERRED,
enable_prf,
win_extensions,
hmac_salts,
options.hints,
)
),
ctypes.byref(attestation_pointer),
)
except OSError as e:
raise ClientError.ERR.OTHER_ERROR(e)
if timer:
# TODO: Avoid setting event?
timer.complete()
obj = attestation_pointer.contents
att_obj = AttestationObject(obj.attestation_object)
extension_outputs: dict[str, Any] = {}
if options.extensions:
extensions_out = att_obj.auth_data.extensions or {}
if obj.dwVersion >= 4 and options.extensions.get("credProps"):
extension_outputs["credProps"] = {"rk": bool(obj.bResidentKey)}
if "hmac-secret" in extensions_out:
if obj.dwVersion >= 7 and obj.pHmacSecret:
secret = obj.pHmacSecret.contents
secrets = (secret.first, secret.second)
else:
secrets = None
if enable_prf:
extension_outputs["prf"] = {
"enabled": extensions_out["hmac-secret"]
}
if secrets:
results = {"first": secrets[0]}
if secrets[1]:
results["second"] = secrets[1]
extension_outputs["prf"]["results"] = results
else:
extension_outputs["hmacCreateSecret"] = extensions_out[
"hmac-secret"
]
if secrets:
results = {"output1": secrets[0]}
if secrets[1]:
results["output2"] = secrets[1]
extension_outputs["hmacGetSecret"] = results
if obj.dwVersion >= 4 and "largeBlob" in options.extensions:
extension_outputs["largeBlob"] = {
"supported": bool(obj.bLargeBlobSupported)
}
logger.info("New credential registered")
credential = att_obj.auth_data.credential_data
assert credential is not None # noqa: S101
return RegistrationResponse(
raw_id=credential.credential_id,
response=AuthenticatorAttestationResponse(
client_data=client_data, attestation_object=att_obj
),
authenticator_attachment=AuthenticatorAttachment.CROSS_PLATFORM,
client_extension_results=AuthenticationExtensionsClientOutputs(
{k: _wrap_ext(k, v) for k, v in extension_outputs.items()}
),
type=PublicKeyCredentialType.PUBLIC_KEY,
)
def get_assertion(self, options, event=None):
"""Get assertion using Windows WebAuthN APIs.
:param options: PublicKeyCredentialRequestOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
options = PublicKeyCredentialRequestOptions.from_dict(options)
# Gather client data, RP ID from client
client_data, rp_id = self._client_data_collector.collect_client_data(options)
logger.debug(f"Assert a credential for RP ID: {rp_id}")
attachment = WebAuthNAuthenticatorAttachment.ANY
for hint in options.hints or []:
match hint:
case "security-key":
attachment = WebAuthNAuthenticatorAttachment.CROSS_PLATFORM
case "client-device":
attachment = WebAuthNAuthenticatorAttachment.PLATFORM
case _:
continue
break
flags = 0
large_blob = None
large_blob_operation = WebAuthNLargeBlobOperation.NONE
hmac_secret_salts = None
win_extensions = []
u2f_appid = None
u2f_appid_used = BOOL(False)
if options.extensions:
if options.extensions.get("appid"):
u2f_appid = options.extensions["appid"]
if options.extensions.get("getCredBlob"):
win_extensions.append(WebAuthNExtension("credBlob", BOOL(True)))
lg_blob = AuthenticatorExtensionsLargeBlobInputs.from_dict(
cast(Mapping | None, options.extensions.get("largeBlob"))
)
if lg_blob:
if lg_blob.read:
large_blob_operation = WebAuthNLargeBlobOperation.GET
else:
large_blob = lg_blob.write
large_blob_operation = WebAuthNLargeBlobOperation.SET
prf = AuthenticatorExtensionsPRFInputs.from_dict(
cast(Mapping | None, options.extensions.get("prf"))
)
if prf:
cred_salts = prf.eval_by_credential or {}
hmac_secret_salts = WebAuthNHmacSecretSaltValues(
(
WebAuthNHmacSecretSalt(prf.eval.first, prf.eval.second)
if prf.eval
else None
),
[
WebAuthNCredWithHmacSecretSalt(
websafe_decode(cred_id),
WebAuthNHmacSecretSalt(salts.first, salts.second),
)
for cred_id, salts in cred_salts.items()
],
)
elif "hmacGetSecret" in options.extensions and self._allow_hmac_secret:
flags |= 0x00100000
salts = HMACGetSecretInput.from_dict(
cast(Mapping, options.extensions["hmacGetSecret"])
)
hmac_secret_salts = WebAuthNHmacSecretSaltValues(
WebAuthNHmacSecretSalt(salts.salt1, salts.salt2)
)
if event:
timer = CancelThread(event)
timer.start()
else:
timer = None
assertion_pointer = ctypes.POINTER(WebAuthNAssertion)()
try:
WEBAUTHN.WebAuthNAuthenticatorGetAssertion(
self.handle,
options.rp_id,
ctypes.byref(WebAuthNClientData(client_data)),
ctypes.byref(
WebAuthNGetAssertionOptions(
options.timeout or 0,
attachment,
WebAuthNUserVerificationRequirement.from_string(
options.user_verification or "discouraged"
),
_cbor_list(options.allow_credentials) or [],
timer.guid if timer else None,
large_blob_operation,
large_blob,
hmac_secret_salts,
win_extensions,
flags,
u2f_appid,
u2f_appid_used,
options.hints,
)
),
ctypes.byref(assertion_pointer),
)
except OSError as e:
raise ClientError.ERR.OTHER_ERROR(e)
if timer:
# TODO: Avoid setting event?
timer.complete()
obj = assertion_pointer.contents
auth_data = AuthenticatorData(obj.auth_data)
extension_outputs: dict[str, Any] = {}
if obj.dwVersion >= 2 and u2f_appid:
extension_outputs["appid"] = bool(u2f_appid_used.value)
if options.extensions:
if obj.dwVersion >= 3 and obj.pHmacSecret:
secret = obj.pHmacSecret.contents
if "prf" in options.extensions:
result = {"first": secret.first}
if secret.second:
result["second"] = secret.second
extension_outputs["prf"] = {"results": result}
else:
result = {"output1": secret.first}
if secret.second:
result["output2"] = secret.second
extension_outputs["hmacGetSecret"] = result
if obj.dwVersion >= 2 and obj.dwCredLargeBlobStatus != 0:
if options.extensions["largeBlob"].get("read", False):
extension_outputs["largeBlob"] = {"blob": obj.cred_large_blob}
else:
extension_outputs["largeBlob"] = {
"written": obj.dwCredLargeBlobStatus == 1
}
credential = {
"type": obj.Credential.pwszCredentialType,
"id": obj.Credential.id,
}
return AssertionSelection(
client_data,
[
AssertionResponse(
credential=credential,
auth_data=auth_data,
signature=obj.signature,
user={"id": obj.user_id} if obj.user_id else None,
)
],
{k: _wrap_ext(k, v) for k, v in extension_outputs.items()},
)
fido2-2.2.1/fido2/cose.py 0000644 0000000 0000000 00000041574 15220526030 011761 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
from typing import TYPE_CHECKING, Any, Mapping, Sequence, Tuple, TypeVar
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec, ed448, ed25519, padding, rsa
from . import arkg
from .utils import bytes2int, int2bytes
if TYPE_CHECKING:
# This type isn't available on cryptography <40.
from cryptography.hazmat.primitives.asymmetric.types import PublicKeyTypes
_backend = default_backend()
_mldsa = hasattr(_backend, "mldsa_supported") and _backend.mldsa_supported()
class CoseKey(dict):
"""A COSE formatted public key.
:param _: The COSE key paramters.
:cvar ALGORITHM: COSE algorithm identifier.
"""
ALGORITHM: int = None # type: ignore
def verify(self, message: bytes, signature: bytes) -> None:
"""Validates a digital signature over a given message.
:param message: The message which was signed.
:param signature: The signature to check.
"""
raise NotImplementedError("Signature verification not supported.")
@classmethod
def from_cryptography_key(
cls: type[T_CoseKey], public_key: PublicKeyTypes
) -> T_CoseKey:
"""Converts a PublicKey object from Cryptography into a COSE key.
:param public_key: Either an EC or RSA public key.
:return: A CoseKey.
"""
raise NotImplementedError("Creation from cryptography not supported.")
@staticmethod
def for_alg(alg: int) -> type[CoseKey]:
"""Get a subclass of CoseKey corresponding to an algorithm identifier.
:param alg: The COSE identifier of the algorithm.
:return: A CoseKey.
"""
def find_subclass(base_cls: type[CoseKey]) -> type[CoseKey] | None:
for cls in base_cls.__subclasses__():
if cls.ALGORITHM == alg:
return cls
subresult = find_subclass(cls)
if subresult:
return subresult
return None
return find_subclass(CoseKey) or UnsupportedKey
@staticmethod
def for_name(name: str) -> type[CoseKey]:
"""Get a subclass of CoseKey corresponding to an algorithm identifier.
:param alg: The COSE identifier of the algorithm.
:return: A CoseKey.
"""
def find_subclass(base_cls: type[CoseKey]) -> type[CoseKey] | None:
for cls in base_cls.__subclasses__():
if cls.__name__ == name:
return cls
subresult = find_subclass(cls)
if subresult:
return subresult
return None
return find_subclass(CoseKey) or UnsupportedKey
@staticmethod
def parse(cose: Mapping[int, Any]) -> CoseKey:
"""Create a CoseKey from a dict"""
alg = cose.get(3)
if not alg:
raise ValueError("COSE alg identifier must be provided.")
return CoseKey.for_alg(alg)(cose)
@staticmethod
def supported_algorithms() -> Sequence[int]:
"""Get a list of all supported algorithm identifiers"""
algs: list[type[CoseKey]] = [
ES256,
EdDSA,
ES384,
ES512,
PS256,
RS256,
ES256K,
]
if _mldsa:
algs.extend([MLDSA44, MLDSA65, MLDSA87])
return [cls.ALGORITHM for cls in algs]
T_CoseKey = TypeVar("T_CoseKey", bound=CoseKey)
class UnsupportedKey(CoseKey):
"""A COSE key with an unsupported algorithm."""
class ES256(CoseKey):
ALGORITHM = -7
_HASH_ALG = hashes.SHA256()
def verify(self, message, signature):
if self[-1] != 1:
raise ValueError("Unsupported elliptic curve")
ec.EllipticCurvePublicNumbers(
bytes2int(self[-2]), bytes2int(self[-3]), ec.SECP256R1()
).public_key(_backend).verify(signature, message, ec.ECDSA(self._HASH_ALG))
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, ec.EllipticCurvePublicKey) # noqa: S101
pn = public_key.public_numbers()
return cls(
{
1: 2,
3: cls.ALGORITHM,
-1: 1,
-2: int2bytes(pn.x, 32),
-3: int2bytes(pn.y, 32),
}
)
@classmethod
def from_ctap1(cls, data):
"""Creates an ES256 key from a CTAP1 formatted public key byte string.
:param data: A 65 byte SECP256R1 public key.
:return: A ES256 key.
"""
return cls({1: 2, 3: cls.ALGORITHM, -1: 1, -2: data[1:33], -3: data[33:65]})
class ESP256(ES256):
# See: https://www.ietf.org/archive/id/draft-ietf-jose-fully-specified-algorithms-10.html#name-elliptic-curve-digital-sign # noqa:E501
ALGORITHM = -9
class ES384(CoseKey):
ALGORITHM = -35
_HASH_ALG = hashes.SHA384()
def verify(self, message, signature):
if self[-1] != 2:
raise ValueError("Unsupported elliptic curve")
ec.EllipticCurvePublicNumbers(
bytes2int(self[-2]), bytes2int(self[-3]), ec.SECP384R1()
).public_key(_backend).verify(signature, message, ec.ECDSA(self._HASH_ALG))
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, ec.EllipticCurvePublicKey) # noqa: S101
pn = public_key.public_numbers()
return cls(
{
1: 2,
3: cls.ALGORITHM,
-1: 2,
-2: int2bytes(pn.x, 48),
-3: int2bytes(pn.y, 48),
}
)
class ESP384(ES384):
# See: https://www.ietf.org/archive/id/draft-ietf-jose-fully-specified-algorithms-12.html#name-elliptic-curve-digital-sign # noqa:E501
ALGORITHM = -51
class ES512(CoseKey):
ALGORITHM = -36
_HASH_ALG = hashes.SHA512()
def verify(self, message, signature):
if self[-1] != 3:
raise ValueError("Unsupported elliptic curve")
ec.EllipticCurvePublicNumbers(
bytes2int(self[-2]), bytes2int(self[-3]), ec.SECP521R1()
).public_key(_backend).verify(signature, message, ec.ECDSA(self._HASH_ALG))
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, ec.EllipticCurvePublicKey) # noqa: S101
pn = public_key.public_numbers()
return cls(
{
1: 2,
3: cls.ALGORITHM,
-1: 3,
-2: int2bytes(pn.x, 66),
-3: int2bytes(pn.y, 66),
}
)
class ESP512(ES512):
# See: https://www.ietf.org/archive/id/draft-ietf-jose-fully-specified-algorithms-12.html#name-elliptic-curve-digital-sign # noqa:E501
ALGORITHM = -52
class RS256(CoseKey):
ALGORITHM = -257
_HASH_ALG = hashes.SHA256()
def verify(self, message, signature):
rsa.RSAPublicNumbers(bytes2int(self[-2]), bytes2int(self[-1])).public_key(
_backend
).verify(signature, message, padding.PKCS1v15(), self._HASH_ALG)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, rsa.RSAPublicKey) # noqa: S101
pn = public_key.public_numbers()
return cls({1: 3, 3: cls.ALGORITHM, -1: int2bytes(pn.n), -2: int2bytes(pn.e)})
class PS256(CoseKey):
ALGORITHM = -37
_HASH_ALG = hashes.SHA256()
def verify(self, message, signature):
rsa.RSAPublicNumbers(bytes2int(self[-2]), bytes2int(self[-1])).public_key(
_backend
).verify(
signature,
message,
padding.PSS(
mgf=padding.MGF1(self._HASH_ALG), salt_length=padding.PSS.MAX_LENGTH
),
self._HASH_ALG,
)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, rsa.RSAPublicKey) # noqa: S101
pn = public_key.public_numbers()
return cls({1: 3, 3: cls.ALGORITHM, -1: int2bytes(pn.n), -2: int2bytes(pn.e)})
class EdDSA(CoseKey):
ALGORITHM = -8
def verify(self, message, signature):
if self[-1] != 6:
raise ValueError("Unsupported elliptic curve")
ed25519.Ed25519PublicKey.from_public_bytes(self[-2]).verify(signature, message)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, ed25519.Ed25519PublicKey) # noqa: S101
return cls(
{
1: 1,
3: cls.ALGORITHM,
-1: 6,
-2: public_key.public_bytes(
serialization.Encoding.Raw, serialization.PublicFormat.Raw
),
}
)
class Ed25519(EdDSA):
# See: https://www.ietf.org/archive/id/draft-ietf-jose-fully-specified-algorithms-12.html#name-edwards-curve-digital-signa # noqa:E501
ALGORITHM = -19
class Ed448(CoseKey):
# See: https://www.ietf.org/archive/id/draft-ietf-jose-fully-specified-algorithms-12.html#name-edwards-curve-digital-signa # noqa:E501
ALGORITHM = -53
def verify(self, message, signature):
if self[-1] != 7:
raise ValueError("Unsupported elliptic curve")
ed448.Ed448PublicKey.from_public_bytes(self[-2]).verify(signature, message)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, ed448.Ed448PublicKey) # noqa: S101
return cls(
{
1: 1,
3: cls.ALGORITHM,
-1: 7,
-2: public_key.public_bytes(
serialization.Encoding.Raw, serialization.PublicFormat.Raw
),
}
)
class RS1(CoseKey):
ALGORITHM = -65535
_HASH_ALG = hashes.SHA1() # noqa: S303
def verify(self, message, signature):
rsa.RSAPublicNumbers(bytes2int(self[-2]), bytes2int(self[-1])).public_key(
_backend
).verify(signature, message, padding.PKCS1v15(), self._HASH_ALG)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, rsa.RSAPublicKey) # noqa: S101
pn = public_key.public_numbers()
return cls({1: 3, 3: cls.ALGORITHM, -1: int2bytes(pn.n), -2: int2bytes(pn.e)})
class ES256K(CoseKey):
ALGORITHM = -47
_HASH_ALG = hashes.SHA256()
def verify(self, message, signature):
if self[-1] != 8:
raise ValueError("Unsupported elliptic curve")
ec.EllipticCurvePublicNumbers(
bytes2int(self[-2]), bytes2int(self[-3]), ec.SECP256K1()
).public_key(_backend).verify(signature, message, ec.ECDSA(self._HASH_ALG))
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, ec.EllipticCurvePublicKey) # noqa: S101
pn = public_key.public_numbers()
return cls(
{
1: 2,
3: cls.ALGORITHM,
-1: 8,
-2: int2bytes(pn.x, 32),
-3: int2bytes(pn.y, 32),
}
)
def _cose2key(cose: CoseKey, curve: ec.EllipticCurve) -> ec.EllipticCurvePublicKey:
return ec.EllipticCurvePublicNumbers(
bytes2int(cose[-2]), bytes2int(cose[-3]), curve
).public_key()
# ESP256-split using private key derived by ARKG-P256
# https://www.ietf.org/archive/id/draft-bradleylundberg-cfrg-arkg-10.html#section-8.3
ESP256_SPLIT_ARKG_PLACEHOLDER = -65539 # placeholder value
class ARKG_P256_PLACEHOLDER(CoseKey):
"""
https://www.ietf.org/archive/id/draft-bradleylundberg-cfrg-arkg-10.html#ARKG-P256
The identifier ARKG-P256 represents the following ARKG instance:
BL: Elliptic curve addition as described in Section 3.1 with the parameters:
crv: The NIST curve secp256r1 [SEC2].
hash-to-crv-suite: P256_XMD:SHA-256_SSWU_RO_ [RFC9380].
DST_ext: 'ARKG-P256'.
KEM: ECDH as described in Section 3.3 with the parameters:
crv: The NIST curve secp256r1 [SEC2].
Hash: SHA-256 [FIPS 180-4].
hash-to-crv-suite: P256_XMD:SHA-256_SSWU_RO_ [RFC9380].
DST_ext: 'ARKG-P256'.
"""
ALGORITHM = -65700 # placeholder value
_CRV = ec.SECP256R1()
_ARKG = arkg._ARKG(
bl=arkg._BL(crv=_CRV, Hash=hashes.SHA256(), DST_ext=b"ARKG-P256"),
kem=arkg._KEM(crv=_CRV, Hash=hashes.SHA256(), DST_ext=b"ARKG-ECDH.ARKG-P256"),
)
@property
def pk_bl(self) -> CoseKey:
return CoseKey.parse(self[-1])
@property
def pk_kem(self) -> CoseKey:
return CoseKey.parse(self[-2])
def derive_public_key(self, ikm: bytes, ctx: bytes) -> Tuple[CoseKey, Mapping]:
pk, kh = self._ARKG.derive_public_key(
_cose2key(self.pk_bl, self._CRV),
_cose2key(self.pk_kem, self._CRV),
ikm,
ctx,
)
point_enc = pk.public_bytes(
serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint
)
ln = (len(point_enc) - 1) // 2
pk_cose = ESP256(
{
1: 2, # kty: EC
3: self[-3], # alg: derived key alg (key -3) from seed (value -9)
-1: 1,
-2: point_enc[1 : ln + 1], # x-coordinate
-3: point_enc[1 + ln :], # y-coordinate
}
)
# COSE_Sign_Args: https://www.ietf.org/archive/id/draft-bradleylundberg-cfrg-arkg-10.html#name-cose-signing-arguments
args = {
3: ESP256_SPLIT_ARKG_PLACEHOLDER,
-1: kh,
-2: ctx,
}
return pk_cose, args
# MLDSA support was added in cryptography 47.0.0, and requires a supported backend
if _mldsa:
from cryptography.hazmat.primitives.asymmetric import mldsa
class MLDSA44(CoseKey):
ALGORITHM = -48
def verify(self, message, signature):
if self[1] != 7:
raise ValueError("Invalid key type")
pk = mldsa.MLDSA44PublicKey.from_public_bytes(self[-1])
pk.verify(signature, message)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, mldsa.MLDSA44PublicKey) # noqa: S101
return cls(
{
1: 7,
3: cls.ALGORITHM,
-1: public_key.public_bytes_raw(),
}
)
class MLDSA65(CoseKey):
ALGORITHM = -49
def verify(self, message, signature):
if self[1] != 7:
raise ValueError("Invalid key type")
pk = mldsa.MLDSA65PublicKey.from_public_bytes(self[-1])
pk.verify(signature, message)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, mldsa.MLDSA65PublicKey) # noqa: S101
return cls(
{
1: 7,
3: cls.ALGORITHM,
-1: public_key.public_bytes_raw(),
}
)
class MLDSA87(CoseKey):
ALGORITHM = -50
def verify(self, message, signature):
if self[1] != 7:
raise ValueError("Invalid key type")
pk = mldsa.MLDSA87PublicKey.from_public_bytes(self[-1])
pk.verify(signature, message)
@classmethod
def from_cryptography_key(cls, public_key):
assert isinstance(public_key, mldsa.MLDSA87PublicKey) # noqa: S101
return cls(
{
1: 7,
3: cls.ALGORITHM,
-1: public_key.public_bytes_raw(),
}
)
fido2-2.2.1/fido2/ctap.py 0000644 0000000 0000000 00000013357 15220526030 011755 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import abc
from enum import IntEnum, unique
from threading import Event
from typing import Callable, Iterator, cast
@unique
class STATUS(IntEnum):
"""Status code for CTAP keep-alive message."""
PROCESSING = 1
UPNEEDED = 2
class CtapDevice(abc.ABC):
"""
CTAP-capable device.
Subclasses of this should implement :func:`call`, as well as :func:`list_devices`,
which should return a generator over discoverable devices.
"""
@property
@abc.abstractmethod
def capabilities(self) -> int:
"""Get device capabilities"""
@abc.abstractmethod
def call(
self,
cmd: int,
data: bytes = b"",
event: Event | None = None,
on_keepalive: Callable[[STATUS], None] | None = None,
) -> bytes:
"""Sends a command to the authenticator, and reads the response.
:param cmd: The integer value of the command.
:param data: The payload of the command.
:param event: An optional threading.Event which can be used to cancel
the invocation.
:param on_keepalive: An optional callback to handle keep-alive messages
from the authenticator. The function is only called once for
consecutive keep-alive messages with the same status.
:return: The response from the authenticator.
"""
def close(self) -> None:
"""Close the device, releasing any held resources."""
def __enter__(self):
return self
def __exit__(self, typ, value, traceback):
self.close()
@classmethod
@abc.abstractmethod
def list_devices(cls) -> Iterator[CtapDevice]:
"""Generates instances of cls for discoverable devices."""
class CtapError(Exception):
"""Error returned from the Authenticator when a command fails."""
class UNKNOWN_ERR(int):
"""CTAP error status code that is not recognized."""
name = "UNKNOWN_ERR"
@property
def value(self) -> int:
return int(self)
def __repr__(self):
return "" % self
def __str__(self):
return f"0x{self:02X} - UNKNOWN"
@unique
class ERR(IntEnum):
"""CTAP status codes.
https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#error-responses
"""
SUCCESS = 0x00
INVALID_COMMAND = 0x01
INVALID_PARAMETER = 0x02
INVALID_LENGTH = 0x03
INVALID_SEQ = 0x04
TIMEOUT = 0x05
CHANNEL_BUSY = 0x06
LOCK_REQUIRED = 0x0A
INVALID_CHANNEL = 0x0B
CBOR_UNEXPECTED_TYPE = 0x11
INVALID_CBOR = 0x12
MISSING_PARAMETER = 0x14
LIMIT_EXCEEDED = 0x15
# UNSUPPORTED_EXTENSION = 0x16 # No longer in spec
FP_DATABASE_FULL = 0x17
LARGE_BLOB_STORAGE_FULL = 0x18
CREDENTIAL_EXCLUDED = 0x19
PROCESSING = 0x21
INVALID_CREDENTIAL = 0x22
USER_ACTION_PENDING = 0x23
OPERATION_PENDING = 0x24
NO_OPERATIONS = 0x25
UNSUPPORTED_ALGORITHM = 0x26
OPERATION_DENIED = 0x27
KEY_STORE_FULL = 0x28
# NOT_BUSY = 0x29 # No longer in spec
# NO_OPERATION_PENDING = 0x2A # No longer in spec
UNSUPPORTED_OPTION = 0x2B
INVALID_OPTION = 0x2C
KEEPALIVE_CANCEL = 0x2D
NO_CREDENTIALS = 0x2E
USER_ACTION_TIMEOUT = 0x2F
NOT_ALLOWED = 0x30
PIN_INVALID = 0x31
PIN_BLOCKED = 0x32
PIN_AUTH_INVALID = 0x33
PIN_AUTH_BLOCKED = 0x34
PIN_NOT_SET = 0x35
PUAT_REQUIRED = 0x36
PIN_POLICY_VIOLATION = 0x37
PIN_TOKEN_EXPIRED = 0x38
REQUEST_TOO_LARGE = 0x39
ACTION_TIMEOUT = 0x3A
UP_REQUIRED = 0x3B
UV_BLOCKED = 0x3C
INTEGRITY_FAILURE = 0x3D
INVALID_SUBCOMMAND = 0x3E
UV_INVALID = 0x3F
UNAUTHORIZED_PERMISSION = 0x40
OTHER = 0x7F
SPEC_LAST = 0xDF
EXTENSION_FIRST = 0xE0
EXTENSION_LAST = 0xEF
VENDOR_FIRST = 0xF0
VENDOR_LAST = 0xFF
def __str__(self):
return f"0x{self.value:02X} - {self.name}"
def __init__(self, code: int):
try:
self.code = CtapError.ERR(code)
except ValueError:
self.code = cast(CtapError.ERR, CtapError.UNKNOWN_ERR(code))
super().__init__(f"CTAP error: {self.code}")
fido2-2.2.1/fido2/ctap1.py 0000644 0000000 0000000 00000021736 15220526030 012036 0 ustar 00 # Copyright (c) 2013 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import struct
from dataclasses import dataclass
from enum import IntEnum, unique
from .attestation import FidoU2FAttestation
from .cose import ES256
from .ctap import CtapDevice
from .hid import CTAPHID
from .utils import ByteBuffer, bytes2int, websafe_decode, websafe_encode
@unique
class APDU(IntEnum):
"""APDU response codes."""
OK = 0x9000
USE_NOT_SATISFIED = 0x6985
WRONG_DATA = 0x6A80
class ApduError(Exception):
"""An Exception thrown when a response APDU doesn't have an OK (0x9000)
status.
:param code: APDU response code.
:param data: APDU response body.
"""
def __init__(self, code: int, data: bytes = b""):
self.code = code
self.data = data
def __repr__(self):
return f"APDU error: 0x{self.code:04X} {len(self.data):d} bytes of data"
@dataclass(init=False)
class RegistrationData(bytes):
"""Binary response data for a CTAP1 registration.
:param _: The binary contents of the response data.
:ivar public_key: Binary representation of the credential public key.
:ivar key_handle: Binary key handle of the credential.
:ivar certificate: Attestation certificate of the authenticator, DER
encoded.
:ivar signature: Attestation signature.
"""
public_key: bytes
key_handle: bytes
certificate: bytes
signature: bytes
def __init__(self, _: bytes):
super().__init__()
reader = ByteBuffer(self)
if reader.unpack("B") != 0x05:
raise ValueError("Reserved byte != 0x05")
self.public_key = reader.read(65)
self.key_handle = reader.read(reader.unpack("B"))
cert_buf = reader.read(2) # Tag and first length byte
cert_len = cert_buf[1]
if cert_len > 0x80: # Multi-byte length
n_bytes = cert_len - 0x80
len_bytes = reader.read(n_bytes)
cert_buf += len_bytes
cert_len = bytes2int(len_bytes)
self.certificate = cert_buf + reader.read(cert_len)
self.signature = reader.read()
@property
def b64(self) -> str:
"""Websafe base64 encoded string of the RegistrationData."""
return websafe_encode(self)
def verify(self, app_param: bytes, client_param: bytes) -> None:
"""Verify the included signature with regard to the given app and client
params.
:param app_param: SHA256 hash of the app ID used for the request.
:param client_param: SHA256 hash of the ClientData used for the request.
"""
FidoU2FAttestation.verify_signature(
app_param,
client_param,
self.key_handle,
self.public_key,
self.certificate,
self.signature,
)
@classmethod
def from_b64(cls, data: str) -> RegistrationData:
"""Parse a RegistrationData from a websafe base64 encoded string.
:param data: Websafe base64 encoded string.
:return: The decoded and parsed RegistrationData.
"""
return cls(websafe_decode(data))
@dataclass(init=False)
class SignatureData(bytes):
"""Binary response data for a CTAP1 authentication.
:param _: The binary contents of the response data.
:ivar user_presence: User presence byte.
:ivar counter: Signature counter.
:ivar signature: Cryptographic signature.
"""
user_presence: int
counter: int
signature: bytes
def __init__(self, _: bytes):
super().__init__()
reader = ByteBuffer(self)
self.user_presence = reader.unpack("B")
self.counter = reader.unpack(">I")
self.signature = reader.read()
@property
def b64(self) -> str:
"""str: Websafe base64 encoded string of the SignatureData."""
return websafe_encode(self)
def verify(self, app_param: bytes, client_param: bytes, public_key: bytes) -> None:
"""Verify the included signature with regard to the given app and client
params, using the given public key.
:param app_param: SHA256 hash of the app ID used for the request.
:param client_param: SHA256 hash of the ClientData used for the request.
:param public_key: Binary representation of the credential public key.
"""
m = app_param + self[:5] + client_param
ES256.from_ctap1(public_key).verify(m, self.signature)
@classmethod
def from_b64(cls, data: str) -> SignatureData:
"""Parse a SignatureData from a websafe base64 encoded string.
:param data: Websafe base64 encoded string.
:return: The decoded and parsed SignatureData.
"""
return cls(websafe_decode(data))
class Ctap1:
"""Implementation of the CTAP1 specification.
:param device: A CtapHidDevice handle supporting CTAP1.
"""
@unique
class INS(IntEnum):
REGISTER = 0x01
AUTHENTICATE = 0x02
VERSION = 0x03
def __init__(self, device: CtapDevice):
self.device = device
def send_apdu(
self, cla: int = 0, ins: int = 0, p1: int = 0, p2: int = 0, data: bytes = b""
) -> bytes:
"""Packs and sends an APDU for use in CTAP1 commands.
This is a low-level method mainly used internally. Avoid calling it
directly if possible, and use the get_version, register, and
authenticate methods if possible instead.
:param cla: The CLA parameter of the request.
:param ins: The INS parameter of the request.
:param p1: The P1 parameter of the request.
:param p2: The P2 parameter of the request.
:param data: The body of the request.
:return: The response APDU data of a successful request.
:raise: ApduError
"""
apdu = struct.pack(">BBBBBH", cla, ins, p1, p2, 0, len(data)) + data + b"\0\0"
response = self.device.call(CTAPHID.MSG, apdu)
status = struct.unpack(">H", response[-2:])[0]
data = response[:-2]
if status != APDU.OK:
raise ApduError(status, data)
return data
def get_version(self) -> str:
"""Get the U2F version implemented by the authenticator.
The only version specified is "U2F_V2".
:return: A U2F version string.
"""
return self.send_apdu(ins=Ctap1.INS.VERSION).decode()
def register(self, client_param: bytes, app_param: bytes) -> RegistrationData:
"""Register a new U2F credential.
:param client_param: SHA256 hash of the ClientData used for the request.
:param app_param: SHA256 hash of the app ID used for the request.
:return: The registration response from the authenticator.
"""
data = client_param + app_param
response = self.send_apdu(ins=Ctap1.INS.REGISTER, data=data)
return RegistrationData(response)
def authenticate(
self,
client_param: bytes,
app_param: bytes,
key_handle: bytes,
check_only: bool = False,
) -> SignatureData:
"""Authenticate a previously registered credential.
:param client_param: SHA256 hash of the ClientData used for the request.
:param app_param: SHA256 hash of the app ID used for the request.
:param key_handle: The binary key handle of the credential.
:param check_only: True to send a "check-only" request, which is used to
determine if a key handle is known.
:return: The authentication response from the authenticator.
"""
data = (
client_param + app_param + struct.pack(">B", len(key_handle)) + key_handle
)
p1 = 0x07 if check_only else 0x03
response = self.send_apdu(ins=Ctap1.INS.AUTHENTICATE, p1=p1, data=data)
return SignatureData(response)
fido2-2.2.1/fido2/ctap2/__init__.py 0000644 0000000 0000000 00000003262 15220526030 013570 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from .base import ( # noqa
Ctap2,
Info,
AttestationResponse,
AssertionResponse,
)
from .pin import ClientPin, PinProtocolV1, PinProtocolV2 # noqa
from .credman import CredentialManagement # noqa
from .bio import FPBioEnrollment, CaptureError # noqa
from .blob import LargeBlobs # noqa
from .config import Config # noqa
fido2-2.2.1/fido2/ctap2/base.py 0000644 0000000 0000000 00000060016 15220526030 012743 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import logging
import struct
from dataclasses import Field, dataclass, field, fields
from enum import IntEnum, unique
from threading import Event
from typing import Any, Callable, Mapping, cast
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from .. import cbor
from ..cose import CoseKey
from ..ctap import CtapDevice, CtapError
from ..hid import CAPABILITY, CTAPHID
from ..utils import _DataClassMapping
from ..webauthn import Aaguid, AuthenticatorData
logger = logging.getLogger(__name__)
def args(*params) -> dict[int, Any]:
"""Constructs a dict from a list of arguments for sending a CBOR command.
None elements will be omitted.
:param params: Arguments, in order, to add to the command.
:return: The input parameters as a dict.
"""
return {i: v for i, v in enumerate(params, 1) if v is not None}
class _CborDataObject(_DataClassMapping[int]):
@classmethod
def _get_field_key(cls, field: Field) -> int:
return fields(cls).index(field) + 1
@dataclass(eq=False, frozen=True)
class Info(_CborDataObject):
"""Binary CBOR encoded response data returned by the CTAP2 GET_INFO command.
See:
https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#authenticatorGetInfo
for descriptions of these fields.
Note that while many fields are optional when returned by the authenticator,
this dataclass uses defaults to represent a missing value such as empty lists
or dicts, or the integer value 0. These are used rather than None for omitted
values as long as this can be done without introducing any practical ambiguity.
This also means that several of these fields may have a 0 value even if the
specification states that they should be non-zero when returned from the
authenticator.
:param _: The binary content of the Info data.
"""
versions: list[str]
extensions: list[str] = field(default_factory=list)
aaguid: Aaguid = Aaguid.NONE
options: dict[str, bool] = field(default_factory=dict)
max_msg_size: int = 1024
pin_uv_protocols: list[int] = field(default_factory=list)
max_creds_in_list: int = 0
max_cred_id_length: int = 0
transports: list[str] = field(default_factory=list)
algorithms: list[dict[str, Any]] = field(default_factory=list)
max_large_blob: int = 0
force_pin_change: bool = False
min_pin_length: int = 4
firmware_version: int = 0
max_cred_blob_length: int = 0
max_rpids_for_min_pin: int = 0
preferred_platform_uv_attempts: int = 0
uv_modality: int = 0
certifications: dict = field(default_factory=dict)
remaining_disc_creds: int | None = None
vendor_prototype_config_commands: list[int] = field(default_factory=list)
attestation_formats: list[str] = field(default_factory=lambda: ["packed"])
uv_count_since_pin: int | None = None
long_touch_for_reset: bool = False
enc_identifier: bytes | None = None
transports_for_reset: list[str] = field(default_factory=list)
pin_complexity_policy: bool | None = None
pin_complexity_policy_url: bytes | None = None
max_pin_length: int = 63
enc_cred_store_state: bytes | None = None
authenticator_config_commands: list[int] | None = None
def _decrypt(
self, encrypted: bytes | None, info: bytes, pin_token: bytes
) -> bytes | None:
if not encrypted:
return None
iv, ct = encrypted[:16], encrypted[16:]
be = default_backend()
secret = HKDF(
algorithm=hashes.SHA256(),
length=16,
salt=b"\0" * 32,
info=info,
backend=be,
).derive(pin_token)
dec = Cipher(algorithms.AES(secret), modes.CBC(iv), be).decryptor()
return dec.update(ct) + dec.finalize()
def get_identifier(self, pin_token: bytes) -> bytes | None:
"""Decrypt the device identifier using a persistent PUAT."""
return self._decrypt(self.enc_identifier, b"encIdentifier", pin_token)
def get_cred_store_state(self, pin_token: bytes) -> bytes | None:
"""Decrypt the credential store state using a persistent PUAT."""
return self._decrypt(self.enc_cred_store_state, b"encCredStoreState", pin_token)
@dataclass(eq=False, frozen=True)
class AttestationResponse(_CborDataObject):
"""Binary CBOR encoded attestation object.
:param _: The binary representation of the attestation object.
:ivar fmt: The type of attestation used.
:ivar auth_data: The attested authenticator data.
:ivar att_stmt: The attestation statement.
:ivar ep_att: Whether an enterprise attestation was returned for this credential.
:ivar large_blob_key: The largeBlobKey for the credential, if requested.
:ivar unsigned_extension_outputs: Any unsigned outputs of extensions.
"""
fmt: str
auth_data: AuthenticatorData
att_stmt: dict[str, Any]
ep_att: bool | None = None
large_blob_key: bytes | None = None
unsigned_extension_outputs: dict[str, Any] = field(default_factory=dict)
@dataclass(eq=False, frozen=True)
class AssertionResponse(_CborDataObject):
"""Binary CBOR encoded assertion response.
:param _: The binary representation of the assertion response.
:ivar credential: The credential used for the assertion.
:ivar auth_data: The authenticator data part of the response.
:ivar signature: The digital signature of the assertion.
:ivar user: The user data of the credential.
:ivar number_of_credentials: The total number of responses available
(only set for the first response, if > 1).
"""
credential: Mapping[str, Any]
auth_data: AuthenticatorData
signature: bytes
user: dict[str, Any] | None = None
number_of_credentials: int | None = None
user_selected: bool | None = None
large_blob_key: bytes | None = None
def verify(self, client_param: bytes, public_key: CoseKey):
"""Verify the digital signature of the response with regard to the
client_param, using the given public key.
:param client_param: SHA256 hash of the ClientData used for the request.
:param public_key: The public key of the credential, to verify.
"""
public_key.verify(self.auth_data + client_param, self.signature)
@classmethod
def from_ctap1(
cls, app_param: bytes, credential: Mapping[str, Any], authentication
) -> "AssertionResponse":
"""Create an AssertionResponse from a CTAP1 SignatureData instance.
:param app_param: SHA256 hash of the RP ID used for the CTAP1 request.
:param credential: Credential used for the CTAP1 request (from the
allowList).
:param authentication: The CTAP1 signature data.
:return: The assertion response.
"""
return cls(
credential=credential,
auth_data=AuthenticatorData.create(
app_param,
authentication.user_presence & AuthenticatorData.FLAG.UP,
authentication.counter,
),
signature=authentication.signature,
)
class Ctap2:
"""Implementation of the CTAP2 specification.
:param device: A CtapHidDevice handle supporting CTAP2.
:param strict_cbor: Validate that CBOR returned from the Authenticator is
canonical, defaults to True.
"""
@unique
class CMD(IntEnum):
MAKE_CREDENTIAL = 0x01
GET_ASSERTION = 0x02
GET_INFO = 0x04
CLIENT_PIN = 0x06
RESET = 0x07
GET_NEXT_ASSERTION = 0x08
BIO_ENROLLMENT = 0x09
CREDENTIAL_MGMT = 0x0A
SELECTION = 0x0B
LARGE_BLOBS = 0x0C
CONFIG = 0x0D
BIO_ENROLLMENT_PRE = 0x40
CREDENTIAL_MGMT_PRE = 0x41
def __init__(self, device: CtapDevice, strict_cbor: bool = True):
if not device.capabilities & CAPABILITY.CBOR:
raise ValueError("Device does not support CTAP2.")
self.device = device
self._strict_cbor = strict_cbor
self._max_msg_size = 1024 # For initial get_info call
self._info = self.get_info()
self._max_msg_size = self._info.max_msg_size
@property
def info(self) -> Info:
"""Get a cached Info object which can be used to determine capabilities.
:rtype: Info
:return: The response of calling GetAuthenticatorInfo.
"""
return self._info
def send_cbor(
self,
cmd: int,
data: Mapping[int, Any] | None = None,
*,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> Mapping[int, Any]:
"""Sends a CBOR message to the device, and waits for a response.
:param cmd: The command byte of the request.
:param data: The payload to send (to be CBOR encoded).
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional function called when keep-alive is sent by
the authenticator.
"""
request = struct.pack(">B", cmd)
if data is not None:
request += cbor.encode(data)
if len(request) > self._max_msg_size:
raise CtapError(CtapError.ERR.REQUEST_TOO_LARGE)
response = self.device.call(CTAPHID.CBOR, request, event, on_keepalive)
status = response[0]
if status != 0x00:
raise CtapError(status)
enc = response[1:]
if not enc:
return {}
decoded = cbor.decode(enc)
if self._strict_cbor:
expected = cbor.encode(decoded)
if expected != enc:
raise ValueError(
"Non-canonical CBOR from Authenticator.\n"
f"Got: {enc.hex()}\nExpected: {expected.hex()}"
)
if isinstance(decoded, Mapping):
return cast(Mapping[int, Any], decoded)
raise TypeError("Decoded value of wrong type")
def get_info(self) -> Info:
"""CTAP2 getInfo command.
:return: Information about the authenticator.
"""
return Info.from_dict(self.send_cbor(Ctap2.CMD.GET_INFO))
def client_pin(
self,
pin_uv_protocol: int,
sub_cmd: int,
key_agreement: Mapping[int, Any] | None = None,
pin_uv_param: bytes | None = None,
new_pin_enc: bytes | None = None,
pin_hash_enc: bytes | None = None,
permissions: int | None = None,
permissions_rpid: str | None = None,
*,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> Mapping[int, Any]:
"""CTAP2 clientPin command, used for various PIN operations.
This method is not intended to be called directly. It is intended to be used by
an instance of the PinProtocolV1 class.
:param pin_uv_protocol: The PIN/UV protocol version to use.
:param sub_cmd: A clientPin sub command.
:param key_agreement: The keyAgreement parameter.
:param pin_uv_param: The pinAuth parameter.
:param new_pin_enc: The newPinEnc parameter.
:param pin_hash_enc: The pinHashEnc parameter.
:param permissions: The permissions parameter.
:param permissions_rpid: The permissions RPID parameter.
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive
messages from the authenticator.
:return: The response of the command, decoded.
"""
return self.send_cbor(
Ctap2.CMD.CLIENT_PIN,
args(
pin_uv_protocol,
sub_cmd,
key_agreement,
pin_uv_param,
new_pin_enc,
pin_hash_enc,
None,
None,
permissions,
permissions_rpid,
),
event=event,
on_keepalive=on_keepalive,
)
def reset(
self,
*,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> None:
"""CTAP2 reset command, erases all credentials and PIN.
:param event: Optional threading.Event object used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive
messages from the authenticator.
"""
self.send_cbor(Ctap2.CMD.RESET, event=event, on_keepalive=on_keepalive)
logger.info("Reset completed - All data erased")
def make_credential(
self,
client_data_hash: bytes,
rp: Mapping[str, Any],
user: Mapping[str, Any],
key_params: list[Mapping[str, Any]],
exclude_list: list[Mapping[str, Any]] | None = None,
extensions: Mapping[str, Any] | None = None,
options: Mapping[str, Any] | None = None,
pin_uv_param: bytes | None = None,
pin_uv_protocol: int | None = None,
enterprise_attestation: int | None = None,
*,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> AttestationResponse:
"""CTAP2 makeCredential operation.
:param client_data_hash: SHA256 hash of the ClientData.
:param rp: PublicKeyCredentialRpEntity parameters.
:param user: PublicKeyCredentialUserEntity parameters.
:param key_params: List of acceptable credential types.
:param exclude_list: Optional list of PublicKeyCredentialDescriptors.
:param extensions: Optional dict of extensions.
:param options: Optional dict of options.
:param pin_uv_param: Optional PIN/UV auth parameter.
:param pin_uv_protocol: The version of PIN/UV protocol used, if any.
:param enterprise_attestation: Whether or not to request Enterprise Attestation.
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive
messages from the authenticator.
:return: The new credential.
"""
logger.debug("Calling CTAP2 make_credential")
return AttestationResponse.from_dict(
self.send_cbor(
Ctap2.CMD.MAKE_CREDENTIAL,
args(
client_data_hash,
rp,
user,
key_params,
exclude_list,
extensions,
options,
pin_uv_param,
pin_uv_protocol,
enterprise_attestation,
),
event=event,
on_keepalive=on_keepalive,
)
)
def get_assertion(
self,
rp_id: str,
client_data_hash: bytes,
allow_list: list[Mapping[str, Any]] | None = None,
extensions: Mapping[str, Any] | None = None,
options: Mapping[str, Any] | None = None,
pin_uv_param: bytes | None = None,
pin_uv_protocol: int | None = None,
*,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> AssertionResponse:
"""CTAP2 getAssertion command.
:param rp_id: The RP ID of the credential.
:param client_data_hash: SHA256 hash of the ClientData used.
:param allow_list: Optional list of PublicKeyCredentialDescriptors.
:param extensions: Optional dict of extensions.
:param options: Optional dict of options.
:param pin_uv_param: Optional PIN/UV auth parameter.
:param pin_uv_protocol: The version of PIN/UV protocol used, if any.
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive messages
from the authenticator.
:return: The new assertion.
"""
logger.debug("Calling CTAP2 get_assertion")
return AssertionResponse.from_dict(
self.send_cbor(
Ctap2.CMD.GET_ASSERTION,
args(
rp_id,
client_data_hash,
allow_list,
extensions,
options,
pin_uv_param,
pin_uv_protocol,
),
event=event,
on_keepalive=on_keepalive,
)
)
def get_next_assertion(self) -> AssertionResponse:
"""CTAP2 getNextAssertion command.
:return: The next available assertion response.
"""
return AssertionResponse.from_dict(self.send_cbor(Ctap2.CMD.GET_NEXT_ASSERTION))
def get_assertions(self, *args, **kwargs) -> list[AssertionResponse]:
"""Convenience method to get list of assertions.
See get_assertion and get_next_assertion for details.
"""
first = self.get_assertion(*args, **kwargs)
rest = [
self.get_next_assertion()
for _ in range(1, first.number_of_credentials or 1)
]
return [first] + rest
def credential_mgmt(
self,
sub_cmd: int,
sub_cmd_params: Mapping[int, Any] | None = None,
pin_uv_protocol: int | None = None,
pin_uv_param: bytes | None = None,
) -> Mapping[int, Any]:
"""CTAP2 credentialManagement command, used to manage resident
credentials.
NOTE: This implements the current draft version of the CTAP2 specification and
should be considered highly experimental.
This method is not intended to be called directly. It is intended to be used by
an instance of the CredentialManagement class.
:param sub_cmd: A CredentialManagement sub command.
:param sub_cmd_params: Sub command specific parameters.
:param pin_uv_protocol: PIN/UV auth protocol version used.
:param pin_uv_param: PIN/UV Auth parameter.
"""
if "credMgmt" in self.info.options:
cmd = Ctap2.CMD.CREDENTIAL_MGMT
elif "credentialMgmtPreview" in self.info.options:
cmd = Ctap2.CMD.CREDENTIAL_MGMT_PRE
else:
raise ValueError(
"Credential Management not supported by this Authenticator"
)
return self.send_cbor(
cmd,
args(sub_cmd, sub_cmd_params, pin_uv_protocol, pin_uv_param),
)
def bio_enrollment(
self,
modality: int | None = None,
sub_cmd: int | None = None,
sub_cmd_params: Mapping[int, Any] | None = None,
pin_uv_protocol: int | None = None,
pin_uv_param: bytes | None = None,
get_modality: bool | None = None,
*,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> Mapping[int, Any]:
"""CTAP2 bio enrollment command. Used to provision/enumerate/delete bio
enrollments in the authenticator.
NOTE: This implements the current draft version of the CTAP2 specification and
should be considered highly experimental.
This method is not intended to be called directly. It is intended to be used by
an instance of the BioEnrollment class.
:param modality: The user verification modality being used.
:param sub_cmd: A BioEnrollment sub command.
:param sub_cmd_params: Sub command specific parameters.
:param pin_uv_protocol: PIN/UV protocol version used.
:param pin_uv_param: PIN/UV auth param.
:param get_modality: Get the user verification type modality.
"""
if "bioEnroll" in self.info.options:
cmd = Ctap2.CMD.BIO_ENROLLMENT
elif "userVerificationMgmtPreview" in self.info.options:
cmd = Ctap2.CMD.BIO_ENROLLMENT_PRE
else:
raise ValueError("Authenticator does not support Bio Enroll")
return self.send_cbor(
cmd,
args(
modality,
sub_cmd,
sub_cmd_params,
pin_uv_protocol,
pin_uv_param,
get_modality,
),
event=event,
on_keepalive=on_keepalive,
)
def selection(
self,
*,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> None:
"""CTAP2 authenticator selection command.
This command allows the platform to let a user select a certain authenticator
by asking for user presence.
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive messages
from the authenticator.
"""
self.send_cbor(Ctap2.CMD.SELECTION, event=event, on_keepalive=on_keepalive)
def large_blobs(
self,
offset: int,
get: int | None = None,
set: bytes | None = None,
length: int | None = None,
pin_uv_param: bytes | None = None,
pin_uv_protocol: int | None = None,
) -> Mapping[int, Any]:
"""CTAP2 authenticator large blobs command.
This command is used to read and write the large blob array.
This method is not intended to be called directly. It is intended to be used by
an instance of the LargeBlobs class.
:param offset: The offset of where to start reading/writing data.
:param get: Optional (max) length of data to read.
:param set: Optional data to write.
:param length: Length of the payload in set.
:param pin_uv_protocol: PIN/UV protocol version used.
:param pin_uv_param: PIN/UV auth param.
"""
return self.send_cbor(
Ctap2.CMD.LARGE_BLOBS,
args(get, set, offset, length, pin_uv_param, pin_uv_protocol),
)
def config(
self,
sub_cmd: int,
sub_cmd_params: Mapping[int, Any] | None = None,
pin_uv_protocol: int | None = None,
pin_uv_param: bytes | None = None,
) -> Mapping[int, Any]:
"""CTAP2 authenticator config command.
This command is used to configure various authenticator features through the
use of its subcommands.
This method is not intended to be called directly. It is intended to be used by
an instance of the Config class.
:param sub_cmd: A Config sub command.
:param sub_cmd_params: Sub command specific parameters.
:param pin_uv_protocol: PIN/UV auth protocol version used.
:param pin_uv_param: PIN/UV Auth parameter.
"""
return self.send_cbor(
Ctap2.CMD.CONFIG,
args(sub_cmd, sub_cmd_params, pin_uv_protocol, pin_uv_param),
)
fido2-2.2.1/fido2/ctap2/bio.py 0000644 0000000 0000000 00000030653 15220526030 012606 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import logging
import struct
from enum import IntEnum, unique
from threading import Event
from typing import Any, Callable, Mapping
from .. import cbor
from ..ctap import CtapError
from .base import Ctap2, Info
from .pin import PinProtocol
logger = logging.getLogger(__name__)
class BioEnrollment:
@unique
class RESULT(IntEnum):
MODALITY = 0x01
FINGERPRINT_KIND = 0x02
MAX_SAMPLES_REQUIRED = 0x03
TEMPLATE_ID = 0x04
LAST_SAMPLE_STATUS = 0x05
REMAINING_SAMPLES = 0x06
TEMPLATE_INFOS = 0x07
MAX_TEMPLATE_FRIENDLY_NAME = 0x08
@unique
class TEMPLATE_INFO(IntEnum):
ID = 0x01
NAME = 0x02
@unique
class MODALITY(IntEnum):
FINGERPRINT = 0x01
@staticmethod
def is_supported(info: Info) -> bool:
if "bioEnroll" in info.options:
return True
# We also support the Prototype command
if (
"FIDO_2_1_PRE" in info.versions
and "userVerificationMgmtPreview" in info.options
):
return True
return False
def __init__(self, ctap: Ctap2, modality: MODALITY):
if not self.is_supported(ctap.info):
raise ValueError("Authenticator does not support BioEnroll")
self.ctap = ctap
self.modality = self.get_modality()
if modality != self.modality:
raise ValueError(f"Device does not support {modality:s}")
def get_modality(self) -> int:
"""Get bio modality.
:return: The type of modality supported by the authenticator.
"""
return self.ctap.bio_enrollment(get_modality=True)[
BioEnrollment.RESULT.MODALITY
]
class CaptureError(Exception):
def __init__(self, code: int):
self.code = code
super().__init__(f"Fingerprint capture error: {code}")
class FPEnrollmentContext:
"""Helper object to perform fingerprint enrollment.
:param bio: An instance of FPBioEnrollment.
:param timeout: Optional timeout for fingerprint captures (ms).
:ivar remaining: The number of (estimated) remaining samples needed.
:ivar template_id: The ID of the new template (only available after the initial
sample has been captured).
"""
def __init__(self, bio: "FPBioEnrollment", timeout: int | None = None):
self._bio = bio
self.timeout = timeout
self.template_id: bytes | None = None
self.remaining: int | None = None
def capture(
self,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> bytes | None:
"""Capture a fingerprint sample.
This call will block for up to timeout milliseconds (or indefinitely, if
timeout not specified) waiting for the user to scan their fingerprint to
collect one sample.
:return: None, if more samples are needed, or the template ID if enrollment is
completed.
"""
if self.template_id is None:
self.template_id, status, self.remaining = self._bio.enroll_begin(
self.timeout, event, on_keepalive
)
else:
status, self.remaining = self._bio.enroll_capture_next(
self.template_id, self.timeout, event, on_keepalive
)
if status != FPBioEnrollment.FEEDBACK.FP_GOOD:
raise CaptureError(status)
if self.remaining == 0:
return self.template_id
return None
def cancel(self) -> None:
"""Cancels ongoing enrollment."""
self._bio.enroll_cancel()
self.template_id = None
class FPBioEnrollment(BioEnrollment):
"""Implementation of the bio enrollment API.
NOTE: The get_fingerprint_sensor_info method does not require authentication, and
can be used by setting pin_uv_protocol and pin_uv_token to None.
:param ctap: An instance of a CTAP2 object.
:param pin_uv_protocol: The PIN/UV protocol version used.
:param pin_uv_token: A valid PIN/UV Auth Token for the current CTAP session.
"""
@unique
class CMD(IntEnum):
ENROLL_BEGIN = 0x01
ENROLL_CAPTURE_NEXT = 0x02
ENROLL_CANCEL = 0x03
ENUMERATE_ENROLLMENTS = 0x04
SET_NAME = 0x05
REMOVE_ENROLLMENT = 0x06
GET_SENSOR_INFO = 0x07
@unique
class PARAM(IntEnum):
TEMPLATE_ID = 0x01
TEMPLATE_NAME = 0x02
TIMEOUT_MS = 0x03
@unique
class FEEDBACK(IntEnum):
FP_GOOD = 0x00
FP_TOO_HIGH = 0x01
FP_TOO_LOW = 0x02
FP_TOO_LEFT = 0x03
FP_TOO_RIGHT = 0x04
FP_TOO_FAST = 0x05
FP_TOO_SLOW = 0x06
FP_POOR_QUALITY = 0x07
FP_TOO_SKEWED = 0x08
FP_TOO_SHORT = 0x09
FP_MERGE_FAILURE = 0x0A
FP_EXISTS = 0x0B
FP_DATABASE_FULL = 0x0C
NO_USER_ACTIVITY = 0x0D
NO_UP_TRANSITION = 0x0E
def __str__(self):
return f"0x{self.value:02X} - {self.name}"
def __init__(self, ctap: Ctap2, pin_uv_protocol: PinProtocol, pin_uv_token: bytes):
super().__init__(ctap, BioEnrollment.MODALITY.FINGERPRINT)
self.pin_uv_protocol = pin_uv_protocol
self.pin_uv_token = pin_uv_token
def _call(self, sub_cmd, params=None, auth=True, event=None, on_keepalive=None):
kwargs: dict[str, Any] = {
"modality": self.modality,
"sub_cmd": sub_cmd,
"sub_cmd_params": params,
"event": event,
"on_keepalive": on_keepalive,
}
if auth:
msg = struct.pack(">BB", self.modality, sub_cmd)
if params is not None:
msg += cbor.encode(params)
kwargs["pin_uv_protocol"] = self.pin_uv_protocol.VERSION
kwargs["pin_uv_param"] = self.pin_uv_protocol.authenticate(
self.pin_uv_token, msg
)
return self.ctap.bio_enrollment(**kwargs)
def get_fingerprint_sensor_info(self) -> Mapping[int, Any]:
"""Get fingerprint sensor info.
:return: A dict containing FINGERPRINT_KIND and MAX_SAMPLES_REQUIRES.
"""
return self._call(FPBioEnrollment.CMD.GET_SENSOR_INFO, auth=False)
def enroll_begin(
self,
timeout: int | None = None,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> tuple[bytes, FPBioEnrollment.FEEDBACK, int]:
"""Start fingerprint enrollment.
Starts the process of enrolling a new fingerprint, and will wait for the user
to scan their fingerprint once to provide an initial sample.
:param timeout: Optional timeout in milliseconds.
:return: A tuple containing the new template ID, the sample status, and the
number of samples remaining to complete the enrollment.
"""
logger.debug(f"Starting fingerprint enrollment (timeout={timeout})")
result = self._call(
FPBioEnrollment.CMD.ENROLL_BEGIN,
(
{FPBioEnrollment.PARAM.TIMEOUT_MS: timeout}
if timeout is not None
else None
),
event=event,
on_keepalive=on_keepalive,
)
logger.debug(f"Sample capture result: {result}")
return (
result[BioEnrollment.RESULT.TEMPLATE_ID],
FPBioEnrollment.FEEDBACK(result[BioEnrollment.RESULT.LAST_SAMPLE_STATUS]),
result[BioEnrollment.RESULT.REMAINING_SAMPLES],
)
def enroll_capture_next(
self,
template_id: bytes,
timeout: int | None = None,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> tuple[FPBioEnrollment.FEEDBACK, int]:
"""Continue fingerprint enrollment.
Continues enrolling a new fingerprint and will wait for the user to scan their
fingerpring once to provide a new sample.
Once the number of samples remaining is 0, the enrollment is completed.
:param template_id: The template ID returned by a call to `enroll_begin`.
:param timeout: Optional timeout in milliseconds.
:return: A tuple containing the sample status, and the number of samples
remaining to complete the enrollment.
"""
logger.debug(f"Capturing next sample with (timeout={timeout})")
params: dict[int, Any] = {FPBioEnrollment.PARAM.TEMPLATE_ID: template_id}
if timeout is not None:
params[FPBioEnrollment.PARAM.TIMEOUT_MS] = timeout
result = self._call(
FPBioEnrollment.CMD.ENROLL_CAPTURE_NEXT,
params,
event=event,
on_keepalive=on_keepalive,
)
logger.debug(f"Sample capture result: {result}")
return (
FPBioEnrollment.FEEDBACK(result[BioEnrollment.RESULT.LAST_SAMPLE_STATUS]),
result[BioEnrollment.RESULT.REMAINING_SAMPLES],
)
def enroll_cancel(self) -> None:
"""Cancel any ongoing fingerprint enrollment."""
logger.debug("Cancelling fingerprint enrollment.")
self._call(FPBioEnrollment.CMD.ENROLL_CANCEL, auth=False)
def enroll(self, timeout: int | None = None) -> FPEnrollmentContext:
"""Convenience wrapper for doing fingerprint enrollment.
See FPEnrollmentContext for details.
:return: An initialized FPEnrollmentContext.
"""
return FPEnrollmentContext(self, timeout)
def enumerate_enrollments(self) -> Mapping[bytes, str | None]:
"""Get a dict of enrolled fingerprint templates which maps template ID's to
their friendly names.
:return: A dict of enrolled template_id -> name pairs.
"""
try:
return {
t[BioEnrollment.TEMPLATE_INFO.ID]: t[BioEnrollment.TEMPLATE_INFO.NAME]
for t in self._call(FPBioEnrollment.CMD.ENUMERATE_ENROLLMENTS)[
BioEnrollment.RESULT.TEMPLATE_INFOS
]
}
except CtapError as e:
if e.code == CtapError.ERR.INVALID_OPTION:
return {}
raise
def set_name(self, template_id: bytes, name: str) -> None:
"""Set/Change the friendly name of a previously enrolled fingerprint template.
:param template_id: The ID of the template to change.
:param name: A friendly name to give the template.
"""
logger.debug(f"Changing name of template: {template_id.hex()} to {name}")
self._call(
FPBioEnrollment.CMD.SET_NAME,
{
BioEnrollment.TEMPLATE_INFO.ID: template_id,
BioEnrollment.TEMPLATE_INFO.NAME: name,
},
)
logger.info("Fingerprint template renamed")
def remove_enrollment(self, template_id: bytes) -> None:
"""Remove a previously enrolled fingerprint template.
:param template_id: The Id of the template to remove.
"""
logger.debug(f"Deleting template: {template_id.hex()}")
self._call(
FPBioEnrollment.CMD.REMOVE_ENROLLMENT,
{BioEnrollment.TEMPLATE_INFO.ID: template_id},
)
logger.info("Fingerprint template deleted")
fido2-2.2.1/fido2/ctap2/blob.py 0000644 0000000 0000000 00000016302 15220526030 012746 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import os
import struct
import zlib
from typing import Any, Mapping, Sequence, cast
from cryptography.exceptions import InvalidTag
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from .. import cbor
from ..utils import sha256
from .base import Ctap2, Info
from .pin import PinProtocol, _PinUv
def _compress(data):
o = zlib.compressobj(wbits=-zlib.MAX_WBITS)
return o.compress(data) + o.flush()
def _decompress(data):
o = zlib.decompressobj(wbits=-zlib.MAX_WBITS)
return o.decompress(data) + o.flush()
def _lb_ad(orig_size):
return b"blob" + struct.pack(" bool:
return info.options.get("largeBlobs") is True
def __init__(
self,
ctap: Ctap2,
pin_uv_protocol: PinProtocol | None = None,
pin_uv_token: bytes | None = None,
):
if not self.is_supported(ctap.info):
raise ValueError("Authenticator does not support LargeBlobs")
self.ctap = ctap
self.max_fragment_length = self.ctap.info.max_msg_size - 64
self.pin_uv = (
_PinUv(pin_uv_protocol, pin_uv_token)
if pin_uv_protocol and pin_uv_token
else None
)
def read_blob_array(self) -> Sequence[Mapping[int, Any]]:
"""Gets the entire contents of the Large Blobs array.
:return: The CBOR decoded list of Large Blobs.
"""
offset = 0
buf = b""
while True:
fragment = self.ctap.large_blobs(offset, get=self.max_fragment_length)[1]
buf += fragment
if len(fragment) < self.max_fragment_length:
break
offset += self.max_fragment_length
data, check = buf[:-16], buf[-16:]
if check != sha256(data)[:-16]:
return []
return cast(Sequence[Mapping[int, Any]], cbor.decode(data))
def write_blob_array(self, blob_array: Sequence[Mapping[int, Any]]) -> None:
"""Writes the entire Large Blobs array.
:param blob_array: A list to write to the Authenticator.
"""
if not isinstance(blob_array, list):
raise TypeError("large-blob array must be a list")
data = cbor.encode(blob_array)
data += sha256(data)[:16]
offset = 0
size = len(data)
while offset < size:
ln = min(size - offset, self.max_fragment_length)
_set = data[offset : offset + ln]
if self.pin_uv:
msg = (
b"\xff" * 32
+ b"\x0c\x00"
+ struct.pack(" bytes | None:
"""Gets the Large Blob stored for a single credential.
:param large_blob_key: The largeBlobKey for the credential, or None.
:returns: The decrypted and deflated value stored for the credential.
"""
for entry in self.read_blob_array():
try:
compressed, orig_size = _lb_unpack(large_blob_key, entry)
decompressed = _decompress(compressed)
if len(decompressed) == orig_size:
return decompressed
except (ValueError, zlib.error):
continue
return None
def put_blob(self, large_blob_key: bytes, data: bytes | None) -> None:
"""Stores a Large Blob for a single credential.
Any existing entries for the same credential will be replaced.
:param large_blob_key: The largeBlobKey for the credential.
:param data: The data to compress, encrypt and store.
"""
modified = data is not None
entries = []
for entry in self.read_blob_array():
try:
_lb_unpack(large_blob_key, entry)
modified = True
except ValueError:
entries.append(entry)
if data is not None:
entries.append(_lb_pack(large_blob_key, data))
if modified:
self.write_blob_array(entries)
def delete_blob(self, large_blob_key: bytes) -> None:
"""Deletes any Large Blob(s) stored for a single credential.
:param large_blob_key: The largeBlobKey for the credential.
"""
self.put_blob(large_blob_key, None)
fido2-2.2.1/fido2/ctap2/config.py 0000644 0000000 0000000 00000012416 15220526030 013277 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import struct
from enum import IntEnum, unique
from typing import Any
from .. import cbor
from .base import Ctap2, Info
from .pin import PinProtocol, _PinUv
class Config:
"""Implementation of the CTAP2.1 Authenticator Config API.
:param ctap: An instance of a CTAP2 object.
:param pin_uv_protocol: An instance of a PinUvAuthProtocol.
:param pin_uv_token: A valid PIN/UV Auth Token for the current CTAP session.
"""
@unique
class CMD(IntEnum):
ENABLE_ENTERPRISE_ATT = 0x01
TOGGLE_ALWAYS_UV = 0x02
SET_MIN_PIN_LENGTH = 0x03
VENDOR_PROTOTYPE = 0xFF
@unique
class PARAM(IntEnum):
NEW_MIN_PIN_LENGTH = 0x01
MIN_PIN_LENGTH_RPIDS = 0x02
FORCE_CHANGE_PIN = 0x03
PIN_COMPLEXITY_POLICY = 0x04
@staticmethod
def is_supported(info: Info) -> bool:
return info.options.get("authnrCfg") is True
def __init__(
self,
ctap: Ctap2,
pin_uv_protocol: PinProtocol | None = None,
pin_uv_token: bytes | None = None,
):
if not self.is_supported(ctap.info):
raise ValueError("Authenticator does not support Config")
self.ctap = ctap
self.pin_uv = (
_PinUv(pin_uv_protocol, pin_uv_token)
if pin_uv_protocol and pin_uv_token
else None
)
self._subcommands = self.ctap.info.authenticator_config_commands
def _call(self, sub_cmd, params=None):
if self._subcommands is not None and sub_cmd not in self._subcommands:
raise ValueError(f"Config command {sub_cmd} not supported by Authenticator")
if self.pin_uv:
msg = b"\xff" * 32 + b"\x0d" + struct.pack(" None:
"""Enables Enterprise Attestation.
If already enabled, this command is ignored.
"""
self._call(Config.CMD.ENABLE_ENTERPRISE_ATT)
def toggle_always_uv(self) -> None:
"""Toggle the alwaysUV setting.
When true, the Authenticator always requires UV for credential assertion.
"""
self._call(Config.CMD.TOGGLE_ALWAYS_UV)
def set_min_pin_length(
self,
min_pin_length: int | None = None,
rp_ids: list[str] | None = None,
force_change_pin: bool = False,
pin_complexity_policy: bool = False,
) -> None:
"""Set the minimum PIN length allowed when setting/changing the PIN.
:param min_pin_length: The minimum PIN length the Authenticator should allow.
:param rp_ids: A list of RP IDs which should be allowed to get the current
minimum PIN length.
:param force_change_pin: True if the Authenticator should enforce changing the
PIN before the next use.
:param pin_complexity_policy: True if the Authenticator should enforce an
additional PIN complexity policy beyond minPINLength.
"""
params: dict[int, Any] = {Config.PARAM.FORCE_CHANGE_PIN: force_change_pin}
if min_pin_length is not None:
params[Config.PARAM.NEW_MIN_PIN_LENGTH] = min_pin_length
if rp_ids is not None:
params[Config.PARAM.MIN_PIN_LENGTH_RPIDS] = rp_ids
if pin_complexity_policy:
if self.ctap.info.pin_complexity_policy is None:
raise ValueError(
"Authenticator does not support setting PIN complexity policy"
)
params[Config.PARAM.PIN_COMPLEXITY_POLICY] = True
self._call(Config.CMD.SET_MIN_PIN_LENGTH, params)
fido2-2.2.1/fido2/ctap2/credman.py 0000644 0000000 0000000 00000022573 15220526030 013450 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import logging
import struct
from enum import IntEnum, unique
from typing import Any, Mapping, Sequence
from .. import cbor
from ..ctap import CtapError
from ..webauthn import (
PublicKeyCredentialDescriptor,
PublicKeyCredentialUserEntity,
_as_cbor,
)
from .base import Ctap2, Info
from .pin import PinProtocol, _PinUv
logger = logging.getLogger(__name__)
class CredentialManagement:
"""Implementation of a draft specification of the Credential Management API.
WARNING: This specification is not final and this class is likely to change.
:param ctap: An instance of a CTAP2 object.
:param pin_uv_protocol: An instance of a PinUvAuthProtocol.
:param pin_uv_token: A valid PIN/UV Auth Token for the current CTAP session.
"""
@unique
class CMD(IntEnum):
GET_CREDS_METADATA = 0x01
ENUMERATE_RPS_BEGIN = 0x02
ENUMERATE_RPS_NEXT = 0x03
ENUMERATE_CREDS_BEGIN = 0x04
ENUMERATE_CREDS_NEXT = 0x05
DELETE_CREDENTIAL = 0x06
UPDATE_USER_INFO = 0x07
@unique
class PARAM(IntEnum):
RP_ID_HASH = 0x01
CREDENTIAL_ID = 0x02
USER = 0x03
@unique
class RESULT(IntEnum):
EXISTING_CRED_COUNT = 0x01
MAX_REMAINING_COUNT = 0x02
RP = 0x03
RP_ID_HASH = 0x04
TOTAL_RPS = 0x05
USER = 0x06
CREDENTIAL_ID = 0x07
PUBLIC_KEY = 0x08
TOTAL_CREDENTIALS = 0x09
CRED_PROTECT = 0x0A
LARGE_BLOB_KEY = 0x0B
THIRD_PARTY_PAYMENT = 0x0C
@staticmethod
def is_supported(info: Info) -> bool:
if info.options.get("credMgmt"):
return True
# We also support the Prototype command
if "FIDO_2_1_PRE" in info.versions and "credentialMgmtPreview" in info.options:
return True
return False
@staticmethod
def is_update_supported(info: Info) -> bool:
# Not supported in credentialMgmtPreview
return bool(info.options.get("credMgmt"))
@staticmethod
def is_readonly_supported(info: Info) -> bool:
return bool(info.options.get("perCredMgmtRO"))
def __init__(
self,
ctap: Ctap2,
pin_uv_protocol: PinProtocol,
pin_uv_token: bytes,
):
if not self.is_supported(ctap.info):
raise ValueError("Authenticator does not support Credential Management")
self.ctap = ctap
self.pin_uv = _PinUv(pin_uv_protocol, pin_uv_token)
def _call(self, sub_cmd, params=None, auth=True):
kwargs: dict[str, Any] = {"sub_cmd": sub_cmd, "sub_cmd_params": params}
if auth:
msg = struct.pack(">B", sub_cmd)
if params is not None:
msg += cbor.encode(params)
kwargs["pin_uv_protocol"] = self.pin_uv.protocol.VERSION
kwargs["pin_uv_param"] = self.pin_uv.protocol.authenticate(
self.pin_uv.token, msg
)
return self.ctap.credential_mgmt(**kwargs)
def get_metadata(self) -> Mapping[int, Any]:
"""Get credentials metadata.
This returns the existing resident credentials count, and the max
possible number of remaining resident credentials (the actual number of
remaining credentials may depend on algorithm choice, etc).
:return: A dict containing EXISTING_CRED_COUNT, and MAX_REMAINING_COUNT.
"""
return self._call(CredentialManagement.CMD.GET_CREDS_METADATA)
def enumerate_rps_begin(self) -> Mapping[int, Any]:
"""Start enumeration of RP entities of resident credentials.
This will begin enumeration of stored RP entities, returning the first
entity, as well as a count of the total number of entities stored.
:return: A dict containing RP, RP_ID_HASH, and TOTAL_RPS.
"""
return self._call(CredentialManagement.CMD.ENUMERATE_RPS_BEGIN)
def enumerate_rps_next(self) -> Mapping[int, Any]:
"""Get the next RP entity stored.
This continues enumeration of stored RP entities, returning the next
entity.
:return: A dict containing RP, and RP_ID_HASH.
"""
return self._call(CredentialManagement.CMD.ENUMERATE_RPS_NEXT, auth=False)
def enumerate_rps(self) -> Sequence[Mapping[int, Any]]:
"""Convenience method to enumerate all RPs.
See enumerate_rps_begin and enumerate_rps_next for details.
"""
try:
first = self.enumerate_rps_begin()
except CtapError as e:
if e.code == CtapError.ERR.NO_CREDENTIALS:
return []
raise # Other error
n_rps = first[CredentialManagement.RESULT.TOTAL_RPS]
if n_rps == 0:
return []
rest = [self.enumerate_rps_next() for _ in range(1, n_rps)]
return [first] + rest
def enumerate_creds_begin(self, rp_id_hash: bytes) -> Mapping[int, Any]:
"""Start enumeration of resident credentials.
This will begin enumeration of resident credentials for a given RP,
returning the first credential, as well as a count of the total number
of resident credentials stored for the given RP.
:param rp_id_hash: SHA256 hash of the RP ID.
:return: A dict containing USER, CREDENTIAL_ID, PUBLIC_KEY, and
TOTAL_CREDENTIALS.
"""
return self._call(
CredentialManagement.CMD.ENUMERATE_CREDS_BEGIN,
{CredentialManagement.PARAM.RP_ID_HASH: rp_id_hash},
)
def enumerate_creds_next(self) -> Mapping[int, Any]:
"""Get the next resident credential stored.
This continues enumeration of resident credentials, returning the next
credential.
:return: A dict containing USER, CREDENTIAL_ID, and PUBLIC_KEY.
"""
return self._call(CredentialManagement.CMD.ENUMERATE_CREDS_NEXT, auth=False)
def enumerate_creds(self, *args, **kwargs) -> Sequence[Mapping[int, Any]]:
"""Convenience method to enumerate all resident credentials for an RP.
See enumerate_creds_begin and enumerate_creds_next for details.
"""
try:
first = self.enumerate_creds_begin(*args, **kwargs)
except CtapError as e:
if e.code == CtapError.ERR.NO_CREDENTIALS:
return []
raise # Other error
rest = [
self.enumerate_creds_next()
for _ in range(
1, first.get(CredentialManagement.RESULT.TOTAL_CREDENTIALS, 1)
)
]
return [first] + rest
def delete_cred(self, cred_id: PublicKeyCredentialDescriptor) -> None:
"""Delete a resident credential.
:param cred_id: The PublicKeyCredentialDescriptor of the credential to delete.
"""
cred_id = PublicKeyCredentialDescriptor.from_dict(cred_id)
logger.debug(f"Deleting credential with ID: {cred_id}")
self._call(
CredentialManagement.CMD.DELETE_CREDENTIAL,
{CredentialManagement.PARAM.CREDENTIAL_ID: _as_cbor(cred_id)},
)
logger.info("Credential deleted")
def update_user_info(
self,
cred_id: PublicKeyCredentialDescriptor,
user_info: PublicKeyCredentialUserEntity,
) -> None:
"""Update the user entity of a resident key.
:param cred_id: The PublicKeyCredentialDescriptor of the credential to update.
:param user_info: The user info update.
"""
if not CredentialManagement.is_update_supported(self.ctap.info):
raise ValueError("Authenticator does not support update_user_info")
cred_id = PublicKeyCredentialDescriptor.from_dict(cred_id)
user_info = PublicKeyCredentialUserEntity.from_dict(user_info)
logger.debug(f"Updating credential: {cred_id} with user info: {user_info}")
self._call(
CredentialManagement.CMD.UPDATE_USER_INFO,
{
CredentialManagement.PARAM.CREDENTIAL_ID: _as_cbor(cred_id),
CredentialManagement.PARAM.USER: _as_cbor(user_info),
},
)
logger.info("Credential user info updated")
fido2-2.2.1/fido2/ctap2/extensions.py 0000644 0000000 0000000 00000072051 15220526030 014232 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import abc
from dataclasses import dataclass
from enum import Enum, unique
from typing import Any, Mapping, Sequence, cast
from .. import cbor
from ..utils import _JsonDataObject, sha256, websafe_encode
from ..webauthn import (
AttestationObject,
AuthenticatorSelectionCriteria,
PublicKeyCredentialCreationOptions,
PublicKeyCredentialDescriptor,
PublicKeyCredentialRequestOptions,
ResidentKeyRequirement,
UserVerificationRequirement,
)
from .base import AssertionResponse, AttestationResponse, Ctap2
from .blob import LargeBlobs
from .pin import ClientPin, PinProtocol
class ExtensionProcessor(abc.ABC):
"""Base class for CTAP2 extension processing.
See: :class:`RegistrationExtensionProcessor` and
:class:`AuthenticationExtensionProcessor`.
"""
def __init__(
self,
permissions: ClientPin.PERMISSION = ClientPin.PERMISSION(0),
inputs: dict[str, Any] | None = None,
outputs: dict[str, Any] | None = None,
):
self.permissions = permissions
self._inputs = inputs
self._outputs = outputs
class RegistrationExtensionProcessor(ExtensionProcessor):
"""Processing state for a CTAP2 extension, for single use.
The ExtensionProcessor holds state and logic for client processing of an extension,
for a registration (MakeCredential) call.
:param permissions: PinUvAuthToken permissions required by the extension.
:param inputs: Default authenticator inputs, if prepare_inputs is not overridden.
:param outputs: Default client outputs, if prepare_outputs is not overridden.
"""
def prepare_inputs(self, pin_token: bytes | None) -> dict[str, Any] | None:
"Prepare authenticator extension inputs, to be passed to the Authenenticator."
return self._inputs
def prepare_outputs(
self,
response: AttestationResponse,
pin_token: bytes | None,
) -> dict[str, Any] | None:
"Prepare client extension outputs, to be returned to the caller."
return self._outputs
class AuthenticationExtensionProcessor(ExtensionProcessor):
"""Processing state for a CTAP2 extension, for single use.
The ExtensionProcessor holds state and logic for client processing of an extension,
for an authentication (GetAssertion) call.
:param permissions: PinUvAuthToken permissions required by the extension.
:param inputs: Default authenticator inputs, if prepare_inputs is not overridden.
:param outputs: Default client outputs, if prepare_outputs is not overridden.
"""
def prepare_inputs(
self,
selected: PublicKeyCredentialDescriptor | None,
pin_token: bytes | None,
) -> dict[str, Any] | None:
"Prepare authenticator extension inputs, to be passed to the Authenenticator."
return self._inputs
def prepare_outputs(
self,
response: AssertionResponse,
pin_token: bytes | None,
) -> dict[str, Any] | None:
"Prepare client extension outputs, to be returned to the caller."
return self._outputs
class Ctap2Extension(abc.ABC):
"""Base class for CTAP2 extensions.
As of python-fido2 1.2 these instances can be used for multiple requests and
should be invoked via the make_credential and get_assertion methods.
Subclasses are instantiated for a single request, if the Authenticator supports
the extension.
"""
@abc.abstractmethod
def is_supported(self, ctap: Ctap2) -> bool:
"""Whether or not the extension is supported by the authenticator."""
def make_credential(
self,
ctap: Ctap2,
options: PublicKeyCredentialCreationOptions,
pin_protocol: PinProtocol | None,
) -> RegistrationExtensionProcessor | None:
"""Start client extension processing for registration."""
return None
def get_assertion(
self,
ctap: Ctap2,
options: PublicKeyCredentialRequestOptions,
pin_protocol: PinProtocol | None,
) -> AuthenticationExtensionProcessor | None:
"""Start client extension processing for authentication."""
return None
@dataclass(eq=False, frozen=True)
class HMACGetSecretInput(_JsonDataObject):
"""Client inputs for hmac-secret."""
salt1: bytes
salt2: bytes | None = None
@dataclass(eq=False, frozen=True)
class HMACGetSecretOutput(_JsonDataObject):
"""Client outputs for hmac-secret."""
output1: bytes
output2: bytes | None = None
def _prf_salt(secret):
return sha256(b"WebAuthn PRF\0" + secret)
@dataclass(eq=False, frozen=True)
class AuthenticatorExtensionsPRFValues(_JsonDataObject):
"""Salt values for use with prf."""
first: bytes
second: bytes | None = None
@dataclass(eq=False, frozen=True)
class AuthenticatorExtensionsPRFInputs(_JsonDataObject):
"""Client inputs for prf."""
eval: AuthenticatorExtensionsPRFValues | None = None
eval_by_credential: Mapping[str, AuthenticatorExtensionsPRFValues] | None = None
@dataclass(eq=False, frozen=True)
class AuthenticatorExtensionsPRFOutputs(_JsonDataObject):
"""Client outputs for prf."""
enabled: bool | None = None
results: AuthenticatorExtensionsPRFValues | None = None
def _hmac_prepare_salts(allow_list, selected, prf, hmac):
if prf:
secrets = prf.eval
by_creds = prf.eval_by_credential
if by_creds:
# Make sure all keys are valid IDs from allow_credentials
if not allow_list:
raise ValueError("evalByCredentials requires allowCredentials")
ids = {websafe_encode(c.id) for c in allow_list}
if not ids.issuperset(by_creds):
raise ValueError("evalByCredentials contains invalid key")
if selected:
key = websafe_encode(selected.id)
if key in by_creds:
secrets = by_creds[key]
if not secrets:
return
salts = (
_prf_salt(secrets.first),
(_prf_salt(secrets.second) if secrets.second is not None else b""),
)
elif hmac:
salts = hmac.salt1, hmac.salt2 or b""
else:
return
if not (
len(salts[0]) == HmacSecretExtension.SALT_LEN
and (not salts[1] or len(salts[1]) == HmacSecretExtension.SALT_LEN)
):
raise ValueError("Invalid salt length")
return salts
def _hmac_format_outputs(enabled, decrypted, prf):
output1 = decrypted[: HmacSecretExtension.SALT_LEN] if decrypted else None
output2 = decrypted[HmacSecretExtension.SALT_LEN :] if decrypted else None
if prf:
result = AuthenticatorExtensionsPRFOutputs(
enabled=enabled,
results=(
AuthenticatorExtensionsPRFValues(output1, output2) if output1 else None
),
)
# If result has no content, don't add an entry for it
return {"prf": result} if result else None
else:
outputs = {}
if enabled is not None:
outputs["hmacCreateSecret"] = enabled
if output1:
outputs["hmacGetSecret"] = HMACGetSecretOutput(output1, output2)
return outputs or None
class HmacSecretExtension(Ctap2Extension):
"""
Implements the Pseudo-random function (prf) and the hmac-secret CTAP2 extensions.
The hmac-secret extension is not directly available to clients by default, instead
the prf extension is used.
https://www.w3.org/TR/webauthn-3/#prf-extension
https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-hmac-secret-extension
:param allow_hmac_secret: Set to True to allow hmac-secret, in addition to prf.
"""
NAME = "hmac-secret"
MC_NAME = "hmac-secret-mc"
SALT_LEN = 32
def __init__(self, allow_hmac_secret=False):
self._allow_hmac_secret = allow_hmac_secret
def is_supported(self, ctap):
return self.NAME in ctap.info.extensions
def make_credential(self, ctap, options, pin_protocol):
c_inputs = options.extensions or {}
prf = c_inputs.get("prf") is not None
hmac = self._allow_hmac_secret and c_inputs.get("hmacCreateSecret") is True
if pin_protocol and self.is_supported(ctap) and (prf or hmac):
inputs: dict[str, Any] = {HmacSecretExtension.NAME: True}
shared_secret = None
if self.MC_NAME in ctap.info.extensions:
prf_salts = AuthenticatorExtensionsPRFInputs.from_dict(
cast(Mapping | None, c_inputs.get("prf"))
)
hmac_salts = (
HMACGetSecretInput.from_dict(
cast(Mapping | None, c_inputs.get("hmacGetSecret"))
)
if hmac
else None
)
salts = _hmac_prepare_salts(None, None, prf_salts, hmac_salts)
if salts:
client_pin = ClientPin(ctap, pin_protocol)
key_agreement, shared_secret = client_pin._get_shared_secret()
salt_enc = pin_protocol.encrypt(shared_secret, salts[0] + salts[1])
salt_auth = pin_protocol.authenticate(shared_secret, salt_enc)
inputs[HmacSecretExtension.MC_NAME] = {
1: key_agreement,
2: salt_enc,
3: salt_auth,
4: pin_protocol.VERSION,
}
class Processor(RegistrationExtensionProcessor):
def prepare_inputs(self, pin_token):
return inputs
def prepare_outputs(self, response, pin_token):
extensions = response.auth_data.extensions or {}
enabled = extensions.get(HmacSecretExtension.NAME, False)
value = extensions.get(HmacSecretExtension.MC_NAME)
decrypted = (
pin_protocol.decrypt(shared_secret, value)
if value and shared_secret
else None
)
return _hmac_format_outputs(enabled, decrypted, prf)
return Processor()
def get_assertion(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
prf = AuthenticatorExtensionsPRFInputs.from_dict(
cast(Mapping | None, inputs.get("prf"))
)
hmac = (
HMACGetSecretInput.from_dict(
cast(Mapping | None, inputs.get("hmacGetSecret"))
)
if self._allow_hmac_secret
else None
)
if pin_protocol and self.is_supported(ctap) and (prf or hmac):
client_pin = ClientPin(ctap, pin_protocol)
key_agreement, shared_secret = client_pin._get_shared_secret()
class Processing(AuthenticationExtensionProcessor):
def prepare_inputs(self, selected, pin_token):
salts = _hmac_prepare_salts(
options.allow_credentials, selected, prf, hmac
)
if not salts:
return
salt_enc = pin_protocol.encrypt(shared_secret, salts[0] + salts[1])
salt_auth = pin_protocol.authenticate(shared_secret, salt_enc)
return {
HmacSecretExtension.NAME: {
1: key_agreement,
2: salt_enc,
3: salt_auth,
4: pin_protocol.VERSION,
}
}
def prepare_outputs(self, response, pin_token):
extensions = response.auth_data.extensions or {}
value = extensions.get(HmacSecretExtension.NAME)
decrypted = (
pin_protocol.decrypt(shared_secret, value) if value else None
)
return _hmac_format_outputs(None, decrypted, prf)
return Processing()
@dataclass(eq=False, frozen=True)
class AuthenticatorExtensionsLargeBlobInputs(_JsonDataObject):
"""Client inputs for largeBlob."""
support: str | None = None
read: bool | None = None
write: bytes | None = None
@dataclass(eq=False, frozen=True)
class AuthenticatorExtensionsLargeBlobOutputs(_JsonDataObject):
"""Client outputs for largeBlob."""
supported: bool | None = None
blob: bytes | None = None
written: bool | None = None
class LargeBlobExtension(Ctap2Extension):
"""
Implements the Large Blob storage (largeBlob) WebAuthn extension.
https://www.w3.org/TR/webauthn-3/#sctn-large-blob-extension
"""
NAME = "largeBlobKey"
def is_supported(self, ctap):
return self.NAME in ctap.info.extensions and ctap.info.options.get(
"largeBlobs", False
)
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
data = AuthenticatorExtensionsLargeBlobInputs.from_dict(
cast(Mapping | None, inputs.get("largeBlob"))
)
if data:
if data.read or data.write:
raise ValueError("Invalid set of parameters")
if data.support == "required" and not self.is_supported(ctap):
raise ValueError("Authenticator does not support large blob storage")
class Processor(RegistrationExtensionProcessor):
def prepare_inputs(self, pin_token):
return {LargeBlobExtension.NAME: True}
def prepare_outputs(self, response, pin_token):
return {
"largeBlob": AuthenticatorExtensionsLargeBlobOutputs(
supported=response.large_blob_key is not None
)
}
return Processor()
def get_assertion(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
data = AuthenticatorExtensionsLargeBlobInputs.from_dict(
cast(Mapping | None, inputs.get("largeBlob"))
)
if data:
if data.support or (data.read and data.write):
raise ValueError("Invalid set of parameters")
if not self.is_supported(ctap):
raise ValueError("Authenticator does not support large blob storage")
class Processor(AuthenticationExtensionProcessor):
def prepare_outputs(self, response, pin_token):
assert data is not None # noqa: S101 needed for mypy
blob_key = response.large_blob_key
if blob_key:
if data.read:
large_blobs = LargeBlobs(ctap)
blob = large_blobs.get_blob(blob_key)
return {
"largeBlob": AuthenticatorExtensionsLargeBlobOutputs(
blob=blob
)
}
elif data.write:
large_blobs = LargeBlobs(ctap, pin_protocol, pin_token)
large_blobs.put_blob(blob_key, data.write)
return {
"largeBlob": AuthenticatorExtensionsLargeBlobOutputs(
written=True
)
}
return Processor(
(
ClientPin.PERMISSION.LARGE_BLOB_WRITE
if data.write
else ClientPin.PERMISSION(0)
),
inputs={LargeBlobExtension.NAME: True},
)
class CredBlobExtension(Ctap2Extension):
"""
Implements the Credential Blob (credBlob) CTAP2 extension.
https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credBlob-extension
"""
NAME = "credBlob"
def is_supported(self, ctap):
return self.NAME in ctap.info.extensions
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
if self.is_supported(ctap):
blob = inputs.get("credBlob")
assert ctap.info.max_cred_blob_length is not None # noqa: S101
if blob and len(blob) <= ctap.info.max_cred_blob_length:
return RegistrationExtensionProcessor(inputs={self.NAME: blob})
def get_assertion(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
if self.is_supported(ctap) and inputs.get("getCredBlob") is True:
return AuthenticationExtensionProcessor(inputs={self.NAME: True})
class CredProtectExtension(Ctap2Extension):
"""
Implements the Credential Protection CTAP2 extension.
https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-credProtect-extension
"""
@unique
class POLICY(Enum):
OPTIONAL = "userVerificationOptional"
OPTIONAL_WITH_LIST = "userVerificationOptionalWithCredentialIDList"
REQUIRED = "userVerificationRequired"
@classmethod
def str2int(cls, policy: str) -> int:
return list(cls).index(cls(policy)) + 1
NAME = "credProtect"
def is_supported(self, ctap):
return self.NAME in ctap.info.extensions
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
policy = inputs.get("credentialProtectionPolicy")
if policy:
index = CredProtectExtension.POLICY.str2int(policy)
enforce = inputs.get("enforceCredentialProtectionPolicy", False)
if enforce and not self.is_supported(ctap) and index > 1:
raise ValueError("Authenticator does not support Credential Protection")
return RegistrationExtensionProcessor(inputs={self.NAME: index})
class MinPinLengthExtension(Ctap2Extension):
"""
Implements the Minimum PIN Length (minPinLength) CTAP2 extension.
https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-minpinlength-extension
"""
NAME = "minPinLength"
def is_supported(self, ctap):
# NB: There is no key in the extensions field.
return "setMinPINLength" in ctap.info.options
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
if self.is_supported(ctap) and inputs.get(self.NAME) is True:
return RegistrationExtensionProcessor(inputs={self.NAME: True})
class PinComplexityPolicyExtension(Ctap2Extension):
"""
Implements the PIN Complexity Policy (pinComplexityPolicy) CTAP2 extension.
https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-minpinlength-extension
"""
NAME = "pinComplexityPolicy"
def is_supported(self, ctap):
return self.NAME in ctap.info.extensions
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
if self.is_supported(ctap) and inputs.get(self.NAME) is True:
return RegistrationExtensionProcessor(inputs={self.NAME: True})
@dataclass(eq=False, frozen=True)
class CredentialPropertiesOutput(_JsonDataObject):
"""Client outputs for credProps."""
rk: bool | None = None
class CredPropsExtension(Ctap2Extension):
"""
Implements the Credential Properties (credProps) WebAuthn extension.
https://www.w3.org/TR/webauthn-3/#sctn-authenticator-credential-properties-extension
"""
NAME = "credProps"
def is_supported(self, ctap):
# NB: There is no key in the extensions field.
return True
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
if inputs.get(self.NAME) is True:
selection = (
options.authenticator_selection or AuthenticatorSelectionCriteria()
)
rk = selection.resident_key == ResidentKeyRequirement.REQUIRED or (
selection.resident_key == ResidentKeyRequirement.PREFERRED
and ctap.info.options.get("rk")
)
return RegistrationExtensionProcessor(
outputs={self.NAME: CredentialPropertiesOutput(rk=rk)}
)
@dataclass(eq=False, frozen=True)
class PaymentCurrencyAmount(_JsonDataObject):
currency: str
value: str
@dataclass(eq=False, frozen=True)
class PaymentCredentialInstrument(_JsonDataObject):
display_name: str
icon: str
icon_must_be_shown: bool = True
@dataclass(eq=False, frozen=True)
class AuthenticationExtensionsPaymentInputs(_JsonDataObject):
"""Client inputs for payment."""
is_payment: bool | None = None
rp_id: str | None = None
top_origin: str | None = None
payee_name: str | None = None
payee_origin: str | None = None
total: PaymentCurrencyAmount | None = None
instrument: PaymentCredentialInstrument | None = None
class ThirdPartyPaymentExtension(Ctap2Extension):
"""
Implements the Third Party Payment (thirdPartyPayment) CTAP2.2 extension.
https://fidoalliance.org/specs/fido-v2.2-ps-20250228/fido-client-to-authenticator-protocol-v2.2-ps-20250228.html#sctn-thirdPartyPayment-extension
Note that most of the processing for the WebAuthn extension needs to be done by the
client, see:
https://www.w3.org/TR/secure-payment-confirmation/#sctn-collectedclientpaymentdata-dictionary
As such, this extension is not included in the default extensions list, and should
not be used without a client that supports the WebAuthn payment extension.
"""
NAME = "thirdPartyPayment"
def is_supported(self, ctap):
return self.NAME in ctap.info.extensions
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
data = AuthenticationExtensionsPaymentInputs.from_dict(
cast(Mapping | None, inputs.get("payment"))
)
if self.is_supported(ctap) and data and data.is_payment:
return RegistrationExtensionProcessor(inputs={self.NAME: True})
def get_assertion(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
data = AuthenticationExtensionsPaymentInputs.from_dict(
cast(Mapping | None, inputs.get("payment"))
)
if self.is_supported(ctap) and data and data.is_payment:
return AuthenticationExtensionProcessor(inputs={self.NAME: True})
@dataclass(eq=False, frozen=True)
class _SignGenerateKeyInputs(_JsonDataObject):
algorithms: Sequence[int]
@dataclass(eq=False, frozen=True)
class _SignSignInputs(_JsonDataObject):
key_handle: bytes
tbs: bytes
additional_args: bytes | None = None
@dataclass(eq=False, frozen=True)
class _SignInputs(_JsonDataObject):
generate_key: _SignGenerateKeyInputs | None = None
sign_by_credential: Mapping[str, _SignSignInputs] | None = None
@dataclass(eq=False, frozen=True)
class _SignGeneratedKey(_JsonDataObject):
key_handle: bytes
public_key: bytes
algorithm: int
attestation_object: AttestationObject
@dataclass(eq=False, frozen=True)
class _SignOutputs(_JsonDataObject):
generated_key: _SignGeneratedKey | None = None
signature: bytes | None = None
class PreviewSignExtension(Ctap2Extension):
"""
WARNING: This extension is currently in DRAFT.
It is to be considered experimental, and NOT part of the stable API of this library.
Implements version 4-SNAPSHOT-2025-08-21T15:00 of the sign CTAP2 extension.
https://github.com/yubicolabs/webauthn-sign-extension
"""
NAME = "previewSign"
def is_supported(self, ctap):
return self.NAME in ctap.info.extensions
def make_credential(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
data = _SignInputs.from_dict(inputs.get(self.NAME))
if not data or not self.is_supported(ctap):
return
if data.sign_by_credential or not data.generate_key:
raise ValueError("Invalid inputs")
class Processor(RegistrationExtensionProcessor):
def prepare_inputs(self, pin_token):
gk = data.generate_key
selection = (
options.authenticator_selection or AuthenticatorSelectionCriteria()
)
flags = (
0b101
if selection.user_verification
== UserVerificationRequirement.REQUIRED
else 0b001
)
outputs = {3: gk.algorithms, 4: flags}
return {PreviewSignExtension.NAME: outputs}
def prepare_outputs(self, response, pin_token):
extensions = response.auth_data.extensions or {}
data = extensions.get(PreviewSignExtension.NAME)
if not data:
return None
att_obj_bytes = response.unsigned_extension_outputs[
PreviewSignExtension.NAME
][7]
att_resp = AttestationResponse.from_dict(
cast(Mapping, cbor.decode(att_obj_bytes))
)
att_obj = AttestationObject.create(
att_resp.fmt, att_resp.auth_data, att_resp.att_stmt
)
cred_data = att_obj.auth_data.credential_data
assert cred_data is not None # noqa: S101
return {
PreviewSignExtension.NAME: _SignOutputs(
generated_key=_SignGeneratedKey(
key_handle=cred_data.credential_id,
public_key=cbor.encode(cred_data.public_key),
algorithm=data.get(3),
attestation_object=att_obj,
),
)
}
return Processor()
def get_assertion(self, ctap, options, pin_protocol):
inputs = options.extensions or {}
data = _SignInputs.from_dict(inputs.get(self.NAME))
if not data or not self.is_supported(ctap):
return
if not data.sign_by_credential or data.generate_key:
raise ValueError("Invalid inputs")
class Processor(AuthenticationExtensionProcessor):
def prepare_inputs(self, selected, pin_token):
by_creds = data.sign_by_credential
# Make sure all keys are valid IDs from allow_credentials
allow_list = options.allow_credentials
if not allow_list or not selected:
raise ValueError("sign requires allowCredentials")
ids = {websafe_encode(c.id) for c in allow_list}
if ids.difference(by_creds):
raise ValueError("keyHandleByCredential is not valid")
cred_inputs = by_creds[websafe_encode(selected.id)]
authenticator_input = {
2: cred_inputs.key_handle,
6: cred_inputs.tbs,
}
if cred_inputs.additional_args:
authenticator_input[7] = cred_inputs.additional_args
return {PreviewSignExtension.NAME: authenticator_input}
def prepare_outputs(self, response, pin_token):
extensions = response.auth_data.extensions or {}
data = extensions.get(PreviewSignExtension.NAME)
if data:
return {PreviewSignExtension.NAME: _SignOutputs(signature=data[6])}
return Processor()
_DEFAULT_EXTENSIONS = [
HmacSecretExtension(),
LargeBlobExtension(),
CredBlobExtension(),
CredProtectExtension(),
MinPinLengthExtension(),
CredPropsExtension(),
]
fido2-2.2.1/fido2/ctap2/pin.py 0000644 0000000 0000000 00000036227 15220526030 012626 0 ustar 00 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import abc
import logging
import os
from dataclasses import dataclass
from enum import IntEnum, IntFlag, unique
from threading import Event
from typing import Any, Callable, ClassVar, Mapping
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from ..cose import CoseKey
from ..utils import bytes2int, hmac_sha256, int2bytes, sha256
from .base import Ctap2
logger = logging.getLogger(__name__)
def _pad_pin(pin: str) -> bytes:
if not isinstance(pin, str):
raise ValueError(f"PIN of wrong type, expecting {str}")
if len(pin) < 4:
raise ValueError("PIN must be >= 4 characters")
pin_padded = pin.encode().ljust(64, b"\0")
pin_padded += b"\0" * (-(len(pin_padded) - 16) % 16)
if len(pin_padded) > 255:
raise ValueError("PIN must be <= 255 bytes")
return pin_padded
class PinProtocol(abc.ABC):
VERSION: ClassVar[int]
@abc.abstractmethod
def encapsulate(self, peer_cose_key: CoseKey) -> tuple[Mapping[int, Any], bytes]:
"""Generates an encapsulation of the public key.
Returns the message to transmit and the shared secret.
"""
@abc.abstractmethod
def encrypt(self, key: bytes, plaintext: bytes) -> bytes:
"""Encrypts data"""
@abc.abstractmethod
def decrypt(self, key: bytes, ciphertext: bytes) -> bytes:
"""Decrypts encrypted data"""
@abc.abstractmethod
def authenticate(self, key: bytes, message: bytes) -> bytes:
"""Computes a MAC of the given message."""
@abc.abstractmethod
def validate_token(self, token: bytes) -> bytes:
"""Validates that a token is well-formed.
Returns the token, or if invalid, raises a ValueError.
"""
@dataclass
class _PinUv:
protocol: PinProtocol
token: bytes
class PinProtocolV1(PinProtocol):
"""Implementation of the CTAP2 PIN/UV protocol v1.
:param ctap: An instance of a CTAP2 object.
:cvar VERSION: The version number of the PIV/UV protocol.
:cvar IV: An all-zero IV used for some cryptographic operations.
"""
VERSION = 1
IV = b"\x00" * 16
def kdf(self, z: bytes) -> bytes:
return sha256(z)
def encapsulate(self, peer_cose_key):
be = default_backend()
sk = ec.generate_private_key(ec.SECP256R1(), be)
pn = sk.public_key().public_numbers()
key_agreement = {
1: 2,
3: -25, # Per the spec, "although this is NOT the algorithm actually used"
-1: 1,
-2: int2bytes(pn.x, 32),
-3: int2bytes(pn.y, 32),
}
x = bytes2int(peer_cose_key[-2])
y = bytes2int(peer_cose_key[-3])
pk = ec.EllipticCurvePublicNumbers(x, y, ec.SECP256R1()).public_key(be)
shared_secret = self.kdf(sk.exchange(ec.ECDH(), pk)) # x-coordinate, 32b
return key_agreement, shared_secret
def _get_cipher_v1(self, secret):
be = default_backend()
return Cipher(algorithms.AES(secret), modes.CBC(PinProtocolV1.IV), be)
def encrypt(self, key, plaintext):
cipher = self._get_cipher_v1(key)
enc = cipher.encryptor()
return enc.update(plaintext) + enc.finalize()
def decrypt(self, key, ciphertext):
cipher = self._get_cipher_v1(key)
dec = cipher.decryptor()
return dec.update(ciphertext) + dec.finalize()
def authenticate(self, key, message):
return hmac_sha256(key, message)[:16]
def validate_token(self, token):
if len(token) not in (16, 32):
raise ValueError("PIN/UV token must be 16 or 32 bytes")
return token
class PinProtocolV2(PinProtocolV1):
"""Implementation of the CTAP2 PIN/UV protocol v2.
:param ctap: An instance of a CTAP2 object.
:cvar VERSION: The version number of the PIV/UV protocol.
:cvar IV: An all-zero IV used for some cryptographic operations.
"""
VERSION = 2
HKDF_SALT = b"\x00" * 32
HKDF_INFO_HMAC = b"CTAP2 HMAC key"
HKDF_INFO_AES = b"CTAP2 AES key"
def kdf(self, z):
be = default_backend()
hmac_key = HKDF(
algorithm=hashes.SHA256(),
length=32,
salt=PinProtocolV2.HKDF_SALT,
info=PinProtocolV2.HKDF_INFO_HMAC,
backend=be,
).derive(z)
aes_key = HKDF(
algorithm=hashes.SHA256(),
length=32,
salt=PinProtocolV2.HKDF_SALT,
info=PinProtocolV2.HKDF_INFO_AES,
backend=be,
).derive(z)
return hmac_key + aes_key
def _get_cipher_v2(self, secret, iv):
be = default_backend()
return Cipher(algorithms.AES(secret), modes.CBC(iv), be)
def encrypt(self, key, plaintext):
aes_key = key[32:]
iv = os.urandom(16)
cipher = self._get_cipher_v2(aes_key, iv)
enc = cipher.encryptor()
return iv + enc.update(plaintext) + enc.finalize()
def decrypt(self, key, ciphertext):
aes_key = key[32:]
iv, ciphertext = ciphertext[:16], ciphertext[16:]
cipher = self._get_cipher_v2(aes_key, iv)
dec = cipher.decryptor()
return dec.update(ciphertext) + dec.finalize()
def authenticate(self, key, message):
hmac_key = key[:32]
return hmac_sha256(hmac_key, message)
def validate_token(self, token):
if len(token) != 32:
raise ValueError("PIN/UV token must be 32 bytes")
return token
class ClientPin:
"""Implementation of the CTAP2 Client PIN API.
:param ctap: An instance of a CTAP2 object.
:param protocol: An optional instance of a PinUvAuthProtocol object. If None is
provided then the latest protocol supported by both library and Authenticator
will be used.
"""
PROTOCOLS = [PinProtocolV2, PinProtocolV1]
@unique
class CMD(IntEnum):
GET_PIN_RETRIES = 0x01
GET_KEY_AGREEMENT = 0x02
SET_PIN = 0x03
CHANGE_PIN = 0x04
GET_TOKEN_USING_PIN_LEGACY = 0x05
GET_TOKEN_USING_UV = 0x06
GET_UV_RETRIES = 0x07
GET_TOKEN_USING_PIN = 0x09
@unique
class RESULT(IntEnum):
KEY_AGREEMENT = 0x01
PIN_UV_TOKEN = 0x02
PIN_RETRIES = 0x03
POWER_CYCLE_STATE = 0x04
UV_RETRIES = 0x05
@unique
class PERMISSION(IntFlag):
MAKE_CREDENTIAL = 0x01
GET_ASSERTION = 0x02
CREDENTIAL_MGMT = 0x04
BIO_ENROLL = 0x08
LARGE_BLOB_WRITE = 0x10
AUTHENTICATOR_CFG = 0x20
PERSISTENT_CREDENTIAL_MGMT = 0x40
@staticmethod
def is_supported(info):
"""Checks if ClientPin functionality is supported.
Note that the ClientPin function is still usable without support for client
PIN functionality, as UV token may still be supported.
"""
return "clientPin" in info.options
@staticmethod
def is_token_supported(info):
"""Checks if pinUvAuthToken is supported."""
return info.options.get("pinUvAuthToken") is True
def __init__(self, ctap: Ctap2, protocol: PinProtocol | None = None):
self.ctap = ctap
if protocol is None:
for proto in ClientPin.PROTOCOLS:
if proto.VERSION in ctap.info.pin_uv_protocols:
self.protocol: PinProtocol = proto()
break
else:
raise ValueError("No compatible PIN/UV protocols supported!")
else:
self.protocol = protocol
def _get_shared_secret(self):
resp = self.ctap.client_pin(
self.protocol.VERSION, ClientPin.CMD.GET_KEY_AGREEMENT
)
pk = resp[ClientPin.RESULT.KEY_AGREEMENT]
return self.protocol.encapsulate(pk)
def get_pin_token(
self,
pin: str,
permissions: ClientPin.PERMISSION | None = None,
permissions_rpid: str | None = None,
) -> bytes:
"""Get a PIN/UV token from the authenticator using PIN.
:param pin: The PIN of the authenticator.
:param permissions: The permissions to associate with the token.
:param permissions_rpid: The permissions RPID to associate with the token.
:return: A PIN/UV token.
"""
if not ClientPin.is_supported(self.ctap.info):
raise ValueError("Authenticator does not support get_pin_token")
key_agreement, shared_secret = self._get_shared_secret()
pin_hash = sha256(pin.encode())[:16]
pin_hash_enc = self.protocol.encrypt(shared_secret, pin_hash)
if ClientPin.is_token_supported(self.ctap.info) and permissions is not None:
cmd = ClientPin.CMD.GET_TOKEN_USING_PIN
else:
cmd = ClientPin.CMD.GET_TOKEN_USING_PIN_LEGACY
# Ignore permissions if not supported
permissions = None
permissions_rpid = None
resp = self.ctap.client_pin(
self.protocol.VERSION,
cmd,
key_agreement=key_agreement,
pin_hash_enc=pin_hash_enc,
permissions=permissions,
permissions_rpid=permissions_rpid,
)
pin_token_enc = resp[ClientPin.RESULT.PIN_UV_TOKEN]
logger.debug(f"Got PIN token for permissions: {permissions}")
return self.protocol.validate_token(
self.protocol.decrypt(shared_secret, pin_token_enc)
)
def get_uv_token(
self,
permissions: ClientPin.PERMISSION | None = None,
permissions_rpid: str | None = None,
event: Event | None = None,
on_keepalive: Callable[[int], None] | None = None,
) -> bytes:
"""Get a PIN/UV token from the authenticator using built-in UV.
:param permissions: The permissions to associate with the token.
:param permissions_rpid: The permissions RPID to associate with the token.
:param event: An optional threading.Event which can be used to cancel
the invocation.
:param on_keepalive: An optional callback to handle keep-alive messages
from the authenticator. The function is only called once for
consecutive keep-alive messages with the same status.
:return: A PIN/UV token.
"""
if not ClientPin.is_token_supported(self.ctap.info):
raise ValueError("Authenticator does not support get_uv_token")
key_agreement, shared_secret = self._get_shared_secret()
resp = self.ctap.client_pin(
self.protocol.VERSION,
ClientPin.CMD.GET_TOKEN_USING_UV,
key_agreement=key_agreement,
permissions=permissions,
permissions_rpid=permissions_rpid,
event=event,
on_keepalive=on_keepalive,
)
pin_token_enc = resp[ClientPin.RESULT.PIN_UV_TOKEN]
logger.debug(f"Got UV token for permissions: {permissions}")
return self.protocol.validate_token(
self.protocol.decrypt(shared_secret, pin_token_enc)
)
def get_pin_retries(self) -> tuple[int, int | None]:
"""Get the number of PIN retries remaining.
:return: A tuple of the number of PIN attempts remaining until the
authenticator is locked, and the power cycle state, if available.
"""
resp = self.ctap.client_pin(
self.protocol.VERSION, ClientPin.CMD.GET_PIN_RETRIES
)
return (
resp[ClientPin.RESULT.PIN_RETRIES],
resp.get(ClientPin.RESULT.POWER_CYCLE_STATE),
)
def get_uv_retries(self) -> int:
"""Get the number of UV retries remaining.
:return: A tuple of the number of UV attempts remaining until the
authenticator is locked, and the power cycle state, if available.
"""
resp = self.ctap.client_pin(self.protocol.VERSION, ClientPin.CMD.GET_UV_RETRIES)
return resp[ClientPin.RESULT.UV_RETRIES]
def set_pin(self, pin: str) -> None:
"""Set the PIN of the autenticator.
This only works when no PIN is set. To change the PIN when set, use
change_pin.
:param pin: A PIN to set.
"""
if not ClientPin.is_supported(self.ctap.info):
raise ValueError("Authenticator does not support ClientPin")
key_agreement, shared_secret = self._get_shared_secret()
pin_enc = self.protocol.encrypt(shared_secret, _pad_pin(pin))
pin_uv_param = self.protocol.authenticate(shared_secret, pin_enc)
self.ctap.client_pin(
self.protocol.VERSION,
ClientPin.CMD.SET_PIN,
key_agreement=key_agreement,
new_pin_enc=pin_enc,
pin_uv_param=pin_uv_param,
)
logger.info("PIN has been set")
def change_pin(self, old_pin: str, new_pin: str) -> None:
"""Change the PIN of the authenticator.
This only works when a PIN is already set. If no PIN is set, use
set_pin.
:param old_pin: The currently set PIN.
:param new_pin: The new PIN to set.
"""
if not ClientPin.is_supported(self.ctap.info):
raise ValueError("Authenticator does not support ClientPin")
key_agreement, shared_secret = self._get_shared_secret()
pin_hash = sha256(old_pin.encode())[:16]
pin_hash_enc = self.protocol.encrypt(shared_secret, pin_hash)
new_pin_enc = self.protocol.encrypt(shared_secret, _pad_pin(new_pin))
pin_uv_param = self.protocol.authenticate(
shared_secret, new_pin_enc + pin_hash_enc
)
self.ctap.client_pin(
self.protocol.VERSION,
ClientPin.CMD.CHANGE_PIN,
key_agreement=key_agreement,
pin_hash_enc=pin_hash_enc,
new_pin_enc=new_pin_enc,
pin_uv_param=pin_uv_param,
)
logger.info("PIN has been changed")
fido2-2.2.1/fido2/features.py 0000644 0000000 0000000 00000005471 15220526030 012642 0 ustar 00 # Copyright (c) 2022 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
import warnings
class FeatureNotEnabledError(Exception):
pass
class _Feature:
def __init__(self, name: str, desc: str):
self._enabled: bool | None = None
self._name = name
self._desc = desc
@property
def enabled(self) -> bool:
self.warn()
return self._enabled is True
@enabled.setter
def enabled(self, value: bool) -> None:
if self._enabled is not None:
raise ValueError(
f"{self._name} has already been configured with {self._enabled}"
)
self._enabled = value
def require(self, state=True) -> None:
if self._enabled != state:
self.warn()
raise FeatureNotEnabledError(
f"Usage requires {self._name}.enabled = {state}"
)
def warn(self) -> None:
if self._enabled is None:
warnings.warn(
f"""Deprecated use of {self._name}.
You are using deprecated functionality which will change in the next major version of
python-fido2. You can opt-in to use the new functionality now by adding the following
to your code somewhere where it gets executed prior to using the affected functionality:
import fido2.features
fido2.features.{self._name}.enabled = True
To silence this warning but retain the current behavior, instead set enabled to False:
fido2.features.{self._name}.enabled = False
{self._desc}
""",
DeprecationWarning,
)
fido2-2.2.1/fido2/hid/__init__.py 0000644 0000000 0000000 00000022320 15220526030 013317 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import logging
import os
import struct
import sys
from enum import IntEnum, IntFlag, unique
from threading import Event
from typing import Callable, Iterator
from ..ctap import STATUS, CtapDevice, CtapError
from ..utils import LOG_LEVEL_TRAFFIC
from .base import CtapHidConnection, HidDescriptor
logger = logging.getLogger(__name__)
if sys.platform == "linux":
from . import linux as backend
elif sys.platform == "win32":
from . import windows as backend
elif sys.platform == "darwin":
from . import macos as backend
# The following have version numbers at the end
elif sys.platform.startswith("freebsd"):
from . import freebsd as backend
elif sys.platform.startswith("netbsd"):
from . import netbsd as backend
elif sys.platform.startswith("openbsd"):
from . import openbsd as backend
else:
raise Exception("Unsupported platform")
list_descriptors = backend.list_descriptors
get_descriptor = backend.get_descriptor
open_connection = backend.open_connection
class ConnectionFailure(Exception):
"""The CTAP connection failed or returned an invalid response."""
@unique
class CTAPHID(IntEnum):
PING = 0x01
MSG = 0x03
LOCK = 0x04
INIT = 0x06
WINK = 0x08
CBOR = 0x10
CANCEL = 0x11
ERROR = 0x3F
KEEPALIVE = 0x3B
VENDOR_FIRST = 0x40
@unique
class CAPABILITY(IntFlag):
WINK = 0x01
LOCK = 0x02 # Not used
CBOR = 0x04
NMSG = 0x08
def supported(self, flags: CAPABILITY) -> bool:
return bool(flags & self)
TYPE_INIT = 0x80
class CtapHidDevice(CtapDevice):
"""
CtapDevice implementation using the HID transport.
:cvar descriptor: Device descriptor.
"""
def __init__(self, descriptor: HidDescriptor, connection: CtapHidConnection):
self.descriptor = descriptor
self._packet_size = descriptor.report_size_out
self._connection = connection
nonce = os.urandom(8)
self._channel_id = 0xFFFFFFFF
response = self.call(CTAPHID.INIT, nonce)
r_nonce, response = response[:8], response[8:]
if r_nonce != nonce:
raise ConnectionFailure("Wrong nonce")
(
self._channel_id,
self._u2fhid_version,
v1,
v2,
v3,
self._capabilities,
) = struct.unpack_from(">IBBBBB", response)
self._device_version = (v1, v2, v3)
def __repr__(self):
return f"CtapHidDevice({self.descriptor.path!r})"
@property
def version(self) -> int:
"""CTAP HID protocol version."""
return self._u2fhid_version
@property
def device_version(self) -> tuple[int, int, int]:
"""Device version number."""
return self._device_version
@property
def capabilities(self) -> int:
"""Capabilities supported by the device."""
return self._capabilities
@property
def product_name(self) -> str | None:
"""Product name of device."""
return self.descriptor.product_name
@property
def serial_number(self) -> str | None:
"""Serial number of device."""
return self.descriptor.serial_number
def _send_cancel(self):
packet = struct.pack(">IB", self._channel_id, TYPE_INIT | CTAPHID.CANCEL).ljust(
self._packet_size, b"\0"
)
logger.log(LOG_LEVEL_TRAFFIC, "SEND: %s", packet.hex())
self._connection.write_packet(packet)
def call(
self,
cmd: int,
data: bytes = b"",
event: Event | None = None,
on_keepalive: Callable[[STATUS], None] | None = None,
) -> bytes:
event = event or Event()
while True:
try:
return self._do_call(cmd, data, event, on_keepalive)
except CtapError as e:
if e.code == CtapError.ERR.CHANNEL_BUSY:
if not event.wait(0.1):
logger.warning("CTAP channel busy, trying again...")
continue # Keep retrying on BUSY while not cancelled
raise
def _do_call(self, cmd, data, event, on_keepalive):
remaining = data
seq = 0
# Send request
header = struct.pack(">IBH", self._channel_id, TYPE_INIT | cmd, len(remaining))
while remaining or seq == 0:
size = min(len(remaining), self._packet_size - len(header))
body, remaining = remaining[:size], remaining[size:]
packet = header + body
logger.log(LOG_LEVEL_TRAFFIC, "SEND: %s", packet.hex())
self._connection.write_packet(packet.ljust(self._packet_size, b"\0"))
header = struct.pack(">IB", self._channel_id, 0x7F & seq)
seq += 1
try:
# Read response
seq = 0
r_len = 0
response = b""
last_ka = None
while True:
if event.is_set():
# Cancel
logger.debug("Sending cancel...")
self._send_cancel()
recv = self._connection.read_packet()
logger.log(LOG_LEVEL_TRAFFIC, "RECV: %s", recv.hex())
r_channel = struct.unpack_from(">I", recv)[0]
recv = recv[4:]
if r_channel != self._channel_id:
raise ConnectionFailure("Wrong channel")
if not response: # Initialization packet
r_cmd, r_len = struct.unpack_from(">BH", recv)
recv = recv[3:]
if r_cmd == TYPE_INIT | cmd:
pass # first data packet
elif r_cmd == TYPE_INIT | CTAPHID.KEEPALIVE:
try:
ka_status = STATUS(struct.unpack_from(">B", recv)[0])
logger.debug(f"Got keepalive status: {ka_status:02x}")
except ValueError:
raise ConnectionFailure("Invalid keepalive status")
if on_keepalive and ka_status != last_ka:
last_ka = ka_status
on_keepalive(ka_status)
continue
elif r_cmd == TYPE_INIT | CTAPHID.ERROR:
raise CtapError(struct.unpack_from(">B", recv)[0])
else:
raise CtapError(CtapError.ERR.INVALID_COMMAND)
else: # Continuation packet
r_seq = struct.unpack_from(">B", recv)[0]
recv = recv[1:]
if r_seq != seq & 0x7F:
raise ConnectionFailure("Wrong sequence number")
seq += 1
response += recv
if len(response) >= r_len:
break
return response[:r_len]
except KeyboardInterrupt:
logger.debug("Keyboard interrupt, cancelling...")
self._send_cancel()
raise
def wink(self) -> None:
"""Causes the authenticator to blink."""
self.call(CTAPHID.WINK)
def ping(self, msg: bytes = b"Hello FIDO") -> bytes:
"""Sends data to the authenticator, which echoes it back.
:param msg: The data to send.
:return: The response from the authenticator.
"""
return self.call(CTAPHID.PING, msg)
def lock(self, lock_time: int = 10) -> None:
"""Locks the channel."""
self.call(CTAPHID.LOCK, struct.pack(">B", lock_time))
def close(self) -> None:
self._connection.close()
@classmethod
def list_devices(cls) -> Iterator[CtapHidDevice]:
for d in list_descriptors():
yield cls(d, open_connection(d))
def list_devices() -> Iterator[CtapHidDevice]:
return CtapHidDevice.list_devices()
def open_device(path) -> CtapHidDevice:
descriptor = get_descriptor(path)
return CtapHidDevice(descriptor, open_connection(descriptor))
fido2-2.2.1/fido2/hid/base.py 0000644 0000000 0000000 00000010640 15220526030 012474 0 ustar 00 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import abc
import os
import struct
from dataclasses import dataclass
FIDO_USAGE_PAGE = 0xF1D0
FIDO_USAGE = 0x1
@dataclass
class HidDescriptor:
path: str | bytes
vid: int
pid: int
report_size_in: int
report_size_out: int
product_name: str | None
serial_number: str | None
class CtapHidConnection(abc.ABC):
@abc.abstractmethod
def read_packet(self) -> bytes:
"""Reads a CTAP HID packet"""
@abc.abstractmethod
def write_packet(self, data: bytes) -> None:
"""Writes a CTAP HID packet"""
@abc.abstractmethod
def close(self) -> None:
"""Closes the connection"""
class FileCtapHidConnection(CtapHidConnection):
"""Basic CtapHidConnection implementation which uses a path to a file descriptor"""
def __init__(self, descriptor):
self.handle = os.open(descriptor.path, os.O_RDWR)
self.descriptor = descriptor
def close(self):
os.close(self.handle)
def write_packet(self, data):
if os.write(self.handle, data) != len(data):
raise OSError("failed to write entire packet")
def read_packet(self):
return os.read(self.handle, self.descriptor.report_size_in)
REPORT_DESCRIPTOR_KEY_MASK = 0xFC
SIZE_MASK = ~REPORT_DESCRIPTOR_KEY_MASK
OUTPUT_ITEM = 0x90
INPUT_ITEM = 0x80
COLLECTION_ITEM = 0xA0
REPORT_COUNT = 0x94
REPORT_SIZE = 0x74
USAGE_PAGE = 0x04
USAGE = 0x08
def parse_report_descriptor(data: bytes) -> tuple[int, int]:
# Parse report descriptor data
usage, usage_page = None, None
max_input_size, max_output_size = None, None
report_count, report_size = None, None
remaining = 4
while data and remaining:
head, data = struct.unpack_from(">B", data)[0], data[1:]
key, size = REPORT_DESCRIPTOR_KEY_MASK & head, SIZE_MASK & head
value = struct.unpack_from("
HIDIOCGRAWINFO = 0x40085520
HIDIOCGRDESC = 0x2000551F
HIDIOCGRDESCSIZE = 0x4004551E
HIDIOCGRAWNAME_128 = 0x40805521
HIDIOCGRAWUNIQ_64 = 0x40405525
class usb_gen_descriptor(ctypes.Structure):
_fields_ = [
(
"ugd_data",
ctypes.c_void_p,
), # TODO: check what COMPAT_32BIT in C header means
("ugd_lang_id", ctypes.c_uint16),
("ugd_maxlen", ctypes.c_uint16),
("ugd_actlen", ctypes.c_uint16),
("ugd_offset", ctypes.c_uint16),
("ugd_config_index", ctypes.c_uint8),
("ugd_string_index", ctypes.c_uint8),
("ugd_iface_index", ctypes.c_uint8),
("ugd_altif_index", ctypes.c_uint8),
("ugd_endpt_index", ctypes.c_uint8),
("ugd_report_type", ctypes.c_uint8),
("reserved", ctypes.c_uint8 * 8),
]
class HidrawCtapHidConnection(FileCtapHidConnection):
def write_packet(self, data):
# Prepend the report ID
super().write_packet(b"\0" + data)
def open_connection(descriptor):
if descriptor.path.find(devdir + "hidraw") == 0:
return HidrawCtapHidConnection(descriptor)
else:
return FileCtapHidConnection(descriptor)
def _get_report_data(fd, report_type):
data = ctypes.create_string_buffer(4096)
desc = usb_gen_descriptor(
ugd_data=ctypes.addressof(data),
ugd_maxlen=ctypes.sizeof(data),
ugd_report_type=report_type,
)
ret = libc.ioctl(fd, USB_GET_REPORT_DESC, ctypes.byref(desc))
if ret != 0:
raise ValueError("ioctl failed")
return data.raw[: desc.ugd_actlen]
def _read_descriptor(vid, pid, name, serial, path):
fd = os.open(path, os.O_RDONLY)
data = _get_report_data(fd, 3)
os.close(fd)
max_in_size, max_out_size = parse_report_descriptor(data)
return HidDescriptor(path, vid, pid, max_in_size, max_out_size, name, serial)
@dataclass
class _UhidDevice:
name: str
path: str
vendor_id: int | None = None
product_id: int | None = None
serial_number: str | None = None
product_desc: str | None = None
def _enumerate():
for uhid in glob.glob(devdir + "uhid?*"):
index = uhid[len(devdir) + len("uhid") :]
if not index.isdigit():
continue
pnpinfo = ("dev.uhid." + index + ".%pnpinfo").encode()
desc = ("dev.uhid." + index + ".%desc").encode()
ovalue = ctypes.create_string_buffer(1024)
olen = ctypes.c_size_t(ctypes.sizeof(ovalue))
key = ctypes.c_char_p(pnpinfo)
retval = libc.sysctlbyname(key, ovalue, ctypes.byref(olen), None, None)
if retval != 0:
continue
dev_name = uhid[len(devdir) :]
dev_path = uhid
value = ovalue.value[: olen.value].decode()
m = vendor_re.search(value)
dev_vendor_id = int(m.group(1), 16) if m else None
m = product_re.search(value)
dev_product_id = int(m.group(1), 16) if m else None
m = sernum_re.search(value)
dev_serial_number = m.group(1) if m else None
key = ctypes.c_char_p(desc)
retval = libc.sysctlbyname(key, ovalue, ctypes.byref(olen), None, None)
if retval == 0:
dev_product_desc = ovalue.value[: olen.value].decode() or None
else:
dev_product_desc = None
yield _UhidDevice(
dev_name,
dev_path,
dev_vendor_id,
dev_product_id,
dev_serial_number,
dev_product_desc,
)
def get_hidraw_descriptor(path):
with open(path, "rb") as f:
# Read VID, PID
buf = array("B", [0] * (4 + 2 + 2))
fcntl.ioctl(f, HIDIOCGRAWINFO, buf, True)
_, vid, pid = struct.unpack(" 1 else None
# Read unique ID
try:
buf = array("B", [0] * 65)
fcntl.ioctl(f, HIDIOCGRAWUNIQ_64, buf, True)
length = buf.index(0) + 1 # emulate ioctl return value
serial = (
bytearray(buf[: (length - 1)]).decode("utf-8") if length > 1 else None
)
except OSError:
serial = None
# Read report descriptor
buf = array("B", [0] * 4)
fcntl.ioctl(f, HIDIOCGRDESCSIZE, buf, True)
size = struct.unpack(" 1 else None
# Read unique ID
try:
buf = array("B", [0] * 64)
length = fcntl.ioctl(f, HIDIOCGRAWUNIQ, buf, True)
serial = (
bytearray(buf[: (length - 1)]).decode("utf-8") if length > 1 else None
)
except OSError:
serial = None
# Read report descriptor
buf = array("B", [0] * 4)
fcntl.ioctl(f, HIDIOCGRDESCSIZE, buf, True)
size = struct.unpack(" bool:
"""Filters out any revoked metadata entry.
This filter will remove any metadata entry which has a status_report with
the REVOKED status.
"""
return not any(
r.status == AuthenticatorStatus.REVOKED for r in entry.status_reports
)
def filter_attestation_key_compromised(
entry: MetadataBlobPayloadEntry, certificate_chain: Sequence[bytes]
) -> bool:
"""Denies any attestation that has a compromised attestation key.
This filter checks the status reports of a metadata entry and ensures the
attestation isn't signed by a key which is marked as compromised.
"""
for r in entry.status_reports:
if r.status == AuthenticatorStatus.ATTESTATION_KEY_COMPROMISE:
if r.certificate in certificate_chain:
return False
return True
_last_entry: ContextVar[MetadataBlobPayloadEntry | None] = ContextVar("_last_entry")
class MdsAttestationVerifier(AttestationVerifier):
"""MDS3 implementation of an AttestationVerifier.
The entry_filter is an optional predicate used to filter which metadata entries to
include in the lookup for verification. By default, a filter that removes any
entries that have a status report indicating the authenticator is REVOKED is used.
See: filter_revoked
The attestation_filter is an optional predicate used to filter metadata entries
while performing attestation validation, and may take into account the
Authenticators attestation trust_chain. By default, a filter that will fail any
verification that has a trust_chain where one of the certificates is marked as
compromised by the metadata statement is used.
See: filter_attestation_key_compromised
NOTE: The attestation_filter is not used when calling find_entry_by_aaguid nor
find_entry_by_chain as no attestation is being verified!
Setting either filter (including setting it to None) will replace it, removing
the default behavior.
:param blob: The MetadataBlobPayload to query for device metadata.
:param entry_filter: An optional filter to exclude entries from lookup.
:param attestation_filter: An optional filter to fail verification for a given
attestation.
:param attestation_types: A list of Attestation types to support.
"""
def __init__(
self,
blob: MetadataBlobPayload,
entry_filter: EntryFilter | None = filter_revoked,
attestation_filter: LookupFilter | None = filter_attestation_key_compromised,
attestation_types: Sequence[Attestation] | None = None,
):
super().__init__(attestation_types)
self._attestation_filter = attestation_filter or (
lambda a, b: True
) # No-op for None
entries = (
[e for e in blob.entries if entry_filter(e)]
if entry_filter
else blob.entries
)
self._aaguid_table = {e.aaguid: e for e in entries if e.aaguid}
self._ski_table = {
ski: e
for e in entries
for ski in e.attestation_certificate_key_identifiers or []
}
def find_entry_by_aaguid(self, aaguid: Aaguid) -> MetadataBlobPayloadEntry | None:
"""Find an entry by AAGUID.
Returns a MetadataBlobPayloadEntry with a matching aaguid field, if found.
This method does not take the attestation_filter into account.
"""
return self._aaguid_table.get(aaguid)
def find_entry_by_chain(
self, certificate_chain: Sequence[bytes]
) -> MetadataBlobPayloadEntry | None:
"""Find an entry by trust chain.
Returns a MetadataBlobPayloadEntry containing an
attestationCertificateKeyIdentifier which matches one of the certificates in the
given chain, if found.
This method does not take the attestation_filter into account.
"""
for der in certificate_chain:
cert = x509.load_der_x509_certificate(der, default_backend())
ski = x509.SubjectKeyIdentifier.from_public_key(cert.public_key()).digest
if ski in self._ski_table:
return self._ski_table[ski]
return None
def ca_lookup(self, attestation_result, auth_data):
assert auth_data.credential_data is not None # noqa: S101
aaguid = auth_data.credential_data.aaguid
if aaguid:
logging.debug(f"Using AAGUID: {aaguid} to look up metadata")
entry = self.find_entry_by_aaguid(aaguid)
else:
logging.debug("Using trust_path chain to look up metadata")
entry = self.find_entry_by_chain(attestation_result.trust_path)
if entry:
logging.debug(f"Found entry: {entry}")
# Check attestation filter
if not self._attestation_filter(entry, attestation_result.trust_path):
logging.debug("Matched entry did not pass attestation filter")
return None
# Figure out which root to use
if not entry.metadata_statement:
logging.warning(
"Matched entry has no metadata_statement, can't validate!"
)
return None
issuer = x509.load_der_x509_certificate(
attestation_result.trust_path[-1], default_backend()
).issuer
for root in entry.metadata_statement.attestation_root_certificates:
subject = x509.load_der_x509_certificate(
root, default_backend()
).subject
if subject == issuer:
_last_entry.set(entry)
return root
logger.info(f"No attestation root matching subject: {issuer}")
return None
def find_entry(
self, attestation_object: AttestationObject, client_data_hash: bytes
) -> MetadataBlobPayloadEntry | None:
"""Lookup a Metadata entry based on an Attestation.
Returns the first Metadata entry matching the given attestation and verifies it,
including checking it against the attestation_filter.
"""
token = _last_entry.set(None)
try:
self.verify_attestation(attestation_object, client_data_hash)
return _last_entry.get()
except UntrustedAttestation:
return None
finally:
_last_entry.reset(token)
def parse_blob(blob: bytes, trust_root: bytes | None) -> MetadataBlobPayload:
"""Parse a FIDO MDS3 blob and verifies its signature.
See https://fidoalliance.org/metadata/ for details on obtaining the blob, as well as
the CA certificate used to sign it.
The resulting MetadataBlobPayload can be used to lookup metadata entries for
specific Authenticators, or used with the MdsAttestationVerifier to verify that the
attestation from a WebAuthn registration is valid and included in the metadata blob.
NOTE: If trust_root is None, the signature of the blob will NOT be verified!
"""
message, signature_b64 = blob.rsplit(b".", 1)
signature = websafe_decode(signature_b64)
header, payload = (json.loads(websafe_decode(x)) for x in message.split(b"."))
if trust_root is not None:
# Verify trust chain
chain = [b64decode(c) for c in header.get("x5c", [])]
chain += [trust_root]
verify_x509_chain(chain)
# Verify blob signature using leaf
leaf = x509.load_der_x509_certificate(chain[0], default_backend())
public_key = CoseKey.for_name(header["alg"]).from_cryptography_key(
leaf.public_key()
)
public_key.verify(message, signature)
else:
logger.warning(
"Parsing MDS blob without trust anchor, CONTENT IS NOT VERIFIED!"
)
return MetadataBlobPayload.from_dict(payload)
fido2-2.2.1/fido2/payment.py 0000644 0000000 0000000 00000013131 15220526030 012471 0 ustar 00 # Copyright (c) 2025 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from dataclasses import dataclass
from .client import DefaultClientDataCollector
from .ctap2.extensions import (
AuthenticationExtensionsPaymentInputs,
PaymentCredentialInstrument,
PaymentCurrencyAmount,
)
from .utils import _JsonDataObject
from .webauthn import (
AuthenticatorAttachment,
CollectedClientData,
PublicKeyCredentialCreationOptions,
PublicKeyCredentialRequestOptions,
ResidentKeyRequirement,
UserVerificationRequirement,
)
"""
Implements client and server functionality for the WebAuthn "payment" extension.
https://www.w3.org/TR/secure-payment-confirmation/#sctn-payment-extension-registration
"""
@dataclass(eq=False, frozen=True, kw_only=True)
class CollectedClientAdditionalPaymentData(_JsonDataObject):
rp_id: str
top_origin: str
payee_name: str | None = None
payee_origin: str | None = None
total: PaymentCurrencyAmount
instrument: PaymentCredentialInstrument
@dataclass(init=False, frozen=True, kw_only=True)
class CollectedClientPaymentData(CollectedClientData):
payment: CollectedClientAdditionalPaymentData
def __init__(self, serialized: bytes):
super().__init__(serialized)
payment = CollectedClientAdditionalPaymentData.from_dict(self._data["payment"])
object.__setattr__(self, "payment", payment)
@classmethod
def create(
cls,
type: str,
challenge: bytes | str,
origin: str,
cross_origin: bool = False,
**kwargs,
) -> CollectedClientData:
return super().create(
type=type,
challenge=challenge,
origin=origin,
cross_origin=cross_origin,
payment=dict(kwargs.pop("payment")),
**kwargs,
)
class PaymentClientDataCollector(DefaultClientDataCollector):
"""ClientDataCollector for the WebAuthn "payment" extension.
This class can be used together with the CTAP2 "thirdPartyPayment" extension to
enable third-party payment confirmation. It collects the necessary client data and
validates the options provided by the client.
"""
def collect_client_data(self, options):
# Get the effective RP ID from the request options, falling back to the origin
rp_id = self.get_rp_id(options, self._origin)
inputs = options.extensions or {}
data = AuthenticationExtensionsPaymentInputs.from_dict(inputs.get("payment"))
if data and data.is_payment:
if isinstance(options, PublicKeyCredentialCreationOptions):
sel = options.authenticator_selection
if (
not sel
or sel.authenticator_attachment
not in (
AuthenticatorAttachment.PLATFORM,
# This is against the spec, but we need cross-platform
AuthenticatorAttachment.CROSS_PLATFORM,
)
or sel.resident_key
not in (
ResidentKeyRequirement.REQUIRED,
ResidentKeyRequirement.PREFERRED,
)
or sel.user_verification != UserVerificationRequirement.REQUIRED
):
raise ValueError("Invalid options for payment extension")
elif isinstance(options, PublicKeyCredentialRequestOptions):
# NOTE: We skip RP ID validation, as per the spec
return (
CollectedClientPaymentData.create(
type="payment.get",
origin=self._origin,
challenge=options.challenge,
payment=CollectedClientAdditionalPaymentData(
rp_id=data.rp_id,
top_origin=data.top_origin,
payee_name=data.payee_name,
payee_origin=data.payee_origin,
total=data.total,
instrument=data.instrument,
),
),
rp_id,
)
# Validate that the RP ID is valid for the given origin
self.verify_rp_id(rp_id, self._origin)
return super().collect_client_data(options)
fido2-2.2.1/fido2/pcsc.py 0000644 0000000 0000000 00000022465 15220526030 011756 0 ustar 00 # Copyright (c) 2019 Yubico AB
# Copyright (c) 2019 Oleg Moiseenko
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import annotations
import logging
import struct
from threading import Event
from typing import Callable, Iterator
from smartcard import System
from smartcard.CardConnection import CardConnection
from smartcard.CardConnectionDecorator import CardConnectionDecorator
from smartcard.pcsc.PCSCExceptions import ListReadersException
from .ctap import STATUS, CtapDevice, CtapError
from .hid import CAPABILITY, CTAPHID
from .utils import LOG_LEVEL_TRAFFIC
AID_FIDO = b"\xa0\x00\x00\x06\x47\x2f\x00\x01"
SW_SUCCESS = (0x90, 0x00)
SW_UPDATE = (0x91, 0x00)
SW1_MORE_DATA = 0x61
logger = logging.getLogger(__name__)
class CtapPcscDevice(CtapDevice):
"""
CtapDevice implementation using pyscard (PCSC).
This class is intended for use with NFC readers.
"""
def __init__(self, connection: CardConnection | CardConnectionDecorator, name: str):
self._name = name
self._capabilities = CAPABILITY(0)
self.use_ext_apdu = False
self.use_nfcctap_getresponse = True
self._conn = connection
self.connect()
try: # Probe for CTAP2 by calling GET_INFO
self.call(CTAPHID.CBOR, b"\x04")
self._capabilities |= CAPABILITY.CBOR
except CtapError:
if not self._capabilities:
raise ValueError("Unsupported device")
def connect(self):
self._conn.connect()
self._select()
def __repr__(self):
return f"CtapPcscDevice({self._name})"
@property
def version(self) -> int:
"""CTAPHID protocol version."""
return 2 if CAPABILITY.CBOR in self._capabilities else 1
@property
def capabilities(self) -> CAPABILITY:
"""Capabilities supported by the device."""
return self._capabilities
@property
def product_name(self) -> str | None:
"""Product name of device."""
return None
@property
def serial_number(self) -> int | None:
"""Serial number of device."""
return None
def get_atr(self) -> bytes:
"""Get the ATR/ATS of the connected card."""
return bytes(self._conn.getATR() or b"")
def apdu_exchange(
self, apdu: bytes, protocol: int | None = None
) -> tuple[bytes, int, int]:
"""Exchange data with smart card.
:param apdu: byte string. data to exchange with card
:return: byte string. response from card
"""
logger.log(LOG_LEVEL_TRAFFIC, "SEND: %s", apdu.hex())
resp, sw1, sw2 = self._conn.transmit(list(apdu), protocol)
response = bytes(resp)
logger.log(LOG_LEVEL_TRAFFIC, "RECV: %s SW=%02X%02X", response.hex(), sw1, sw2)
return response, sw1, sw2
def control_exchange(self, control_code: int, control_data: bytes = b"") -> bytes:
"""Sends control sequence to reader's driver.
:param control_code: int. code to send to reader driver.
:param control_data: byte string. data to send to driver
:return: byte string. response
"""
logger.log(LOG_LEVEL_TRAFFIC, "Send control: %s", control_data.hex())
response = self._conn.control(control_code, list(control_data))
response = bytes(response)
logger.log(LOG_LEVEL_TRAFFIC, "Control response: %s", response.hex())
return response
def _select(self) -> None:
apdu = b"\x00\xa4\x04\x00" + struct.pack("!B", len(AID_FIDO)) + AID_FIDO
resp, sw1, sw2 = self._chained_apdu_exchange(apdu)
if (sw1, sw2) != SW_SUCCESS:
raise ValueError("FIDO applet selection failure.")
if resp == b"U2F_V2":
self._capabilities |= CAPABILITY.NMSG
def _chain_apdus(
self, cla: int, ins: int, p1: int, p2: int, data: bytes = b""
) -> tuple[bytes, int, int]:
if self.use_ext_apdu:
header = struct.pack("!BBBBBH", cla, ins, p1, p2, 0x00, len(data))
resp, sw1, sw2 = self.apdu_exchange(header + data)
return resp, sw1, sw2
else:
while len(data) > 250:
to_send, data = data[:250], data[250:]
header = struct.pack("!BBBBB", 0x10 | cla, ins, p1, p2, len(to_send))
resp, sw1, sw2 = self.apdu_exchange(header + to_send)
if (sw1, sw2) != SW_SUCCESS:
return resp, sw1, sw2
apdu = struct.pack("!BBBB", cla, ins, p1, p2)
if data:
apdu += struct.pack("!B", len(data)) + data
resp, sw1, sw2 = self.apdu_exchange(apdu + b"\x00")
while sw1 == SW1_MORE_DATA:
apdu = b"\x00\xc0\x00\x00" + struct.pack("!B", sw2) # sw2 == le
lres, sw1, sw2 = self.apdu_exchange(apdu)
resp += lres
return resp, sw1, sw2
def _chained_apdu_exchange(self, apdu: bytes) -> tuple[bytes, int, int]:
if len(apdu) >= 7 and apdu[4] == 0:
# Extended APDU
data_len = struct.unpack("!H", apdu[5:7])[0]
data = apdu[7 : 7 + data_len]
elif len(apdu) == 4:
data = b""
else:
# Short APDU
data_len = apdu[4]
data = apdu[5 : 5 + data_len]
(cla, ins, p1, p2) = apdu[:4]
return self._chain_apdus(cla, ins, p1, p2, data)
def _call_apdu(self, apdu: bytes) -> bytes:
resp, sw1, sw2 = self._chained_apdu_exchange(apdu)
return resp + struct.pack("!BB", sw1, sw2)
def _call_cbor(
self,
data: bytes = b"",
event: Event | None = None,
on_keepalive: Callable[[STATUS], None] | None = None,
) -> bytes:
event = event or Event()
# NFCCTAP_MSG
p1 = 0x80 if self.use_nfcctap_getresponse else 0x00
resp, sw1, sw2 = self._chain_apdus(0x80, 0x10, p1, 0x00, data)
last_ka = None
# NFCCTAP_GETRESPONSE
p1 = 0x00
try:
while (sw1, sw2) == SW_UPDATE:
ka_status = STATUS(resp[0])
if on_keepalive and last_ka != ka_status:
last_ka = ka_status
on_keepalive(ka_status)
if event.wait(0.1):
p1 = 0x11 # cancel
resp, sw1, sw2 = self._chain_apdus(0x80, 0x11, p1, 0x00)
except KeyboardInterrupt:
logger.debug("Keyboard interrupt, cancelling...")
self._chain_apdus(0x80, 0x11, 0x11, 0x00)
raise
if (sw1, sw2) != SW_SUCCESS:
raise CtapError(CtapError.ERR.OTHER) # TODO: Map from SW error
return resp
def call(
self,
cmd: int,
data: bytes = b"",
event: Event | None = None,
on_keepalive: Callable[[STATUS], None] | None = None,
) -> bytes:
if cmd == CTAPHID.CBOR:
return self._call_cbor(data, event, on_keepalive)
elif cmd == CTAPHID.MSG:
return self._call_apdu(data)
else:
raise CtapError(CtapError.ERR.INVALID_COMMAND)
def close(self, release: bool = False) -> None:
self._conn.disconnect()
if release and hasattr(self._conn, "release"):
self._conn.release()
@classmethod
def list_devices(cls, name: str = "") -> Iterator[CtapPcscDevice]:
for reader in _list_readers():
if name in reader.name:
try:
yield cls(reader.createConnection(), reader.name)
except Exception as e:
logger.debug("Error %r", e)
def _list_readers():
try:
return System.readers()
except ListReadersException as e:
# If the PCSC system has restarted the context might be stale, try
# forcing a new context (This happens on Windows if the last reader is
# removed):
try:
from smartcard.pcsc.PCSCContext import PCSCContext # type: ignore
PCSCContext.instance = None
return System.readers()
except ImportError:
# As of pyscard 2.2.2 the PCSCContext singleton has been removed
raise e
fido2-2.2.1/fido2/public_suffix_list.dat 0000644 0000000 0000000 00001212522 15220526030 015037 0 ustar 00 // This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at https://mozilla.org/MPL/2.0/.
// Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
// rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
// VERSION: 2026-06-24_06-18-09_UTC
// COMMIT: 18ecca5d54471f21918798da451dd8d03a18f3c7
// Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
// ===BEGIN ICANN DOMAINS===
// ac : http://nic.ac/rules.htm
ac
com.ac
edu.ac
gov.ac
mil.ac
net.ac
org.ac
// ad : https://www.iana.org/domains/root/db/ad.html
// Confirmed by Amadeu Abril i Abril (CORE) 2024-11-17
ad
// ae : https://www.iana.org/domains/root/db/ae.html
ae
ac.ae
co.ae
gov.ae
mil.ae
net.ae
org.ae
sch.ae
// aero : https://information.aero/registration/policies/dmp
aero
// 2LDs
airline.aero
airport.aero
// 2LDs (currently not accepting registration, seemingly never have)
// As of 2024-07, these are marked as reserved for potential 3LD
// registrations (clause 11 "allocated subdomains" in the 2006 TLD
// policy), but the relevant industry partners have not opened them up
// for registration. Current status can be determined from the TLD's
// policy document: 2LDs that are open for registration must list
// their policy in the TLD's policy. Any 2LD without such a policy is
// not open for registrations.
accident-investigation.aero
accident-prevention.aero
aerobatic.aero
aeroclub.aero
aerodrome.aero
agents.aero
air-surveillance.aero
air-traffic-control.aero
aircraft.aero
airtraffic.aero
ambulance.aero
association.aero
author.aero
ballooning.aero
broker.aero
caa.aero
cargo.aero
catering.aero
certification.aero
championship.aero
charter.aero
civilaviation.aero
club.aero
conference.aero
consultant.aero
consulting.aero
control.aero
council.aero
crew.aero
design.aero
dgca.aero
educator.aero
emergency.aero
engine.aero
engineer.aero
entertainment.aero
equipment.aero
exchange.aero
express.aero
federation.aero
flight.aero
freight.aero
fuel.aero
gliding.aero
government.aero
groundhandling.aero
group.aero
hanggliding.aero
homebuilt.aero
insurance.aero
journal.aero
journalist.aero
leasing.aero
logistics.aero
magazine.aero
maintenance.aero
marketplace.aero
media.aero
microlight.aero
modelling.aero
navigation.aero
parachuting.aero
paragliding.aero
passenger-association.aero
pilot.aero
press.aero
production.aero
recreation.aero
repbody.aero
res.aero
research.aero
rotorcraft.aero
safety.aero
scientist.aero
services.aero
show.aero
skydiving.aero
software.aero
student.aero
taxi.aero
trader.aero
trading.aero
trainer.aero
union.aero
workinggroup.aero
works.aero
// af : https://www.nic.af/domain-price
af
com.af
edu.af
gov.af
net.af
org.af
// ag : http://www.nic.ag/prices.htm
ag
co.ag
com.ag
net.ag
nom.ag
org.ag
// ai : http://nic.com.ai/
ai
com.ai
net.ai
off.ai
org.ai
// al : http://www.ert.gov.al/ert_alb/faq_det.html?Id=31
al
com.al
edu.al
gov.al
mil.al
net.al
org.al
// am : https://www.amnic.net/policy/en/Policy_EN.pdf
// Confirmed by ISOC AM 2024-11-18
am
co.am
com.am
commune.am
net.am
org.am
// ao : https://www.iana.org/domains/root/db/ao.html
// https://www.dns.ao/ao/
ao
co.ao
ed.ao
edu.ao
gov.ao
gv.ao
it.ao
og.ao
org.ao
pb.ao
// aq : https://www.iana.org/domains/root/db/aq.html
aq
// ar : https://nic.ar/es/nic-argentina/normativa
ar
bet.ar
com.ar
coop.ar
edu.ar
gob.ar
gov.ar
int.ar
mil.ar
musica.ar
mutual.ar
net.ar
org.ar
seg.ar
senasa.ar
tur.ar
// arpa : https://www.iana.org/domains/root/db/arpa.html
// Confirmed by registry 2008-06-18
arpa
e164.arpa
home.arpa
in-addr.arpa
ip6.arpa
iris.arpa
uri.arpa
urn.arpa
// as : https://www.iana.org/domains/root/db/as.html
as
gov.as
// asia : https://www.iana.org/domains/root/db/asia.html
asia
// at : https://www.iana.org/domains/root/db/at.html
// Confirmed by registry 2008-06-17
at
ac.at
sth.ac.at
co.at
gv.at
or.at
// au : https://www.iana.org/domains/root/db/au.html
// https://www.auda.org.au/
// Confirmed by registry 2025-07-16
au
// 2LDs
asn.au
com.au
edu.au
gov.au
id.au
net.au
org.au
// Historic 2LDs (closed to new registration, but sites still exist)
conf.au
oz.au
// CGDNs : https://www.auda.org.au/au-domain-names/the-different-au-domain-names/state-and-territory-domain-names/
act.au
nsw.au
nt.au
qld.au
sa.au
tas.au
vic.au
wa.au
// 3LDs
act.edu.au
catholic.edu.au
// eq.edu.au - Removed at the request of the Queensland Department of Education
nsw.edu.au
nt.edu.au
qld.edu.au
sa.edu.au
tas.edu.au
vic.edu.au
wa.edu.au
// act.gov.au - Bug 984824 - Removed at request of Greg Tankard
// nsw.gov.au - Bug 547985 - Removed at request of
// nt.gov.au - Bug 940478 - Removed at request of Greg Connors
qld.gov.au
sa.gov.au
tas.gov.au
vic.gov.au
wa.gov.au
// 4LDs
// education.tas.edu.au - Removed at the request of the Department of Education Tasmania
// schools.nsw.edu.au - Removed at the request of the New South Wales Department of Education.
// aw : https://www.iana.org/domains/root/db/aw.html
aw
com.aw
// ax : https://www.iana.org/domains/root/db/ax.html
ax
// az : https://www.iana.org/domains/root/db/az.html
// Confirmed via https://whois.az/?page_id=10 2024-12-11
az
biz.az
co.az
com.az
edu.az
gov.az
info.az
int.az
mil.az
name.az
net.az
org.az
pp.az
// No longer available for registration, however domains exist as of 2024-12-11
// see https://whois.az/?page_id=783
pro.az
// ba : https://www.iana.org/domains/root/db/ba.html
ba
com.ba
edu.ba
gov.ba
mil.ba
net.ba
org.ba
// bb : https://www.iana.org/domains/root/db/bb.html
bb
biz.bb
co.bb
com.bb
edu.bb
gov.bb
info.bb
net.bb
org.bb
store.bb
tv.bb
// bd : https://www.iana.org/domains/root/db/bd.html
// Confirmed by registry
bd
ac.bd
ai.bd
co.bd
com.bd
edu.bd
gov.bd
id.bd
info.bd
it.bd
mil.bd
net.bd
org.bd
sch.bd
tv.bd
// be : https://www.iana.org/domains/root/db/be.html
// Confirmed by registry 2008-06-08
be
ac.be
// bf : https://www.iana.org/domains/root/db/bf.html
bf
gov.bf
// bg : https://www.iana.org/domains/root/db/bg.html
// https://www.register.bg/user/static/rules/en/index.html
bg
0.bg
1.bg
2.bg
3.bg
4.bg
5.bg
6.bg
7.bg
8.bg
9.bg
a.bg
b.bg
c.bg
d.bg
e.bg
f.bg
g.bg
h.bg
i.bg
j.bg
k.bg
l.bg
m.bg
n.bg
o.bg
p.bg
q.bg
r.bg
s.bg
t.bg
u.bg
v.bg
w.bg
x.bg
y.bg
z.bg
// bh : https://www.iana.org/domains/root/db/bh.html
bh
com.bh
edu.bh
gov.bh
net.bh
org.bh
// bi : https://www.iana.org/domains/root/db/bi.html
// http://whois.nic.bi/
bi
co.bi
com.bi
edu.bi
or.bi
org.bi
// biz : https://www.iana.org/domains/root/db/biz.html
biz
// bj : https://nic.bj/bj-suffixes.txt
// Submitted by registry
bj
africa.bj
agro.bj
architectes.bj
assur.bj
avocats.bj
co.bj
com.bj
eco.bj
econo.bj
edu.bj
info.bj
loisirs.bj
money.bj
net.bj
org.bj
ote.bj
restaurant.bj
resto.bj
tourism.bj
univ.bj
// bm : https://www.bermudanic.bm/domain-registration/index.php
bm
com.bm
edu.bm
gov.bm
net.bm
org.bm
// bn : http://www.bnnic.bn/faqs
bn
com.bn
edu.bn
gov.bn
net.bn
org.bn
// bo : https://nic.bo
// Confirmed by registry 2024-11-19
bo
com.bo
edu.bo
gob.bo
int.bo
mil.bo
net.bo
org.bo
tv.bo
web.bo
// Social Domains
academia.bo
agro.bo
arte.bo
blog.bo
bolivia.bo
ciencia.bo
cooperativa.bo
democracia.bo
deporte.bo
ecologia.bo
economia.bo
empresa.bo
indigena.bo
industria.bo
info.bo
medicina.bo
movimiento.bo
musica.bo
natural.bo
nombre.bo
noticias.bo
patria.bo
plurinacional.bo
politica.bo
profesional.bo
pueblo.bo
revista.bo
salud.bo
tecnologia.bo
tksat.bo
transporte.bo
wiki.bo
// br : http://registro.br/dominio/categoria.html
// Submitted by registry
br
9guacu.br
abc.br
adm.br
adv.br
agr.br
aju.br
am.br
anani.br
aparecida.br
api.br
app.br
arq.br
art.br
ato.br
b.br
barueri.br
belem.br
bet.br
bhz.br
bib.br
bio.br
blog.br
bmd.br
boavista.br
bsb.br
campinagrande.br
campinas.br
caxias.br
cim.br
cng.br
cnt.br
com.br
contagem.br
coop.br
coz.br
cri.br
cuiaba.br
curitiba.br
def.br
des.br
det.br
dev.br
ecn.br
eco.br
edu.br
emp.br
enf.br
eng.br
esp.br
etc.br
eti.br
far.br
feira.br
flog.br
floripa.br
fm.br
fnd.br
fortal.br
fot.br
foz.br
fst.br
g12.br
geo.br
ggf.br
goiania.br
gov.br
// gov.br 26 states + df https://en.wikipedia.org/wiki/States_of_Brazil
ac.gov.br
al.gov.br
am.gov.br
ap.gov.br
ba.gov.br
ce.gov.br
df.gov.br
es.gov.br
go.gov.br
ma.gov.br
mg.gov.br
ms.gov.br
mt.gov.br
pa.gov.br
pb.gov.br
pe.gov.br
pi.gov.br
pr.gov.br
rj.gov.br
rn.gov.br
ro.gov.br
rr.gov.br
rs.gov.br
sc.gov.br
se.gov.br
sp.gov.br
to.gov.br
gru.br
ia.br
imb.br
ind.br
inf.br
jab.br
jampa.br
jdf.br
joinville.br
jor.br
jus.br
leg.br
leilao.br
lel.br
log.br
londrina.br
macapa.br
maceio.br
manaus.br
maringa.br
mat.br
med.br
mil.br
morena.br
mp.br
mus.br
natal.br
net.br
niteroi.br
*.nom.br
not.br
ntr.br
odo.br
ong.br
org.br
osasco.br
palmas.br
poa.br
ppg.br
pro.br
psc.br
psi.br
pvh.br
qsl.br
radio.br
rec.br
recife.br
rep.br
ribeirao.br
rio.br
riobranco.br
riopreto.br
salvador.br
sampa.br
santamaria.br
santoandre.br
saobernardo.br
saogonca.br
seg.br
sjc.br
slg.br
slz.br
social.br
sorocaba.br
srv.br
taxi.br
tc.br
tec.br
teo.br
the.br
tmp.br
trd.br
tur.br
tv.br
udi.br
vet.br
vix.br
vlog.br
wiki.br
xyz.br
zlg.br
// bs : http://www.nic.bs/rules.html
bs
com.bs
edu.bs
gov.bs
net.bs
org.bs
// bt : https://www.iana.org/domains/root/db/bt.html
bt
com.bt
edu.bt
gov.bt
net.bt
org.bt
// bv : No registrations at this time.
// Submitted by registry
bv
// bw : https://www.iana.org/domains/root/db/bw.html
// https://nic.net.bw/bw-name-structure
bw
ac.bw
co.bw
gov.bw
net.bw
org.bw
// by : https://www.iana.org/domains/root/db/by.html
// http://tld.by/rules_2006_en.html
// list of other 2nd level tlds ?
by
gov.by
mil.by
// Official information does not indicate that com.by is a reserved
// second-level domain, but it's being used as one (see www.google.com.by and
// www.yahoo.com.by, for example), so we list it here for safety's sake.
com.by
// http://hoster.by/
of.by
// bz : https://www.iana.org/domains/root/db/bz.html
// http://www.belizenic.bz/
bz
co.bz
com.bz
edu.bz
gov.bz
net.bz
org.bz
// ca : https://www.iana.org/domains/root/db/ca.html
ca
// ca geographical names
ab.ca
bc.ca
mb.ca
nb.ca
nf.ca
nl.ca
ns.ca
nt.ca
nu.ca
on.ca
pe.ca
qc.ca
sk.ca
yk.ca
// gc.ca: https://en.wikipedia.org/wiki/.gc.ca
// see also: http://registry.gc.ca/en/SubdomainFAQ
gc.ca
// cat : https://www.iana.org/domains/root/db/cat.html
cat
// cc : https://www.iana.org/domains/root/db/cc.html
cc
// cd : https://www.iana.org/domains/root/db/cd.html
// https://www.nic.cd
cd
gov.cd
// cf : https://www.iana.org/domains/root/db/cf.html
cf
// cg : https://www.iana.org/domains/root/db/cg.html
cg
// ch : https://www.iana.org/domains/root/db/ch.html
ch
// ci : https://www.iana.org/domains/root/db/ci.html
ci
ac.ci
aéroport.ci
asso.ci
co.ci
com.ci
ed.ci
edu.ci
go.ci
gouv.ci
int.ci
net.ci
or.ci
org.ci
// ck : https://www.iana.org/domains/root/db/ck.html
*.ck
!www.ck
// cl : https://www.nic.cl
// Confirmed by .CL registry
cl
co.cl
gob.cl
gov.cl
mil.cl
// cm : https://www.iana.org/domains/root/db/cm.html plus bug 981927
cm
co.cm
com.cm
gov.cm
net.cm
// cn : https://www.iana.org/domains/root/db/cn.html
// Submitted by registry
cn
ac.cn
com.cn
edu.cn
gov.cn
mil.cn
net.cn
org.cn
公司.cn
網絡.cn
网络.cn
// cn geographic names
ah.cn
bj.cn
cq.cn
fj.cn
gd.cn
gs.cn
gx.cn
gz.cn
ha.cn
hb.cn
he.cn
hi.cn
hk.cn
hl.cn
hn.cn
jl.cn
js.cn
jx.cn
ln.cn
mo.cn
nm.cn
nx.cn
qh.cn
sc.cn
sd.cn
sh.cn
sn.cn
sx.cn
tj.cn
tw.cn
xj.cn
xz.cn
yn.cn
zj.cn
// co : https://www.iana.org/domains/root/db/co.html
// https://www.cointernet.com.co/como-funciona-un-dominio-restringido
// Confirmed by registry 2024-11-18
co
com.co
edu.co
gov.co
mil.co
net.co
nom.co
org.co
// com : https://www.iana.org/domains/root/db/com.html
com
// coop : https://www.iana.org/domains/root/db/coop.html
coop
// cr : https://nic.cr/capitulo-1-registro-de-un-nombre-de-dominio/
cr
ac.cr
co.cr
ed.cr
fi.cr
go.cr
or.cr
sa.cr
// cu : https://www.iana.org/domains/root/db/cu.html
cu
com.cu
edu.cu
gob.cu
inf.cu
nat.cu
net.cu
org.cu
// cv : https://www.iana.org/domains/root/db/cv.html
// https://ola.cv/domain-extensions-under-cv/
// Confirmed by registry 2024-11-26
cv
com.cv
edu.cv
id.cv
int.cv
net.cv
nome.cv
org.cv
publ.cv
// cw : https://www.uoc.cw/cw-registry
// Confirmed by registry 2024-11-19
cw
com.cw
edu.cw
net.cw
org.cw
// cx : https://www.iana.org/domains/root/db/cx.html
// list of other 2nd level tlds ?
cx
gov.cx
// cy : http://www.nic.cy/
// Submitted by Panayiotou Fotia
// https://nic.cy/wp-content/uploads/2024/01/Create-Request-for-domain-name-registration-1.pdf
cy
ac.cy
biz.cy
com.cy
ekloges.cy
gov.cy
ltd.cy
mil.cy
net.cy
org.cy
press.cy
pro.cy
tm.cy
// cz : https://www.iana.org/domains/root/db/cz.html
// Confirmed by registry 2025-08-06
cz
gov.cz
// de : https://www.iana.org/domains/root/db/de.html
// Confirmed by registry (with technical
// reservations) 2008-07-01
de
// dj : https://www.iana.org/domains/root/db/dj.html
dj
// dk : https://www.iana.org/domains/root/db/dk.html
// Confirmed by registry 2008-06-17
dk
// dm : https://www.iana.org/domains/root/db/dm.html
// https://nic.dm/policies/pdf/DMRulesandGuidelines2024v1.pdf
// Confirmed by registry 2024-11-19
dm
co.dm
com.dm
edu.dm
gov.dm
net.dm
org.dm
// do : https://www.iana.org/domains/root/db/do.html
do
art.do
com.do
edu.do
gob.do
gov.do
mil.do
net.do
org.do
sld.do
web.do
// dz : http://www.nic.dz/images/pdf_nic/charte.pdf
dz
art.dz
asso.dz
com.dz
edu.dz
gov.dz
net.dz
org.dz
pol.dz
soc.dz
tm.dz
// ec : https://www.nic.ec/
// Submitted by registry
ec
abg.ec
adm.ec
agron.ec
arqt.ec
art.ec
bar.ec
chef.ec
com.ec
cont.ec
cpa.ec
cue.ec
dent.ec
dgn.ec
disco.ec
doc.ec
edu.ec
eng.ec
esm.ec
fin.ec
fot.ec
gal.ec
gob.ec
gov.ec
gye.ec
ibr.ec
info.ec
k12.ec
lat.ec
loj.ec
med.ec
mil.ec
mktg.ec
mon.ec
net.ec
ntr.ec
odont.ec
org.ec
pro.ec
prof.ec
psic.ec
psiq.ec
pub.ec
rio.ec
rrpp.ec
sal.ec
tech.ec
tul.ec
tur.ec
uio.ec
vet.ec
xxx.ec
// edu : https://www.iana.org/domains/root/db/edu.html
edu
// ee : https://www.internet.ee/domains/general-domains-and-procedure-for-registration-of-sub-domains-under-general-domains
ee
aip.ee
com.ee
edu.ee
fie.ee
gov.ee
lib.ee
med.ee
org.ee
pri.ee
riik.ee
// eg : https://www.iana.org/domains/root/db/eg.html
// https://domain.eg/en/domain-rules/subdomain-names-types/
eg
ac.eg
com.eg
edu.eg
eun.eg
gov.eg
info.eg
me.eg
mil.eg
name.eg
net.eg
org.eg
sci.eg
sport.eg
tv.eg
// er : https://www.iana.org/domains/root/db/er.html
*.er
// es : https://www.dominios.es/en
es
com.es
edu.es
gob.es
nom.es
org.es
// et : https://www.iana.org/domains/root/db/et.html
et
biz.et
com.et
edu.et
gov.et
info.et
name.et
net.et
org.et
// eu : https://www.iana.org/domains/root/db/eu.html
eu
// fi : https://www.iana.org/domains/root/db/fi.html
fi
// aland.fi : https://www.iana.org/domains/root/db/ax.html
// This domain is being phased out in favor of .ax. As there are still many
// domains under aland.fi, we still keep it on the list until aland.fi is
// completely removed.
aland.fi
// fj : https://www.iana.org/domains/root/db/fj.html
fj
ac.fj
biz.fj
com.fj
edu.fj
gov.fj
id.fj
info.fj
mil.fj
name.fj
net.fj
org.fj
pro.fj
// fk : https://www.iana.org/domains/root/db/fk.html
*.fk
// fm : https://www.iana.org/domains/root/db/fm.html
fm
com.fm
edu.fm
net.fm
org.fm
// fo : https://www.iana.org/domains/root/db/fo.html
fo
// fr : https://www.afnic.fr/ https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf
fr
asso.fr
com.fr
gouv.fr
nom.fr
prd.fr
tm.fr
// Other SLDs now selfmanaged out of AFNIC range. Former "domaines sectoriels", still registration suffixes
avoues.fr
cci.fr
greta.fr
huissier-justice.fr
// ga : https://www.iana.org/domains/root/db/ga.html
ga
// gb : This registry is effectively dormant
// Submitted by registry
gb
// gd : https://www.iana.org/domains/root/db/gd.html
gd
edu.gd
gov.gd
// ge : https://nic.ge/en/administrator/the-ge-domain-regulations
// Confirmed by registry 2024-11-20
ge
com.ge
edu.ge
gov.ge
net.ge
org.ge
pvt.ge
school.ge
// gf : https://www.iana.org/domains/root/db/gf.html
gf
// gg : https://www.channelisles.net/register-1/register-direct
// Confirmed by registry 2013-11-28
gg
co.gg
net.gg
org.gg
// gh : https://www.iana.org/domains/root/db/gh.html
// https://www.nic.gh/
// Although domains directly at second level are not possible at the moment,
// they have been possible for some time and may come back.
gh
biz.gh
com.gh
edu.gh
gov.gh
mil.gh
net.gh
org.gh
// gi : http://www.nic.gi/rules.html
gi
com.gi
edu.gi
gov.gi
ltd.gi
mod.gi
org.gi
// gl : https://www.iana.org/domains/root/db/gl.html
// http://nic.gl
gl
co.gl
com.gl
edu.gl
net.gl
org.gl
// gm : http://www.nic.gm/htmlpages%5Cgm-policy.htm
gm
// gn : http://psg.com/dns/gn/gn.txt
// Submitted by registry
gn
ac.gn
com.gn
edu.gn
gov.gn
net.gn
org.gn
// gov : https://www.iana.org/domains/root/db/gov.html
gov
// gp : http://www.nic.gp/index.php?lang=en
gp
asso.gp
com.gp
edu.gp
mobi.gp
net.gp
org.gp
// gq : https://www.iana.org/domains/root/db/gq.html
gq
// gr : https://www.iana.org/domains/root/db/gr.html
// Submitted by registry
gr
com.gr
edu.gr
gov.gr
net.gr
org.gr
// gs : https://www.iana.org/domains/root/db/gs.html
gs
// gt : https://www.gt/sitio/registration_policy.php?lang=en
gt
com.gt
edu.gt
gob.gt
ind.gt
mil.gt
net.gt
org.gt
// gu : http://gadao.gov.gu/register.html
// University of Guam : https://www.uog.edu
// Submitted by uognoc@triton.uog.edu
gu
com.gu
edu.gu
gov.gu
guam.gu
info.gu
net.gu
org.gu
web.gu
// gw : https://www.iana.org/domains/root/db/gw.html
// gw : https://nic.gw/regras/
gw
// gy : https://www.iana.org/domains/root/db/gy.html
// http://registry.gy/
gy
co.gy
com.gy
edu.gy
gov.gy
net.gy
org.gy
// hk : https://www.hkirc.hk
// Submitted by registry
hk
com.hk
edu.hk
gov.hk
idv.hk
net.hk
org.hk
个人.hk
個人.hk
公司.hk
政府.hk
敎育.hk
教育.hk
箇人.hk
組織.hk
組织.hk
網絡.hk
網络.hk
组織.hk
组织.hk
网絡.hk
网络.hk
// hm : https://www.iana.org/domains/root/db/hm.html
hm
// hn : https://www.iana.org/domains/root/db/hn.html
hn
com.hn
edu.hn
gob.hn
mil.hn
net.hn
org.hn
// hr : http://www.dns.hr/documents/pdf/HRTLD-regulations.pdf
hr
com.hr
from.hr
iz.hr
name.hr
// ht : http://www.nic.ht/info/charte.cfm
ht
adult.ht
art.ht
asso.ht
com.ht
coop.ht
edu.ht
firm.ht
gouv.ht
info.ht
med.ht
net.ht
org.ht
perso.ht
pol.ht
pro.ht
rel.ht
shop.ht
// hu : https://www.iana.org/domains/root/db/hu.html
// Confirmed by registry 2008-06-12
hu
2000.hu
agrar.hu
bolt.hu
casino.hu
city.hu
co.hu
erotica.hu
erotika.hu
film.hu
forum.hu
games.hu
hotel.hu
info.hu
ingatlan.hu
jogasz.hu
konyvelo.hu
lakas.hu
media.hu
news.hu
org.hu
priv.hu
reklam.hu
sex.hu
shop.hu
sport.hu
suli.hu
szex.hu
tm.hu
tozsde.hu
utazas.hu
video.hu
// id : https://www.iana.org/domains/root/db/id.html
id
ac.id
ai.id
biz.id
co.id
desa.id
go.id
kop.id
mil.id
my.id
net.id
or.id
ponpes.id
sch.id
web.id
// xn--9tfky.id (.id, Und-Bali)
ᬩᬮᬶ.id
// ie : https://www.iana.org/domains/root/db/ie.html
ie
gov.ie
// il : http://www.isoc.org.il/domains/
// see also: https://en.isoc.org.il/il-cctld/registration-rules
// ISOC-IL (operated by .il Registry)
il
ac.il
co.il
gov.il
idf.il
k12.il
muni.il
net.il
org.il
// xn--4dbrk0ce ("Israel", Hebrew) : IL
ישראל
// xn--4dbgdty6c.xn--4dbrk0ce.
אקדמיה.ישראל
// xn--5dbhl8d.xn--4dbrk0ce.
ישוב.ישראל
// xn--8dbq2a.xn--4dbrk0ce.
צהל.ישראל
// xn--hebda8b.xn--4dbrk0ce.
ממשל.ישראל
// im : https://www.nic.im/
// Submitted by registry
im
ac.im
co.im
ltd.co.im
plc.co.im
com.im
net.im
org.im
tt.im
tv.im
// in : https://www.iana.org/domains/root/db/in.html
// see also: https://registry.in/policies
// Please note, that nic.in is not an official eTLD, but used by most
// government institutions.
// Confirmed by Gaurav Kansal 2025-11-06
in
5g.in
6g.in
ac.in
ai.in
am.in
bank.in
bihar.in
biz.in
business.in
ca.in
cn.in
co.in
com.in
coop.in
cs.in
delhi.in
dr.in
edu.in
er.in
fin.in
firm.in
gen.in
gov.in
gujarat.in
ind.in
info.in
int.in
internet.in
io.in
me.in
mil.in
net.in
nic.in
org.in
pg.in
post.in
pro.in
res.in
travel.in
tv.in
uk.in
up.in
us.in
// info : https://www.iana.org/domains/root/db/info.html
info
// int : https://www.iana.org/domains/root/db/int.html
// Confirmed by registry 2008-06-18
int
eu.int
// io : http://www.nic.io/rules.htm
io
co.io
com.io
edu.io
gov.io
mil.io
net.io
nom.io
org.io
// iq : http://www.cmc.iq/english/iq/iqregister1.htm
iq
com.iq
edu.iq
gov.iq
mil.iq
net.iq
org.iq
// ir : http://www.nic.ir/Terms_and_Conditions_ir,_Appendix_1_Domain_Rules
// Also see http://www.nic.ir/Internationalized_Domain_Names
// Two .ir entries added at request of , 2010-04-16
ir
ac.ir
co.ir
gov.ir
id.ir
net.ir
org.ir
sch.ir
// xn--mgba3a4f16a.ir (.ir, Persian YEH)
ایران.ir
// xn--mgba3a4fra.ir (.ir, Arabic YEH)
ايران.ir
// is : http://www.isnic.is/domain/rules.php
// Confirmed by registry 2024-11-17
is
// it : https://www.iana.org/domains/root/db/it.html
// https://www.nic.it/
it
edu.it
gov.it
// Regions (3.3.1)
// https://www.nic.it/en/manage-your-it/forms-and-docs -> "Assignment and Management of domain names"
abr.it
abruzzo.it
aosta-valley.it
aostavalley.it
bas.it
basilicata.it
cal.it
calabria.it
cam.it
campania.it
emilia-romagna.it
emiliaromagna.it
emr.it
friuli-v-giulia.it
friuli-ve-giulia.it
friuli-vegiulia.it
friuli-venezia-giulia.it
friuli-veneziagiulia.it
friuli-vgiulia.it
friuliv-giulia.it
friulive-giulia.it
friulivegiulia.it
friulivenezia-giulia.it
friuliveneziagiulia.it
friulivgiulia.it
fvg.it
laz.it
lazio.it
lig.it
liguria.it
lom.it
lombardia.it
lombardy.it
lucania.it
mar.it
marche.it
mol.it
molise.it
piedmont.it
piemonte.it
pmn.it
pug.it
puglia.it
sar.it
sardegna.it
sardinia.it
sic.it
sicilia.it
sicily.it
taa.it
tos.it
toscana.it
trentin-sud-tirol.it
trentin-süd-tirol.it
trentin-sudtirol.it
trentin-südtirol.it
trentin-sued-tirol.it
trentin-suedtirol.it
trentino.it
trentino-a-adige.it
trentino-aadige.it
trentino-alto-adige.it
trentino-altoadige.it
trentino-s-tirol.it
trentino-stirol.it
trentino-sud-tirol.it
trentino-süd-tirol.it
trentino-sudtirol.it
trentino-südtirol.it
trentino-sued-tirol.it
trentino-suedtirol.it
trentinoa-adige.it
trentinoaadige.it
trentinoalto-adige.it
trentinoaltoadige.it
trentinos-tirol.it
trentinostirol.it
trentinosud-tirol.it
trentinosüd-tirol.it
trentinosudtirol.it
trentinosüdtirol.it
trentinosued-tirol.it
trentinosuedtirol.it
trentinsud-tirol.it
trentinsüd-tirol.it
trentinsudtirol.it
trentinsüdtirol.it
trentinsued-tirol.it
trentinsuedtirol.it
tuscany.it
umb.it
umbria.it
val-d-aosta.it
val-daosta.it
vald-aosta.it
valdaosta.it
valle-aosta.it
valle-d-aosta.it
valle-daosta.it
valleaosta.it
valled-aosta.it
valledaosta.it
vallee-aoste.it
vallée-aoste.it
vallee-d-aoste.it
vallée-d-aoste.it
valleeaoste.it
valléeaoste.it
valleedaoste.it
valléedaoste.it
vao.it
vda.it
ven.it
veneto.it
// Provinces (3.3.2)
ag.it
agrigento.it
al.it
alessandria.it
alto-adige.it
altoadige.it
an.it
ancona.it
andria-barletta-trani.it
andria-trani-barletta.it
andriabarlettatrani.it
andriatranibarletta.it
ao.it
aosta.it
aoste.it
ap.it
aq.it
aquila.it
ar.it
arezzo.it
ascoli-piceno.it
ascolipiceno.it
asti.it
at.it
av.it
avellino.it
ba.it
balsan.it
balsan-sudtirol.it
balsan-südtirol.it
balsan-suedtirol.it
bari.it
barletta-trani-andria.it
barlettatraniandria.it
belluno.it
benevento.it
bergamo.it
bg.it
bi.it
biella.it
bl.it
bn.it
bo.it
bologna.it
bolzano.it
bolzano-altoadige.it
bozen.it
bozen-sudtirol.it
bozen-südtirol.it
bozen-suedtirol.it
br.it
brescia.it
brindisi.it
bs.it
bt.it
bulsan.it
bulsan-sudtirol.it
bulsan-südtirol.it
bulsan-suedtirol.it
bz.it
ca.it
cagliari.it
caltanissetta.it
campidano-medio.it
campidanomedio.it
campobasso.it
carbonia-iglesias.it
carboniaiglesias.it
carrara-massa.it
carraramassa.it
caserta.it
catania.it
catanzaro.it
cb.it
ce.it
cesena-forli.it
cesena-forlì.it
cesenaforli.it
cesenaforlì.it
ch.it
chieti.it
ci.it
cl.it
cn.it
co.it
como.it
cosenza.it
cr.it
cremona.it
crotone.it
cs.it
ct.it
cuneo.it
cz.it
dell-ogliastra.it
dellogliastra.it
en.it
enna.it
fc.it
fe.it
fermo.it
ferrara.it
fg.it
fi.it
firenze.it
florence.it
fm.it
foggia.it
forli-cesena.it
forlì-cesena.it
forlicesena.it
forlìcesena.it
fr.it
frosinone.it
ge.it
genoa.it
genova.it
go.it
gorizia.it
gr.it
grosseto.it
iglesias-carbonia.it
iglesiascarbonia.it
im.it
imperia.it
is.it
isernia.it
kr.it
la-spezia.it
laquila.it
laspezia.it
latina.it
lc.it
le.it
lecce.it
lecco.it
li.it
livorno.it
lo.it
lodi.it
lt.it
lu.it
lucca.it
macerata.it
mantova.it
massa-carrara.it
massacarrara.it
matera.it
mb.it
mc.it
me.it
medio-campidano.it
mediocampidano.it
messina.it
mi.it
milan.it
milano.it
mn.it
mo.it
modena.it
monza.it
monza-brianza.it
monza-e-della-brianza.it
monzabrianza.it
monzaebrianza.it
monzaedellabrianza.it
ms.it
mt.it
na.it
naples.it
napoli.it
no.it
novara.it
nu.it
nuoro.it
og.it
ogliastra.it
olbia-tempio.it
olbiatempio.it
or.it
oristano.it
ot.it
pa.it
padova.it
padua.it
palermo.it
parma.it
pavia.it
pc.it
pd.it
pe.it
perugia.it
pesaro-urbino.it
pesarourbino.it
pescara.it
pg.it
pi.it
piacenza.it
pisa.it
pistoia.it
pn.it
po.it
pordenone.it
potenza.it
pr.it
prato.it
pt.it
pu.it
pv.it
pz.it
ra.it
ragusa.it
ravenna.it
rc.it
re.it
reggio-calabria.it
reggio-emilia.it
reggiocalabria.it
reggioemilia.it
rg.it
ri.it
rieti.it
rimini.it
rm.it
rn.it
ro.it
roma.it
rome.it
rovigo.it
sa.it
salerno.it
sassari.it
savona.it
si.it
siena.it
siracusa.it
so.it
sondrio.it
sp.it
sr.it
ss.it
südtirol.it
suedtirol.it
sv.it
ta.it
taranto.it
te.it
tempio-olbia.it
tempioolbia.it
teramo.it
terni.it
tn.it
to.it
torino.it
tp.it
tr.it
trani-andria-barletta.it
trani-barletta-andria.it
traniandriabarletta.it
tranibarlettaandria.it
trapani.it
trento.it
treviso.it
trieste.it
ts.it
turin.it
tv.it
ud.it
udine.it
urbino-pesaro.it
urbinopesaro.it
va.it
varese.it
vb.it
vc.it
ve.it
venezia.it
venice.it
verbania.it
vercelli.it
verona.it
vi.it
vibo-valentia.it
vibovalentia.it
vicenza.it
viterbo.it
vr.it
vs.it
vt.it
vv.it
// je : https://www.iana.org/domains/root/db/je.html
// Confirmed by registry 2013-11-28
je
co.je
net.je
org.je
// jm : http://www.com.jm/register.html
*.jm
// jo : https://www.dns.jo/JoFamily.aspx
// Confirmed by registry 2024-11-17
jo
agri.jo
ai.jo
com.jo
edu.jo
eng.jo
fm.jo
gov.jo
mil.jo
net.jo
org.jo
per.jo
phd.jo
sch.jo
tv.jo
// jobs : https://www.iana.org/domains/root/db/jobs.html
jobs
// jp : https://www.iana.org/domains/root/db/jp.html
// http://jprs.co.jp/en/jpdomain.html
// Confirmed by registry 2024-11-22
jp
// jp organizational type names
ac.jp
ad.jp
co.jp
ed.jp
go.jp
gr.jp
lg.jp
ne.jp
or.jp
// jp prefecture type names
aichi.jp
akita.jp
aomori.jp
chiba.jp
ehime.jp
fukui.jp
fukuoka.jp
fukushima.jp
gifu.jp
gunma.jp
hiroshima.jp
hokkaido.jp
hyogo.jp
ibaraki.jp
ishikawa.jp
iwate.jp
kagawa.jp
kagoshima.jp
kanagawa.jp
kochi.jp
kumamoto.jp
kyoto.jp
mie.jp
miyagi.jp
miyazaki.jp
nagano.jp
nagasaki.jp
nara.jp
niigata.jp
oita.jp
okayama.jp
okinawa.jp
osaka.jp
saga.jp
saitama.jp
shiga.jp
shimane.jp
shizuoka.jp
tochigi.jp
tokushima.jp
tokyo.jp
tottori.jp
toyama.jp
wakayama.jp
yamagata.jp
yamaguchi.jp
yamanashi.jp
三重.jp
京都.jp
佐賀.jp
兵庫.jp
北海道.jp
千葉.jp
和歌山.jp
埼玉.jp
大分.jp
大阪.jp
奈良.jp
宮城.jp
宮崎.jp
富山.jp
山口.jp
山形.jp
山梨.jp
岐阜.jp
岡山.jp
岩手.jp
島根.jp
広島.jp
徳島.jp
愛媛.jp
愛知.jp
新潟.jp
東京.jp
栃木.jp
沖縄.jp
滋賀.jp
熊本.jp
石川.jp
神奈川.jp
福井.jp
福岡.jp
福島.jp
秋田.jp
群馬.jp
茨城.jp
長崎.jp
長野.jp
青森.jp
静岡.jp
香川.jp
高知.jp
鳥取.jp
鹿児島.jp
// jp geographic type names
// http://jprs.jp/doc/rule/saisoku-1.html
// 2024-11-22: JPRS confirmed that jp geographic type names no longer accept new registrations.
// Once all existing registrations expire (marking full discontinuation), these suffixes
// will be removed from the PSL.
*.kawasaki.jp
!city.kawasaki.jp
*.kitakyushu.jp
!city.kitakyushu.jp
*.kobe.jp
!city.kobe.jp
*.nagoya.jp
!city.nagoya.jp
*.sapporo.jp
!city.sapporo.jp
*.sendai.jp
!city.sendai.jp
*.yokohama.jp
!city.yokohama.jp
// 4th level registration
aisai.aichi.jp
ama.aichi.jp
anjo.aichi.jp
asuke.aichi.jp
chiryu.aichi.jp
chita.aichi.jp
fuso.aichi.jp
gamagori.aichi.jp
handa.aichi.jp
hazu.aichi.jp
hekinan.aichi.jp
higashiura.aichi.jp
ichinomiya.aichi.jp
inazawa.aichi.jp
inuyama.aichi.jp
isshiki.aichi.jp
iwakura.aichi.jp
kanie.aichi.jp
kariya.aichi.jp
kasugai.aichi.jp
kira.aichi.jp
kiyosu.aichi.jp
komaki.aichi.jp
konan.aichi.jp
kota.aichi.jp
mihama.aichi.jp
miyoshi.aichi.jp
nishio.aichi.jp
nisshin.aichi.jp
obu.aichi.jp
oguchi.aichi.jp
oharu.aichi.jp
okazaki.aichi.jp
owariasahi.aichi.jp
seto.aichi.jp
shikatsu.aichi.jp
shinshiro.aichi.jp
shitara.aichi.jp
tahara.aichi.jp
takahama.aichi.jp
tobishima.aichi.jp
toei.aichi.jp
togo.aichi.jp
tokai.aichi.jp
tokoname.aichi.jp
toyoake.aichi.jp
toyohashi.aichi.jp
toyokawa.aichi.jp
toyone.aichi.jp
toyota.aichi.jp
tsushima.aichi.jp
yatomi.aichi.jp
akita.akita.jp
daisen.akita.jp
fujisato.akita.jp
gojome.akita.jp
hachirogata.akita.jp
happou.akita.jp
higashinaruse.akita.jp
honjo.akita.jp
honjyo.akita.jp
ikawa.akita.jp
kamikoani.akita.jp
kamioka.akita.jp
katagami.akita.jp
kazuno.akita.jp
kitaakita.akita.jp
kosaka.akita.jp
kyowa.akita.jp
misato.akita.jp
mitane.akita.jp
moriyoshi.akita.jp
nikaho.akita.jp
noshiro.akita.jp
odate.akita.jp
oga.akita.jp
ogata.akita.jp
semboku.akita.jp
yokote.akita.jp
yurihonjo.akita.jp
aomori.aomori.jp
gonohe.aomori.jp
hachinohe.aomori.jp
hashikami.aomori.jp
hiranai.aomori.jp
hirosaki.aomori.jp
itayanagi.aomori.jp
kuroishi.aomori.jp
misawa.aomori.jp
mutsu.aomori.jp
nakadomari.aomori.jp
noheji.aomori.jp
oirase.aomori.jp
owani.aomori.jp
rokunohe.aomori.jp
sannohe.aomori.jp
shichinohe.aomori.jp
shingo.aomori.jp
takko.aomori.jp
towada.aomori.jp
tsugaru.aomori.jp
tsuruta.aomori.jp
abiko.chiba.jp
asahi.chiba.jp
chonan.chiba.jp
chosei.chiba.jp
choshi.chiba.jp
chuo.chiba.jp
funabashi.chiba.jp
futtsu.chiba.jp
hanamigawa.chiba.jp
ichihara.chiba.jp
ichikawa.chiba.jp
ichinomiya.chiba.jp
inzai.chiba.jp
isumi.chiba.jp
kamagaya.chiba.jp
kamogawa.chiba.jp
kashiwa.chiba.jp
katori.chiba.jp
katsuura.chiba.jp
kimitsu.chiba.jp
kisarazu.chiba.jp
kozaki.chiba.jp
kujukuri.chiba.jp
kyonan.chiba.jp
matsudo.chiba.jp
midori.chiba.jp
mihama.chiba.jp
minamiboso.chiba.jp
mobara.chiba.jp
mutsuzawa.chiba.jp
nagara.chiba.jp
nagareyama.chiba.jp
narashino.chiba.jp
narita.chiba.jp
noda.chiba.jp
oamishirasato.chiba.jp
omigawa.chiba.jp
onjuku.chiba.jp
otaki.chiba.jp
sakae.chiba.jp
sakura.chiba.jp
shimofusa.chiba.jp
shirako.chiba.jp
shiroi.chiba.jp
shisui.chiba.jp
sodegaura.chiba.jp
sosa.chiba.jp
tako.chiba.jp
tateyama.chiba.jp
togane.chiba.jp
tohnosho.chiba.jp
tomisato.chiba.jp
urayasu.chiba.jp
yachimata.chiba.jp
yachiyo.chiba.jp
yokaichiba.chiba.jp
yokoshibahikari.chiba.jp
yotsukaido.chiba.jp
ainan.ehime.jp
honai.ehime.jp
ikata.ehime.jp
imabari.ehime.jp
iyo.ehime.jp
kamijima.ehime.jp
kihoku.ehime.jp
kumakogen.ehime.jp
masaki.ehime.jp
matsuno.ehime.jp
matsuyama.ehime.jp
namikata.ehime.jp
niihama.ehime.jp
ozu.ehime.jp
saijo.ehime.jp
seiyo.ehime.jp
shikokuchuo.ehime.jp
tobe.ehime.jp
toon.ehime.jp
uchiko.ehime.jp
uwajima.ehime.jp
yawatahama.ehime.jp
echizen.fukui.jp
eiheiji.fukui.jp
fukui.fukui.jp
ikeda.fukui.jp
katsuyama.fukui.jp
mihama.fukui.jp
minamiechizen.fukui.jp
obama.fukui.jp
ohi.fukui.jp
ono.fukui.jp
sabae.fukui.jp
sakai.fukui.jp
takahama.fukui.jp
tsuruga.fukui.jp
wakasa.fukui.jp
ashiya.fukuoka.jp
buzen.fukuoka.jp
chikugo.fukuoka.jp
chikuho.fukuoka.jp
chikujo.fukuoka.jp
chikushino.fukuoka.jp
chikuzen.fukuoka.jp
chuo.fukuoka.jp
dazaifu.fukuoka.jp
fukuchi.fukuoka.jp
hakata.fukuoka.jp
higashi.fukuoka.jp
hirokawa.fukuoka.jp
hisayama.fukuoka.jp
iizuka.fukuoka.jp
inatsuki.fukuoka.jp
kaho.fukuoka.jp
kasuga.fukuoka.jp
kasuya.fukuoka.jp
kawara.fukuoka.jp
keisen.fukuoka.jp
koga.fukuoka.jp
kurate.fukuoka.jp
kurogi.fukuoka.jp
kurume.fukuoka.jp
minami.fukuoka.jp
miyako.fukuoka.jp
miyama.fukuoka.jp
miyawaka.fukuoka.jp
mizumaki.fukuoka.jp
munakata.fukuoka.jp
nakagawa.fukuoka.jp
nakama.fukuoka.jp
nishi.fukuoka.jp
nogata.fukuoka.jp
ogori.fukuoka.jp
okagaki.fukuoka.jp
okawa.fukuoka.jp
oki.fukuoka.jp
omuta.fukuoka.jp
onga.fukuoka.jp
onojo.fukuoka.jp
oto.fukuoka.jp
saigawa.fukuoka.jp
sasaguri.fukuoka.jp
shingu.fukuoka.jp
shinyoshitomi.fukuoka.jp
shonai.fukuoka.jp
soeda.fukuoka.jp
sue.fukuoka.jp
tachiarai.fukuoka.jp
tagawa.fukuoka.jp
takata.fukuoka.jp
toho.fukuoka.jp
toyotsu.fukuoka.jp
tsuiki.fukuoka.jp
ukiha.fukuoka.jp
umi.fukuoka.jp
usui.fukuoka.jp
yamada.fukuoka.jp
yame.fukuoka.jp
yanagawa.fukuoka.jp
yukuhashi.fukuoka.jp
aizubange.fukushima.jp
aizumisato.fukushima.jp
aizuwakamatsu.fukushima.jp
asakawa.fukushima.jp
bandai.fukushima.jp
date.fukushima.jp
fukushima.fukushima.jp
furudono.fukushima.jp
futaba.fukushima.jp
hanawa.fukushima.jp
higashi.fukushima.jp
hirata.fukushima.jp
hirono.fukushima.jp
iitate.fukushima.jp
inawashiro.fukushima.jp
ishikawa.fukushima.jp
iwaki.fukushima.jp
izumizaki.fukushima.jp
kagamiishi.fukushima.jp
kaneyama.fukushima.jp
kawamata.fukushima.jp
kitakata.fukushima.jp
kitashiobara.fukushima.jp
koori.fukushima.jp
koriyama.fukushima.jp
kunimi.fukushima.jp
miharu.fukushima.jp
mishima.fukushima.jp
namie.fukushima.jp
nango.fukushima.jp
nishiaizu.fukushima.jp
nishigo.fukushima.jp
okuma.fukushima.jp
omotego.fukushima.jp
ono.fukushima.jp
otama.fukushima.jp
samegawa.fukushima.jp
shimogo.fukushima.jp
shirakawa.fukushima.jp
showa.fukushima.jp
soma.fukushima.jp
sukagawa.fukushima.jp
taishin.fukushima.jp
tamakawa.fukushima.jp
tanagura.fukushima.jp
tenei.fukushima.jp
yabuki.fukushima.jp
yamato.fukushima.jp
yamatsuri.fukushima.jp
yanaizu.fukushima.jp
yugawa.fukushima.jp
anpachi.gifu.jp
ena.gifu.jp
gifu.gifu.jp
ginan.gifu.jp
godo.gifu.jp
gujo.gifu.jp
hashima.gifu.jp
hichiso.gifu.jp
hida.gifu.jp
higashishirakawa.gifu.jp
ibigawa.gifu.jp
ikeda.gifu.jp
kakamigahara.gifu.jp
kani.gifu.jp
kasahara.gifu.jp
kasamatsu.gifu.jp
kawaue.gifu.jp
kitagata.gifu.jp
mino.gifu.jp
minokamo.gifu.jp
mitake.gifu.jp
mizunami.gifu.jp
motosu.gifu.jp
nakatsugawa.gifu.jp
ogaki.gifu.jp
sakahogi.gifu.jp
seki.gifu.jp
sekigahara.gifu.jp
shirakawa.gifu.jp
tajimi.gifu.jp
takayama.gifu.jp
tarui.gifu.jp
toki.gifu.jp
tomika.gifu.jp
wanouchi.gifu.jp
yamagata.gifu.jp
yaotsu.gifu.jp
yoro.gifu.jp
annaka.gunma.jp
chiyoda.gunma.jp
fujioka.gunma.jp
higashiagatsuma.gunma.jp
isesaki.gunma.jp
itakura.gunma.jp
kanna.gunma.jp
kanra.gunma.jp
katashina.gunma.jp
kawaba.gunma.jp
kiryu.gunma.jp
kusatsu.gunma.jp
maebashi.gunma.jp
meiwa.gunma.jp
midori.gunma.jp
minakami.gunma.jp
naganohara.gunma.jp
nakanojo.gunma.jp
nanmoku.gunma.jp
numata.gunma.jp
oizumi.gunma.jp
ora.gunma.jp
ota.gunma.jp
shibukawa.gunma.jp
shimonita.gunma.jp
shinto.gunma.jp
showa.gunma.jp
takasaki.gunma.jp
takayama.gunma.jp
tamamura.gunma.jp
tatebayashi.gunma.jp
tomioka.gunma.jp
tsukiyono.gunma.jp
tsumagoi.gunma.jp
ueno.gunma.jp
yoshioka.gunma.jp
asaminami.hiroshima.jp
daiwa.hiroshima.jp
etajima.hiroshima.jp
fuchu.hiroshima.jp
fukuyama.hiroshima.jp
hatsukaichi.hiroshima.jp
higashihiroshima.hiroshima.jp
hongo.hiroshima.jp
jinsekikogen.hiroshima.jp
kaita.hiroshima.jp
kui.hiroshima.jp
kumano.hiroshima.jp
kure.hiroshima.jp
mihara.hiroshima.jp
miyoshi.hiroshima.jp
naka.hiroshima.jp
onomichi.hiroshima.jp
osakikamijima.hiroshima.jp
otake.hiroshima.jp
saka.hiroshima.jp
sera.hiroshima.jp
seranishi.hiroshima.jp
shinichi.hiroshima.jp
shobara.hiroshima.jp
takehara.hiroshima.jp
abashiri.hokkaido.jp
abira.hokkaido.jp
aibetsu.hokkaido.jp
akabira.hokkaido.jp
akkeshi.hokkaido.jp
asahikawa.hokkaido.jp
ashibetsu.hokkaido.jp
ashoro.hokkaido.jp
assabu.hokkaido.jp
atsuma.hokkaido.jp
bibai.hokkaido.jp
biei.hokkaido.jp
bifuka.hokkaido.jp
bihoro.hokkaido.jp
biratori.hokkaido.jp
chippubetsu.hokkaido.jp
chitose.hokkaido.jp
date.hokkaido.jp
ebetsu.hokkaido.jp
embetsu.hokkaido.jp
eniwa.hokkaido.jp
erimo.hokkaido.jp
esan.hokkaido.jp
esashi.hokkaido.jp
fukagawa.hokkaido.jp
fukushima.hokkaido.jp
furano.hokkaido.jp
furubira.hokkaido.jp
haboro.hokkaido.jp
hakodate.hokkaido.jp
hamatonbetsu.hokkaido.jp
hidaka.hokkaido.jp
higashikagura.hokkaido.jp
higashikawa.hokkaido.jp
hiroo.hokkaido.jp
hokuryu.hokkaido.jp
hokuto.hokkaido.jp
honbetsu.hokkaido.jp
horokanai.hokkaido.jp
horonobe.hokkaido.jp
ikeda.hokkaido.jp
imakane.hokkaido.jp
ishikari.hokkaido.jp
iwamizawa.hokkaido.jp
iwanai.hokkaido.jp
kamifurano.hokkaido.jp
kamikawa.hokkaido.jp
kamishihoro.hokkaido.jp
kamisunagawa.hokkaido.jp
kamoenai.hokkaido.jp
kayabe.hokkaido.jp
kembuchi.hokkaido.jp
kikonai.hokkaido.jp
kimobetsu.hokkaido.jp
kitahiroshima.hokkaido.jp
kitami.hokkaido.jp
kiyosato.hokkaido.jp
koshimizu.hokkaido.jp
kunneppu.hokkaido.jp
kuriyama.hokkaido.jp
kuromatsunai.hokkaido.jp
kushiro.hokkaido.jp
kutchan.hokkaido.jp
kyowa.hokkaido.jp
mashike.hokkaido.jp
matsumae.hokkaido.jp
mikasa.hokkaido.jp
minamifurano.hokkaido.jp
mombetsu.hokkaido.jp
moseushi.hokkaido.jp
mukawa.hokkaido.jp
muroran.hokkaido.jp
naie.hokkaido.jp
nakagawa.hokkaido.jp
nakasatsunai.hokkaido.jp
nakatombetsu.hokkaido.jp
nanae.hokkaido.jp
nanporo.hokkaido.jp
nayoro.hokkaido.jp
nemuro.hokkaido.jp
niikappu.hokkaido.jp
niki.hokkaido.jp
nishiokoppe.hokkaido.jp
noboribetsu.hokkaido.jp
numata.hokkaido.jp
obihiro.hokkaido.jp
obira.hokkaido.jp
oketo.hokkaido.jp
okoppe.hokkaido.jp
otaru.hokkaido.jp
otobe.hokkaido.jp
otofuke.hokkaido.jp
otoineppu.hokkaido.jp
oumu.hokkaido.jp
ozora.hokkaido.jp
pippu.hokkaido.jp
rankoshi.hokkaido.jp
rebun.hokkaido.jp
rikubetsu.hokkaido.jp
rishiri.hokkaido.jp
rishirifuji.hokkaido.jp
saroma.hokkaido.jp
sarufutsu.hokkaido.jp
shakotan.hokkaido.jp
shari.hokkaido.jp
shibecha.hokkaido.jp
shibetsu.hokkaido.jp
shikabe.hokkaido.jp
shikaoi.hokkaido.jp
shimamaki.hokkaido.jp
shimizu.hokkaido.jp
shimokawa.hokkaido.jp
shinshinotsu.hokkaido.jp
shintoku.hokkaido.jp
shiranuka.hokkaido.jp
shiraoi.hokkaido.jp
shiriuchi.hokkaido.jp
sobetsu.hokkaido.jp
sunagawa.hokkaido.jp
taiki.hokkaido.jp
takasu.hokkaido.jp
takikawa.hokkaido.jp
takinoue.hokkaido.jp
teshikaga.hokkaido.jp
tobetsu.hokkaido.jp
tohma.hokkaido.jp
tomakomai.hokkaido.jp
tomari.hokkaido.jp
toya.hokkaido.jp
toyako.hokkaido.jp
toyotomi.hokkaido.jp
toyoura.hokkaido.jp
tsubetsu.hokkaido.jp
tsukigata.hokkaido.jp
urakawa.hokkaido.jp
urausu.hokkaido.jp
uryu.hokkaido.jp
utashinai.hokkaido.jp
wakkanai.hokkaido.jp
wassamu.hokkaido.jp
yakumo.hokkaido.jp
yoichi.hokkaido.jp
aioi.hyogo.jp
akashi.hyogo.jp
ako.hyogo.jp
amagasaki.hyogo.jp
aogaki.hyogo.jp
asago.hyogo.jp
ashiya.hyogo.jp
awaji.hyogo.jp
fukusaki.hyogo.jp
goshiki.hyogo.jp
harima.hyogo.jp
himeji.hyogo.jp
ichikawa.hyogo.jp
inagawa.hyogo.jp
itami.hyogo.jp
kakogawa.hyogo.jp
kamigori.hyogo.jp
kamikawa.hyogo.jp
kasai.hyogo.jp
kasuga.hyogo.jp
kawanishi.hyogo.jp
miki.hyogo.jp
minamiawaji.hyogo.jp
nishinomiya.hyogo.jp
nishiwaki.hyogo.jp
ono.hyogo.jp
sanda.hyogo.jp
sannan.hyogo.jp
sasayama.hyogo.jp
sayo.hyogo.jp
shingu.hyogo.jp
shinonsen.hyogo.jp
shiso.hyogo.jp
sumoto.hyogo.jp
taishi.hyogo.jp
taka.hyogo.jp
takarazuka.hyogo.jp
takasago.hyogo.jp
takino.hyogo.jp
tamba.hyogo.jp
tatsuno.hyogo.jp
toyooka.hyogo.jp
yabu.hyogo.jp
yashiro.hyogo.jp
yoka.hyogo.jp
yokawa.hyogo.jp
ami.ibaraki.jp
asahi.ibaraki.jp
bando.ibaraki.jp
chikusei.ibaraki.jp
daigo.ibaraki.jp
fujishiro.ibaraki.jp
hitachi.ibaraki.jp
hitachinaka.ibaraki.jp
hitachiomiya.ibaraki.jp
hitachiota.ibaraki.jp
ibaraki.ibaraki.jp
ina.ibaraki.jp
inashiki.ibaraki.jp
itako.ibaraki.jp
iwama.ibaraki.jp
joso.ibaraki.jp
kamisu.ibaraki.jp
kasama.ibaraki.jp
kashima.ibaraki.jp
kasumigaura.ibaraki.jp
koga.ibaraki.jp
miho.ibaraki.jp
mito.ibaraki.jp
moriya.ibaraki.jp
naka.ibaraki.jp
namegata.ibaraki.jp
oarai.ibaraki.jp
ogawa.ibaraki.jp
omitama.ibaraki.jp
ryugasaki.ibaraki.jp
sakai.ibaraki.jp
sakuragawa.ibaraki.jp
shimodate.ibaraki.jp
shimotsuma.ibaraki.jp
shirosato.ibaraki.jp
sowa.ibaraki.jp
suifu.ibaraki.jp
takahagi.ibaraki.jp
tamatsukuri.ibaraki.jp
tokai.ibaraki.jp
tomobe.ibaraki.jp
tone.ibaraki.jp
toride.ibaraki.jp
tsuchiura.ibaraki.jp
tsukuba.ibaraki.jp
uchihara.ibaraki.jp
ushiku.ibaraki.jp
yachiyo.ibaraki.jp
yamagata.ibaraki.jp
yawara.ibaraki.jp
yuki.ibaraki.jp
anamizu.ishikawa.jp
hakui.ishikawa.jp
hakusan.ishikawa.jp
kaga.ishikawa.jp
kahoku.ishikawa.jp
kanazawa.ishikawa.jp
kawakita.ishikawa.jp
komatsu.ishikawa.jp
nakanoto.ishikawa.jp
nanao.ishikawa.jp
nomi.ishikawa.jp
nonoichi.ishikawa.jp
noto.ishikawa.jp
shika.ishikawa.jp
suzu.ishikawa.jp
tsubata.ishikawa.jp
tsurugi.ishikawa.jp
uchinada.ishikawa.jp
wajima.ishikawa.jp
fudai.iwate.jp
fujisawa.iwate.jp
hanamaki.iwate.jp
hiraizumi.iwate.jp
hirono.iwate.jp
ichinohe.iwate.jp
ichinoseki.iwate.jp
iwaizumi.iwate.jp
iwate.iwate.jp
joboji.iwate.jp
kamaishi.iwate.jp
kanegasaki.iwate.jp
karumai.iwate.jp
kawai.iwate.jp
kitakami.iwate.jp
kuji.iwate.jp
kunohe.iwate.jp
kuzumaki.iwate.jp
miyako.iwate.jp
mizusawa.iwate.jp
morioka.iwate.jp
ninohe.iwate.jp
noda.iwate.jp
ofunato.iwate.jp
oshu.iwate.jp
otsuchi.iwate.jp
rikuzentakata.iwate.jp
shiwa.iwate.jp
shizukuishi.iwate.jp
sumita.iwate.jp
tanohata.iwate.jp
tono.iwate.jp
yahaba.iwate.jp
yamada.iwate.jp
ayagawa.kagawa.jp
higashikagawa.kagawa.jp
kanonji.kagawa.jp
kotohira.kagawa.jp
manno.kagawa.jp
marugame.kagawa.jp
mitoyo.kagawa.jp
naoshima.kagawa.jp
sanuki.kagawa.jp
tadotsu.kagawa.jp
takamatsu.kagawa.jp
tonosho.kagawa.jp
uchinomi.kagawa.jp
utazu.kagawa.jp
zentsuji.kagawa.jp
akune.kagoshima.jp
amami.kagoshima.jp
hioki.kagoshima.jp
isa.kagoshima.jp
isen.kagoshima.jp
izumi.kagoshima.jp
kagoshima.kagoshima.jp
kanoya.kagoshima.jp
kawanabe.kagoshima.jp
kinko.kagoshima.jp
kouyama.kagoshima.jp
makurazaki.kagoshima.jp
matsumoto.kagoshima.jp
minamitane.kagoshima.jp
nakatane.kagoshima.jp
nishinoomote.kagoshima.jp
satsumasendai.kagoshima.jp
soo.kagoshima.jp
tarumizu.kagoshima.jp
yusui.kagoshima.jp
aikawa.kanagawa.jp
atsugi.kanagawa.jp
ayase.kanagawa.jp
chigasaki.kanagawa.jp
ebina.kanagawa.jp
fujisawa.kanagawa.jp
hadano.kanagawa.jp
hakone.kanagawa.jp
hiratsuka.kanagawa.jp
isehara.kanagawa.jp
kaisei.kanagawa.jp
kamakura.kanagawa.jp
kiyokawa.kanagawa.jp
matsuda.kanagawa.jp
minamiashigara.kanagawa.jp
miura.kanagawa.jp
nakai.kanagawa.jp
ninomiya.kanagawa.jp
odawara.kanagawa.jp
oi.kanagawa.jp
oiso.kanagawa.jp
sagamihara.kanagawa.jp
samukawa.kanagawa.jp
tsukui.kanagawa.jp
yamakita.kanagawa.jp
yamato.kanagawa.jp
yokosuka.kanagawa.jp
yugawara.kanagawa.jp
zama.kanagawa.jp
zushi.kanagawa.jp
aki.kochi.jp
geisei.kochi.jp
hidaka.kochi.jp
higashitsuno.kochi.jp
ino.kochi.jp
kagami.kochi.jp
kami.kochi.jp
kitagawa.kochi.jp
kochi.kochi.jp
mihara.kochi.jp
motoyama.kochi.jp
muroto.kochi.jp
nahari.kochi.jp
nakamura.kochi.jp
nankoku.kochi.jp
nishitosa.kochi.jp
niyodogawa.kochi.jp
ochi.kochi.jp
okawa.kochi.jp
otoyo.kochi.jp
otsuki.kochi.jp
sakawa.kochi.jp
sukumo.kochi.jp
susaki.kochi.jp
tosa.kochi.jp
tosashimizu.kochi.jp
toyo.kochi.jp
tsuno.kochi.jp
umaji.kochi.jp
yasuda.kochi.jp
yusuhara.kochi.jp
amakusa.kumamoto.jp
arao.kumamoto.jp
aso.kumamoto.jp
choyo.kumamoto.jp
gyokuto.kumamoto.jp
kamiamakusa.kumamoto.jp
kikuchi.kumamoto.jp
kumamoto.kumamoto.jp
mashiki.kumamoto.jp
mifune.kumamoto.jp
minamata.kumamoto.jp
minamioguni.kumamoto.jp
nagasu.kumamoto.jp
nishihara.kumamoto.jp
oguni.kumamoto.jp
ozu.kumamoto.jp
sumoto.kumamoto.jp
takamori.kumamoto.jp
uki.kumamoto.jp
uto.kumamoto.jp
yamaga.kumamoto.jp
yamato.kumamoto.jp
yatsushiro.kumamoto.jp
ayabe.kyoto.jp
fukuchiyama.kyoto.jp
higashiyama.kyoto.jp
ide.kyoto.jp
ine.kyoto.jp
joyo.kyoto.jp
kameoka.kyoto.jp
kamo.kyoto.jp
kita.kyoto.jp
kizu.kyoto.jp
kumiyama.kyoto.jp
kyotamba.kyoto.jp
kyotanabe.kyoto.jp
kyotango.kyoto.jp
maizuru.kyoto.jp
minami.kyoto.jp
minamiyamashiro.kyoto.jp
miyazu.kyoto.jp
muko.kyoto.jp
nagaokakyo.kyoto.jp
nakagyo.kyoto.jp
nantan.kyoto.jp
oyamazaki.kyoto.jp
sakyo.kyoto.jp
seika.kyoto.jp
tanabe.kyoto.jp
uji.kyoto.jp
ujitawara.kyoto.jp
wazuka.kyoto.jp
yamashina.kyoto.jp
yawata.kyoto.jp
asahi.mie.jp
inabe.mie.jp
ise.mie.jp
kameyama.mie.jp
kawagoe.mie.jp
kiho.mie.jp
kisosaki.mie.jp
kiwa.mie.jp
komono.mie.jp
kumano.mie.jp
kuwana.mie.jp
matsusaka.mie.jp
meiwa.mie.jp
mihama.mie.jp
minamiise.mie.jp
misugi.mie.jp
miyama.mie.jp
nabari.mie.jp
shima.mie.jp
suzuka.mie.jp
tado.mie.jp
taiki.mie.jp
taki.mie.jp
tamaki.mie.jp
toba.mie.jp
tsu.mie.jp
udono.mie.jp
ureshino.mie.jp
watarai.mie.jp
yokkaichi.mie.jp
furukawa.miyagi.jp
higashimatsushima.miyagi.jp
ishinomaki.miyagi.jp
iwanuma.miyagi.jp
kakuda.miyagi.jp
kami.miyagi.jp
kawasaki.miyagi.jp
marumori.miyagi.jp
matsushima.miyagi.jp
minamisanriku.miyagi.jp
misato.miyagi.jp
murata.miyagi.jp
natori.miyagi.jp
ogawara.miyagi.jp
ohira.miyagi.jp
onagawa.miyagi.jp
osaki.miyagi.jp
rifu.miyagi.jp
semine.miyagi.jp
shibata.miyagi.jp
shichikashuku.miyagi.jp
shikama.miyagi.jp
shiogama.miyagi.jp
shiroishi.miyagi.jp
tagajo.miyagi.jp
taiwa.miyagi.jp
tome.miyagi.jp
tomiya.miyagi.jp
wakuya.miyagi.jp
watari.miyagi.jp
yamamoto.miyagi.jp
zao.miyagi.jp
aya.miyazaki.jp
ebino.miyazaki.jp
gokase.miyazaki.jp
hyuga.miyazaki.jp
kadogawa.miyazaki.jp
kawaminami.miyazaki.jp
kijo.miyazaki.jp
kitagawa.miyazaki.jp
kitakata.miyazaki.jp
kitaura.miyazaki.jp
kobayashi.miyazaki.jp
kunitomi.miyazaki.jp
kushima.miyazaki.jp
mimata.miyazaki.jp
miyakonojo.miyazaki.jp
miyazaki.miyazaki.jp
morotsuka.miyazaki.jp
nichinan.miyazaki.jp
nishimera.miyazaki.jp
nobeoka.miyazaki.jp
saito.miyazaki.jp
shiiba.miyazaki.jp
shintomi.miyazaki.jp
takaharu.miyazaki.jp
takanabe.miyazaki.jp
takazaki.miyazaki.jp
tsuno.miyazaki.jp
achi.nagano.jp
agematsu.nagano.jp
anan.nagano.jp
aoki.nagano.jp
asahi.nagano.jp
azumino.nagano.jp
chikuhoku.nagano.jp
chikuma.nagano.jp
chino.nagano.jp
fujimi.nagano.jp
hakuba.nagano.jp
hara.nagano.jp
hiraya.nagano.jp
iida.nagano.jp
iijima.nagano.jp
iiyama.nagano.jp
iizuna.nagano.jp
ikeda.nagano.jp
ikusaka.nagano.jp
ina.nagano.jp
karuizawa.nagano.jp
kawakami.nagano.jp
kiso.nagano.jp
kisofukushima.nagano.jp
kitaaiki.nagano.jp
komagane.nagano.jp
komoro.nagano.jp
matsukawa.nagano.jp
matsumoto.nagano.jp
miasa.nagano.jp
minamiaiki.nagano.jp
minamimaki.nagano.jp
minamiminowa.nagano.jp
minowa.nagano.jp
miyada.nagano.jp
miyota.nagano.jp
mochizuki.nagano.jp
nagano.nagano.jp
nagawa.nagano.jp
nagiso.nagano.jp
nakagawa.nagano.jp
nakano.nagano.jp
nozawaonsen.nagano.jp
obuse.nagano.jp
ogawa.nagano.jp
okaya.nagano.jp
omachi.nagano.jp
omi.nagano.jp
ookuwa.nagano.jp
ooshika.nagano.jp
otaki.nagano.jp
otari.nagano.jp
sakae.nagano.jp
sakaki.nagano.jp
saku.nagano.jp
sakuho.nagano.jp
shimosuwa.nagano.jp
shinanomachi.nagano.jp
shiojiri.nagano.jp
suwa.nagano.jp
suzaka.nagano.jp
takagi.nagano.jp
takamori.nagano.jp
takayama.nagano.jp
tateshina.nagano.jp
tatsuno.nagano.jp
togakushi.nagano.jp
togura.nagano.jp
tomi.nagano.jp
ueda.nagano.jp
wada.nagano.jp
yamagata.nagano.jp
yamanouchi.nagano.jp
yasaka.nagano.jp
yasuoka.nagano.jp
chijiwa.nagasaki.jp
futsu.nagasaki.jp
goto.nagasaki.jp
hasami.nagasaki.jp
hirado.nagasaki.jp
iki.nagasaki.jp
isahaya.nagasaki.jp
kawatana.nagasaki.jp
kuchinotsu.nagasaki.jp
matsuura.nagasaki.jp
nagasaki.nagasaki.jp
obama.nagasaki.jp
omura.nagasaki.jp
oseto.nagasaki.jp
saikai.nagasaki.jp
sasebo.nagasaki.jp
seihi.nagasaki.jp
shimabara.nagasaki.jp
shinkamigoto.nagasaki.jp
togitsu.nagasaki.jp
tsushima.nagasaki.jp
unzen.nagasaki.jp
ando.nara.jp
gose.nara.jp
heguri.nara.jp
higashiyoshino.nara.jp
ikaruga.nara.jp
ikoma.nara.jp
kamikitayama.nara.jp
kanmaki.nara.jp
kashiba.nara.jp
kashihara.nara.jp
katsuragi.nara.jp
kawai.nara.jp
kawakami.nara.jp
kawanishi.nara.jp
koryo.nara.jp
kurotaki.nara.jp
mitsue.nara.jp
miyake.nara.jp
nara.nara.jp
nosegawa.nara.jp
oji.nara.jp
ouda.nara.jp
oyodo.nara.jp
sakurai.nara.jp
sango.nara.jp
shimoichi.nara.jp
shimokitayama.nara.jp
shinjo.nara.jp
soni.nara.jp
takatori.nara.jp
tawaramoto.nara.jp
tenkawa.nara.jp
tenri.nara.jp
uda.nara.jp
yamatokoriyama.nara.jp
yamatotakada.nara.jp
yamazoe.nara.jp
yoshino.nara.jp
aga.niigata.jp
agano.niigata.jp
gosen.niigata.jp
itoigawa.niigata.jp
izumozaki.niigata.jp
joetsu.niigata.jp
kamo.niigata.jp
kariwa.niigata.jp
kashiwazaki.niigata.jp
minamiuonuma.niigata.jp
mitsuke.niigata.jp
muika.niigata.jp
murakami.niigata.jp
myoko.niigata.jp
nagaoka.niigata.jp
niigata.niigata.jp
ojiya.niigata.jp
omi.niigata.jp
sado.niigata.jp
sanjo.niigata.jp
seiro.niigata.jp
seirou.niigata.jp
sekikawa.niigata.jp
shibata.niigata.jp
tagami.niigata.jp
tainai.niigata.jp
tochio.niigata.jp
tokamachi.niigata.jp
tsubame.niigata.jp
tsunan.niigata.jp
uonuma.niigata.jp
yahiko.niigata.jp
yoita.niigata.jp
yuzawa.niigata.jp
beppu.oita.jp
bungoono.oita.jp
bungotakada.oita.jp
hasama.oita.jp
hiji.oita.jp
himeshima.oita.jp
hita.oita.jp
kamitsue.oita.jp
kokonoe.oita.jp
kuju.oita.jp
kunisaki.oita.jp
kusu.oita.jp
oita.oita.jp
saiki.oita.jp
taketa.oita.jp
tsukumi.oita.jp
usa.oita.jp
usuki.oita.jp
yufu.oita.jp
akaiwa.okayama.jp
asakuchi.okayama.jp
bizen.okayama.jp
hayashima.okayama.jp
ibara.okayama.jp
kagamino.okayama.jp
kasaoka.okayama.jp
kibichuo.okayama.jp
kumenan.okayama.jp
kurashiki.okayama.jp
maniwa.okayama.jp
misaki.okayama.jp
nagi.okayama.jp
niimi.okayama.jp
nishiawakura.okayama.jp
okayama.okayama.jp
satosho.okayama.jp
setouchi.okayama.jp
shinjo.okayama.jp
shoo.okayama.jp
soja.okayama.jp
takahashi.okayama.jp
tamano.okayama.jp
tsuyama.okayama.jp
wake.okayama.jp
yakage.okayama.jp
aguni.okinawa.jp
ginowan.okinawa.jp
ginoza.okinawa.jp
gushikami.okinawa.jp
haebaru.okinawa.jp
higashi.okinawa.jp
hirara.okinawa.jp
iheya.okinawa.jp
ishigaki.okinawa.jp
ishikawa.okinawa.jp
itoman.okinawa.jp
izena.okinawa.jp
kadena.okinawa.jp
kin.okinawa.jp
kitadaito.okinawa.jp
kitanakagusuku.okinawa.jp
kumejima.okinawa.jp
kunigami.okinawa.jp
minamidaito.okinawa.jp
motobu.okinawa.jp
nago.okinawa.jp
naha.okinawa.jp
nakagusuku.okinawa.jp
nakijin.okinawa.jp
nanjo.okinawa.jp
nishihara.okinawa.jp
ogimi.okinawa.jp
okinawa.okinawa.jp
onna.okinawa.jp
shimoji.okinawa.jp
taketomi.okinawa.jp
tarama.okinawa.jp
tokashiki.okinawa.jp
tomigusuku.okinawa.jp
tonaki.okinawa.jp
urasoe.okinawa.jp
uruma.okinawa.jp
yaese.okinawa.jp
yomitan.okinawa.jp
yonabaru.okinawa.jp
yonaguni.okinawa.jp
zamami.okinawa.jp
abeno.osaka.jp
chihayaakasaka.osaka.jp
chuo.osaka.jp
daito.osaka.jp
fujiidera.osaka.jp
habikino.osaka.jp
hannan.osaka.jp
higashiosaka.osaka.jp
higashisumiyoshi.osaka.jp
higashiyodogawa.osaka.jp
hirakata.osaka.jp
ibaraki.osaka.jp
ikeda.osaka.jp
izumi.osaka.jp
izumiotsu.osaka.jp
izumisano.osaka.jp
kadoma.osaka.jp
kaizuka.osaka.jp
kanan.osaka.jp
kashiwara.osaka.jp
katano.osaka.jp
kawachinagano.osaka.jp
kishiwada.osaka.jp
kita.osaka.jp
kumatori.osaka.jp
matsubara.osaka.jp
minato.osaka.jp
minoh.osaka.jp
misaki.osaka.jp
moriguchi.osaka.jp
neyagawa.osaka.jp
nishi.osaka.jp
nose.osaka.jp
osakasayama.osaka.jp
sakai.osaka.jp
sayama.osaka.jp
sennan.osaka.jp
settsu.osaka.jp
shijonawate.osaka.jp
shimamoto.osaka.jp
suita.osaka.jp
tadaoka.osaka.jp
taishi.osaka.jp
tajiri.osaka.jp
takaishi.osaka.jp
takatsuki.osaka.jp
tondabayashi.osaka.jp
toyonaka.osaka.jp
toyono.osaka.jp
yao.osaka.jp
ariake.saga.jp
arita.saga.jp
fukudomi.saga.jp
genkai.saga.jp
hamatama.saga.jp
hizen.saga.jp
imari.saga.jp
kamimine.saga.jp
kanzaki.saga.jp
karatsu.saga.jp
kashima.saga.jp
kitagata.saga.jp
kitahata.saga.jp
kiyama.saga.jp
kouhoku.saga.jp
kyuragi.saga.jp
nishiarita.saga.jp
ogi.saga.jp
omachi.saga.jp
ouchi.saga.jp
saga.saga.jp
shiroishi.saga.jp
taku.saga.jp
tara.saga.jp
tosu.saga.jp
yoshinogari.saga.jp
arakawa.saitama.jp
asaka.saitama.jp
chichibu.saitama.jp
fujimi.saitama.jp
fujimino.saitama.jp
fukaya.saitama.jp
hanno.saitama.jp
hanyu.saitama.jp
hasuda.saitama.jp
hatogaya.saitama.jp
hatoyama.saitama.jp
hidaka.saitama.jp
higashichichibu.saitama.jp
higashimatsuyama.saitama.jp
honjo.saitama.jp
ina.saitama.jp
iruma.saitama.jp
iwatsuki.saitama.jp
kamiizumi.saitama.jp
kamikawa.saitama.jp
kamisato.saitama.jp
kasukabe.saitama.jp
kawagoe.saitama.jp
kawaguchi.saitama.jp
kawajima.saitama.jp
kazo.saitama.jp
kitamoto.saitama.jp
koshigaya.saitama.jp
kounosu.saitama.jp
kuki.saitama.jp
kumagaya.saitama.jp
matsubushi.saitama.jp
minano.saitama.jp
misato.saitama.jp
miyashiro.saitama.jp
miyoshi.saitama.jp
moroyama.saitama.jp
nagatoro.saitama.jp
namegawa.saitama.jp
niiza.saitama.jp
ogano.saitama.jp
ogawa.saitama.jp
ogose.saitama.jp
okegawa.saitama.jp
omiya.saitama.jp
otaki.saitama.jp
ranzan.saitama.jp
ryokami.saitama.jp
saitama.saitama.jp
sakado.saitama.jp
satte.saitama.jp
sayama.saitama.jp
shiki.saitama.jp
shiraoka.saitama.jp
soka.saitama.jp
sugito.saitama.jp
toda.saitama.jp
tokigawa.saitama.jp
tokorozawa.saitama.jp
tsurugashima.saitama.jp
urawa.saitama.jp
warabi.saitama.jp
yashio.saitama.jp
yokoze.saitama.jp
yono.saitama.jp
yorii.saitama.jp
yoshida.saitama.jp
yoshikawa.saitama.jp
yoshimi.saitama.jp
aisho.shiga.jp
gamo.shiga.jp
higashiomi.shiga.jp
hikone.shiga.jp
koka.shiga.jp
konan.shiga.jp
kosei.shiga.jp
koto.shiga.jp
kusatsu.shiga.jp
maibara.shiga.jp
moriyama.shiga.jp
nagahama.shiga.jp
nishiazai.shiga.jp
notogawa.shiga.jp
omihachiman.shiga.jp
otsu.shiga.jp
ritto.shiga.jp
ryuoh.shiga.jp
takashima.shiga.jp
takatsuki.shiga.jp
torahime.shiga.jp
toyosato.shiga.jp
yasu.shiga.jp
akagi.shimane.jp
ama.shimane.jp
gotsu.shimane.jp
hamada.shimane.jp
higashiizumo.shimane.jp
hikawa.shimane.jp
hikimi.shimane.jp
izumo.shimane.jp
kakinoki.shimane.jp
masuda.shimane.jp
matsue.shimane.jp
misato.shimane.jp
nishinoshima.shimane.jp
ohda.shimane.jp
okinoshima.shimane.jp
okuizumo.shimane.jp
shimane.shimane.jp
tamayu.shimane.jp
tsuwano.shimane.jp
unnan.shimane.jp
yakumo.shimane.jp
yasugi.shimane.jp
yatsuka.shimane.jp
arai.shizuoka.jp
atami.shizuoka.jp
fuji.shizuoka.jp
fujieda.shizuoka.jp
fujikawa.shizuoka.jp
fujinomiya.shizuoka.jp
fukuroi.shizuoka.jp
gotemba.shizuoka.jp
haibara.shizuoka.jp
hamamatsu.shizuoka.jp
higashiizu.shizuoka.jp
ito.shizuoka.jp
iwata.shizuoka.jp
izu.shizuoka.jp
izunokuni.shizuoka.jp
kakegawa.shizuoka.jp
kannami.shizuoka.jp
kawanehon.shizuoka.jp
kawazu.shizuoka.jp
kikugawa.shizuoka.jp
kosai.shizuoka.jp
makinohara.shizuoka.jp
matsuzaki.shizuoka.jp
minamiizu.shizuoka.jp
mishima.shizuoka.jp
morimachi.shizuoka.jp
nishiizu.shizuoka.jp
numazu.shizuoka.jp
omaezaki.shizuoka.jp
shimada.shizuoka.jp
shimizu.shizuoka.jp
shimoda.shizuoka.jp
shizuoka.shizuoka.jp
susono.shizuoka.jp
yaizu.shizuoka.jp
yoshida.shizuoka.jp
ashikaga.tochigi.jp
bato.tochigi.jp
haga.tochigi.jp
ichikai.tochigi.jp
iwafune.tochigi.jp
kaminokawa.tochigi.jp
kanuma.tochigi.jp
karasuyama.tochigi.jp
kuroiso.tochigi.jp
mashiko.tochigi.jp
mibu.tochigi.jp
moka.tochigi.jp
motegi.tochigi.jp
nasu.tochigi.jp
nasushiobara.tochigi.jp
nikko.tochigi.jp
nishikata.tochigi.jp
nogi.tochigi.jp
ohira.tochigi.jp
ohtawara.tochigi.jp
oyama.tochigi.jp
sakura.tochigi.jp
sano.tochigi.jp
shimotsuke.tochigi.jp
shioya.tochigi.jp
takanezawa.tochigi.jp
tochigi.tochigi.jp
tsuga.tochigi.jp
ujiie.tochigi.jp
utsunomiya.tochigi.jp
yaita.tochigi.jp
aizumi.tokushima.jp
anan.tokushima.jp
ichiba.tokushima.jp
itano.tokushima.jp
kainan.tokushima.jp
komatsushima.tokushima.jp
matsushige.tokushima.jp
mima.tokushima.jp
minami.tokushima.jp
miyoshi.tokushima.jp
mugi.tokushima.jp
nakagawa.tokushima.jp
naruto.tokushima.jp
sanagochi.tokushima.jp
shishikui.tokushima.jp
tokushima.tokushima.jp
wajiki.tokushima.jp
adachi.tokyo.jp
akiruno.tokyo.jp
akishima.tokyo.jp
aogashima.tokyo.jp
arakawa.tokyo.jp
bunkyo.tokyo.jp
chiyoda.tokyo.jp
chofu.tokyo.jp
chuo.tokyo.jp
edogawa.tokyo.jp
fuchu.tokyo.jp
fussa.tokyo.jp
hachijo.tokyo.jp
hachioji.tokyo.jp
hamura.tokyo.jp
higashikurume.tokyo.jp
higashimurayama.tokyo.jp
higashiyamato.tokyo.jp
hino.tokyo.jp
hinode.tokyo.jp
hinohara.tokyo.jp
inagi.tokyo.jp
itabashi.tokyo.jp
katsushika.tokyo.jp
kita.tokyo.jp
kiyose.tokyo.jp
kodaira.tokyo.jp
koganei.tokyo.jp
kokubunji.tokyo.jp
komae.tokyo.jp
koto.tokyo.jp
kouzushima.tokyo.jp
kunitachi.tokyo.jp
machida.tokyo.jp
meguro.tokyo.jp
minato.tokyo.jp
mitaka.tokyo.jp
mizuho.tokyo.jp
musashimurayama.tokyo.jp
musashino.tokyo.jp
nakano.tokyo.jp
nerima.tokyo.jp
ogasawara.tokyo.jp
okutama.tokyo.jp
ome.tokyo.jp
oshima.tokyo.jp
ota.tokyo.jp
setagaya.tokyo.jp
shibuya.tokyo.jp
shinagawa.tokyo.jp
shinjuku.tokyo.jp
suginami.tokyo.jp
sumida.tokyo.jp
tachikawa.tokyo.jp
taito.tokyo.jp
tama.tokyo.jp
toshima.tokyo.jp
chizu.tottori.jp
hino.tottori.jp
kawahara.tottori.jp
koge.tottori.jp
kotoura.tottori.jp
misasa.tottori.jp
nanbu.tottori.jp
nichinan.tottori.jp
sakaiminato.tottori.jp
tottori.tottori.jp
wakasa.tottori.jp
yazu.tottori.jp
yonago.tottori.jp
asahi.toyama.jp
fuchu.toyama.jp
fukumitsu.toyama.jp
funahashi.toyama.jp
himi.toyama.jp
imizu.toyama.jp
inami.toyama.jp
johana.toyama.jp
kamiichi.toyama.jp
kurobe.toyama.jp
nakaniikawa.toyama.jp
namerikawa.toyama.jp
nanto.toyama.jp
nyuzen.toyama.jp
oyabe.toyama.jp
taira.toyama.jp
takaoka.toyama.jp
tateyama.toyama.jp
toga.toyama.jp
tonami.toyama.jp
toyama.toyama.jp
unazuki.toyama.jp
uozu.toyama.jp
yamada.toyama.jp
arida.wakayama.jp
aridagawa.wakayama.jp
gobo.wakayama.jp
hashimoto.wakayama.jp
hidaka.wakayama.jp
hirogawa.wakayama.jp
inami.wakayama.jp
iwade.wakayama.jp
kainan.wakayama.jp
kamitonda.wakayama.jp
katsuragi.wakayama.jp
kimino.wakayama.jp
kinokawa.wakayama.jp
kitayama.wakayama.jp
koya.wakayama.jp
koza.wakayama.jp
kozagawa.wakayama.jp
kudoyama.wakayama.jp
kushimoto.wakayama.jp
mihama.wakayama.jp
misato.wakayama.jp
nachikatsuura.wakayama.jp
shingu.wakayama.jp
shirahama.wakayama.jp
taiji.wakayama.jp
tanabe.wakayama.jp
wakayama.wakayama.jp
yuasa.wakayama.jp
yura.wakayama.jp
asahi.yamagata.jp
funagata.yamagata.jp
higashine.yamagata.jp
iide.yamagata.jp
kahoku.yamagata.jp
kaminoyama.yamagata.jp
kaneyama.yamagata.jp
kawanishi.yamagata.jp
mamurogawa.yamagata.jp
mikawa.yamagata.jp
murayama.yamagata.jp
nagai.yamagata.jp
nakayama.yamagata.jp
nanyo.yamagata.jp
nishikawa.yamagata.jp
obanazawa.yamagata.jp
oe.yamagata.jp
oguni.yamagata.jp
ohkura.yamagata.jp
oishida.yamagata.jp
sagae.yamagata.jp
sakata.yamagata.jp
sakegawa.yamagata.jp
shinjo.yamagata.jp
shirataka.yamagata.jp
shonai.yamagata.jp
takahata.yamagata.jp
tendo.yamagata.jp
tozawa.yamagata.jp
tsuruoka.yamagata.jp
yamagata.yamagata.jp
yamanobe.yamagata.jp
yonezawa.yamagata.jp
yuza.yamagata.jp
abu.yamaguchi.jp
hagi.yamaguchi.jp
hikari.yamaguchi.jp
hofu.yamaguchi.jp
iwakuni.yamaguchi.jp
kudamatsu.yamaguchi.jp
mitou.yamaguchi.jp
nagato.yamaguchi.jp
oshima.yamaguchi.jp
shimonoseki.yamaguchi.jp
shunan.yamaguchi.jp
tabuse.yamaguchi.jp
tokuyama.yamaguchi.jp
toyota.yamaguchi.jp
ube.yamaguchi.jp
yuu.yamaguchi.jp
chuo.yamanashi.jp
doshi.yamanashi.jp
fuefuki.yamanashi.jp
fujikawa.yamanashi.jp
fujikawaguchiko.yamanashi.jp
fujiyoshida.yamanashi.jp
hayakawa.yamanashi.jp
hokuto.yamanashi.jp
ichikawamisato.yamanashi.jp
kai.yamanashi.jp
kofu.yamanashi.jp
koshu.yamanashi.jp
kosuge.yamanashi.jp
minami-alps.yamanashi.jp
minobu.yamanashi.jp
nakamichi.yamanashi.jp
nanbu.yamanashi.jp
narusawa.yamanashi.jp
nirasaki.yamanashi.jp
nishikatsura.yamanashi.jp
oshino.yamanashi.jp
otsuki.yamanashi.jp
showa.yamanashi.jp
tabayama.yamanashi.jp
tsuru.yamanashi.jp
uenohara.yamanashi.jp
yamanakako.yamanashi.jp
yamanashi.yamanashi.jp
// ke : http://www.kenic.or.ke/index.php/en/ke-domains/ke-domains
ke
ac.ke
co.ke
go.ke
info.ke
me.ke
mobi.ke
ne.ke
or.ke
sc.ke
// kg : http://www.domain.kg/dmn_n.html
kg
com.kg
edu.kg
gov.kg
mil.kg
net.kg
org.kg
// kh : https://trc.gov.kh
// Submitted by khnic@trc.gov.kh
kh
com.kh
edu.kh
gov.kh
net.kh
org.kh
// ki : https://www.iana.org/domains/root/db/ki.html
ki
biz.ki
com.ki
edu.ki
gov.ki
info.ki
net.ki
org.ki
// km : https://www.iana.org/domains/root/db/km.html
// http://www.domaine.km/documents/charte.doc
km
ass.km
com.km
edu.km
gov.km
mil.km
nom.km
org.km
prd.km
tm.km
// These are only mentioned as proposed suggestions at domaine.km, but
// https://www.iana.org/domains/root/db/km.html says they're available for registration:
asso.km
coop.km
gouv.km
medecin.km
notaires.km
pharmaciens.km
presse.km
veterinaire.km
// kn : https://www.iana.org/domains/root/db/kn.html
// http://www.dot.kn/domainRules.html
kn
edu.kn
gov.kn
net.kn
org.kn
// kp : http://www.kcce.kp/en_index.php
kp
com.kp
edu.kp
gov.kp
org.kp
rep.kp
tra.kp
// kr : https://www.iana.org/domains/root/db/kr.html
// see also: https://krnic.kisa.or.kr/jsp/infoboard/law/domBylawsReg.jsp
kr
ac.kr
ai.kr
co.kr
es.kr
go.kr
hs.kr
io.kr
it.kr
kg.kr
me.kr
mil.kr
ms.kr
ne.kr
or.kr
pe.kr
re.kr
sc.kr
// kr geographical names
busan.kr
chungbuk.kr
chungnam.kr
daegu.kr
daejeon.kr
gangwon.kr
gwangju.kr
gyeongbuk.kr
gyeonggi.kr
gyeongnam.kr
incheon.kr
jeju.kr
jeonbuk.kr
jeonnam.kr
seoul.kr
ulsan.kr
// kw : https://www.nic.kw/policies/
// Confirmed by registry
kw
com.kw
edu.kw
emb.kw
gov.kw
ind.kw
net.kw
org.kw
// ky : http://www.icta.ky/da_ky_reg_dom.php
// Confirmed by registry 2008-06-17
ky
com.ky
edu.ky
net.ky
org.ky
// kz : https://www.iana.org/domains/root/db/kz.html
// see also: http://www.nic.kz/rules/index.jsp
kz
com.kz
edu.kz
gov.kz
mil.kz
net.kz
org.kz
// la : https://www.iana.org/domains/root/db/la.html
// Submitted by registry
la
com.la
edu.la
gov.la
info.la
int.la
net.la
org.la
per.la
// lb : https://www.iana.org/domains/root/db/lb.html
// Submitted by registry
lb
com.lb
edu.lb
gov.lb
net.lb
org.lb
// lc : https://www.iana.org/domains/root/db/lc.html
// see also: http://www.nic.lc/rules.htm
lc
co.lc
com.lc
edu.lc
gov.lc
net.lc
org.lc
// li : https://www.iana.org/domains/root/db/li.html
li
// lk : https://www.iana.org/domains/root/db/lk.html
lk
ac.lk
assn.lk
com.lk
edu.lk
gov.lk
grp.lk
hotel.lk
int.lk
ltd.lk
net.lk
ngo.lk
org.lk
sch.lk
soc.lk
web.lk
// lr : http://psg.com/dns/lr/lr.txt
// Submitted by registry
lr
com.lr
edu.lr
gov.lr
net.lr
org.lr
// ls : http://www.nic.ls/
// Confirmed by registry
ls
ac.ls
biz.ls
co.ls
edu.ls
gov.ls
info.ls
net.ls
org.ls
sc.ls
// lt : https://www.iana.org/domains/root/db/lt.html
lt
// gov.lt : http://www.gov.lt/index_en.php
gov.lt
// lu : http://www.dns.lu/en/
lu
// lv : https://www.iana.org/domains/root/db/lv.html
lv
asn.lv
com.lv
conf.lv
edu.lv
gov.lv
id.lv
mil.lv
net.lv
org.lv
// ly : http://www.nic.ly/regulations.php
ly
com.ly
edu.ly
gov.ly
id.ly
med.ly
net.ly
org.ly
plc.ly
sch.ly
// ma : https://www.iana.org/domains/root/db/ma.html
// http://www.anrt.ma/fr/admin/download/upload/file_fr782.pdf
ma
ac.ma
co.ma
gov.ma
net.ma
org.ma
press.ma
// mc : http://www.nic.mc/
mc
asso.mc
tm.mc
// md : https://www.iana.org/domains/root/db/md.html
md
// me : https://www.iana.org/domains/root/db/me.html
me
ac.me
co.me
edu.me
gov.me
its.me
net.me
org.me
priv.me
// mg : https://nic.mg
mg
co.mg
com.mg
edu.mg
gov.mg
mil.mg
nom.mg
org.mg
prd.mg
// mh : https://www.iana.org/domains/root/db/mh.html
mh
// mil : https://www.iana.org/domains/root/db/mil.html
mil
// mk : https://www.iana.org/domains/root/db/mk.html
// see also: http://dns.marnet.net.mk/postapka.php
mk
com.mk
edu.mk
gov.mk
inf.mk
name.mk
net.mk
org.mk
// ml : https://www.iana.org/domains/root/db/ml.html
// Confirmed by Boubacar NDIAYE 2024-12-31
ml
ac.ml
art.ml
asso.ml
com.ml
edu.ml
gouv.ml
gov.ml
info.ml
inst.ml
net.ml
org.ml
pr.ml
presse.ml
// mm : https://www.iana.org/domains/root/db/mm.html
*.mm
// mn : https://www.iana.org/domains/root/db/mn.html
mn
edu.mn
gov.mn
org.mn
// mo : http://www.monic.net.mo/
mo
com.mo
edu.mo
gov.mo
net.mo
org.mo
// mobi : https://www.iana.org/domains/root/db/mobi.html
mobi
// mp : http://www.dot.mp/
// Confirmed by registry 2008-06-17
mp
// mq : https://www.iana.org/domains/root/db/mq.html
mq
// mr : https://www.iana.org/domains/root/db/mr.html
mr
gov.mr
// ms : https://www.iana.org/domains/root/db/ms.html
ms
com.ms
edu.ms
gov.ms
net.ms
org.ms
// mt : https://www.nic.org.mt/go/policy
// Submitted by registry
mt
com.mt
edu.mt
net.mt
org.mt
// mu : https://www.iana.org/domains/root/db/mu.html
mu
ac.mu
co.mu
com.mu
gov.mu
net.mu
or.mu
org.mu
// museum : https://welcome.museum/wp-content/uploads/2018/05/20180525-Registration-Policy-MUSEUM-EN_VF-2.pdf https://welcome.museum/buy-your-dot-museum-2/
museum
// mv : https://www.iana.org/domains/root/db/mv.html
// "mv" included because, contra Wikipedia, google.mv exists.
mv
aero.mv
biz.mv
com.mv
coop.mv
edu.mv
gov.mv
info.mv
int.mv
mil.mv
museum.mv
name.mv
net.mv
org.mv
pro.mv
// mw : http://www.registrar.mw/
mw
ac.mw
biz.mw
co.mw
com.mw
coop.mw
edu.mw
gov.mw
int.mw
net.mw
org.mw
// mx : http://www.nic.mx/
// Submitted by registry
mx
com.mx
edu.mx
gob.mx
net.mx
org.mx
// my : http://www.mynic.my/
// Available strings: https://mynic.my/resources/domains/buying-a-domain/
my
biz.my
com.my
edu.my
gov.my
mil.my
name.my
net.my
org.my
// mz : http://www.uem.mz/
// Submitted by registry
mz
ac.mz
adv.mz
co.mz
edu.mz
gov.mz
mil.mz
net.mz
org.mz
// na : http://www.na-nic.com.na/
na
alt.na
co.na
com.na
gov.na
net.na
org.na
// name : http://www.nic.name/
// Regarding 2LDs: https://github.com/publicsuffix/list/issues/2306
name
// nc : http://www.cctld.nc/
nc
asso.nc
nom.nc
// ne : https://www.iana.org/domains/root/db/ne.html
ne
// net : https://www.iana.org/domains/root/db/net.html
net
// nf : https://www.iana.org/domains/root/db/nf.html
nf
arts.nf
com.nf
firm.nf
info.nf
net.nf
other.nf
per.nf
rec.nf
store.nf
web.nf
// ng : http://www.nira.org.ng/index.php/join-us/register-ng-domain/189-nira-slds
ng
com.ng
edu.ng
gov.ng
i.ng
mil.ng
mobi.ng
name.ng
net.ng
org.ng
sch.ng
// ni : http://www.nic.ni/
ni
ac.ni
biz.ni
co.ni
com.ni
edu.ni
gob.ni
in.ni
info.ni
int.ni
mil.ni
net.ni
nom.ni
org.ni
web.ni
// nl : https://www.iana.org/domains/root/db/nl.html
// https://www.sidn.nl/
nl
// no : https://www.norid.no/en/om-domenenavn/regelverk-for-no/
// Norid geographical second level domains : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-b/
// Norid category second level domains : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-c/
// Norid category second-level domains managed by parties other than Norid : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-d/
// RSS feed: https://teknisk.norid.no/en/feed/
no
// Norid category second level domains : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-c/
fhs.no
folkebibl.no
fylkesbibl.no
idrett.no
museum.no
priv.no
vgs.no
// Norid category second-level domains managed by parties other than Norid : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-d/
dep.no
herad.no
kommune.no
mil.no
stat.no
// Norid geographical second level domains : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-b/
// counties
aa.no
ah.no
bu.no
fm.no
hl.no
hm.no
jan-mayen.no
mr.no
nl.no
nt.no
of.no
ol.no
oslo.no
rl.no
sf.no
st.no
svalbard.no
tm.no
tr.no
va.no
vf.no
// primary and lower secondary schools per county
gs.aa.no
gs.ah.no
gs.bu.no
gs.fm.no
gs.hl.no
gs.hm.no
gs.jan-mayen.no
gs.mr.no
gs.nl.no
gs.nt.no
gs.of.no
gs.ol.no
gs.oslo.no
gs.rl.no
gs.sf.no
gs.st.no
gs.svalbard.no
gs.tm.no
gs.tr.no
gs.va.no
gs.vf.no
// cities
akrehamn.no
åkrehamn.no
algard.no
ålgård.no
arna.no
bronnoysund.no
brønnøysund.no
brumunddal.no
bryne.no
drobak.no
drøbak.no
egersund.no
fetsund.no
floro.no
florø.no
fredrikstad.no
hokksund.no
honefoss.no
hønefoss.no
jessheim.no
jorpeland.no
jørpeland.no
kirkenes.no
kopervik.no
krokstadelva.no
langevag.no
langevåg.no
leirvik.no
mjondalen.no
mjøndalen.no
mo-i-rana.no
mosjoen.no
mosjøen.no
nesoddtangen.no
orkanger.no
osoyro.no
osøyro.no
raholt.no
råholt.no
sandnessjoen.no
sandnessjøen.no
skedsmokorset.no
slattum.no
spjelkavik.no
stathelle.no
stavern.no
stjordalshalsen.no
stjørdalshalsen.no
tananger.no
tranby.no
vossevangen.no
// communities
aarborte.no
aejrie.no
afjord.no
åfjord.no
agdenes.no
nes.akershus.no
aknoluokta.no
ákŋoluokta.no
al.no
ål.no
alaheadju.no
álaheadju.no
alesund.no
ålesund.no
alstahaug.no
alta.no
áltá.no
alvdal.no
amli.no
åmli.no
amot.no
åmot.no
andasuolo.no
andebu.no
andoy.no
andøy.no
ardal.no
årdal.no
aremark.no
arendal.no
ås.no
aseral.no
åseral.no
asker.no
askim.no
askoy.no
askøy.no
askvoll.no
asnes.no
åsnes.no
audnedaln.no
aukra.no
aure.no
aurland.no
aurskog-holand.no
aurskog-høland.no
austevoll.no
austrheim.no
averoy.no
averøy.no
badaddja.no
bådåddjå.no
bærum.no
bahcavuotna.no
báhcavuotna.no
bahccavuotna.no
báhccavuotna.no
baidar.no
báidár.no
bajddar.no
bájddar.no
balat.no
bálát.no
balestrand.no
ballangen.no
balsfjord.no
bamble.no
bardu.no
barum.no
batsfjord.no
båtsfjord.no
bearalvahki.no
bearalváhki.no
beardu.no
beiarn.no
berg.no
bergen.no
berlevag.no
berlevåg.no
bievat.no
bievát.no
bindal.no
birkenes.no
bjerkreim.no
bjugn.no
bodo.no
bodø.no
bokn.no
bomlo.no
bømlo.no
bremanger.no
bronnoy.no
brønnøy.no
budejju.no
nes.buskerud.no
bygland.no
bykle.no
cahcesuolo.no
čáhcesuolo.no
davvenjarga.no
davvenjárga.no
davvesiida.no
deatnu.no
dielddanuorri.no
divtasvuodna.no
divttasvuotna.no
donna.no
dønna.no
dovre.no
drammen.no
drangedal.no
dyroy.no
dyrøy.no
eid.no
eidfjord.no
eidsberg.no
eidskog.no
eidsvoll.no
eigersund.no
elverum.no
enebakk.no
engerdal.no
etne.no
etnedal.no
evenassi.no
evenášši.no
evenes.no
evje-og-hornnes.no
farsund.no
fauske.no
fedje.no
fet.no
finnoy.no
finnøy.no
fitjar.no
fjaler.no
fjell.no
fla.no
flå.no
flakstad.no
flatanger.no
flekkefjord.no
flesberg.no
flora.no
folldal.no
forde.no
førde.no
forsand.no
fosnes.no
fræna.no
frana.no
frei.no
frogn.no
froland.no
frosta.no
froya.no
frøya.no
fuoisku.no
fuossko.no
fusa.no
fyresdal.no
gaivuotna.no
gáivuotna.no
galsa.no
gálsá.no
gamvik.no
gangaviika.no
gáŋgaviika.no
gaular.no
gausdal.no
giehtavuoatna.no
gildeskal.no
gildeskål.no
giske.no
gjemnes.no
gjerdrum.no
gjerstad.no
gjesdal.no
gjovik.no
gjøvik.no
gloppen.no
gol.no
gran.no
grane.no
granvin.no
gratangen.no
grimstad.no
grong.no
grue.no
gulen.no
guovdageaidnu.no
ha.no
hå.no
habmer.no
hábmer.no
hadsel.no
hægebostad.no
hagebostad.no
halden.no
halsa.no
hamar.no
hamaroy.no
hammarfeasta.no
hámmárfeasta.no
hammerfest.no
hapmir.no
hápmir.no
haram.no
hareid.no
harstad.no
hasvik.no
hattfjelldal.no
haugesund.no
os.hedmark.no
valer.hedmark.no
våler.hedmark.no
hemne.no
hemnes.no
hemsedal.no
hitra.no
hjartdal.no
hjelmeland.no
hobol.no
hobøl.no
hof.no
hol.no
hole.no
holmestrand.no
holtalen.no
holtålen.no
os.hordaland.no
hornindal.no
horten.no
hoyanger.no
høyanger.no
hoylandet.no
høylandet.no
hurdal.no
hurum.no
hvaler.no
hyllestad.no
ibestad.no
inderoy.no
inderøy.no
iveland.no
ivgu.no
jevnaker.no
jolster.no
jølster.no
jondal.no
kafjord.no
kåfjord.no
karasjohka.no
kárášjohka.no
karasjok.no
karlsoy.no
karmoy.no
karmøy.no
kautokeino.no
klabu.no
klæbu.no
klepp.no
kongsberg.no
kongsvinger.no
kraanghke.no
kråanghke.no
kragero.no
kragerø.no
kristiansand.no
kristiansund.no
krodsherad.no
krødsherad.no
kvæfjord.no
kvænangen.no
kvafjord.no
kvalsund.no
kvam.no
kvanangen.no
kvinesdal.no
kvinnherad.no
kviteseid.no
kvitsoy.no
kvitsøy.no
laakesvuemie.no
lærdal.no
lahppi.no
láhppi.no
lardal.no
larvik.no
lavagis.no
lavangen.no
leangaviika.no
leaŋgaviika.no
lebesby.no
leikanger.no
leirfjord.no
leka.no
leksvik.no
lenvik.no
lerdal.no
lesja.no
levanger.no
lier.no
lierne.no
lillehammer.no
lillesand.no
lindas.no
lindås.no
lindesnes.no
loabat.no
loabát.no
lodingen.no
lødingen.no
lom.no
loppa.no
lorenskog.no
lørenskog.no
loten.no
løten.no
lund.no
lunner.no
luroy.no
lurøy.no
luster.no
lyngdal.no
lyngen.no
malatvuopmi.no
málatvuopmi.no
malselv.no
målselv.no
malvik.no
mandal.no
marker.no
marnardal.no
masfjorden.no
masoy.no
måsøy.no
matta-varjjat.no
mátta-várjjat.no
meland.no
meldal.no
melhus.no
meloy.no
meløy.no
meraker.no
meråker.no
midsund.no
midtre-gauldal.no
moareke.no
moåreke.no
modalen.no
modum.no
molde.no
heroy.more-og-romsdal.no
sande.more-og-romsdal.no
herøy.møre-og-romsdal.no
sande.møre-og-romsdal.no
moskenes.no
moss.no
muosat.no
muosát.no
naamesjevuemie.no
nååmesjevuemie.no
nærøy.no
namdalseid.no
namsos.no
namsskogan.no
nannestad.no
naroy.no
narviika.no
narvik.no
naustdal.no
navuotna.no
návuotna.no
nedre-eiker.no
nesna.no
nesodden.no
nesseby.no
nesset.no
nissedal.no
nittedal.no
nord-aurdal.no
nord-fron.no
nord-odal.no
norddal.no
nordkapp.no
bo.nordland.no
bø.nordland.no
heroy.nordland.no
herøy.nordland.no
nordre-land.no
nordreisa.no
nore-og-uvdal.no
notodden.no
notteroy.no
nøtterøy.no
odda.no
oksnes.no
øksnes.no
omasvuotna.no
oppdal.no
oppegard.no
oppegård.no
orkdal.no
orland.no
ørland.no
orskog.no
ørskog.no
orsta.no
ørsta.no
osen.no
osteroy.no
osterøy.no
valer.ostfold.no
våler.østfold.no
ostre-toten.no
østre-toten.no
overhalla.no
ovre-eiker.no
øvre-eiker.no
oyer.no
øyer.no
oygarden.no
øygarden.no
oystre-slidre.no
øystre-slidre.no
porsanger.no
porsangu.no
porsáŋgu.no
porsgrunn.no
rade.no
råde.no
radoy.no
radøy.no
rælingen.no
rahkkeravju.no
ráhkkerávju.no
raisa.no
ráisa.no
rakkestad.no
ralingen.no
rana.no
randaberg.no
rauma.no
rendalen.no
rennebu.no
rennesoy.no
rennesøy.no
rindal.no
ringebu.no
ringerike.no
ringsaker.no
risor.no
risør.no
rissa.no
roan.no
rodoy.no
rødøy.no
rollag.no
romsa.no
romskog.no
rømskog.no
roros.no
røros.no
rost.no
røst.no
royken.no
røyken.no
royrvik.no
røyrvik.no
ruovat.no
rygge.no
salangen.no
salat.no
sálat.no
sálát.no
saltdal.no
samnanger.no
sandefjord.no
sandnes.no
sandoy.no
sandøy.no
sarpsborg.no
sauda.no
sauherad.no
sel.no
selbu.no
selje.no
seljord.no
siellak.no
sigdal.no
siljan.no
sirdal.no
skanit.no
skánit.no
skanland.no
skånland.no
skaun.no
skedsmo.no
ski.no
skien.no
skierva.no
skiervá.no
skiptvet.no
skjak.no
skjåk.no
skjervoy.no
skjervøy.no
skodje.no
smola.no
smøla.no
snaase.no
snåase.no
snasa.no
snåsa.no
snillfjord.no
snoasa.no
sogndal.no
sogne.no
søgne.no
sokndal.no
sola.no
solund.no
somna.no
sømna.no
sondre-land.no
søndre-land.no
songdalen.no
sor-aurdal.no
sør-aurdal.no
sor-fron.no
sør-fron.no
sor-odal.no
sør-odal.no
sor-varanger.no
sør-varanger.no
sorfold.no
sørfold.no
sorreisa.no
sørreisa.no
sortland.no
sorum.no
sørum.no
spydeberg.no
stange.no
stavanger.no
steigen.no
steinkjer.no
stjordal.no
stjørdal.no
stokke.no
stor-elvdal.no
stord.no
stordal.no
storfjord.no
strand.no
stranda.no
stryn.no
sula.no
suldal.no
sund.no
sunndal.no
surnadal.no
sveio.no
svelvik.no
sykkylven.no
tana.no
bo.telemark.no
bø.telemark.no
time.no
tingvoll.no
tinn.no
tjeldsund.no
tjome.no
tjøme.no
tokke.no
tolga.no
tonsberg.no
tønsberg.no
torsken.no
træna.no
trana.no
tranoy.no
tranøy.no
troandin.no
trogstad.no
trøgstad.no
tromsa.no
tromso.no
tromsø.no
trondheim.no
trysil.no
tvedestrand.no
tydal.no
tynset.no
tysfjord.no
tysnes.no
tysvær.no
tysvar.no
ullensaker.no
ullensvang.no
ulvik.no
unjarga.no
unjárga.no
utsira.no
vaapste.no
vadso.no
vadsø.no
værøy.no
vaga.no
vågå.no
vagan.no
vågan.no
vagsoy.no
vågsøy.no
vaksdal.no
valle.no
vang.no
vanylven.no
vardo.no
vardø.no
varggat.no
várggát.no
varoy.no
vefsn.no
vega.no
vegarshei.no
vegårshei.no
vennesla.no
verdal.no
verran.no
vestby.no
sande.vestfold.no
vestnes.no
vestre-slidre.no
vestre-toten.no
vestvagoy.no
vestvågøy.no
vevelstad.no
vik.no
vikna.no
vindafjord.no
voagat.no
volda.no
voss.no
// np : http://www.mos.com.np/register.html
*.np
// nr : http://cenpac.net.nr/dns/index.html
// Submitted by registry
nr
biz.nr
com.nr
edu.nr
gov.nr
info.nr
net.nr
org.nr
// nu : https://www.iana.org/domains/root/db/nu.html
nu
// nz : https://www.iana.org/domains/root/db/nz.html
// Submitted by registry
nz
ac.nz
co.nz
cri.nz
geek.nz
gen.nz
govt.nz
health.nz
iwi.nz
kiwi.nz
maori.nz
māori.nz
mil.nz
net.nz
org.nz
parliament.nz
school.nz
// om : https://www.iana.org/domains/root/db/om.html
om
co.om
com.om
edu.om
gov.om
med.om
museum.om
net.om
org.om
pro.om
// onion : https://tools.ietf.org/html/rfc7686
onion
// org : https://www.iana.org/domains/root/db/org.html
org
// pa : http://www.nic.pa/
// Some additional second level "domains" resolve directly as hostnames, such as
// pannet.pa, so we add a rule for "pa".
pa
abo.pa
ac.pa
com.pa
edu.pa
gob.pa
ing.pa
med.pa
net.pa
nom.pa
org.pa
sld.pa
// pe : https://www.nic.pe/InformeFinalComision.pdf
pe
com.pe
edu.pe
gob.pe
mil.pe
net.pe
nom.pe
org.pe
// pf : http://www.gobin.info/domainname/formulaire-pf.pdf
pf
com.pf
edu.pf
org.pf
// pg : https://www.iana.org/domains/root/db/pg.html
*.pg
// ph : https://www.iana.org/domains/root/db/ph.html
// Submitted by registry
ph
com.ph
edu.ph
gov.ph
i.ph
mil.ph
net.ph
ngo.ph
org.ph
// pk : https://pk5.pknic.net.pk/pk5/msgNamepk.PK
// Contact Email: staff@pknic.net.pk
pk
ac.pk
biz.pk
com.pk
edu.pk
fam.pk
gkp.pk
gob.pk
gog.pk
gok.pk
gop.pk
gos.pk
gov.pk
net.pk
org.pk
web.pk
// pl : https://www.dns.pl/en/
// Confirmed by registry 2024-11-18
pl
com.pl
net.pl
org.pl
// pl functional domains : https://www.dns.pl/en/list_of_functional_domain_names
agro.pl
aid.pl
atm.pl
auto.pl
biz.pl
edu.pl
gmina.pl
gsm.pl
info.pl
mail.pl
media.pl
miasta.pl
mil.pl
nieruchomosci.pl
nom.pl
pc.pl
powiat.pl
priv.pl
realestate.pl
rel.pl
sex.pl
shop.pl
sklep.pl
sos.pl
szkola.pl
targi.pl
tm.pl
tourism.pl
travel.pl
turystyka.pl
// Government domains : https://www.dns.pl/informacje_o_rejestracji_domen_gov_pl
// In accordance with the .gov.pl Domain Name Regulations : https://www.dns.pl/regulamin_gov_pl
gov.pl
ap.gov.pl
griw.gov.pl
ic.gov.pl
is.gov.pl
kmpsp.gov.pl
konsulat.gov.pl
kppsp.gov.pl
kwp.gov.pl
kwpsp.gov.pl
mup.gov.pl
mw.gov.pl
oia.gov.pl
oirm.gov.pl
oke.gov.pl
oow.gov.pl
oschr.gov.pl
oum.gov.pl
pa.gov.pl
pinb.gov.pl
piw.gov.pl
po.gov.pl
pr.gov.pl
psp.gov.pl
psse.gov.pl
pup.gov.pl
rzgw.gov.pl
sa.gov.pl
sdn.gov.pl
sko.gov.pl
so.gov.pl
sr.gov.pl
starostwo.gov.pl
ug.gov.pl
ugim.gov.pl
um.gov.pl
umig.gov.pl
upow.gov.pl
uppo.gov.pl
us.gov.pl
uw.gov.pl
uzs.gov.pl
wif.gov.pl
wiih.gov.pl
winb.gov.pl
wios.gov.pl
witd.gov.pl
wiw.gov.pl
wkz.gov.pl
wsa.gov.pl
wskr.gov.pl
wsse.gov.pl
wuoz.gov.pl
wzmiuw.gov.pl
zp.gov.pl
zpisdn.gov.pl
// pl regional domains : https://www.dns.pl/en/list_of_regional_domain_names
augustow.pl
babia-gora.pl
bedzin.pl
beskidy.pl
bialowieza.pl
bialystok.pl
bielawa.pl
bieszczady.pl
boleslawiec.pl
bydgoszcz.pl
bytom.pl
cieszyn.pl
czeladz.pl
czest.pl
dlugoleka.pl
elblag.pl
elk.pl
glogow.pl
gniezno.pl
gorlice.pl
grajewo.pl
ilawa.pl
jaworzno.pl
jelenia-gora.pl
jgora.pl
kalisz.pl
karpacz.pl
kartuzy.pl
kaszuby.pl
katowice.pl
kazimierz-dolny.pl
kepno.pl
ketrzyn.pl
klodzko.pl
kobierzyce.pl
kolobrzeg.pl
konin.pl
konskowola.pl
kutno.pl
lapy.pl
lebork.pl
legnica.pl
lezajsk.pl
limanowa.pl
lomza.pl
lowicz.pl
lubin.pl
lukow.pl
malbork.pl
malopolska.pl
mazowsze.pl
mazury.pl
mielec.pl
mielno.pl
mragowo.pl
naklo.pl
nowaruda.pl
nysa.pl
olawa.pl
olecko.pl
olkusz.pl
olsztyn.pl
opoczno.pl
opole.pl
ostroda.pl
ostroleka.pl
ostrowiec.pl
ostrowwlkp.pl
pila.pl
pisz.pl
podhale.pl
podlasie.pl
polkowice.pl
pomorskie.pl
pomorze.pl
prochowice.pl
pruszkow.pl
przeworsk.pl
pulawy.pl
radom.pl
rawa-maz.pl
rybnik.pl
rzeszow.pl
sanok.pl
sejny.pl
skoczow.pl
slask.pl
slupsk.pl
sosnowiec.pl
stalowa-wola.pl
starachowice.pl
stargard.pl
suwalki.pl
swidnica.pl
swiebodzin.pl
swinoujscie.pl
szczecin.pl
szczytno.pl
tarnobrzeg.pl
tgory.pl
turek.pl
tychy.pl
ustka.pl
walbrzych.pl
warmia.pl
warszawa.pl
waw.pl
wegrow.pl
wielun.pl
wlocl.pl
wloclawek.pl
wodzislaw.pl
wolomin.pl
wroclaw.pl
zachpomor.pl
zagan.pl
zarow.pl
zgora.pl
zgorzelec.pl
// pm : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf
pm
// pn : https://www.iana.org/domains/root/db/pn.html
pn
co.pn
edu.pn
gov.pn
net.pn
org.pn
// post : https://www.iana.org/domains/root/db/post.html
post
// pr : http://www.nic.pr/index.asp?f=1
pr
biz.pr
com.pr
edu.pr
gov.pr
info.pr
isla.pr
name.pr
net.pr
org.pr
pro.pr
// these aren't mentioned on nic.pr, but on https://www.iana.org/domains/root/db/pr.html
ac.pr
est.pr
prof.pr
// pro : http://registry.pro/get-pro
pro
aaa.pro
aca.pro
acct.pro
avocat.pro
bar.pro
cpa.pro
eng.pro
jur.pro
law.pro
med.pro
recht.pro
// ps : https://www.iana.org/domains/root/db/ps.html
// http://www.nic.ps/registration/policy.html#reg
ps
com.ps
edu.ps
gov.ps
net.ps
org.ps
plo.ps
sec.ps
// pt : https://www.dns.pt/en/domain/pt-terms-and-conditions-registration-rules/
pt
com.pt
edu.pt
gov.pt
int.pt
net.pt
nome.pt
org.pt
publ.pt
// pw : https://www.iana.org/domains/root/db/pw.html
// Confirmed by registry in private correspondence with @dnsguru 2024-12-09
pw
gov.pw
// py : https://www.iana.org/domains/root/db/py.html
// Submitted by registry
py
com.py
coop.py
edu.py
gov.py
mil.py
net.py
org.py
// qa : http://domains.qa/en/
qa
com.qa
edu.qa
gov.qa
mil.qa
name.qa
net.qa
org.qa
sch.qa
// re : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf
// Confirmed by registry 2024-11-18
re
// Closed for registration on 2013-03-15 but domains are still maintained
asso.re
com.re
// ro : http://www.rotld.ro/
ro
arts.ro
com.ro
firm.ro
info.ro
nom.ro
nt.ro
org.ro
rec.ro
store.ro
tm.ro
www.ro
// rs : https://www.rnids.rs/en/domains/national-domains
rs
ac.rs
co.rs
edu.rs
gov.rs
in.rs
org.rs
// ru : https://cctld.ru/files/pdf/docs/en/rules_ru-rf.pdf
// Submitted by George Georgievsky
ru
// rw : https://www.iana.org/domains/root/db/rw.html
rw
ac.rw
co.rw
coop.rw
gov.rw
mil.rw
net.rw
org.rw
// sa : http://www.nic.net.sa/
sa
com.sa
edu.sa
gov.sa
med.sa
net.sa
org.sa
pub.sa
sch.sa
// sb : http://www.sbnic.net.sb/
// Submitted by registry
sb
com.sb
edu.sb
gov.sb
net.sb
org.sb
// sc : http://www.nic.sc/
sc
com.sc
edu.sc
gov.sc
net.sc
org.sc
// sd : https://www.iana.org/domains/root/db/sd.html
// Submitted by registry
sd
com.sd
edu.sd
gov.sd
info.sd
med.sd
net.sd
org.sd
tv.sd
// se : https://www.iana.org/domains/root/db/se.html
// https://data.internetstiftelsen.se/barred_domains_list.txt -> Second level domains & Sub-domains
// Confirmed by Registry Services 2024-11-20
se
a.se
ac.se
b.se
bd.se
brand.se
c.se
d.se
e.se
f.se
fh.se
fhsk.se
fhv.se
g.se
h.se
i.se
k.se
komforb.se
kommunalforbund.se
komvux.se
l.se
lanbib.se
m.se
n.se
naturbruksgymn.se
o.se
org.se
p.se
parti.se
pp.se
press.se
r.se
s.se
t.se
tm.se
u.se
w.se
x.se
y.se
z.se
// sg : https://www.sgnic.sg/domain-registration/sg-categories-rules
// Confirmed by registry 2024-11-19
sg
com.sg
edu.sg
gov.sg
net.sg
org.sg
// sh : http://nic.sh/rules.htm
sh
com.sh
gov.sh
mil.sh
net.sh
org.sh
// si : https://www.iana.org/domains/root/db/si.html
si
// sj : No registrations at this time.
// Submitted by registry
sj
// sk : https://www.iana.org/domains/root/db/sk.html
// https://sk-nic.sk/
sk
org.sk
// sl : http://www.nic.sl
// Submitted by registry
sl
com.sl
edu.sl
gov.sl
net.sl
org.sl
// sm : https://www.iana.org/domains/root/db/sm.html
sm
// sn : https://www.iana.org/domains/root/db/sn.html
sn
art.sn
com.sn
edu.sn
gouv.sn
org.sn
univ.sn
// so : http://sonic.so/policies/
so
com.so
edu.so
gov.so
me.so
net.so
org.so
// sr : https://www.iana.org/domains/root/db/sr.html
sr
// ss : https://registry.nic.ss/
// Submitted by registry
ss
biz.ss
co.ss
com.ss
edu.ss
gov.ss
me.ss
net.ss
org.ss
sch.ss
// st : http://www.nic.st/html/policyrules/
st
co.st
com.st
consulado.st
edu.st
embaixada.st
mil.st
net.st
org.st
principe.st
saotome.st
store.st
// su : https://www.iana.org/domains/root/db/su.html
su
// sv : https://www.iana.org/domains/root/db/sv.html
sv
com.sv
edu.sv
gob.sv
org.sv
red.sv
// sx : https://www.iana.org/domains/root/db/sx.html
// Submitted by registry
sx
gov.sx
// sy : https://www.iana.org/domains/root/db/sy.html
sy
com.sy
edu.sy
gov.sy
mil.sy
net.sy
org.sy
// sz : https://www.iana.org/domains/root/db/sz.html
// http://www.sispa.org.sz/
sz
ac.sz
co.sz
org.sz
// tc : https://www.iana.org/domains/root/db/tc.html
tc
// td : https://www.iana.org/domains/root/db/td.html
td
// tel : https://www.iana.org/domains/root/db/tel.html
// http://www.telnic.org/
tel
// tf : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf
tf
// tg : https://www.iana.org/domains/root/db/tg.html
// http://www.nic.tg/
tg
// th : https://www.iana.org/domains/root/db/th.html
// Submitted by registry
th
ac.th
co.th
go.th
in.th
mi.th
net.th
or.th
// tj : http://www.nic.tj/policy.html
tj
ac.tj
biz.tj
co.tj
com.tj
edu.tj
go.tj
gov.tj
int.tj
mil.tj
name.tj
net.tj
nic.tj
org.tj
test.tj
web.tj
// tk : https://www.iana.org/domains/root/db/tk.html
tk
// tl : https://www.iana.org/domains/root/db/tl.html
tl
gov.tl
// tm : https://www.nic.tm/local.html
// Confirmed by registry 2024-11-19
tm
co.tm
com.tm
edu.tm
gov.tm
mil.tm
net.tm
nom.tm
org.tm
// tn : http://www.registre.tn/fr/
// https://whois.ati.tn/
tn
com.tn
ens.tn
fin.tn
gov.tn
ind.tn
info.tn
intl.tn
mincom.tn
nat.tn
net.tn
org.tn
perso.tn
tourism.tn
// to : https://www.iana.org/domains/root/db/to.html
// Submitted by registry
to
com.to
edu.to
gov.to
mil.to
net.to
org.to
// tr : https://nic.tr/
// https://nic.tr/forms/eng/policies.pdf
// https://nic.tr/index.php?USRACTN=PRICELST
tr
av.tr
bbs.tr
bel.tr
biz.tr
com.tr
dr.tr
edu.tr
gen.tr
gov.tr
info.tr
k12.tr
kep.tr
mil.tr
name.tr
net.tr
org.tr
pol.tr
tel.tr
tsk.tr
tv.tr
web.tr
// Used by Northern Cyprus
nc.tr
// Used by government agencies of Northern Cyprus
gov.nc.tr
// tt : https://www.nic.tt/
// Confirmed by registry 2024-11-19
tt
biz.tt
co.tt
com.tt
edu.tt
gov.tt
info.tt
mil.tt
name.tt
net.tt
org.tt
pro.tt
// tv : https://www.iana.org/domains/root/db/tv.html
// Not listing any 2LDs as reserved since none seem to exist in practice,
// Wikipedia notwithstanding.
tv
// tw : https://www.iana.org/domains/root/db/tw.html
// https://twnic.tw/dnservice_catag.php
// Confirmed by registry 2024-11-26
tw
club.tw
com.tw
ebiz.tw
edu.tw
game.tw
gov.tw
idv.tw
mil.tw
net.tw
org.tw
// tz : http://www.tznic.or.tz/index.php/domains
// Submitted by registry
tz
ac.tz
co.tz
go.tz
hotel.tz
info.tz
me.tz
mil.tz
mobi.tz
ne.tz
or.tz
sc.tz
tv.tz
// ua : https://hostmaster.ua/policy/?ua
// Submitted by registry
ua
// ua 2LD
com.ua
edu.ua
gov.ua
in.ua
net.ua
org.ua
// ua geographic names
// https://hostmaster.ua/2ld/
cherkassy.ua
cherkasy.ua
chernigov.ua
chernihiv.ua
chernivtsi.ua
chernovtsy.ua
ck.ua
cn.ua
cr.ua
crimea.ua
cv.ua
dn.ua
dnepropetrovsk.ua
dnipropetrovsk.ua
donetsk.ua
dp.ua
if.ua
ivano-frankivsk.ua
kh.ua
kharkiv.ua
kharkov.ua
kherson.ua
khmelnitskiy.ua
khmelnytskyi.ua
kiev.ua
kirovograd.ua
km.ua
kr.ua
kropyvnytskyi.ua
krym.ua
ks.ua
kv.ua
kyiv.ua
lg.ua
lt.ua
lugansk.ua
luhansk.ua
lutsk.ua
lv.ua
lviv.ua
mk.ua
mykolaiv.ua
nikolaev.ua
od.ua
odesa.ua
odessa.ua
pl.ua
poltava.ua
rivne.ua
rovno.ua
rv.ua
sb.ua
sebastopol.ua
sevastopol.ua
sm.ua
sumy.ua
te.ua
ternopil.ua
uz.ua
uzhgorod.ua
uzhhorod.ua
vinnica.ua
vinnytsia.ua
vn.ua
volyn.ua
yalta.ua
zakarpattia.ua
zaporizhzhe.ua
zaporizhzhia.ua
zhitomir.ua
zhytomyr.ua
zp.ua
zt.ua
// ug : https://www.registry.co.ug/
// https://www.registry.co.ug, https://whois.co.ug
// Confirmed by registry 2025-01-20
ug
ac.ug
co.ug
com.ug
edu.ug
go.ug
gov.ug
mil.ug
ne.ug
or.ug
org.ug
sc.ug
us.ug
// uk : https://www.iana.org/domains/root/db/uk.html
// Submitted by registry
uk
ac.uk
co.uk
gov.uk
ltd.uk
me.uk
net.uk
nhs.uk
org.uk
plc.uk
police.uk
*.sch.uk
// us : https://www.iana.org/domains/root/db/us.html
// Confirmed via the .us zone file by William Harrison 2024-12-10
us
dni.us
isa.us
nsn.us
// Geographic Names
ak.us
al.us
ar.us
as.us
az.us
ca.us
co.us
ct.us
dc.us
de.us
fl.us
ga.us
gu.us
hi.us
ia.us
id.us
il.us
in.us
ks.us
ky.us
la.us
ma.us
md.us
me.us
mi.us
mn.us
mo.us
ms.us
mt.us
nc.us
nd.us
ne.us
nh.us
nj.us
nm.us
nv.us
ny.us
oh.us
ok.us
or.us
pa.us
pr.us
ri.us
sc.us
sd.us
tn.us
tx.us
ut.us
va.us
vi.us
vt.us
wa.us
wi.us
wv.us
wy.us
// The registrar notes several more specific domains available in each state,
// such as state.*.us, dst.*.us, etc., but resolution of these is somewhat
// haphazard; in some states these domains resolve as addresses, while in others
// only subdomains are available, or even nothing at all. We include the
// most common ones where it's clear that different sites are different
// entities.
k12.ak.us
k12.al.us
k12.ar.us
k12.as.us
k12.az.us
k12.ca.us
k12.co.us
k12.ct.us
k12.dc.us
k12.fl.us
k12.ga.us
k12.gu.us
// k12.hi.us - Bug 614565 - Hawaii has a state-wide DOE login
k12.ia.us
k12.id.us
k12.il.us
k12.in.us
k12.ks.us
k12.ky.us
k12.la.us
k12.ma.us
k12.md.us
k12.me.us
k12.mi.us
k12.mn.us
k12.mo.us
k12.ms.us
k12.mt.us
k12.nc.us
k12.ne.us
k12.nh.us
k12.nj.us
k12.nm.us
k12.nv.us
k12.ny.us
k12.oh.us
k12.ok.us
k12.or.us
k12.pa.us
k12.pr.us
// k12.ri.us - Removed at request of Kim Cournoyer
k12.sc.us
// k12.sd.us - Bug 934131 - Removed at request of James Booze
k12.tn.us
k12.tx.us
k12.ut.us
k12.va.us
k12.vi.us
k12.vt.us
k12.wa.us
k12.wi.us
// k12.wv.us - Bug 947705 - Removed at request of Verne Britton
cc.ak.us
lib.ak.us
cc.al.us
lib.al.us
cc.ar.us
lib.ar.us
cc.as.us
lib.as.us
cc.az.us
lib.az.us
cc.ca.us
lib.ca.us
cc.co.us
lib.co.us
cc.ct.us
lib.ct.us
cc.dc.us
lib.dc.us
cc.de.us
cc.fl.us
lib.fl.us
cc.ga.us
lib.ga.us
cc.gu.us
lib.gu.us
cc.hi.us
lib.hi.us
cc.ia.us
lib.ia.us
cc.id.us
lib.id.us
cc.il.us
lib.il.us
cc.in.us
lib.in.us
cc.ks.us
lib.ks.us
cc.ky.us
lib.ky.us
cc.la.us
lib.la.us
cc.ma.us
lib.ma.us
cc.md.us
lib.md.us
cc.me.us
lib.me.us
cc.mi.us
lib.mi.us
cc.mn.us
lib.mn.us
cc.mo.us
lib.mo.us
cc.ms.us
cc.mt.us
lib.mt.us
cc.nc.us
lib.nc.us
cc.ne.us
lib.ne.us
cc.nh.us
lib.nh.us
cc.nj.us
lib.nj.us
cc.nm.us
lib.nm.us
cc.nv.us
lib.nv.us
cc.ny.us
lib.ny.us
cc.oh.us
lib.oh.us
cc.ok.us
lib.ok.us
cc.or.us
lib.or.us
cc.pa.us
lib.pa.us
cc.pr.us
lib.pr.us
cc.ri.us
lib.ri.us
cc.sc.us
lib.sc.us
cc.sd.us
lib.sd.us
cc.tn.us
lib.tn.us
cc.tx.us
lib.tx.us
cc.ut.us
lib.ut.us
cc.va.us
lib.va.us
cc.vi.us
lib.vi.us
cc.vt.us
lib.vt.us
cc.wa.us
lib.wa.us
cc.wi.us
lib.wi.us
cc.wv.us
cc.wy.us
k12.wy.us
// lib.wv.us - Bug 941670 - Removed at request of Larry W Arnold
lib.wy.us
// k12.ma.us contains school districts in Massachusetts. The 4LDs are
// managed independently except for private (PVT), charter (CHTR) and
// parochial (PAROCH) schools. Those are delegated directly to the
// 5LD operators.
chtr.k12.ma.us
paroch.k12.ma.us
pvt.k12.ma.us
// Merit Network, Inc. maintains the registry for =~ /(k12|cc|lib).mi.us/ and the following
// see also: https://domreg.merit.edu : domreg@merit.edu
// see also: whois -h whois.domreg.merit.edu help
ann-arbor.mi.us
cog.mi.us
dst.mi.us
eaton.mi.us
gen.mi.us
mus.mi.us
tec.mi.us
washtenaw.mi.us
// uy : http://www.nic.org.uy/
uy
com.uy
edu.uy
gub.uy
mil.uy
net.uy
org.uy
// uz : http://www.reg.uz/
uz
co.uz
com.uz
net.uz
org.uz
// va : https://www.iana.org/domains/root/db/va.html
va
// vc : https://www.iana.org/domains/root/db/vc.html
// Submitted by registry
vc
com.vc
edu.vc
gov.vc
mil.vc
net.vc
org.vc
// ve : https://registro.nic.ve/
// https://nic.ve/site/user-agreement -> under "III. Clasificación de Nombres de Dominio"
// Submitted by registry nic@nic.ve and nicve@conatel.gob.ve
ve
arts.ve
bib.ve
co.ve
com.ve
e12.ve
edu.ve
emprende.ve
firm.ve
gob.ve
gov.ve
ia.ve
info.ve
int.ve
mil.ve
net.ve
nom.ve
org.ve
rar.ve
rec.ve
store.ve
tec.ve
web.ve
// vg : https://www.iana.org/domains/root/db/vg.html
// Confirmed by registry 2025-01-10
vg
edu.vg
// vi : https://www.iana.org/domains/root/db/vi.html
vi
co.vi
com.vi
k12.vi
net.vi
org.vi
// vn : https://www.vnnic.vn/en/domain/cctld-vn
// https://vnnic.vn/sites/default/files/tailieu/vn.cctld.domains.txt
vn
ac.vn
ai.vn
biz.vn
com.vn
edu.vn
gov.vn
health.vn
id.vn
info.vn
int.vn
io.vn
name.vn
net.vn
org.vn
pro.vn
// vn geographical names
angiang.vn
bacgiang.vn
backan.vn
baclieu.vn
bacninh.vn
baria-vungtau.vn
bentre.vn
binhdinh.vn
binhduong.vn
binhphuoc.vn
binhthuan.vn
camau.vn
cantho.vn
caobang.vn
daklak.vn
daknong.vn
danang.vn
dienbien.vn
dongnai.vn
dongthap.vn
gialai.vn
hagiang.vn
haiduong.vn
haiphong.vn
hanam.vn
hanoi.vn
hatinh.vn
haugiang.vn
hoabinh.vn
hue.vn
hungyen.vn
khanhhoa.vn
kiengiang.vn
kontum.vn
laichau.vn
lamdong.vn
langson.vn
laocai.vn
longan.vn
namdinh.vn
nghean.vn
ninhbinh.vn
ninhthuan.vn
phutho.vn
phuyen.vn
quangbinh.vn
quangnam.vn
quangngai.vn
quangninh.vn
quangtri.vn
soctrang.vn
sonla.vn
tayninh.vn
thaibinh.vn
thainguyen.vn
thanhhoa.vn
thanhphohochiminh.vn
thuathienhue.vn
tiengiang.vn
travinh.vn
tuyenquang.vn
vinhlong.vn
vinhphuc.vn
yenbai.vn
// vu : https://www.iana.org/domains/root/db/vu.html
// http://www.vunic.vu/
vu
com.vu
edu.vu
net.vu
org.vu
// wf : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf
wf
// ws : https://www.iana.org/domains/root/db/ws.html
// http://samoanic.ws/index.dhtml
ws
com.ws
edu.ws
gov.ws
net.ws
org.ws
// yt : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf
yt
// IDN ccTLDs
// When submitting patches, please maintain a sort by ISO 3166 ccTLD, then
// U-label, and follow this format:
// // A-Label ("", [, variant info]) :
// // [sponsoring org]
// U-Label
// xn--mgbaam7a8h ("Emerat", Arabic) : AE
// http://nic.ae/english/arabicdomain/rules.jsp
امارات
// xn--y9a3aq ("hye", Armenian) : AM
// ISOC AM (operated by .am Registry)
հայ
// xn--54b7fta0cc ("Bangla", Bangla) : BD
বাংলা
// xn--90ae ("bg", Bulgarian) : BG
бг
// xn--mgbcpq6gpa1a ("albahrain", Arabic) : BH
البحرين
// xn--90ais ("bel", Belarusian/Russian Cyrillic) : BY
// Operated by .by registry
бел
// xn--fiqs8s ("Zhongguo/China", Chinese, Simplified) : CN
// CNNIC
// https://www.cnnic.cn/11/192/index.html
中国
// xn--fiqz9s ("Zhongguo/China", Chinese, Traditional) : CN
// CNNIC
// https://www.cnnic.com.cn/AU/MediaC/Announcement/201609/t20160905_54470.htm
中國
// xn--lgbbat1ad8j ("Algeria/Al Jazair", Arabic) : DZ
الجزائر
// xn--wgbh1c ("Egypt/Masr", Arabic) : EG
// http://www.dotmasr.eg/
مصر
// xn--e1a4c ("eu", Cyrillic) : EU
// https://eurid.eu
ею
// xn--qxa6a ("eu", Greek) : EU
// https://eurid.eu
ευ
// xn--mgbah1a3hjkrd ("Mauritania", Arabic) : MR
موريتانيا
// xn--node ("ge", Georgian Mkhedruli) : GE
გე
// xn--qxam ("el", Greek) : GR
// Hellenic Ministry of Infrastructure, Transport, and Networks
ελ
// xn--j6w193g ("Hong Kong", Chinese) : HK
// https://www.hkirc.hk
// Submitted by registry
// https://www.hkirc.hk/content.jsp?id=30#!/34
香港
個人.香港
公司.香港
政府.香港
教育.香港
組織.香港
網絡.香港
// xn--2scrj9c ("Bharat", Kannada) : IN
// India
ಭಾರತ
// xn--3hcrj9c ("Bharat", Oriya) : IN
// India
ଭାରତ
// xn--45br5cyl ("Bharatam", Assamese) : IN
// India
ভাৰত
// xn--h2breg3eve ("Bharatam", Sanskrit) : IN
// India
भारतम्
// xn--h2brj9c8c ("Bharot", Santali) : IN
// India
भारोत
// xn--mgbgu82a ("Bharat", Sindhi) : IN
// India
ڀارت
// xn--rvc1e0am3e ("Bharatam", Malayalam) : IN
// India
ഭാരതം
// xn--h2brj9c ("Bharat", Devanagari) : IN
// India
भारत
// xn--mgbbh1a ("Bharat", Kashmiri) : IN
// India
بارت
// xn--mgbbh1a71e ("Bharat", Arabic) : IN
// India
بھارت
// xn--fpcrj9c3d ("Bharat", Telugu) : IN
// India
భారత్
// xn--gecrj9c ("Bharat", Gujarati) : IN
// India
ભારત
// xn--s9brj9c ("Bharat", Gurmukhi) : IN
// India
ਭਾਰਤ
// xn--45brj9c ("Bharat", Bengali) : IN
// India
ভারত
// xn--xkc2dl3a5ee0h ("India", Tamil) : IN
// India
இந்தியா
// xn--mgba3a4f16a ("Iran", Persian) : IR
ایران
// xn--mgba3a4fra ("Iran", Arabic) : IR
ايران
// xn--mgbtx2b ("Iraq", Arabic) : IQ
// Communications and Media Commission
عراق
// xn--mgbayh7gpa ("al-Ordon", Arabic) : JO
// National Information Technology Center (NITC)
// Royal Scientific Society, Al-Jubeiha
الاردن
// xn--3e0b707e ("Republic of Korea", Hangul) : KR
한국
// xn--80ao21a ("Kaz", Kazakh) : KZ
қаз
// xn--q7ce6a ("Lao", Lao) : LA
ລາວ
// xn--fzc2c9e2c ("Lanka", Sinhalese-Sinhala) : LK
// https://nic.lk
ලංකා
// xn--xkc2al3hye2a ("Ilangai", Tamil) : LK
// https://nic.lk
இலங்கை
// xn--mgbc0a9azcg ("Morocco/al-Maghrib", Arabic) : MA
المغرب
// xn--d1alf ("mkd", Macedonian) : MK
// MARnet
мкд
// xn--l1acc ("mon", Mongolian) : MN
мон
// xn--mix891f ("Macao", Chinese, Traditional) : MO
// MONIC / HNET Asia (Registry Operator for .mo)
澳門
// xn--mix082f ("Macao", Chinese, Simplified) : MO
澳门
// xn--mgbx4cd0ab ("Malaysia", Malay) : MY
مليسيا
// xn--mgb9awbf ("Oman", Arabic) : OM
عمان
// xn--mgbai9azgqp6j ("Pakistan", Urdu/Arabic) : PK
پاکستان
// xn--mgbai9a5eva00b ("Pakistan", Urdu/Arabic, variant) : PK
پاكستان
// xn--ygbi2ammx ("Falasteen", Arabic) : PS
// The Palestinian National Internet Naming Authority (PNINA)
// http://www.pnina.ps
فلسطين
// xn--90a3ac ("srb", Cyrillic) : RS
// https://www.rnids.rs/en/domains/national-domains
срб
ак.срб
обр.срб
од.срб
орг.срб
пр.срб
упр.срб
// xn--p1ai ("rf", Russian-Cyrillic) : RU
// https://cctld.ru/files/pdf/docs/en/rules_ru-rf.pdf
// Submitted by George Georgievsky
рф
// xn--wgbl6a ("Qatar", Arabic) : QA
// http://www.ict.gov.qa/
قطر
// xn--mgberp4a5d4ar ("AlSaudiah", Arabic) : SA
// http://www.nic.net.sa/
السعودية
// xn--mgberp4a5d4a87g ("AlSaudiah", Arabic, variant): SA
السعودیة
// xn--mgbqly7c0a67fbc ("AlSaudiah", Arabic, variant) : SA
السعودیۃ
// xn--mgbqly7cvafr ("AlSaudiah", Arabic, variant) : SA
السعوديه
// xn--mgbpl2fh ("sudan", Arabic) : SD
// Operated by .sd registry
سودان
// xn--yfro4i67o Singapore ("Singapore", Chinese) : SG
新加坡
// xn--clchc0ea0b2g2a9gcd ("Singapore", Tamil) : SG
சிங்கப்பூர்
// xn--ogbpf8fl ("Syria", Arabic) : SY
سورية
// xn--mgbtf8fl ("Syria", Arabic, variant) : SY
سوريا
// xn--o3cw4h ("Thai", Thai) : TH
// http://www.thnic.co.th
ไทย
ทหาร.ไทย
ธุรกิจ.ไทย
เน็ต.ไทย
รัฐบาล.ไทย
ศึกษา.ไทย
องค์กร.ไทย
// xn--pgbs0dh ("Tunisia", Arabic) : TN
// http://nic.tn
تونس
// xn--kpry57d ("Taiwan", Chinese, Traditional) : TW
// https://twnic.tw/dnservice_catag.php
台灣
// xn--kprw13d ("Taiwan", Chinese, Simplified) : TW
// http://www.twnic.net/english/dn/dn_07a.htm
台湾
// xn--nnx388a ("Taiwan", Chinese, variant) : TW
臺灣
// xn--j1amh ("ukr", Cyrillic) : UA
укр
// xn--mgb2ddes ("AlYemen", Arabic) : YE
اليمن
// xxx : http://icmregistry.com
xxx
// ye : http://www.y.net.ye/services/domain_name.htm
ye
com.ye
edu.ye
gov.ye
mil.ye
net.ye
org.ye
// za : https://www.iana.org/domains/root/db/za.html
ac.za
agric.za
alt.za
co.za
edu.za
gov.za
grondar.za
law.za
mil.za
net.za
ngo.za
nic.za
nis.za
nom.za
org.za
school.za
tm.za
web.za
// zm : https://zicta.zm/
// Submitted by registry
zm
ac.zm
biz.zm
co.zm
com.zm
edu.zm
gov.zm
info.zm
mil.zm
net.zm
org.zm
sch.zm
// zw : https://www.potraz.gov.zw/
// Confirmed by registry 2017-01-25
zw
ac.zw
co.zw
gov.zw
mil.zw
org.zw
// newGTLDs
// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-06-13T16:12:40Z
// This list is auto-generated, don't edit it manually.
// aaa : American Automobile Association, Inc.
// https://www.iana.org/domains/root/db/aaa.html
aaa
// aarp : AARP
// https://www.iana.org/domains/root/db/aarp.html
aarp
// abb : ABB Ltd
// https://www.iana.org/domains/root/db/abb.html
abb
// abbott : Abbott Laboratories, Inc.
// https://www.iana.org/domains/root/db/abbott.html
abbott
// abbvie : AbbVie Inc.
// https://www.iana.org/domains/root/db/abbvie.html
abbvie
// abc : Disney Enterprises, Inc.
// https://www.iana.org/domains/root/db/abc.html
abc
// able : Able Inc.
// https://www.iana.org/domains/root/db/able.html
able
// abogado : Registry Services, LLC
// https://www.iana.org/domains/root/db/abogado.html
abogado
// abudhabi : Abu Dhabi Systems and Information Centre
// https://www.iana.org/domains/root/db/abudhabi.html
abudhabi
// academy : Binky Moon, LLC
// https://www.iana.org/domains/root/db/academy.html
academy
// accenture : Accenture plc
// https://www.iana.org/domains/root/db/accenture.html
accenture
// accountant : dot Accountant Limited
// https://www.iana.org/domains/root/db/accountant.html
accountant
// accountants : Binky Moon, LLC
// https://www.iana.org/domains/root/db/accountants.html
accountants
// aco : ACO Severin Ahlmann GmbH & Co. KG
// https://www.iana.org/domains/root/db/aco.html
aco
// actor : Dog Beach, LLC
// https://www.iana.org/domains/root/db/actor.html
actor
// ads : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/ads.html
ads
// adult : ICM Registry AD LLC
// https://www.iana.org/domains/root/db/adult.html
adult
// aeg : Aktiebolaget Electrolux
// https://www.iana.org/domains/root/db/aeg.html
aeg
// aetna : Aetna Life Insurance Company
// https://www.iana.org/domains/root/db/aetna.html
aetna
// afl : Australian Football League
// https://www.iana.org/domains/root/db/afl.html
afl
// africa : ZA Central Registry NPC trading as Registry.Africa
// https://www.iana.org/domains/root/db/africa.html
africa
// agakhan : Fondation Aga Khan (Aga Khan Foundation)
// https://www.iana.org/domains/root/db/agakhan.html
agakhan
// agency : Binky Moon, LLC
// https://www.iana.org/domains/root/db/agency.html
agency
// aig : American International Group, Inc.
// https://www.iana.org/domains/root/db/aig.html
aig
// airbus : Airbus S.A.S.
// https://www.iana.org/domains/root/db/airbus.html
airbus
// airforce : Dog Beach, LLC
// https://www.iana.org/domains/root/db/airforce.html
airforce
// airtel : Bharti Airtel Limited
// https://www.iana.org/domains/root/db/airtel.html
airtel
// akdn : Fondation Aga Khan (Aga Khan Foundation)
// https://www.iana.org/domains/root/db/akdn.html
akdn
// alibaba : Alibaba Group Holding Limited
// https://www.iana.org/domains/root/db/alibaba.html
alibaba
// alipay : Alibaba Group Holding Limited
// https://www.iana.org/domains/root/db/alipay.html
alipay
// allfinanz : Allfinanz Deutsche Vermögensberatung Aktiengesellschaft
// https://www.iana.org/domains/root/db/allfinanz.html
allfinanz
// allstate : Allstate Fire and Casualty Insurance Company
// https://www.iana.org/domains/root/db/allstate.html
allstate
// ally : Ally Financial Inc.
// https://www.iana.org/domains/root/db/ally.html
ally
// alsace : Region Grand Est
// https://www.iana.org/domains/root/db/alsace.html
alsace
// alstom : ALSTOM
// https://www.iana.org/domains/root/db/alstom.html
alstom
// amazon : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/amazon.html
amazon
// americanexpress : American Express Travel Related Services Company, Inc.
// https://www.iana.org/domains/root/db/americanexpress.html
americanexpress
// americanfamily : AmFam, Inc.
// https://www.iana.org/domains/root/db/americanfamily.html
americanfamily
// amex : American Express Travel Related Services Company, Inc.
// https://www.iana.org/domains/root/db/amex.html
amex
// amfam : AmFam, Inc.
// https://www.iana.org/domains/root/db/amfam.html
amfam
// amica : Amica Mutual Insurance Company
// https://www.iana.org/domains/root/db/amica.html
amica
// amsterdam : Gemeente Amsterdam
// https://www.iana.org/domains/root/db/amsterdam.html
amsterdam
// analytics : Campus IP LLC
// https://www.iana.org/domains/root/db/analytics.html
analytics
// android : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/android.html
android
// anquan : Beijing Qihu Keji Co., Ltd.
// https://www.iana.org/domains/root/db/anquan.html
anquan
// anz : Australia and New Zealand Banking Group Limited
// https://www.iana.org/domains/root/db/anz.html
anz
// aol : AOL Media LLC
// https://www.iana.org/domains/root/db/aol.html
aol
// apartments : Binky Moon, LLC
// https://www.iana.org/domains/root/db/apartments.html
apartments
// app : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/app.html
app
// apple : Apple Inc.
// https://www.iana.org/domains/root/db/apple.html
apple
// aquarelle : Aquarelle.com
// https://www.iana.org/domains/root/db/aquarelle.html
aquarelle
// arab : League of Arab States
// https://www.iana.org/domains/root/db/arab.html
arab
// aramco : Aramco Services Company
// https://www.iana.org/domains/root/db/aramco.html
aramco
// archi : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/archi.html
archi
// army : Dog Beach, LLC
// https://www.iana.org/domains/root/db/army.html
army
// art : UK Creative Ideas Limited
// https://www.iana.org/domains/root/db/art.html
art
// arte : Association Relative à la Télévision Européenne G.E.I.E.
// https://www.iana.org/domains/root/db/arte.html
arte
// asda : Asda Stores Limited
// https://www.iana.org/domains/root/db/asda.html
asda
// associates : Binky Moon, LLC
// https://www.iana.org/domains/root/db/associates.html
associates
// athleta : The Gap, Inc.
// https://www.iana.org/domains/root/db/athleta.html
athleta
// attorney : Dog Beach, LLC
// https://www.iana.org/domains/root/db/attorney.html
attorney
// auction : Dog Beach, LLC
// https://www.iana.org/domains/root/db/auction.html
auction
// audi : AUDI Aktiengesellschaft
// https://www.iana.org/domains/root/db/audi.html
audi
// audible : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/audible.html
audible
// audio : XYZ.COM LLC
// https://www.iana.org/domains/root/db/audio.html
audio
// auspost : Australian Postal Corporation
// https://www.iana.org/domains/root/db/auspost.html
auspost
// author : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/author.html
author
// auto : XYZ.COM LLC
// https://www.iana.org/domains/root/db/auto.html
auto
// autos : XYZ.COM LLC
// https://www.iana.org/domains/root/db/autos.html
autos
// aws : AWS Registry LLC
// https://www.iana.org/domains/root/db/aws.html
aws
// axa : AXA Group Operations SAS
// https://www.iana.org/domains/root/db/axa.html
axa
// azure : Microsoft Corporation
// https://www.iana.org/domains/root/db/azure.html
azure
// baby : XYZ.COM LLC
// https://www.iana.org/domains/root/db/baby.html
baby
// baidu : Baidu, Inc.
// https://www.iana.org/domains/root/db/baidu.html
baidu
// banamex : Citigroup Inc.
// https://www.iana.org/domains/root/db/banamex.html
banamex
// band : Dog Beach, LLC
// https://www.iana.org/domains/root/db/band.html
band
// bank : fTLD Registry Services LLC
// https://www.iana.org/domains/root/db/bank.html
bank
// bar : Punto 2012 Sociedad Anonima Promotora de Inversion de Capital Variable
// https://www.iana.org/domains/root/db/bar.html
bar
// barcelona : Municipi de Barcelona
// https://www.iana.org/domains/root/db/barcelona.html
barcelona
// barclaycard : Barclays Bank PLC
// https://www.iana.org/domains/root/db/barclaycard.html
barclaycard
// barclays : Barclays Bank PLC
// https://www.iana.org/domains/root/db/barclays.html
barclays
// barefoot : Gallo Vineyards, Inc.
// https://www.iana.org/domains/root/db/barefoot.html
barefoot
// bargains : Binky Moon, LLC
// https://www.iana.org/domains/root/db/bargains.html
bargains
// baseball : MLB Advanced Media DH, LLC
// https://www.iana.org/domains/root/db/baseball.html
baseball
// basketball : Fédération Internationale de Basketball (FIBA)
// https://www.iana.org/domains/root/db/basketball.html
basketball
// bauhaus : Werkhaus GmbH
// https://www.iana.org/domains/root/db/bauhaus.html
bauhaus
// bayern : Bayern Connect GmbH
// https://www.iana.org/domains/root/db/bayern.html
bayern
// bbc : British Broadcasting Corporation
// https://www.iana.org/domains/root/db/bbc.html
bbc
// bbt : BB&T Corporation
// https://www.iana.org/domains/root/db/bbt.html
bbt
// bbva : BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
// https://www.iana.org/domains/root/db/bbva.html
bbva
// bcg : The Boston Consulting Group, Inc.
// https://www.iana.org/domains/root/db/bcg.html
bcg
// bcn : Municipi de Barcelona
// https://www.iana.org/domains/root/db/bcn.html
bcn
// beats : Beats Electronics, LLC
// https://www.iana.org/domains/root/db/beats.html
beats
// beauty : XYZ.COM LLC
// https://www.iana.org/domains/root/db/beauty.html
beauty
// beer : Registry Services, LLC
// https://www.iana.org/domains/root/db/beer.html
beer
// berlin : dotBERLIN GmbH & Co. KG
// https://www.iana.org/domains/root/db/berlin.html
berlin
// best : BestTLD Pty Ltd
// https://www.iana.org/domains/root/db/best.html
best
// bestbuy : BBY Solutions, Inc.
// https://www.iana.org/domains/root/db/bestbuy.html
bestbuy
// bet : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/bet.html
bet
// bharti : Bharti Enterprises (Holding) Private Limited
// https://www.iana.org/domains/root/db/bharti.html
bharti
// bible : American Bible Society
// https://www.iana.org/domains/root/db/bible.html
bible
// bid : dot Bid Limited
// https://www.iana.org/domains/root/db/bid.html
bid
// bike : Binky Moon, LLC
// https://www.iana.org/domains/root/db/bike.html
bike
// bing : Microsoft Corporation
// https://www.iana.org/domains/root/db/bing.html
bing
// bingo : Binky Moon, LLC
// https://www.iana.org/domains/root/db/bingo.html
bingo
// bio : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/bio.html
bio
// black : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/black.html
black
// blackfriday : Registry Services, LLC
// https://www.iana.org/domains/root/db/blackfriday.html
blackfriday
// blockbuster : Dish DBS Corporation
// https://www.iana.org/domains/root/db/blockbuster.html
blockbuster
// blog : Knock Knock WHOIS There, LLC
// https://www.iana.org/domains/root/db/blog.html
blog
// bloomberg : Bloomberg IP Holdings LLC
// https://www.iana.org/domains/root/db/bloomberg.html
bloomberg
// blue : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/blue.html
blue
// bms : Bristol-Myers Squibb Company
// https://www.iana.org/domains/root/db/bms.html
bms
// bmw : Bayerische Motoren Werke Aktiengesellschaft
// https://www.iana.org/domains/root/db/bmw.html
bmw
// bnpparibas : BNP Paribas
// https://www.iana.org/domains/root/db/bnpparibas.html
bnpparibas
// boats : XYZ.COM LLC
// https://www.iana.org/domains/root/db/boats.html
boats
// boehringer : Boehringer Ingelheim International GmbH
// https://www.iana.org/domains/root/db/boehringer.html
boehringer
// bofa : Bank of America Corporation
// https://www.iana.org/domains/root/db/bofa.html
bofa
// bom : Núcleo de Informação e Coordenação do Ponto BR - NIC.br
// https://www.iana.org/domains/root/db/bom.html
bom
// bond : ShortDot SA
// https://www.iana.org/domains/root/db/bond.html
bond
// boo : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/boo.html
boo
// book : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/book.html
book
// booking : Booking.com B.V.
// https://www.iana.org/domains/root/db/booking.html
booking
// bosch : Robert Bosch GMBH
// https://www.iana.org/domains/root/db/bosch.html
bosch
// bostik : Bostik SA
// https://www.iana.org/domains/root/db/bostik.html
bostik
// boston : Registry Services, LLC
// https://www.iana.org/domains/root/db/boston.html
boston
// bot : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/bot.html
bot
// boutique : Binky Moon, LLC
// https://www.iana.org/domains/root/db/boutique.html
boutique
// box : Intercap Registry Inc.
// https://www.iana.org/domains/root/db/box.html
box
// bradesco : Banco Bradesco S.A.
// https://www.iana.org/domains/root/db/bradesco.html
bradesco
// bridgestone : Bridgestone Corporation
// https://www.iana.org/domains/root/db/bridgestone.html
bridgestone
// broadway : Celebrate Broadway, Inc.
// https://www.iana.org/domains/root/db/broadway.html
broadway
// broker : Dog Beach, LLC
// https://www.iana.org/domains/root/db/broker.html
broker
// brother : Brother Industries, Ltd.
// https://www.iana.org/domains/root/db/brother.html
brother
// brussels : DNS.be vzw
// https://www.iana.org/domains/root/db/brussels.html
brussels
// build : Plan Bee LLC
// https://www.iana.org/domains/root/db/build.html
build
// builders : Binky Moon, LLC
// https://www.iana.org/domains/root/db/builders.html
builders
// business : Binky Moon, LLC
// https://www.iana.org/domains/root/db/business.html
business
// buy : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/buy.html
buy
// buzz : DOTSTRATEGY CO.
// https://www.iana.org/domains/root/db/buzz.html
buzz
// bzh : Association www.bzh
// https://www.iana.org/domains/root/db/bzh.html
bzh
// cab : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cab.html
cab
// cafe : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cafe.html
cafe
// cal : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/cal.html
cal
// call : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/call.html
call
// calvinklein : PVH gTLD Holdings LLC
// https://www.iana.org/domains/root/db/calvinklein.html
calvinklein
// cam : Cam Connecting SARL
// https://www.iana.org/domains/root/db/cam.html
cam
// camera : Binky Moon, LLC
// https://www.iana.org/domains/root/db/camera.html
camera
// camp : Binky Moon, LLC
// https://www.iana.org/domains/root/db/camp.html
camp
// canon : Canon Inc.
// https://www.iana.org/domains/root/db/canon.html
canon
// capetown : ZA Central Registry NPC trading as ZA Central Registry
// https://www.iana.org/domains/root/db/capetown.html
capetown
// capital : Binky Moon, LLC
// https://www.iana.org/domains/root/db/capital.html
capital
// capitalone : Capital One Financial Corporation
// https://www.iana.org/domains/root/db/capitalone.html
capitalone
// car : XYZ.COM LLC
// https://www.iana.org/domains/root/db/car.html
car
// caravan : Caravan International, Inc.
// https://www.iana.org/domains/root/db/caravan.html
caravan
// cards : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cards.html
cards
// care : Binky Moon, LLC
// https://www.iana.org/domains/root/db/care.html
care
// career : dotCareer LLC
// https://www.iana.org/domains/root/db/career.html
career
// careers : Binky Moon, LLC
// https://www.iana.org/domains/root/db/careers.html
careers
// cars : XYZ.COM LLC
// https://www.iana.org/domains/root/db/cars.html
cars
// casa : Registry Services, LLC
// https://www.iana.org/domains/root/db/casa.html
casa
// case : Digity, LLC
// https://www.iana.org/domains/root/db/case.html
case
// cash : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cash.html
cash
// casino : Binky Moon, LLC
// https://www.iana.org/domains/root/db/casino.html
casino
// catering : Binky Moon, LLC
// https://www.iana.org/domains/root/db/catering.html
catering
// catholic : Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
// https://www.iana.org/domains/root/db/catholic.html
catholic
// cba : COMMONWEALTH BANK OF AUSTRALIA
// https://www.iana.org/domains/root/db/cba.html
cba
// cbn : The Christian Broadcasting Network, Inc.
// https://www.iana.org/domains/root/db/cbn.html
cbn
// cbre : CBRE, Inc.
// https://www.iana.org/domains/root/db/cbre.html
cbre
// center : Binky Moon, LLC
// https://www.iana.org/domains/root/db/center.html
center
// ceo : XYZ.COM LLC
// https://www.iana.org/domains/root/db/ceo.html
ceo
// cern : European Organization for Nuclear Research ("CERN")
// https://www.iana.org/domains/root/db/cern.html
cern
// cfa : CFA Institute
// https://www.iana.org/domains/root/db/cfa.html
cfa
// cfd : ShortDot SA
// https://www.iana.org/domains/root/db/cfd.html
cfd
// chanel : Chanel International B.V.
// https://www.iana.org/domains/root/db/chanel.html
chanel
// channel : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/channel.html
channel
// charity : Public Interest Registry
// https://www.iana.org/domains/root/db/charity.html
charity
// chase : JPMorgan Chase Bank, National Association
// https://www.iana.org/domains/root/db/chase.html
chase
// chat : Binky Moon, LLC
// https://www.iana.org/domains/root/db/chat.html
chat
// cheap : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cheap.html
cheap
// chintai : CHINTAI Corporation
// https://www.iana.org/domains/root/db/chintai.html
chintai
// christmas : XYZ.COM LLC
// https://www.iana.org/domains/root/db/christmas.html
christmas
// chrome : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/chrome.html
chrome
// church : Binky Moon, LLC
// https://www.iana.org/domains/root/db/church.html
church
// cipriani : Hotel Cipriani Srl
// https://www.iana.org/domains/root/db/cipriani.html
cipriani
// circle : Jolly Host, LLC
// https://www.iana.org/domains/root/db/circle.html
circle
// cisco : Cisco Technology, Inc.
// https://www.iana.org/domains/root/db/cisco.html
cisco
// citadel : Citadel Domain LLC
// https://www.iana.org/domains/root/db/citadel.html
citadel
// citi : Citigroup Inc.
// https://www.iana.org/domains/root/db/citi.html
citi
// citic : CITIC Group Corporation
// https://www.iana.org/domains/root/db/citic.html
citic
// city : Binky Moon, LLC
// https://www.iana.org/domains/root/db/city.html
city
// claims : Binky Moon, LLC
// https://www.iana.org/domains/root/db/claims.html
claims
// cleaning : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cleaning.html
cleaning
// click : Waterford Limited
// https://www.iana.org/domains/root/db/click.html
click
// clinic : Binky Moon, LLC
// https://www.iana.org/domains/root/db/clinic.html
clinic
// clinique : The Estée Lauder Companies Inc.
// https://www.iana.org/domains/root/db/clinique.html
clinique
// clothing : Binky Moon, LLC
// https://www.iana.org/domains/root/db/clothing.html
clothing
// cloud : Aruba PEC S.p.A.
// https://www.iana.org/domains/root/db/cloud.html
cloud
// club : Registry Services, LLC
// https://www.iana.org/domains/root/db/club.html
club
// clubmed : Club Méditerranée S.A.
// https://www.iana.org/domains/root/db/clubmed.html
clubmed
// coach : Binky Moon, LLC
// https://www.iana.org/domains/root/db/coach.html
coach
// codes : Binky Moon, LLC
// https://www.iana.org/domains/root/db/codes.html
codes
// coffee : Binky Moon, LLC
// https://www.iana.org/domains/root/db/coffee.html
coffee
// college : XYZ.COM LLC
// https://www.iana.org/domains/root/db/college.html
college
// cologne : dotKoeln GmbH
// https://www.iana.org/domains/root/db/cologne.html
cologne
// commbank : COMMONWEALTH BANK OF AUSTRALIA
// https://www.iana.org/domains/root/db/commbank.html
commbank
// community : Binky Moon, LLC
// https://www.iana.org/domains/root/db/community.html
community
// company : Binky Moon, LLC
// https://www.iana.org/domains/root/db/company.html
company
// compare : Registry Services, LLC
// https://www.iana.org/domains/root/db/compare.html
compare
// computer : Binky Moon, LLC
// https://www.iana.org/domains/root/db/computer.html
computer
// comsec : VeriSign, Inc.
// https://www.iana.org/domains/root/db/comsec.html
comsec
// condos : Binky Moon, LLC
// https://www.iana.org/domains/root/db/condos.html
condos
// construction : Binky Moon, LLC
// https://www.iana.org/domains/root/db/construction.html
construction
// consulting : Dog Beach, LLC
// https://www.iana.org/domains/root/db/consulting.html
consulting
// contact : Dog Beach, LLC
// https://www.iana.org/domains/root/db/contact.html
contact
// contractors : Binky Moon, LLC
// https://www.iana.org/domains/root/db/contractors.html
contractors
// cooking : Registry Services, LLC
// https://www.iana.org/domains/root/db/cooking.html
cooking
// cool : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cool.html
cool
// corsica : Collectivité de Corse
// https://www.iana.org/domains/root/db/corsica.html
corsica
// country : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/country.html
country
// coupon : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/coupon.html
coupon
// coupons : Binky Moon, LLC
// https://www.iana.org/domains/root/db/coupons.html
coupons
// courses : Registry Services, LLC
// https://www.iana.org/domains/root/db/courses.html
courses
// cpa : American Institute of Certified Public Accountants
// https://www.iana.org/domains/root/db/cpa.html
cpa
// credit : Binky Moon, LLC
// https://www.iana.org/domains/root/db/credit.html
credit
// creditcard : Binky Moon, LLC
// https://www.iana.org/domains/root/db/creditcard.html
creditcard
// creditunion : DotCooperation LLC
// https://www.iana.org/domains/root/db/creditunion.html
creditunion
// cricket : dot Cricket Limited
// https://www.iana.org/domains/root/db/cricket.html
cricket
// crown : Crown Equipment Corporation
// https://www.iana.org/domains/root/db/crown.html
crown
// crs : Federated Co-operatives Limited
// https://www.iana.org/domains/root/db/crs.html
crs
// cruise : Viking River Cruises (Bermuda) Ltd.
// https://www.iana.org/domains/root/db/cruise.html
cruise
// cruises : Binky Moon, LLC
// https://www.iana.org/domains/root/db/cruises.html
cruises
// cuisinella : SCHMIDT GROUPE S.A.S.
// https://www.iana.org/domains/root/db/cuisinella.html
cuisinella
// cymru : Nominet UK
// https://www.iana.org/domains/root/db/cymru.html
cymru
// cyou : ShortDot SA
// https://www.iana.org/domains/root/db/cyou.html
cyou
// dad : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/dad.html
dad
// dance : Dog Beach, LLC
// https://www.iana.org/domains/root/db/dance.html
dance
// data : Dish DBS Corporation
// https://www.iana.org/domains/root/db/data.html
data
// date : dot Date Limited
// https://www.iana.org/domains/root/db/date.html
date
// dating : Binky Moon, LLC
// https://www.iana.org/domains/root/db/dating.html
dating
// datsun : NISSAN MOTOR CO., LTD.
// https://www.iana.org/domains/root/db/datsun.html
datsun
// day : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/day.html
day
// dclk : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/dclk.html
dclk
// dds : Registry Services, LLC
// https://www.iana.org/domains/root/db/dds.html
dds
// deal : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/deal.html
deal
// dealer : Intercap Registry Inc.
// https://www.iana.org/domains/root/db/dealer.html
dealer
// deals : Binky Moon, LLC
// https://www.iana.org/domains/root/db/deals.html
deals
// degree : Dog Beach, LLC
// https://www.iana.org/domains/root/db/degree.html
degree
// delivery : Binky Moon, LLC
// https://www.iana.org/domains/root/db/delivery.html
delivery
// dell : Dell Inc.
// https://www.iana.org/domains/root/db/dell.html
dell
// deloitte : Deloitte Touche Tohmatsu
// https://www.iana.org/domains/root/db/deloitte.html
deloitte
// delta : Delta Air Lines, Inc.
// https://www.iana.org/domains/root/db/delta.html
delta
// democrat : Dog Beach, LLC
// https://www.iana.org/domains/root/db/democrat.html
democrat
// dental : Binky Moon, LLC
// https://www.iana.org/domains/root/db/dental.html
dental
// dentist : Dog Beach, LLC
// https://www.iana.org/domains/root/db/dentist.html
dentist
// desi
// https://www.iana.org/domains/root/db/desi.html
desi
// design : Registry Services, LLC
// https://www.iana.org/domains/root/db/design.html
design
// dev : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/dev.html
dev
// dhl : Deutsche Post AG
// https://www.iana.org/domains/root/db/dhl.html
dhl
// diamonds : Binky Moon, LLC
// https://www.iana.org/domains/root/db/diamonds.html
diamonds
// diet : XYZ.COM LLC
// https://www.iana.org/domains/root/db/diet.html
diet
// digital : Binky Moon, LLC
// https://www.iana.org/domains/root/db/digital.html
digital
// direct : Binky Moon, LLC
// https://www.iana.org/domains/root/db/direct.html
direct
// directory : Binky Moon, LLC
// https://www.iana.org/domains/root/db/directory.html
directory
// discount : Binky Moon, LLC
// https://www.iana.org/domains/root/db/discount.html
discount
// discover : Discover Financial Services
// https://www.iana.org/domains/root/db/discover.html
discover
// dish : Dish DBS Corporation
// https://www.iana.org/domains/root/db/dish.html
dish
// diy : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/diy.html
diy
// dnp : Dai Nippon Printing Co., Ltd.
// https://www.iana.org/domains/root/db/dnp.html
dnp
// docs : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/docs.html
docs
// doctor : Binky Moon, LLC
// https://www.iana.org/domains/root/db/doctor.html
doctor
// dog : Binky Moon, LLC
// https://www.iana.org/domains/root/db/dog.html
dog
// domains : Binky Moon, LLC
// https://www.iana.org/domains/root/db/domains.html
domains
// dot : Dish DBS Corporation
// https://www.iana.org/domains/root/db/dot.html
dot
// download : dot Support Limited
// https://www.iana.org/domains/root/db/download.html
download
// drive : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/drive.html
drive
// dtv : Dish DBS Corporation
// https://www.iana.org/domains/root/db/dtv.html
dtv
// dubai : Dubai Smart Government Department
// https://www.iana.org/domains/root/db/dubai.html
dubai
// dupont : DuPont Specialty Products USA, LLC
// https://www.iana.org/domains/root/db/dupont.html
dupont
// durban : ZA Central Registry NPC trading as ZA Central Registry
// https://www.iana.org/domains/root/db/durban.html
durban
// dvag : Deutsche Vermögensberatung Aktiengesellschaft DVAG
// https://www.iana.org/domains/root/db/dvag.html
dvag
// dvr : DISH Technologies L.L.C.
// https://www.iana.org/domains/root/db/dvr.html
dvr
// earth : Interlink Systems Innovation Institute K.K.
// https://www.iana.org/domains/root/db/earth.html
earth
// eat : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/eat.html
eat
// eco : Big Room Inc.
// https://www.iana.org/domains/root/db/eco.html
eco
// edeka : EDEKA Verband kaufmännischer Genossenschaften e.V.
// https://www.iana.org/domains/root/db/edeka.html
edeka
// education : Binky Moon, LLC
// https://www.iana.org/domains/root/db/education.html
education
// email : Binky Moon, LLC
// https://www.iana.org/domains/root/db/email.html
email
// emerck : Merck KGaA
// https://www.iana.org/domains/root/db/emerck.html
emerck
// energy : Binky Moon, LLC
// https://www.iana.org/domains/root/db/energy.html
energy
// engineer : Dog Beach, LLC
// https://www.iana.org/domains/root/db/engineer.html
engineer
// engineering : Binky Moon, LLC
// https://www.iana.org/domains/root/db/engineering.html
engineering
// enterprises : Binky Moon, LLC
// https://www.iana.org/domains/root/db/enterprises.html
enterprises
// epson : Seiko Epson Corporation
// https://www.iana.org/domains/root/db/epson.html
epson
// equipment : Binky Moon, LLC
// https://www.iana.org/domains/root/db/equipment.html
equipment
// ericsson : Telefonaktiebolaget L M Ericsson
// https://www.iana.org/domains/root/db/ericsson.html
ericsson
// erni : ERNI Group Holding AG
// https://www.iana.org/domains/root/db/erni.html
erni
// esq : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/esq.html
esq
// estate : Binky Moon, LLC
// https://www.iana.org/domains/root/db/estate.html
estate
// eurovision : European Broadcasting Union (EBU)
// https://www.iana.org/domains/root/db/eurovision.html
eurovision
// eus : Puntueus Fundazioa
// https://www.iana.org/domains/root/db/eus.html
eus
// events : Binky Moon, LLC
// https://www.iana.org/domains/root/db/events.html
events
// exchange : Binky Moon, LLC
// https://www.iana.org/domains/root/db/exchange.html
exchange
// expert : Binky Moon, LLC
// https://www.iana.org/domains/root/db/expert.html
expert
// exposed : Binky Moon, LLC
// https://www.iana.org/domains/root/db/exposed.html
exposed
// express : Binky Moon, LLC
// https://www.iana.org/domains/root/db/express.html
express
// extraspace : Extra Space Storage LLC
// https://www.iana.org/domains/root/db/extraspace.html
extraspace
// fage : Fage International S.A.
// https://www.iana.org/domains/root/db/fage.html
fage
// fail : Binky Moon, LLC
// https://www.iana.org/domains/root/db/fail.html
fail
// fairwinds : FairWinds Partners, LLC
// https://www.iana.org/domains/root/db/fairwinds.html
fairwinds
// faith : dot Faith Limited
// https://www.iana.org/domains/root/db/faith.html
faith
// family : Dog Beach, LLC
// https://www.iana.org/domains/root/db/family.html
family
// fan : Dog Beach, LLC
// https://www.iana.org/domains/root/db/fan.html
fan
// fans : ZDNS International Limited
// https://www.iana.org/domains/root/db/fans.html
fans
// farm : Binky Moon, LLC
// https://www.iana.org/domains/root/db/farm.html
farm
// farmers : Farmers Insurance Exchange
// https://www.iana.org/domains/root/db/farmers.html
farmers
// fashion : Registry Services, LLC
// https://www.iana.org/domains/root/db/fashion.html
fashion
// fast : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/fast.html
fast
// fedex : Federal Express Corporation
// https://www.iana.org/domains/root/db/fedex.html
fedex
// feedback : Top Level Spectrum, Inc.
// https://www.iana.org/domains/root/db/feedback.html
feedback
// ferrari : Fiat Chrysler Automobiles N.V.
// https://www.iana.org/domains/root/db/ferrari.html
ferrari
// ferrero : Ferrero Trading Lux S.A.
// https://www.iana.org/domains/root/db/ferrero.html
ferrero
// fidelity : Fidelity Brokerage Services LLC
// https://www.iana.org/domains/root/db/fidelity.html
fidelity
// fido : Rogers Communications Canada Inc.
// https://www.iana.org/domains/root/db/fido.html
fido
// film : Motion Picture Domain Registry Pty Ltd
// https://www.iana.org/domains/root/db/film.html
film
// final : Núcleo de Informação e Coordenação do Ponto BR - NIC.br
// https://www.iana.org/domains/root/db/final.html
final
// finance : Binky Moon, LLC
// https://www.iana.org/domains/root/db/finance.html
finance
// financial : Binky Moon, LLC
// https://www.iana.org/domains/root/db/financial.html
financial
// fire : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/fire.html
fire
// firestone : Bridgestone Licensing Services, Inc
// https://www.iana.org/domains/root/db/firestone.html
firestone
// firmdale : Firmdale Holdings Limited
// https://www.iana.org/domains/root/db/firmdale.html
firmdale
// fish : Binky Moon, LLC
// https://www.iana.org/domains/root/db/fish.html
fish
// fishing : Registry Services, LLC
// https://www.iana.org/domains/root/db/fishing.html
fishing
// fit : Registry Services, LLC
// https://www.iana.org/domains/root/db/fit.html
fit
// fitness : Binky Moon, LLC
// https://www.iana.org/domains/root/db/fitness.html
fitness
// flickr : Flickr, Inc.
// https://www.iana.org/domains/root/db/flickr.html
flickr
// flights : Binky Moon, LLC
// https://www.iana.org/domains/root/db/flights.html
flights
// flir : FLIR Systems, Inc.
// https://www.iana.org/domains/root/db/flir.html
flir
// florist : Binky Moon, LLC
// https://www.iana.org/domains/root/db/florist.html
florist
// flowers : XYZ.COM LLC
// https://www.iana.org/domains/root/db/flowers.html
flowers
// fly : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/fly.html
fly
// foo : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/foo.html
foo
// food : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/food.html
food
// football : Binky Moon, LLC
// https://www.iana.org/domains/root/db/football.html
football
// ford : Ford Motor Company
// https://www.iana.org/domains/root/db/ford.html
ford
// forex : Dog Beach, LLC
// https://www.iana.org/domains/root/db/forex.html
forex
// forsale : Dog Beach, LLC
// https://www.iana.org/domains/root/db/forsale.html
forsale
// forum : Waterford Limited
// https://www.iana.org/domains/root/db/forum.html
forum
// foundation : Public Interest Registry
// https://www.iana.org/domains/root/db/foundation.html
foundation
// fox : FOX Registry, LLC
// https://www.iana.org/domains/root/db/fox.html
fox
// free : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/free.html
free
// fresenius : Fresenius Immobilien-Verwaltungs-GmbH
// https://www.iana.org/domains/root/db/fresenius.html
fresenius
// frl : FRLregistry B.V.
// https://www.iana.org/domains/root/db/frl.html
frl
// frogans : OP3FT
// https://www.iana.org/domains/root/db/frogans.html
frogans
// frontier : Frontier Communications Corporation
// https://www.iana.org/domains/root/db/frontier.html
frontier
// ftr : Frontier Communications Corporation
// https://www.iana.org/domains/root/db/ftr.html
ftr
// fujitsu : Fujitsu Limited
// https://www.iana.org/domains/root/db/fujitsu.html
fujitsu
// fun : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/fun.html
fun
// fund : Binky Moon, LLC
// https://www.iana.org/domains/root/db/fund.html
fund
// furniture : Binky Moon, LLC
// https://www.iana.org/domains/root/db/furniture.html
furniture
// futbol : Dog Beach, LLC
// https://www.iana.org/domains/root/db/futbol.html
futbol
// fyi : Binky Moon, LLC
// https://www.iana.org/domains/root/db/fyi.html
fyi
// gal : Asociación puntoGAL
// https://www.iana.org/domains/root/db/gal.html
gal
// gallery : Binky Moon, LLC
// https://www.iana.org/domains/root/db/gallery.html
gallery
// gallo : Gallo Vineyards, Inc.
// https://www.iana.org/domains/root/db/gallo.html
gallo
// gallup : Gallup, Inc.
// https://www.iana.org/domains/root/db/gallup.html
gallup
// game : XYZ.COM LLC
// https://www.iana.org/domains/root/db/game.html
game
// games : Dog Beach, LLC
// https://www.iana.org/domains/root/db/games.html
games
// gap : The Gap, Inc.
// https://www.iana.org/domains/root/db/gap.html
gap
// garden : Registry Services, LLC
// https://www.iana.org/domains/root/db/garden.html
garden
// gay : Registry Services, LLC
// https://www.iana.org/domains/root/db/gay.html
gay
// gbiz : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/gbiz.html
gbiz
// gdn : Joint Stock Company "Navigation-information systems"
// https://www.iana.org/domains/root/db/gdn.html
gdn
// gea : GEA Group Aktiengesellschaft
// https://www.iana.org/domains/root/db/gea.html
gea
// gent : Easyhost BV
// https://www.iana.org/domains/root/db/gent.html
gent
// genting : Resorts World Inc Pte. Ltd.
// https://www.iana.org/domains/root/db/genting.html
genting
// george : Wal-Mart Stores, Inc.
// https://www.iana.org/domains/root/db/george.html
george
// ggee : GMO Internet, Inc.
// https://www.iana.org/domains/root/db/ggee.html
ggee
// gift : DotGift, LLC
// https://www.iana.org/domains/root/db/gift.html
gift
// gifts : Binky Moon, LLC
// https://www.iana.org/domains/root/db/gifts.html
gifts
// gives : Public Interest Registry
// https://www.iana.org/domains/root/db/gives.html
gives
// giving : Public Interest Registry
// https://www.iana.org/domains/root/db/giving.html
giving
// glass : Binky Moon, LLC
// https://www.iana.org/domains/root/db/glass.html
glass
// gle : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/gle.html
gle
// global : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/global.html
global
// globo : Globo Comunicação e Participações S.A
// https://www.iana.org/domains/root/db/globo.html
globo
// gmail : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/gmail.html
gmail
// gmbh : Binky Moon, LLC
// https://www.iana.org/domains/root/db/gmbh.html
gmbh
// gmo : GMO Internet, Inc.
// https://www.iana.org/domains/root/db/gmo.html
gmo
// gmx : 1&1 Mail & Media GmbH
// https://www.iana.org/domains/root/db/gmx.html
gmx
// godaddy : Go Daddy East, LLC
// https://www.iana.org/domains/root/db/godaddy.html
godaddy
// gold : Binky Moon, LLC
// https://www.iana.org/domains/root/db/gold.html
gold
// goldpoint : YODOBASHI CAMERA CO.,LTD.
// https://www.iana.org/domains/root/db/goldpoint.html
goldpoint
// golf : Binky Moon, LLC
// https://www.iana.org/domains/root/db/golf.html
golf
// goodyear : The Goodyear Tire & Rubber Company
// https://www.iana.org/domains/root/db/goodyear.html
goodyear
// goog : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/goog.html
goog
// google : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/google.html
google
// gop : Republican State Leadership Committee, Inc.
// https://www.iana.org/domains/root/db/gop.html
gop
// got : Jolly Host, LLC
// https://www.iana.org/domains/root/db/got.html
got
// grainger : Grainger Registry Services, LLC
// https://www.iana.org/domains/root/db/grainger.html
grainger
// graphics : Binky Moon, LLC
// https://www.iana.org/domains/root/db/graphics.html
graphics
// gratis : Binky Moon, LLC
// https://www.iana.org/domains/root/db/gratis.html
gratis
// green : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/green.html
green
// gripe : Binky Moon, LLC
// https://www.iana.org/domains/root/db/gripe.html
gripe
// grocery : Wal-Mart Stores, Inc.
// https://www.iana.org/domains/root/db/grocery.html
grocery
// group : Binky Moon, LLC
// https://www.iana.org/domains/root/db/group.html
group
// gucci : Guccio Gucci S.p.a.
// https://www.iana.org/domains/root/db/gucci.html
gucci
// guge : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/guge.html
guge
// guide : Binky Moon, LLC
// https://www.iana.org/domains/root/db/guide.html
guide
// guitars : XYZ.COM LLC
// https://www.iana.org/domains/root/db/guitars.html
guitars
// guru : Binky Moon, LLC
// https://www.iana.org/domains/root/db/guru.html
guru
// hair : XYZ.COM LLC
// https://www.iana.org/domains/root/db/hair.html
hair
// hamburg : Hamburg Top-Level-Domain GmbH
// https://www.iana.org/domains/root/db/hamburg.html
hamburg
// hangout : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/hangout.html
hangout
// haus : Dog Beach, LLC
// https://www.iana.org/domains/root/db/haus.html
haus
// hbo : HBO Registry Services, Inc.
// https://www.iana.org/domains/root/db/hbo.html
hbo
// hdfc : HDFC BANK LIMITED
// https://www.iana.org/domains/root/db/hdfc.html
hdfc
// hdfcbank : HDFC BANK LIMITED
// https://www.iana.org/domains/root/db/hdfcbank.html
hdfcbank
// health : Registry Services, LLC
// https://www.iana.org/domains/root/db/health.html
health
// healthcare : Binky Moon, LLC
// https://www.iana.org/domains/root/db/healthcare.html
healthcare
// help : Innovation service Limited
// https://www.iana.org/domains/root/db/help.html
help
// helsinki : City of Helsinki
// https://www.iana.org/domains/root/db/helsinki.html
helsinki
// here : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/here.html
here
// hermes : HERMES INTERNATIONAL
// https://www.iana.org/domains/root/db/hermes.html
hermes
// hiphop : Dot Hip Hop, LLC
// https://www.iana.org/domains/root/db/hiphop.html
hiphop
// hisamitsu : Hisamitsu Pharmaceutical Co.,Inc.
// https://www.iana.org/domains/root/db/hisamitsu.html
hisamitsu
// hitachi : Hitachi, Ltd.
// https://www.iana.org/domains/root/db/hitachi.html
hitachi
// hiv : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/hiv.html
hiv
// hkt : PCCW-HKT DataCom Services Limited
// https://www.iana.org/domains/root/db/hkt.html
hkt
// hockey : Binky Moon, LLC
// https://www.iana.org/domains/root/db/hockey.html
hockey
// holdings : Binky Moon, LLC
// https://www.iana.org/domains/root/db/holdings.html
holdings
// holiday : Binky Moon, LLC
// https://www.iana.org/domains/root/db/holiday.html
holiday
// homedepot : Home Depot Product Authority, LLC
// https://www.iana.org/domains/root/db/homedepot.html
homedepot
// homegoods : The TJX Companies, Inc.
// https://www.iana.org/domains/root/db/homegoods.html
homegoods
// homes : XYZ.COM LLC
// https://www.iana.org/domains/root/db/homes.html
homes
// homesense : The TJX Companies, Inc.
// https://www.iana.org/domains/root/db/homesense.html
homesense
// honda : Honda Motor Co., Ltd.
// https://www.iana.org/domains/root/db/honda.html
honda
// horse : Registry Services, LLC
// https://www.iana.org/domains/root/db/horse.html
horse
// hospital : Binky Moon, LLC
// https://www.iana.org/domains/root/db/hospital.html
hospital
// host : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/host.html
host
// hosting : XYZ.COM LLC
// https://www.iana.org/domains/root/db/hosting.html
hosting
// hot : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/hot.html
hot
// hotel : HOTEL Top-Level-Domain S.a.r.l
// https://www.iana.org/domains/root/db/hotel.html
hotel
// hotels : Booking.com B.V.
// https://www.iana.org/domains/root/db/hotels.html
hotels
// hotmail : Microsoft Corporation
// https://www.iana.org/domains/root/db/hotmail.html
hotmail
// house : Binky Moon, LLC
// https://www.iana.org/domains/root/db/house.html
house
// how : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/how.html
how
// hsbc : HSBC Global Services (UK) Limited
// https://www.iana.org/domains/root/db/hsbc.html
hsbc
// hughes : Hughes Satellite Systems Corporation
// https://www.iana.org/domains/root/db/hughes.html
hughes
// hyatt : Hyatt GTLD, L.L.C.
// https://www.iana.org/domains/root/db/hyatt.html
hyatt
// hyundai : Hyundai Motor Company
// https://www.iana.org/domains/root/db/hyundai.html
hyundai
// ibm : International Business Machines Corporation
// https://www.iana.org/domains/root/db/ibm.html
ibm
// icbc : Industrial and Commercial Bank of China Limited
// https://www.iana.org/domains/root/db/icbc.html
icbc
// ice : IntercontinentalExchange, Inc.
// https://www.iana.org/domains/root/db/ice.html
ice
// icu : ShortDot SA
// https://www.iana.org/domains/root/db/icu.html
icu
// ieee : IEEE Global LLC
// https://www.iana.org/domains/root/db/ieee.html
ieee
// ifm : ifm electronic gmbh
// https://www.iana.org/domains/root/db/ifm.html
ifm
// ikano : Ikano S.A.
// https://www.iana.org/domains/root/db/ikano.html
ikano
// imamat : Fondation Aga Khan (Aga Khan Foundation)
// https://www.iana.org/domains/root/db/imamat.html
imamat
// imdb : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/imdb.html
imdb
// immo : Binky Moon, LLC
// https://www.iana.org/domains/root/db/immo.html
immo
// immobilien : Dog Beach, LLC
// https://www.iana.org/domains/root/db/immobilien.html
immobilien
// inc : Intercap Registry Inc.
// https://www.iana.org/domains/root/db/inc.html
inc
// industries : Binky Moon, LLC
// https://www.iana.org/domains/root/db/industries.html
industries
// infiniti : NISSAN MOTOR CO., LTD.
// https://www.iana.org/domains/root/db/infiniti.html
infiniti
// ing : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/ing.html
ing
// ink : Registry Services, LLC
// https://www.iana.org/domains/root/db/ink.html
ink
// institute : Binky Moon, LLC
// https://www.iana.org/domains/root/db/institute.html
institute
// insurance : fTLD Registry Services LLC
// https://www.iana.org/domains/root/db/insurance.html
insurance
// insure : Binky Moon, LLC
// https://www.iana.org/domains/root/db/insure.html
insure
// international : Binky Moon, LLC
// https://www.iana.org/domains/root/db/international.html
international
// intuit : Intuit Administrative Services, Inc.
// https://www.iana.org/domains/root/db/intuit.html
intuit
// investments : Binky Moon, LLC
// https://www.iana.org/domains/root/db/investments.html
investments
// ipiranga : Ipiranga Produtos de Petroleo S.A.
// https://www.iana.org/domains/root/db/ipiranga.html
ipiranga
// irish : Binky Moon, LLC
// https://www.iana.org/domains/root/db/irish.html
irish
// ismaili : Fondation Aga Khan (Aga Khan Foundation)
// https://www.iana.org/domains/root/db/ismaili.html
ismaili
// ist : Istanbul Metropolitan Municipality
// https://www.iana.org/domains/root/db/ist.html
ist
// istanbul : Istanbul Metropolitan Municipality
// https://www.iana.org/domains/root/db/istanbul.html
istanbul
// itau : Itau Unibanco Holding S.A.
// https://www.iana.org/domains/root/db/itau.html
itau
// itv : ITV Services Limited
// https://www.iana.org/domains/root/db/itv.html
itv
// jaguar : Jaguar Land Rover Ltd
// https://www.iana.org/domains/root/db/jaguar.html
jaguar
// java : Oracle Corporation
// https://www.iana.org/domains/root/db/java.html
java
// jcb : JCB Co., Ltd.
// https://www.iana.org/domains/root/db/jcb.html
jcb
// jeep : FCA US LLC.
// https://www.iana.org/domains/root/db/jeep.html
jeep
// jetzt : Binky Moon, LLC
// https://www.iana.org/domains/root/db/jetzt.html
jetzt
// jewelry : Binky Moon, LLC
// https://www.iana.org/domains/root/db/jewelry.html
jewelry
// jio : Reliance Industries Limited
// https://www.iana.org/domains/root/db/jio.html
jio
// jll : Jones Lang LaSalle Incorporated
// https://www.iana.org/domains/root/db/jll.html
jll
// jmp : Matrix IP LLC
// https://www.iana.org/domains/root/db/jmp.html
jmp
// jnj : Johnson & Johnson Services, Inc.
// https://www.iana.org/domains/root/db/jnj.html
jnj
// joburg : ZA Central Registry NPC trading as ZA Central Registry
// https://www.iana.org/domains/root/db/joburg.html
joburg
// jot : Jolly Host, LLC
// https://www.iana.org/domains/root/db/jot.html
jot
// joy : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/joy.html
joy
// jpmorgan : JPMorgan Chase Bank, National Association
// https://www.iana.org/domains/root/db/jpmorgan.html
jpmorgan
// jprs : Japan Registry Services Co., Ltd.
// https://www.iana.org/domains/root/db/jprs.html
jprs
// juegos : Dog Beach, LLC
// https://www.iana.org/domains/root/db/juegos.html
juegos
// juniper : JUNIPER NETWORKS, INC.
// https://www.iana.org/domains/root/db/juniper.html
juniper
// kaufen : Dog Beach, LLC
// https://www.iana.org/domains/root/db/kaufen.html
kaufen
// kddi : KDDI CORPORATION
// https://www.iana.org/domains/root/db/kddi.html
kddi
// kerryhotels : Kerry Trading Co. Limited
// https://www.iana.org/domains/root/db/kerryhotels.html
kerryhotels
// kerryproperties : Kerry Trading Co. Limited
// https://www.iana.org/domains/root/db/kerryproperties.html
kerryproperties
// kfh : Kuwait Finance House
// https://www.iana.org/domains/root/db/kfh.html
kfh
// kia : KIA MOTORS CORPORATION
// https://www.iana.org/domains/root/db/kia.html
kia
// kids : DotKids Foundation Limited
// https://www.iana.org/domains/root/db/kids.html
kids
// kim : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/kim.html
kim
// kindle : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/kindle.html
kindle
// kitchen : Binky Moon, LLC
// https://www.iana.org/domains/root/db/kitchen.html
kitchen
// kiwi : DOT KIWI LIMITED
// https://www.iana.org/domains/root/db/kiwi.html
kiwi
// koeln : dotKoeln GmbH
// https://www.iana.org/domains/root/db/koeln.html
koeln
// komatsu : Komatsu Ltd.
// https://www.iana.org/domains/root/db/komatsu.html
komatsu
// kosher : Kosher Marketing Assets LLC
// https://www.iana.org/domains/root/db/kosher.html
kosher
// kpmg : KPMG International Cooperative (KPMG International Genossenschaft)
// https://www.iana.org/domains/root/db/kpmg.html
kpmg
// kpn : Koninklijke KPN N.V.
// https://www.iana.org/domains/root/db/kpn.html
kpn
// krd : KRG Department of Information Technology
// https://www.iana.org/domains/root/db/krd.html
krd
// kred : KredTLD Pty Ltd
// https://www.iana.org/domains/root/db/kred.html
kred
// kuokgroup : Kerry Trading Co. Limited
// https://www.iana.org/domains/root/db/kuokgroup.html
kuokgroup
// kyoto : Academic Institution: Kyoto Jyoho Gakuen
// https://www.iana.org/domains/root/db/kyoto.html
kyoto
// lacaixa : Fundación Bancaria Caixa d’Estalvis i Pensions de Barcelona, “la Caixa”
// https://www.iana.org/domains/root/db/lacaixa.html
lacaixa
// lamborghini : Automobili Lamborghini S.p.A.
// https://www.iana.org/domains/root/db/lamborghini.html
lamborghini
// lamer : The Estée Lauder Companies Inc.
// https://www.iana.org/domains/root/db/lamer.html
lamer
// land : Binky Moon, LLC
// https://www.iana.org/domains/root/db/land.html
land
// landrover : Jaguar Land Rover Ltd
// https://www.iana.org/domains/root/db/landrover.html
landrover
// lanxess : LANXESS Corporation
// https://www.iana.org/domains/root/db/lanxess.html
lanxess
// lasalle : Jones Lang LaSalle Incorporated
// https://www.iana.org/domains/root/db/lasalle.html
lasalle
// lat : XYZ.COM LLC
// https://www.iana.org/domains/root/db/lat.html
lat
// latino : Dish DBS Corporation
// https://www.iana.org/domains/root/db/latino.html
latino
// latrobe : La Trobe University
// https://www.iana.org/domains/root/db/latrobe.html
latrobe
// law : Registry Services, LLC
// https://www.iana.org/domains/root/db/law.html
law
// lawyer : Dog Beach, LLC
// https://www.iana.org/domains/root/db/lawyer.html
lawyer
// lds : IRI Domain Management, LLC
// https://www.iana.org/domains/root/db/lds.html
lds
// lease : Binky Moon, LLC
// https://www.iana.org/domains/root/db/lease.html
lease
// leclerc : A.C.D. LEC Association des Centres Distributeurs Edouard Leclerc
// https://www.iana.org/domains/root/db/leclerc.html
leclerc
// lefrak : LeFrak Organization, Inc.
// https://www.iana.org/domains/root/db/lefrak.html
lefrak
// legal : Binky Moon, LLC
// https://www.iana.org/domains/root/db/legal.html
legal
// lego : LEGO Juris A/S
// https://www.iana.org/domains/root/db/lego.html
lego
// lexus : TOYOTA MOTOR CORPORATION
// https://www.iana.org/domains/root/db/lexus.html
lexus
// lgbt : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/lgbt.html
lgbt
// lidl : Schwarz Domains und Services GmbH & Co. KG
// https://www.iana.org/domains/root/db/lidl.html
lidl
// life : Binky Moon, LLC
// https://www.iana.org/domains/root/db/life.html
life
// lifeinsurance : American Council of Life Insurers
// https://www.iana.org/domains/root/db/lifeinsurance.html
lifeinsurance
// lifestyle : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/lifestyle.html
lifestyle
// lighting : Binky Moon, LLC
// https://www.iana.org/domains/root/db/lighting.html
lighting
// like : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/like.html
like
// lilly : Eli Lilly and Company
// https://www.iana.org/domains/root/db/lilly.html
lilly
// limited : Binky Moon, LLC
// https://www.iana.org/domains/root/db/limited.html
limited
// limo : Binky Moon, LLC
// https://www.iana.org/domains/root/db/limo.html
limo
// lincoln : Ford Motor Company
// https://www.iana.org/domains/root/db/lincoln.html
lincoln
// link : Nova Registry Ltd
// https://www.iana.org/domains/root/db/link.html
link
// live : Dog Beach, LLC
// https://www.iana.org/domains/root/db/live.html
live
// living : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/living.html
living
// llc : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/llc.html
llc
// llp : Intercap Registry Inc.
// https://www.iana.org/domains/root/db/llp.html
llp
// loan : dot Loan Limited
// https://www.iana.org/domains/root/db/loan.html
loan
// loans : Binky Moon, LLC
// https://www.iana.org/domains/root/db/loans.html
loans
// locker : Orange Domains LLC
// https://www.iana.org/domains/root/db/locker.html
locker
// locus : Locus Analytics LLC
// https://www.iana.org/domains/root/db/locus.html
locus
// lol : XYZ.COM LLC
// https://www.iana.org/domains/root/db/lol.html
lol
// london : Dot London Domains Limited
// https://www.iana.org/domains/root/db/london.html
london
// lotte : Lotte Holdings Co., Ltd.
// https://www.iana.org/domains/root/db/lotte.html
lotte
// lotto : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/lotto.html
lotto
// love : Waterford Limited
// https://www.iana.org/domains/root/db/love.html
love
// lpl : LPL Holdings, Inc.
// https://www.iana.org/domains/root/db/lpl.html
lpl
// lplfinancial : LPL Holdings, Inc.
// https://www.iana.org/domains/root/db/lplfinancial.html
lplfinancial
// ltd : Binky Moon, LLC
// https://www.iana.org/domains/root/db/ltd.html
ltd
// ltda : InterNetX, Corp
// https://www.iana.org/domains/root/db/ltda.html
ltda
// lundbeck : H. Lundbeck A/S
// https://www.iana.org/domains/root/db/lundbeck.html
lundbeck
// luxe : Registry Services, LLC
// https://www.iana.org/domains/root/db/luxe.html
luxe
// luxury : Luxury Partners, LLC
// https://www.iana.org/domains/root/db/luxury.html
luxury
// madrid : Comunidad de Madrid
// https://www.iana.org/domains/root/db/madrid.html
madrid
// maif : Mutuelle Assurance Instituteur France (MAIF)
// https://www.iana.org/domains/root/db/maif.html
maif
// maison : Binky Moon, LLC
// https://www.iana.org/domains/root/db/maison.html
maison
// makeup : XYZ.COM LLC
// https://www.iana.org/domains/root/db/makeup.html
makeup
// man : MAN Truck & Bus SE
// https://www.iana.org/domains/root/db/man.html
man
// management : Binky Moon, LLC
// https://www.iana.org/domains/root/db/management.html
management
// mango : PUNTO FA S.L.
// https://www.iana.org/domains/root/db/mango.html
mango
// map : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/map.html
map
// market : Dog Beach, LLC
// https://www.iana.org/domains/root/db/market.html
market
// marketing : Binky Moon, LLC
// https://www.iana.org/domains/root/db/marketing.html
marketing
// markets : Dog Beach, LLC
// https://www.iana.org/domains/root/db/markets.html
markets
// marriott : Marriott Worldwide Corporation
// https://www.iana.org/domains/root/db/marriott.html
marriott
// marshalls : The TJX Companies, Inc.
// https://www.iana.org/domains/root/db/marshalls.html
marshalls
// mattel : Mattel IT Services, Inc.
// https://www.iana.org/domains/root/db/mattel.html
mattel
// mba : Binky Moon, LLC
// https://www.iana.org/domains/root/db/mba.html
mba
// mckinsey : McKinsey Holdings, Inc.
// https://www.iana.org/domains/root/db/mckinsey.html
mckinsey
// med : Medistry LLC
// https://www.iana.org/domains/root/db/med.html
med
// media : Binky Moon, LLC
// https://www.iana.org/domains/root/db/media.html
media
// meet : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/meet.html
meet
// melbourne : The Crown in right of the State of Victoria, represented by its Department of State Development, Business and Innovation
// https://www.iana.org/domains/root/db/melbourne.html
melbourne
// meme : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/meme.html
meme
// memorial : Dog Beach, LLC
// https://www.iana.org/domains/root/db/memorial.html
memorial
// men : Exclusive Registry Limited
// https://www.iana.org/domains/root/db/men.html
men
// menu : Dot Menu Registry, LLC
// https://www.iana.org/domains/root/db/menu.html
menu
// merck : Merck Registry Holdings, Inc.
// https://www.iana.org/domains/root/db/merck.html
merck
// merckmsd : MSD Registry Holdings, Inc.
// https://www.iana.org/domains/root/db/merckmsd.html
merckmsd
// miami : Registry Services, LLC
// https://www.iana.org/domains/root/db/miami.html
miami
// microsoft : Microsoft Corporation
// https://www.iana.org/domains/root/db/microsoft.html
microsoft
// mini : Bayerische Motoren Werke Aktiengesellschaft
// https://www.iana.org/domains/root/db/mini.html
mini
// mint : Intuit Administrative Services, Inc.
// https://www.iana.org/domains/root/db/mint.html
mint
// mit : Massachusetts Institute of Technology
// https://www.iana.org/domains/root/db/mit.html
mit
// mitsubishi : Mitsubishi Corporation
// https://www.iana.org/domains/root/db/mitsubishi.html
mitsubishi
// mlb : MLB Advanced Media DH, LLC
// https://www.iana.org/domains/root/db/mlb.html
mlb
// mls : The Canadian Real Estate Association
// https://www.iana.org/domains/root/db/mls.html
mls
// mma : MMA IARD
// https://www.iana.org/domains/root/db/mma.html
mma
// mobile : Dish DBS Corporation
// https://www.iana.org/domains/root/db/mobile.html
mobile
// moda : Dog Beach, LLC
// https://www.iana.org/domains/root/db/moda.html
moda
// moe : Interlink Systems Innovation Institute K.K.
// https://www.iana.org/domains/root/db/moe.html
moe
// moi : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/moi.html
moi
// mom : XYZ.COM LLC
// https://www.iana.org/domains/root/db/mom.html
mom
// monash : Monash University
// https://www.iana.org/domains/root/db/monash.html
monash
// money : Binky Moon, LLC
// https://www.iana.org/domains/root/db/money.html
money
// monster : XYZ.COM LLC
// https://www.iana.org/domains/root/db/monster.html
monster
// mormon : IRI Domain Management, LLC
// https://www.iana.org/domains/root/db/mormon.html
mormon
// mortgage : Dog Beach, LLC
// https://www.iana.org/domains/root/db/mortgage.html
mortgage
// moscow : Foundation for Assistance for Internet Technologies and Infrastructure Development (FAITID)
// https://www.iana.org/domains/root/db/moscow.html
moscow
// moto : Motorola Trademark Holdings, LLC
// https://www.iana.org/domains/root/db/moto.html
moto
// motorcycles : XYZ.COM LLC
// https://www.iana.org/domains/root/db/motorcycles.html
motorcycles
// mov : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/mov.html
mov
// movie : Binky Moon, LLC
// https://www.iana.org/domains/root/db/movie.html
movie
// msd : MSD Registry Holdings, Inc.
// https://www.iana.org/domains/root/db/msd.html
msd
// mtn : MTN Dubai Limited
// https://www.iana.org/domains/root/db/mtn.html
mtn
// mtr : MTR Corporation Limited
// https://www.iana.org/domains/root/db/mtr.html
mtr
// music : DotMusic Limited
// https://www.iana.org/domains/root/db/music.html
music
// nab : National Australia Bank Limited
// https://www.iana.org/domains/root/db/nab.html
nab
// nagoya : GMO Registry, Inc.
// https://www.iana.org/domains/root/db/nagoya.html
nagoya
// navy : Dog Beach, LLC
// https://www.iana.org/domains/root/db/navy.html
navy
// nba : NBA REGISTRY, LLC
// https://www.iana.org/domains/root/db/nba.html
nba
// nec : NEC Corporation
// https://www.iana.org/domains/root/db/nec.html
nec
// netbank : COMMONWEALTH BANK OF AUSTRALIA
// https://www.iana.org/domains/root/db/netbank.html
netbank
// netflix : Netflix, Inc.
// https://www.iana.org/domains/root/db/netflix.html
netflix
// network : Binky Moon, LLC
// https://www.iana.org/domains/root/db/network.html
network
// neustar : NeuStar, Inc.
// https://www.iana.org/domains/root/db/neustar.html
neustar
// new : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/new.html
new
// news : Dog Beach, LLC
// https://www.iana.org/domains/root/db/news.html
news
// next : Next plc
// https://www.iana.org/domains/root/db/next.html
next
// nextdirect : Next plc
// https://www.iana.org/domains/root/db/nextdirect.html
nextdirect
// nexus : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/nexus.html
nexus
// nfl : NFL Reg Ops LLC
// https://www.iana.org/domains/root/db/nfl.html
nfl
// ngo : Public Interest Registry
// https://www.iana.org/domains/root/db/ngo.html
ngo
// nhk : Japan Broadcasting Corporation (NHK)
// https://www.iana.org/domains/root/db/nhk.html
nhk
// nico : DWANGO Co., Ltd.
// https://www.iana.org/domains/root/db/nico.html
nico
// nike : NIKE, Inc.
// https://www.iana.org/domains/root/db/nike.html
nike
// nikon : NIKON CORPORATION
// https://www.iana.org/domains/root/db/nikon.html
nikon
// ninja : Dog Beach, LLC
// https://www.iana.org/domains/root/db/ninja.html
ninja
// nissan : NISSAN MOTOR CO., LTD.
// https://www.iana.org/domains/root/db/nissan.html
nissan
// nissay : Nippon Life Insurance Company
// https://www.iana.org/domains/root/db/nissay.html
nissay
// nokia : Nokia Corporation
// https://www.iana.org/domains/root/db/nokia.html
nokia
// norton : Gen Digital Inc.
// https://www.iana.org/domains/root/db/norton.html
norton
// now : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/now.html
now
// nowruz
// https://www.iana.org/domains/root/db/nowruz.html
nowruz
// nowtv : Starbucks (HK) Limited
// https://www.iana.org/domains/root/db/nowtv.html
nowtv
// nra : National Rifle Association of America
// https://www.iana.org/domains/root/db/nra.html
nra
// nrw : Minds + Machines GmbH
// https://www.iana.org/domains/root/db/nrw.html
nrw
// ntt : NIPPON TELEGRAPH AND TELEPHONE CORPORATION
// https://www.iana.org/domains/root/db/ntt.html
ntt
// nyc : The City of New York by and through the New York City Department of Information Technology & Telecommunications
// https://www.iana.org/domains/root/db/nyc.html
nyc
// obi : OBI Group Holding SE & Co. KGaA
// https://www.iana.org/domains/root/db/obi.html
obi
// observer : Fegistry, LLC
// https://www.iana.org/domains/root/db/observer.html
observer
// office : Microsoft Corporation
// https://www.iana.org/domains/root/db/office.html
office
// okinawa : BRregistry, Inc.
// https://www.iana.org/domains/root/db/okinawa.html
okinawa
// olayan : Competrol (Luxembourg) Sarl
// https://www.iana.org/domains/root/db/olayan.html
olayan
// olayangroup : Competrol (Luxembourg) Sarl
// https://www.iana.org/domains/root/db/olayangroup.html
olayangroup
// ollo : Dish DBS Corporation
// https://www.iana.org/domains/root/db/ollo.html
ollo
// omega : The Swatch Group Ltd
// https://www.iana.org/domains/root/db/omega.html
omega
// one : One.com A/S
// https://www.iana.org/domains/root/db/one.html
one
// ong : Public Interest Registry
// https://www.iana.org/domains/root/db/ong.html
ong
// onl : Jolly Host, LLC
// https://www.iana.org/domains/root/db/onl.html
onl
// online : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/online.html
online
// ooo : INFIBEAM AVENUES LIMITED
// https://www.iana.org/domains/root/db/ooo.html
ooo
// open : American Express Travel Related Services Company, Inc.
// https://www.iana.org/domains/root/db/open.html
open
// oracle : Oracle Corporation
// https://www.iana.org/domains/root/db/oracle.html
oracle
// orange : Orange Brand Services Limited
// https://www.iana.org/domains/root/db/orange.html
orange
// organic : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/organic.html
organic
// origins : The Estée Lauder Companies Inc.
// https://www.iana.org/domains/root/db/origins.html
origins
// osaka : Osaka Registry Co., Ltd.
// https://www.iana.org/domains/root/db/osaka.html
osaka
// otsuka : Otsuka Holdings Co., Ltd.
// https://www.iana.org/domains/root/db/otsuka.html
otsuka
// ott : Dish DBS Corporation
// https://www.iana.org/domains/root/db/ott.html
ott
// ovh : MédiaBC
// https://www.iana.org/domains/root/db/ovh.html
ovh
// page : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/page.html
page
// panasonic : Panasonic Holdings Corporation
// https://www.iana.org/domains/root/db/panasonic.html
panasonic
// paris : City of Paris
// https://www.iana.org/domains/root/db/paris.html
paris
// pars
// https://www.iana.org/domains/root/db/pars.html
pars
// partners : Binky Moon, LLC
// https://www.iana.org/domains/root/db/partners.html
partners
// parts : Binky Moon, LLC
// https://www.iana.org/domains/root/db/parts.html
parts
// party : Blue Sky Registry Limited
// https://www.iana.org/domains/root/db/party.html
party
// pay : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/pay.html
pay
// pccw : PCCW Enterprises Limited
// https://www.iana.org/domains/root/db/pccw.html
pccw
// pet : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/pet.html
pet
// pfizer : Pfizer Inc.
// https://www.iana.org/domains/root/db/pfizer.html
pfizer
// pharmacy : National Association of Boards of Pharmacy
// https://www.iana.org/domains/root/db/pharmacy.html
pharmacy
// phd : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/phd.html
phd
// philips : Koninklijke Philips N.V.
// https://www.iana.org/domains/root/db/philips.html
philips
// phone : Dish DBS Corporation
// https://www.iana.org/domains/root/db/phone.html
phone
// photo : Registry Services, LLC
// https://www.iana.org/domains/root/db/photo.html
photo
// photography : Binky Moon, LLC
// https://www.iana.org/domains/root/db/photography.html
photography
// photos : Binky Moon, LLC
// https://www.iana.org/domains/root/db/photos.html
photos
// physio : PhysBiz Pty Ltd
// https://www.iana.org/domains/root/db/physio.html
physio
// pics : XYZ.COM LLC
// https://www.iana.org/domains/root/db/pics.html
pics
// pictet : Banque Pictet & Cie SA
// https://www.iana.org/domains/root/db/pictet.html
pictet
// pictures : Binky Moon, LLC
// https://www.iana.org/domains/root/db/pictures.html
pictures
// pid : Top Level Spectrum, Inc.
// https://www.iana.org/domains/root/db/pid.html
pid
// pin : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/pin.html
pin
// ping : Ping Registry Provider, Inc.
// https://www.iana.org/domains/root/db/ping.html
ping
// pink : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/pink.html
pink
// pioneer : Pioneer Corporation
// https://www.iana.org/domains/root/db/pioneer.html
pioneer
// pizza : Binky Moon, LLC
// https://www.iana.org/domains/root/db/pizza.html
pizza
// place : Binky Moon, LLC
// https://www.iana.org/domains/root/db/place.html
place
// play : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/play.html
play
// playstation : Sony Interactive Entertainment Inc.
// https://www.iana.org/domains/root/db/playstation.html
playstation
// plumbing : Binky Moon, LLC
// https://www.iana.org/domains/root/db/plumbing.html
plumbing
// plus : Binky Moon, LLC
// https://www.iana.org/domains/root/db/plus.html
plus
// pnc : PNC Domain Co., LLC
// https://www.iana.org/domains/root/db/pnc.html
pnc
// pohl : Deutsche Vermögensberatung Aktiengesellschaft DVAG
// https://www.iana.org/domains/root/db/pohl.html
pohl
// poker : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/poker.html
poker
// politie : Politie Nederland
// https://www.iana.org/domains/root/db/politie.html
politie
// porn : ICM Registry PN LLC
// https://www.iana.org/domains/root/db/porn.html
porn
// praxi : Praxi S.p.A.
// https://www.iana.org/domains/root/db/praxi.html
praxi
// press : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/press.html
press
// prime : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/prime.html
prime
// prod : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/prod.html
prod
// productions : Binky Moon, LLC
// https://www.iana.org/domains/root/db/productions.html
productions
// prof : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/prof.html
prof
// progressive : Progressive Casualty Insurance Company
// https://www.iana.org/domains/root/db/progressive.html
progressive
// promo : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/promo.html
promo
// properties : Binky Moon, LLC
// https://www.iana.org/domains/root/db/properties.html
properties
// property : Digital Property Infrastructure Limited
// https://www.iana.org/domains/root/db/property.html
property
// protection : XYZ.COM LLC
// https://www.iana.org/domains/root/db/protection.html
protection
// pru : Prudential Financial, Inc.
// https://www.iana.org/domains/root/db/pru.html
pru
// prudential : Prudential Financial, Inc.
// https://www.iana.org/domains/root/db/prudential.html
prudential
// pub : Dog Beach, LLC
// https://www.iana.org/domains/root/db/pub.html
pub
// pwc : PricewaterhouseCoopers LLP
// https://www.iana.org/domains/root/db/pwc.html
pwc
// qpon : dotQPON LLC
// https://www.iana.org/domains/root/db/qpon.html
qpon
// quebec : PointQuébec Inc
// https://www.iana.org/domains/root/db/quebec.html
quebec
// quest : XYZ.COM LLC
// https://www.iana.org/domains/root/db/quest.html
quest
// racing : Premier Registry Limited
// https://www.iana.org/domains/root/db/racing.html
racing
// radio : Digity, LLC
// https://www.iana.org/domains/root/db/radio.html
radio
// read : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/read.html
read
// realestate : dotRealEstate LLC
// https://www.iana.org/domains/root/db/realestate.html
realestate
// realtor : Real Estate Domains LLC
// https://www.iana.org/domains/root/db/realtor.html
realtor
// realty : Waterford Limited
// https://www.iana.org/domains/root/db/realty.html
realty
// recipes : Binky Moon, LLC
// https://www.iana.org/domains/root/db/recipes.html
recipes
// red : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/red.html
red
// redumbrella : Travelers TLD, LLC
// https://www.iana.org/domains/root/db/redumbrella.html
redumbrella
// rehab : Dog Beach, LLC
// https://www.iana.org/domains/root/db/rehab.html
rehab
// reise : Binky Moon, LLC
// https://www.iana.org/domains/root/db/reise.html
reise
// reisen : Binky Moon, LLC
// https://www.iana.org/domains/root/db/reisen.html
reisen
// reit : National Association of Real Estate Investment Trusts, Inc.
// https://www.iana.org/domains/root/db/reit.html
reit
// reliance : Reliance Industries Limited
// https://www.iana.org/domains/root/db/reliance.html
reliance
// ren : ZDNS International Limited
// https://www.iana.org/domains/root/db/ren.html
ren
// rent : XYZ.COM LLC
// https://www.iana.org/domains/root/db/rent.html
rent
// rentals : Binky Moon, LLC
// https://www.iana.org/domains/root/db/rentals.html
rentals
// repair : Binky Moon, LLC
// https://www.iana.org/domains/root/db/repair.html
repair
// report : Binky Moon, LLC
// https://www.iana.org/domains/root/db/report.html
report
// republican : Dog Beach, LLC
// https://www.iana.org/domains/root/db/republican.html
republican
// rest : Punto 2012 Sociedad Anonima Promotora de Inversion de Capital Variable
// https://www.iana.org/domains/root/db/rest.html
rest
// restaurant : Binky Moon, LLC
// https://www.iana.org/domains/root/db/restaurant.html
restaurant
// review : dot Review Limited
// https://www.iana.org/domains/root/db/review.html
review
// reviews : Dog Beach, LLC
// https://www.iana.org/domains/root/db/reviews.html
reviews
// rexroth : Robert Bosch GMBH
// https://www.iana.org/domains/root/db/rexroth.html
rexroth
// rich : iRegistry GmbH
// https://www.iana.org/domains/root/db/rich.html
rich
// richardli : Pacific Century Asset Management (HK) Limited
// https://www.iana.org/domains/root/db/richardli.html
richardli
// ricoh : Ricoh Company, Ltd.
// https://www.iana.org/domains/root/db/ricoh.html
ricoh
// ril : Reliance Industries Limited
// https://www.iana.org/domains/root/db/ril.html
ril
// rio : Empresa Municipal de Informática SA - IPLANRIO
// https://www.iana.org/domains/root/db/rio.html
rio
// rip : Dog Beach, LLC
// https://www.iana.org/domains/root/db/rip.html
rip
// rocks : Dog Beach, LLC
// https://www.iana.org/domains/root/db/rocks.html
rocks
// rodeo : Registry Services, LLC
// https://www.iana.org/domains/root/db/rodeo.html
rodeo
// rogers : Rogers Communications Canada Inc.
// https://www.iana.org/domains/root/db/rogers.html
rogers
// room : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/room.html
room
// rsvp : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/rsvp.html
rsvp
// rugby : World Rugby Strategic Developments Limited
// https://www.iana.org/domains/root/db/rugby.html
rugby
// ruhr : dotSaarland GmbH
// https://www.iana.org/domains/root/db/ruhr.html
ruhr
// run : Binky Moon, LLC
// https://www.iana.org/domains/root/db/run.html
run
// rwe : RWE AG
// https://www.iana.org/domains/root/db/rwe.html
rwe
// ryukyu : BRregistry, Inc.
// https://www.iana.org/domains/root/db/ryukyu.html
ryukyu
// saarland : dotSaarland GmbH
// https://www.iana.org/domains/root/db/saarland.html
saarland
// safe : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/safe.html
safe
// safety : Jolly Host, LLC
// https://www.iana.org/domains/root/db/safety.html
safety
// sakura : SAKURA Internet Inc.
// https://www.iana.org/domains/root/db/sakura.html
sakura
// sale : Dog Beach, LLC
// https://www.iana.org/domains/root/db/sale.html
sale
// salon : Binky Moon, LLC
// https://www.iana.org/domains/root/db/salon.html
salon
// samsclub : Wal-Mart Stores, Inc.
// https://www.iana.org/domains/root/db/samsclub.html
samsclub
// samsung : SAMSUNG SDS CO., LTD
// https://www.iana.org/domains/root/db/samsung.html
samsung
// sandvik : Sandvik AB
// https://www.iana.org/domains/root/db/sandvik.html
sandvik
// sandvikcoromant : Sandvik AB
// https://www.iana.org/domains/root/db/sandvikcoromant.html
sandvikcoromant
// sanofi : Sanofi
// https://www.iana.org/domains/root/db/sanofi.html
sanofi
// sap : SAP AG
// https://www.iana.org/domains/root/db/sap.html
sap
// sarl : Binky Moon, LLC
// https://www.iana.org/domains/root/db/sarl.html
sarl
// sas : Research IP LLC
// https://www.iana.org/domains/root/db/sas.html
sas
// save : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/save.html
save
// saxo : Saxo Bank A/S
// https://www.iana.org/domains/root/db/saxo.html
saxo
// sbi : STATE BANK OF INDIA
// https://www.iana.org/domains/root/db/sbi.html
sbi
// sbs : ShortDot SA
// https://www.iana.org/domains/root/db/sbs.html
sbs
// scb : The Siam Commercial Bank Public Company Limited ("SCB")
// https://www.iana.org/domains/root/db/scb.html
scb
// schaeffler : Schaeffler Technologies AG & Co. KG
// https://www.iana.org/domains/root/db/schaeffler.html
schaeffler
// schmidt : SCHMIDT GROUPE S.A.S.
// https://www.iana.org/domains/root/db/schmidt.html
schmidt
// scholarships : Scholarships.com, LLC
// https://www.iana.org/domains/root/db/scholarships.html
scholarships
// school : Binky Moon, LLC
// https://www.iana.org/domains/root/db/school.html
school
// schule : Binky Moon, LLC
// https://www.iana.org/domains/root/db/schule.html
schule
// schwarz : Schwarz Domains und Services GmbH & Co. KG
// https://www.iana.org/domains/root/db/schwarz.html
schwarz
// science : dot Science Limited
// https://www.iana.org/domains/root/db/science.html
science
// scot : Dot Scot Registry Limited
// https://www.iana.org/domains/root/db/scot.html
scot
// search : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/search.html
search
// seat : SEAT, S.A. (Sociedad Unipersonal)
// https://www.iana.org/domains/root/db/seat.html
seat
// secure : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/secure.html
secure
// security : XYZ.COM LLC
// https://www.iana.org/domains/root/db/security.html
security
// seek : Seek Limited
// https://www.iana.org/domains/root/db/seek.html
seek
// select : Registry Services, LLC
// https://www.iana.org/domains/root/db/select.html
select
// sener : Sener Ingeniería y Sistemas, S.A.
// https://www.iana.org/domains/root/db/sener.html
sener
// services : Binky Moon, LLC
// https://www.iana.org/domains/root/db/services.html
services
// seven : Seven West Media Ltd
// https://www.iana.org/domains/root/db/seven.html
seven
// sew : SEW-EURODRIVE GmbH & Co KG
// https://www.iana.org/domains/root/db/sew.html
sew
// sex : ICM Registry SX LLC
// https://www.iana.org/domains/root/db/sex.html
sex
// sexy : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/sexy.html
sexy
// sfr : Societe Francaise du Radiotelephone - SFR
// https://www.iana.org/domains/root/db/sfr.html
sfr
// shangrila : Shangri‐La International Hotel Management Limited
// https://www.iana.org/domains/root/db/shangrila.html
shangrila
// sharp : Sharp Corporation
// https://www.iana.org/domains/root/db/sharp.html
sharp
// shell : Shell Information Technology International Inc
// https://www.iana.org/domains/root/db/shell.html
shell
// shia
// https://www.iana.org/domains/root/db/shia.html
shia
// shiksha : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/shiksha.html
shiksha
// shoes : Binky Moon, LLC
// https://www.iana.org/domains/root/db/shoes.html
shoes
// shop : GMO Registry, Inc.
// https://www.iana.org/domains/root/db/shop.html
shop
// shopping : Binky Moon, LLC
// https://www.iana.org/domains/root/db/shopping.html
shopping
// shouji : Beijing Qihu Keji Co., Ltd.
// https://www.iana.org/domains/root/db/shouji.html
shouji
// show : Binky Moon, LLC
// https://www.iana.org/domains/root/db/show.html
show
// silk : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/silk.html
silk
// sina : Sina Corporation
// https://www.iana.org/domains/root/db/sina.html
sina
// singles : Binky Moon, LLC
// https://www.iana.org/domains/root/db/singles.html
singles
// site : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/site.html
site
// ski : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/ski.html
ski
// skin : XYZ.COM LLC
// https://www.iana.org/domains/root/db/skin.html
skin
// sky : Sky UK Limited
// https://www.iana.org/domains/root/db/sky.html
sky
// skype : Microsoft Corporation
// https://www.iana.org/domains/root/db/skype.html
skype
// sling : DISH Technologies L.L.C.
// https://www.iana.org/domains/root/db/sling.html
sling
// smart : Smart Communications, Inc. (SMART)
// https://www.iana.org/domains/root/db/smart.html
smart
// smile : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/smile.html
smile
// sncf : Société Nationale SNCF
// https://www.iana.org/domains/root/db/sncf.html
sncf
// soccer : Binky Moon, LLC
// https://www.iana.org/domains/root/db/soccer.html
soccer
// social : Dog Beach, LLC
// https://www.iana.org/domains/root/db/social.html
social
// softbank : SoftBank Group Corp.
// https://www.iana.org/domains/root/db/softbank.html
softbank
// software : Dog Beach, LLC
// https://www.iana.org/domains/root/db/software.html
software
// sohu : Sohu.com Limited
// https://www.iana.org/domains/root/db/sohu.html
sohu
// solar : Binky Moon, LLC
// https://www.iana.org/domains/root/db/solar.html
solar
// solutions : Binky Moon, LLC
// https://www.iana.org/domains/root/db/solutions.html
solutions
// song : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/song.html
song
// sony : Sony Group Corporation
// https://www.iana.org/domains/root/db/sony.html
sony
// soy : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/soy.html
soy
// spa : Asia Spa and Wellness Promotion Council Limited
// https://www.iana.org/domains/root/db/spa.html
spa
// space : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/space.html
space
// sport : SportAccord
// https://www.iana.org/domains/root/db/sport.html
sport
// spot : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/spot.html
spot
// srl : InterNetX, Corp
// https://www.iana.org/domains/root/db/srl.html
srl
// stada : STADA Arzneimittel AG
// https://www.iana.org/domains/root/db/stada.html
stada
// staples : Staples, Inc.
// https://www.iana.org/domains/root/db/staples.html
staples
// star : Star India Private Limited
// https://www.iana.org/domains/root/db/star.html
star
// statebank : STATE BANK OF INDIA
// https://www.iana.org/domains/root/db/statebank.html
statebank
// statefarm : State Farm Mutual Automobile Insurance Company
// https://www.iana.org/domains/root/db/statefarm.html
statefarm
// stc : Saudi Telecom Company
// https://www.iana.org/domains/root/db/stc.html
stc
// stcgroup : Saudi Telecom Company
// https://www.iana.org/domains/root/db/stcgroup.html
stcgroup
// stockholm : Stockholms kommun
// https://www.iana.org/domains/root/db/stockholm.html
stockholm
// storage : XYZ.COM LLC
// https://www.iana.org/domains/root/db/storage.html
storage
// store : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/store.html
store
// stream : dot Stream Limited
// https://www.iana.org/domains/root/db/stream.html
stream
// studio : Dog Beach, LLC
// https://www.iana.org/domains/root/db/studio.html
studio
// study : Registry Services, LLC
// https://www.iana.org/domains/root/db/study.html
study
// style : Binky Moon, LLC
// https://www.iana.org/domains/root/db/style.html
style
// sucks : Vox Populi Registry Ltd.
// https://www.iana.org/domains/root/db/sucks.html
sucks
// supplies : Binky Moon, LLC
// https://www.iana.org/domains/root/db/supplies.html
supplies
// supply : Binky Moon, LLC
// https://www.iana.org/domains/root/db/supply.html
supply
// support : Binky Moon, LLC
// https://www.iana.org/domains/root/db/support.html
support
// surf : Registry Services, LLC
// https://www.iana.org/domains/root/db/surf.html
surf
// surgery : Binky Moon, LLC
// https://www.iana.org/domains/root/db/surgery.html
surgery
// suzuki : SUZUKI MOTOR CORPORATION
// https://www.iana.org/domains/root/db/suzuki.html
suzuki
// swatch : The Swatch Group Ltd
// https://www.iana.org/domains/root/db/swatch.html
swatch
// swiss : Swiss Confederation
// https://www.iana.org/domains/root/db/swiss.html
swiss
// sydney : State of New South Wales, Department of Premier and Cabinet
// https://www.iana.org/domains/root/db/sydney.html
sydney
// systems : Binky Moon, LLC
// https://www.iana.org/domains/root/db/systems.html
systems
// tab : Tabcorp Holdings Limited
// https://www.iana.org/domains/root/db/tab.html
tab
// taipei : Taipei City Government
// https://www.iana.org/domains/root/db/taipei.html
taipei
// talk : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/talk.html
talk
// taobao : Alibaba Group Holding Limited
// https://www.iana.org/domains/root/db/taobao.html
taobao
// target : Target Domain Holdings, LLC
// https://www.iana.org/domains/root/db/target.html
target
// tatamotors : Tata Motors Ltd
// https://www.iana.org/domains/root/db/tatamotors.html
tatamotors
// tatar : Limited Liability Company "Coordination Center of Regional Domain of Tatarstan Republic"
// https://www.iana.org/domains/root/db/tatar.html
tatar
// tattoo : Registry Services, LLC
// https://www.iana.org/domains/root/db/tattoo.html
tattoo
// tax : Binky Moon, LLC
// https://www.iana.org/domains/root/db/tax.html
tax
// taxi : Binky Moon, LLC
// https://www.iana.org/domains/root/db/taxi.html
taxi
// tci
// https://www.iana.org/domains/root/db/tci.html
tci
// tdk : TDK Corporation
// https://www.iana.org/domains/root/db/tdk.html
tdk
// team : Binky Moon, LLC
// https://www.iana.org/domains/root/db/team.html
team
// tech : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/tech.html
tech
// technology : Binky Moon, LLC
// https://www.iana.org/domains/root/db/technology.html
technology
// temasek : Temasek Holdings (Private) Limited
// https://www.iana.org/domains/root/db/temasek.html
temasek
// tennis : Binky Moon, LLC
// https://www.iana.org/domains/root/db/tennis.html
tennis
// teva : Teva Pharmaceutical Industries Limited
// https://www.iana.org/domains/root/db/teva.html
teva
// thd : Home Depot Product Authority, LLC
// https://www.iana.org/domains/root/db/thd.html
thd
// theater : Binky Moon, LLC
// https://www.iana.org/domains/root/db/theater.html
theater
// theatre : XYZ.COM LLC
// https://www.iana.org/domains/root/db/theatre.html
theatre
// tiaa : Teachers Insurance and Annuity Association of America
// https://www.iana.org/domains/root/db/tiaa.html
tiaa
// tickets : XYZ.COM LLC
// https://www.iana.org/domains/root/db/tickets.html
tickets
// tienda : Binky Moon, LLC
// https://www.iana.org/domains/root/db/tienda.html
tienda
// tips : Binky Moon, LLC
// https://www.iana.org/domains/root/db/tips.html
tips
// tires : Binky Moon, LLC
// https://www.iana.org/domains/root/db/tires.html
tires
// tirol : punkt Tirol GmbH
// https://www.iana.org/domains/root/db/tirol.html
tirol
// tjmaxx : The TJX Companies, Inc.
// https://www.iana.org/domains/root/db/tjmaxx.html
tjmaxx
// tjx : The TJX Companies, Inc.
// https://www.iana.org/domains/root/db/tjx.html
tjx
// tkmaxx : The TJX Companies, Inc.
// https://www.iana.org/domains/root/db/tkmaxx.html
tkmaxx
// tmall : Alibaba Group Holding Limited
// https://www.iana.org/domains/root/db/tmall.html
tmall
// today : Binky Moon, LLC
// https://www.iana.org/domains/root/db/today.html
today
// tokyo : GMO Registry, Inc.
// https://www.iana.org/domains/root/db/tokyo.html
tokyo
// tools : Binky Moon, LLC
// https://www.iana.org/domains/root/db/tools.html
tools
// top : Hong Kong Zhongze International Limited
// https://www.iana.org/domains/root/db/top.html
top
// toray : Toray Industries, Inc.
// https://www.iana.org/domains/root/db/toray.html
toray
// toshiba : TOSHIBA Corporation
// https://www.iana.org/domains/root/db/toshiba.html
toshiba
// total : TotalEnergies SE
// https://www.iana.org/domains/root/db/total.html
total
// tours : Binky Moon, LLC
// https://www.iana.org/domains/root/db/tours.html
tours
// town : Binky Moon, LLC
// https://www.iana.org/domains/root/db/town.html
town
// toyota : TOYOTA MOTOR CORPORATION
// https://www.iana.org/domains/root/db/toyota.html
toyota
// toys : Binky Moon, LLC
// https://www.iana.org/domains/root/db/toys.html
toys
// trade : Elite Registry Limited
// https://www.iana.org/domains/root/db/trade.html
trade
// trading : Dog Beach, LLC
// https://www.iana.org/domains/root/db/trading.html
trading
// training : Binky Moon, LLC
// https://www.iana.org/domains/root/db/training.html
training
// travel : Dog Beach, LLC
// https://www.iana.org/domains/root/db/travel.html
travel
// travelers : Travelers TLD, LLC
// https://www.iana.org/domains/root/db/travelers.html
travelers
// travelersinsurance : Travelers TLD, LLC
// https://www.iana.org/domains/root/db/travelersinsurance.html
travelersinsurance
// trust : Internet Naming Company LLC
// https://www.iana.org/domains/root/db/trust.html
trust
// trv : Travelers TLD, LLC
// https://www.iana.org/domains/root/db/trv.html
trv
// tube : Latin American Telecom LLC
// https://www.iana.org/domains/root/db/tube.html
tube
// tui : TUI AG
// https://www.iana.org/domains/root/db/tui.html
tui
// tunes : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/tunes.html
tunes
// tushu : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/tushu.html
tushu
// tvs : T V SUNDRAM IYENGAR & SONS LIMITED
// https://www.iana.org/domains/root/db/tvs.html
tvs
// ubank : National Australia Bank Limited
// https://www.iana.org/domains/root/db/ubank.html
ubank
// ubs : UBS AG
// https://www.iana.org/domains/root/db/ubs.html
ubs
// unicom : China United Network Communications Corporation Limited
// https://www.iana.org/domains/root/db/unicom.html
unicom
// university : Binky Moon, LLC
// https://www.iana.org/domains/root/db/university.html
university
// uno : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/uno.html
uno
// uol : UBN INTERNET LTDA.
// https://www.iana.org/domains/root/db/uol.html
uol
// ups : UPS Market Driver, Inc.
// https://www.iana.org/domains/root/db/ups.html
ups
// vacations : Binky Moon, LLC
// https://www.iana.org/domains/root/db/vacations.html
vacations
// vana : D3 Registry LLC
// https://www.iana.org/domains/root/db/vana.html
vana
// vanguard : The Vanguard Group, Inc.
// https://www.iana.org/domains/root/db/vanguard.html
vanguard
// vegas : Dot Vegas, Inc.
// https://www.iana.org/domains/root/db/vegas.html
vegas
// ventures : Binky Moon, LLC
// https://www.iana.org/domains/root/db/ventures.html
ventures
// verisign : VeriSign, Inc.
// https://www.iana.org/domains/root/db/verisign.html
verisign
// versicherung : tldbox GmbH
// https://www.iana.org/domains/root/db/versicherung.html
versicherung
// vet : Dog Beach, LLC
// https://www.iana.org/domains/root/db/vet.html
vet
// viajes : Binky Moon, LLC
// https://www.iana.org/domains/root/db/viajes.html
viajes
// video : Dog Beach, LLC
// https://www.iana.org/domains/root/db/video.html
video
// vig : VIENNA INSURANCE GROUP AG Wiener Versicherung Gruppe
// https://www.iana.org/domains/root/db/vig.html
vig
// viking : Viking River Cruises (Bermuda) Ltd.
// https://www.iana.org/domains/root/db/viking.html
viking
// villas : Binky Moon, LLC
// https://www.iana.org/domains/root/db/villas.html
villas
// vin : Binky Moon, LLC
// https://www.iana.org/domains/root/db/vin.html
vin
// vip : Registry Services, LLC
// https://www.iana.org/domains/root/db/vip.html
vip
// virgin : Virgin Enterprises Limited
// https://www.iana.org/domains/root/db/virgin.html
virgin
// visa : Visa Worldwide Pte. Limited
// https://www.iana.org/domains/root/db/visa.html
visa
// vision : Binky Moon, LLC
// https://www.iana.org/domains/root/db/vision.html
vision
// viva : Saudi Telecom Company
// https://www.iana.org/domains/root/db/viva.html
viva
// vivo : Telefonica Brasil S.A.
// https://www.iana.org/domains/root/db/vivo.html
vivo
// vlaanderen : DNS.be vzw
// https://www.iana.org/domains/root/db/vlaanderen.html
vlaanderen
// vodka : Registry Services, LLC
// https://www.iana.org/domains/root/db/vodka.html
vodka
// volvo : Volvo Holding Sverige Aktiebolag
// https://www.iana.org/domains/root/db/volvo.html
volvo
// vote : Monolith Registry LLC
// https://www.iana.org/domains/root/db/vote.html
vote
// voting : Valuetainment Corp.
// https://www.iana.org/domains/root/db/voting.html
voting
// voto : Monolith Registry LLC
// https://www.iana.org/domains/root/db/voto.html
voto
// voyage : Binky Moon, LLC
// https://www.iana.org/domains/root/db/voyage.html
voyage
// wales : Nominet UK
// https://www.iana.org/domains/root/db/wales.html
wales
// walmart : Wal-Mart Stores, Inc.
// https://www.iana.org/domains/root/db/walmart.html
walmart
// walter : Sandvik AB
// https://www.iana.org/domains/root/db/walter.html
walter
// wang : Zodiac Wang Limited
// https://www.iana.org/domains/root/db/wang.html
wang
// wanggou : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/wanggou.html
wanggou
// watch : Binky Moon, LLC
// https://www.iana.org/domains/root/db/watch.html
watch
// watches : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/watches.html
watches
// weather : The Weather Company, LLC
// https://www.iana.org/domains/root/db/weather.html
weather
// weatherchannel : The Weather Company, LLC
// https://www.iana.org/domains/root/db/weatherchannel.html
weatherchannel
// webcam : dot Webcam Limited
// https://www.iana.org/domains/root/db/webcam.html
webcam
// weber : Saint-Gobain Weber SA
// https://www.iana.org/domains/root/db/weber.html
weber
// website : Radix Technologies Inc SEZC
// https://www.iana.org/domains/root/db/website.html
website
// wed
// https://www.iana.org/domains/root/db/wed.html
wed
// wedding : Registry Services, LLC
// https://www.iana.org/domains/root/db/wedding.html
wedding
// weibo : Sina Corporation
// https://www.iana.org/domains/root/db/weibo.html
weibo
// weir : Weir Group IP Limited
// https://www.iana.org/domains/root/db/weir.html
weir
// whoswho : Who's Who Registry
// https://www.iana.org/domains/root/db/whoswho.html
whoswho
// wien : domainworx Service & Management GmbH
// https://www.iana.org/domains/root/db/wien.html
wien
// wiki : Registry Services, LLC
// https://www.iana.org/domains/root/db/wiki.html
wiki
// williamhill : William Hill Organization Limited
// https://www.iana.org/domains/root/db/williamhill.html
williamhill
// win : First Registry Limited
// https://www.iana.org/domains/root/db/win.html
win
// windows : Microsoft Corporation
// https://www.iana.org/domains/root/db/windows.html
windows
// wine : Binky Moon, LLC
// https://www.iana.org/domains/root/db/wine.html
wine
// winners : The TJX Companies, Inc.
// https://www.iana.org/domains/root/db/winners.html
winners
// wme : William Morris Endeavor Entertainment, LLC
// https://www.iana.org/domains/root/db/wme.html
wme
// woodside : Woodside Petroleum Limited
// https://www.iana.org/domains/root/db/woodside.html
woodside
// work : Registry Services, LLC
// https://www.iana.org/domains/root/db/work.html
work
// works : Binky Moon, LLC
// https://www.iana.org/domains/root/db/works.html
works
// world : Binky Moon, LLC
// https://www.iana.org/domains/root/db/world.html
world
// wow : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/wow.html
wow
// wtc : World Trade Centers Association, Inc.
// https://www.iana.org/domains/root/db/wtc.html
wtc
// wtf : Binky Moon, LLC
// https://www.iana.org/domains/root/db/wtf.html
wtf
// xbox : Microsoft Corporation
// https://www.iana.org/domains/root/db/xbox.html
xbox
// xerox : Xerox DNHC LLC
// https://www.iana.org/domains/root/db/xerox.html
xerox
// xihuan : Beijing Qihu Keji Co., Ltd.
// https://www.iana.org/domains/root/db/xihuan.html
xihuan
// xin : Elegant Leader Limited
// https://www.iana.org/domains/root/db/xin.html
xin
// xn--11b4c3d : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--11b4c3d.html
कॉम
// xn--1ck2e1b : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--1ck2e1b.html
セール
// xn--1qqw23a : Guangzhou YU Wei Information Technology Co., Ltd.
// https://www.iana.org/domains/root/db/xn--1qqw23a.html
佛山
// xn--30rr7y : Excellent First Limited
// https://www.iana.org/domains/root/db/xn--30rr7y.html
慈善
// xn--3bst00m : Eagle Horizon Limited
// https://www.iana.org/domains/root/db/xn--3bst00m.html
集团
// xn--3ds443g : Beijing TLD Registry Technology Limited
// https://www.iana.org/domains/root/db/xn--3ds443g.html
在线
// xn--3pxu8k : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--3pxu8k.html
点看
// xn--42c2d9a : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--42c2d9a.html
คอม
// xn--45q11c : Zodiac Gemini Ltd
// https://www.iana.org/domains/root/db/xn--45q11c.html
八卦
// xn--4gbrim : Helium TLDs Ltd
// https://www.iana.org/domains/root/db/xn--4gbrim.html
موقع
// xn--55qw42g : China Organizational Name Administration Center
// https://www.iana.org/domains/root/db/xn--55qw42g.html
公益
// xn--55qx5d : China Internet Network Information Center (CNNIC)
// https://www.iana.org/domains/root/db/xn--55qx5d.html
公司
// xn--5su34j936bgsg : Shangri‐La International Hotel Management Limited
// https://www.iana.org/domains/root/db/xn--5su34j936bgsg.html
香格里拉
// xn--5tzm5g : Jolly Host, LLC
// https://www.iana.org/domains/root/db/xn--5tzm5g.html
网站
// xn--6frz82g : Identity Digital Domains Limited
// https://www.iana.org/domains/root/db/xn--6frz82g.html
移动
// xn--6qq986b3xl : Tycoon Treasure Limited
// https://www.iana.org/domains/root/db/xn--6qq986b3xl.html
我爱你
// xn--80adxhks : Foundation for Assistance for Internet Technologies and Infrastructure Development (FAITID)
// https://www.iana.org/domains/root/db/xn--80adxhks.html
москва
// xn--80aqecdr1a : Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
// https://www.iana.org/domains/root/db/xn--80aqecdr1a.html
католик
// xn--80asehdb : CORE Association
// https://www.iana.org/domains/root/db/xn--80asehdb.html
онлайн
// xn--80aswg : CORE Association
// https://www.iana.org/domains/root/db/xn--80aswg.html
сайт
// xn--8y0a063a : China United Network Communications Corporation Limited
// https://www.iana.org/domains/root/db/xn--8y0a063a.html
联通
// xn--9dbq2a : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--9dbq2a.html
קום
// xn--9et52u : RISE VICTORY LIMITED
// https://www.iana.org/domains/root/db/xn--9et52u.html
时尚
// xn--9krt00a : Sina Corporation
// https://www.iana.org/domains/root/db/xn--9krt00a.html
微博
// xn--b4w605ferd : Temasek Holdings (Private) Limited
// https://www.iana.org/domains/root/db/xn--b4w605ferd.html
淡马锡
// xn--bck1b9a5dre4c : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--bck1b9a5dre4c.html
ファッション
// xn--c1avg : Public Interest Registry
// https://www.iana.org/domains/root/db/xn--c1avg.html
орг
// xn--c2br7g : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--c2br7g.html
नेट
// xn--cck2b3b : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--cck2b3b.html
ストア
// xn--cckwcxetd : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--cckwcxetd.html
アマゾン
// xn--cg4bki : SAMSUNG SDS CO., LTD
// https://www.iana.org/domains/root/db/xn--cg4bki.html
삼성
// xn--czr694b : Internet DotTrademark Organisation Limited
// https://www.iana.org/domains/root/db/xn--czr694b.html
商标
// xn--czrs0t : Binky Moon, LLC
// https://www.iana.org/domains/root/db/xn--czrs0t.html
商店
// xn--czru2d : Zodiac Aquarius Limited
// https://www.iana.org/domains/root/db/xn--czru2d.html
商城
// xn--d1acj3b : The Foundation for Network Initiatives “The Smart Internet”
// https://www.iana.org/domains/root/db/xn--d1acj3b.html
дети
// xn--eckvdtc9d : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--eckvdtc9d.html
ポイント
// xn--efvy88h : Guangzhou YU Wei Information Technology Co., Ltd.
// https://www.iana.org/domains/root/db/xn--efvy88h.html
新闻
// xn--fct429k : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--fct429k.html
家電
// xn--fhbei : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--fhbei.html
كوم
// xn--fiq228c5hs : Beijing TLD Registry Technology Limited
// https://www.iana.org/domains/root/db/xn--fiq228c5hs.html
中文网
// xn--fiq64b : CITIC Group Corporation
// https://www.iana.org/domains/root/db/xn--fiq64b.html
中信
// xn--fjq720a : Binky Moon, LLC
// https://www.iana.org/domains/root/db/xn--fjq720a.html
娱乐
// xn--flw351e : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/xn--flw351e.html
谷歌
// xn--fzys8d69uvgm : PCCW Enterprises Limited
// https://www.iana.org/domains/root/db/xn--fzys8d69uvgm.html
電訊盈科
// xn--g2xx48c : Nawang Heli(Xiamen) Network Service Co., LTD.
// https://www.iana.org/domains/root/db/xn--g2xx48c.html
购物
// xn--gckr3f0f : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--gckr3f0f.html
クラウド
// xn--gk3at1e : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--gk3at1e.html
通販
// xn--hxt814e : Zodiac Taurus Limited
// https://www.iana.org/domains/root/db/xn--hxt814e.html
网店
// xn--i1b6b1a6a2e : Public Interest Registry
// https://www.iana.org/domains/root/db/xn--i1b6b1a6a2e.html
संगठन
// xn--imr513n : Internet DotTrademark Organisation Limited
// https://www.iana.org/domains/root/db/xn--imr513n.html
餐厅
// xn--io0a7i : China Internet Network Information Center (CNNIC)
// https://www.iana.org/domains/root/db/xn--io0a7i.html
网络
// xn--j1aef : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--j1aef.html
ком
// xn--jlq480n2rg : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--jlq480n2rg.html
亚马逊
// xn--jvr189m : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--jvr189m.html
食品
// xn--kcrx77d1x4a : Koninklijke Philips N.V.
// https://www.iana.org/domains/root/db/xn--kcrx77d1x4a.html
飞利浦
// xn--kput3i : Beijing RITT-Net Technology Development Co., Ltd
// https://www.iana.org/domains/root/db/xn--kput3i.html
手机
// xn--mgba3a3ejt : Aramco Services Company
// https://www.iana.org/domains/root/db/xn--mgba3a3ejt.html
ارامكو
// xn--mgba7c0bbn0a : Competrol (Luxembourg) Sarl
// https://www.iana.org/domains/root/db/xn--mgba7c0bbn0a.html
العليان
// xn--mgbab2bd : CORE Association
// https://www.iana.org/domains/root/db/xn--mgbab2bd.html
بازار
// xn--mgbca7dzdo : Abu Dhabi Systems and Information Centre
// https://www.iana.org/domains/root/db/xn--mgbca7dzdo.html
ابوظبي
// xn--mgbi4ecexp : Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
// https://www.iana.org/domains/root/db/xn--mgbi4ecexp.html
كاثوليك
// xn--mgbt3dhd
// https://www.iana.org/domains/root/db/xn--mgbt3dhd.html
همراه
// xn--mk1bu44c : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--mk1bu44c.html
닷컴
// xn--mxtq1m : Net-Chinese Co., Ltd.
// https://www.iana.org/domains/root/db/xn--mxtq1m.html
政府
// xn--ngbc5azd : International Domain Registry Pty. Ltd.
// https://www.iana.org/domains/root/db/xn--ngbc5azd.html
شبكة
// xn--ngbe9e0a : Kuwait Finance House
// https://www.iana.org/domains/root/db/xn--ngbe9e0a.html
بيتك
// xn--ngbrx : League of Arab States
// https://www.iana.org/domains/root/db/xn--ngbrx.html
عرب
// xn--nqv7f : Public Interest Registry
// https://www.iana.org/domains/root/db/xn--nqv7f.html
机构
// xn--nqv7fs00ema : Public Interest Registry
// https://www.iana.org/domains/root/db/xn--nqv7fs00ema.html
组织机构
// xn--nyqy26a : Stable Tone Limited
// https://www.iana.org/domains/root/db/xn--nyqy26a.html
健康
// xn--otu796d : Jiang Yu Liang Cai Technology Company Limited
// https://www.iana.org/domains/root/db/xn--otu796d.html
招聘
// xn--p1acf : Rusnames Limited
// https://www.iana.org/domains/root/db/xn--p1acf.html
рус
// xn--pssy2u : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--pssy2u.html
大拿
// xn--q9jyb4c : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/xn--q9jyb4c.html
みんな
// xn--qcka1pmc : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/xn--qcka1pmc.html
グーグル
// xn--rhqv96g : Stable Tone Limited
// https://www.iana.org/domains/root/db/xn--rhqv96g.html
世界
// xn--rovu88b : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/xn--rovu88b.html
書籍
// xn--ses554g : KNET Co., Ltd.
// https://www.iana.org/domains/root/db/xn--ses554g.html
网址
// xn--t60b56a : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--t60b56a.html
닷넷
// xn--tckwe : VeriSign Sarl
// https://www.iana.org/domains/root/db/xn--tckwe.html
コム
// xn--tiq49xqyj : Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
// https://www.iana.org/domains/root/db/xn--tiq49xqyj.html
天主教
// xn--unup4y : Binky Moon, LLC
// https://www.iana.org/domains/root/db/xn--unup4y.html
游戏
// xn--vermgensberater-ctb : Deutsche Vermögensberatung Aktiengesellschaft DVAG
// https://www.iana.org/domains/root/db/xn--vermgensberater-ctb.html
vermögensberater
// xn--vermgensberatung-pwb : Deutsche Vermögensberatung Aktiengesellschaft DVAG
// https://www.iana.org/domains/root/db/xn--vermgensberatung-pwb.html
vermögensberatung
// xn--vhquv : Binky Moon, LLC
// https://www.iana.org/domains/root/db/xn--vhquv.html
企业
// xn--vuq861b : Beijing Tele-info Technology Co., Ltd.
// https://www.iana.org/domains/root/db/xn--vuq861b.html
信息
// xn--w4r85el8fhu5dnra : Kerry Trading Co. Limited
// https://www.iana.org/domains/root/db/xn--w4r85el8fhu5dnra.html
嘉里大酒店
// xn--w4rs40l : Kerry Trading Co. Limited
// https://www.iana.org/domains/root/db/xn--w4rs40l.html
嘉里
// xn--xhq521b : Guangzhou YU Wei Information Technology Co., Ltd.
// https://www.iana.org/domains/root/db/xn--xhq521b.html
广东
// xn--zfr164b : China Organizational Name Administration Center
// https://www.iana.org/domains/root/db/xn--zfr164b.html
政务
// xyz : XYZ.COM LLC
// https://www.iana.org/domains/root/db/xyz.html
xyz
// yachts : XYZ.COM LLC
// https://www.iana.org/domains/root/db/yachts.html
yachts
// yahoo : Yahoo Inc.
// https://www.iana.org/domains/root/db/yahoo.html
yahoo
// yamaxun : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/yamaxun.html
yamaxun
// yandex : YANDEX, LLC
// https://www.iana.org/domains/root/db/yandex.html
yandex
// yodobashi : YODOBASHI CAMERA CO.,LTD.
// https://www.iana.org/domains/root/db/yodobashi.html
yodobashi
// yoga : Registry Services, LLC
// https://www.iana.org/domains/root/db/yoga.html
yoga
// yokohama : GMO Registry, Inc.
// https://www.iana.org/domains/root/db/yokohama.html
yokohama
// you : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/you.html
you
// youtube : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/youtube.html
youtube
// yun : Beijing Qihu Keji Co., Ltd.
// https://www.iana.org/domains/root/db/yun.html
yun
// zappos : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/zappos.html
zappos
// zara : Industria de Diseño Textil, S.A. (INDITEX, S.A.)
// https://www.iana.org/domains/root/db/zara.html
zara
// zero : Amazon Registry Services, Inc.
// https://www.iana.org/domains/root/db/zero.html
zero
// zip : Charleston Road Registry Inc.
// https://www.iana.org/domains/root/db/zip.html
zip
// zone : Binky Moon, LLC
// https://www.iana.org/domains/root/db/zone.html
zone
// zuerich : Kanton Zürich (Canton of Zurich)
// https://www.iana.org/domains/root/db/zuerich.html
zuerich
// ===END ICANN DOMAINS===
// ===BEGIN PRIVATE DOMAINS===
// (Note: these are in alphabetical order by company name)
// .KRD : https://nic.krd
co.krd
edu.krd
// .pl domains (grandfathered)
art.pl
gliwice.pl
krakow.pl
poznan.pl
wroc.pl
zakopane.pl
// 1GB LLC : https://www.1gb.ua/
// Submitted by 1GB LLC
cc.ua
inf.ua
ltd.ua
// 611 blockchain domain name system : https://sixone.one/
611.to
// A2 Hosting
// Submitted by Tyler Hall
a2hosted.com
cpserver.com
// Acorn Labs : https://acorn.io
// Submitted by Craig Jellick
*.on-acorn.io
// ActiveTrail : https://www.activetrail.biz/
// Submitted by Ofer Kalaora
activetrail.biz
// Adaptable.io : https://adaptable.io
// Submitted by Mark Terrel
adaptable.app
// addr.tools : https://addr.tools/
// Submitted by Brian Shea
myaddr.dev
myaddr.io
dyn.addr.tools
myaddr.tools
// Adobe : https://www.adobe.com/
// Submitted by Ian Boston and Lars Trieloff
adobeaemcloud.com
*.dev.adobeaemcloud.com
aem.live
hlx.live
adobeaemcloud.net
aem.network
aem.page
hlx.page
aem.reviews
// Adobe Developer Platform : https://developer.adobe.com
// Submitted by Jesse MacFadyen
adobeio-static.net
adobeioruntime.net
// Africa.com Web Solutions Ltd : https://registry.africa.com
// Submitted by Gavin Brown
africa.com
// AgentbaseAI Inc. : https://assistant-ui.com
// Submitted by Simon Farshid
*.auiusercontent.com
// Agnat sp. z o.o. : https://domena.pl
// Submitted by Przemyslaw Plewa
beep.pl
// Aiven : https://aiven.io/
// Submitted by Aiven Security Team
aiven.app
aivencloud.com
// Akamai : https://www.akamai.com/
// Submitted by Akamai Team
akadns.net
akamai.net
akamai-staging.net
akamaiedge.net
akamaiedge-staging.net
akamaihd.net
akamaihd-staging.net
akamaiorigin.net
akamaiorigin-staging.net
akamaized.net
akamaized-staging.net
edgekey.net
edgekey-staging.net
edgesuite.net
edgesuite-staging.net
// alboto.ca : http://alboto.ca
// Submitted by Anton Avramov
barsy.ca
// Alces Software Ltd : http://alces-software.com
// Submitted by Mark J. Titorenko
*.compute.estate
*.alces.network
// Alibaba Cloud API Gateway
// Submitted by Alibaba Cloud Security
alibabacloudcs.com
ms.fun
ms.show
// all-inkl.com : https://all-inkl.com
// Submitted by Werner Kaltofen
kasserver.com
// Altervista : https://www.altervista.org
// Submitted by Carlo Cannas
altervista.org
// alwaysdata : https://www.alwaysdata.com
// Submitted by Cyril
alwaysdata.net
// Amaze Software : https://amaze.co
// Submitted by Domain Admin
myamaze.net
// Amazon : https://www.amazon.com/
// Submitted by AWS Security
// Subsections of Amazon/subsidiaries will appear until "concludes" tag
// Amazon API Gateway
// Submitted by AWS Security
// Reference: 6a4f5a95-8c7d-4077-a7af-9cf1abec0a53
execute-api.cn-north-1.amazonaws.com.cn
execute-api.cn-northwest-1.amazonaws.com.cn
execute-api.af-south-1.amazonaws.com
execute-api.ap-east-1.amazonaws.com
execute-api.ap-northeast-1.amazonaws.com
execute-api.ap-northeast-2.amazonaws.com
execute-api.ap-northeast-3.amazonaws.com
execute-api.ap-south-1.amazonaws.com
execute-api.ap-south-2.amazonaws.com
execute-api.ap-southeast-1.amazonaws.com
execute-api.ap-southeast-2.amazonaws.com
execute-api.ap-southeast-3.amazonaws.com
execute-api.ap-southeast-4.amazonaws.com
execute-api.ap-southeast-5.amazonaws.com
execute-api.ca-central-1.amazonaws.com
execute-api.ca-west-1.amazonaws.com
execute-api.eu-central-1.amazonaws.com
execute-api.eu-central-2.amazonaws.com
execute-api.eu-north-1.amazonaws.com
execute-api.eu-south-1.amazonaws.com
execute-api.eu-south-2.amazonaws.com
execute-api.eu-west-1.amazonaws.com
execute-api.eu-west-2.amazonaws.com
execute-api.eu-west-3.amazonaws.com
execute-api.il-central-1.amazonaws.com
execute-api.me-central-1.amazonaws.com
execute-api.me-south-1.amazonaws.com
execute-api.sa-east-1.amazonaws.com
execute-api.us-east-1.amazonaws.com
execute-api.us-east-2.amazonaws.com
execute-api.us-gov-east-1.amazonaws.com
execute-api.us-gov-west-1.amazonaws.com
execute-api.us-west-1.amazonaws.com
execute-api.us-west-2.amazonaws.com
// Amazon CloudFront
// Submitted by Donavan Miller
// Reference: 54144616-fd49-4435-8535-19c6a601bdb3
cloudfront.net
// Amazon Cognito
// Submitted by AWS Security
// Reference: d7d4a954-976e-403e-a010-de9ed0cfbbd1
auth.af-south-1.amazoncognito.com
auth.ap-east-1.amazoncognito.com
auth.ap-northeast-1.amazoncognito.com
auth.ap-northeast-2.amazoncognito.com
auth.ap-northeast-3.amazoncognito.com
auth.ap-south-1.amazoncognito.com
auth.ap-south-2.amazoncognito.com
auth.ap-southeast-1.amazoncognito.com
auth.ap-southeast-2.amazoncognito.com
auth.ap-southeast-3.amazoncognito.com
auth.ap-southeast-4.amazoncognito.com
auth.ap-southeast-5.amazoncognito.com
auth.ap-southeast-7.amazoncognito.com
auth.ca-central-1.amazoncognito.com
auth.ca-west-1.amazoncognito.com
auth.eu-central-1.amazoncognito.com
auth.eu-central-2.amazoncognito.com
auth.eu-north-1.amazoncognito.com
auth.eu-south-1.amazoncognito.com
auth.eu-south-2.amazoncognito.com
auth.eu-west-1.amazoncognito.com
auth.eu-west-2.amazoncognito.com
auth.eu-west-3.amazoncognito.com
auth.il-central-1.amazoncognito.com
auth.me-central-1.amazoncognito.com
auth.me-south-1.amazoncognito.com
auth.mx-central-1.amazoncognito.com
auth.sa-east-1.amazoncognito.com
auth.us-east-1.amazoncognito.com
auth-fips.us-east-1.amazoncognito.com
auth.us-east-2.amazoncognito.com
auth-fips.us-east-2.amazoncognito.com
auth-fips.us-gov-east-1.amazoncognito.com
auth-fips.us-gov-west-1.amazoncognito.com
auth.us-west-1.amazoncognito.com
auth-fips.us-west-1.amazoncognito.com
auth.us-west-2.amazoncognito.com
auth-fips.us-west-2.amazoncognito.com
auth.cognito-idp.eusc-de-east-1.on.amazonwebservices.eu
// Amazon EC2
// Submitted by Luke Wells
// Reference: 4c38fa71-58ac-4768-99e5-689c1767e537
*.compute.amazonaws.com.cn
*.compute.amazonaws.com
*.compute-1.amazonaws.com
us-east-1.amazonaws.com
// Amazon EMR
// Submitted by AWS Security
// Reference: 82f43f9f-bbb8-400e-8349-854f5a62f20d
emrappui-prod.cn-north-1.amazonaws.com.cn
emrnotebooks-prod.cn-north-1.amazonaws.com.cn
emrstudio-prod.cn-north-1.amazonaws.com.cn
emrappui-prod.cn-northwest-1.amazonaws.com.cn
emrnotebooks-prod.cn-northwest-1.amazonaws.com.cn
emrstudio-prod.cn-northwest-1.amazonaws.com.cn
emrappui-prod.af-south-1.amazonaws.com
emrnotebooks-prod.af-south-1.amazonaws.com
emrstudio-prod.af-south-1.amazonaws.com
emrappui-prod.ap-east-1.amazonaws.com
emrnotebooks-prod.ap-east-1.amazonaws.com
emrstudio-prod.ap-east-1.amazonaws.com
emrappui-prod.ap-northeast-1.amazonaws.com
emrnotebooks-prod.ap-northeast-1.amazonaws.com
emrstudio-prod.ap-northeast-1.amazonaws.com
emrappui-prod.ap-northeast-2.amazonaws.com
emrnotebooks-prod.ap-northeast-2.amazonaws.com
emrstudio-prod.ap-northeast-2.amazonaws.com
emrappui-prod.ap-northeast-3.amazonaws.com
emrnotebooks-prod.ap-northeast-3.amazonaws.com
emrstudio-prod.ap-northeast-3.amazonaws.com
emrappui-prod.ap-south-1.amazonaws.com
emrnotebooks-prod.ap-south-1.amazonaws.com
emrstudio-prod.ap-south-1.amazonaws.com
emrappui-prod.ap-south-2.amazonaws.com
emrnotebooks-prod.ap-south-2.amazonaws.com
emrstudio-prod.ap-south-2.amazonaws.com
emrappui-prod.ap-southeast-1.amazonaws.com
emrnotebooks-prod.ap-southeast-1.amazonaws.com
emrstudio-prod.ap-southeast-1.amazonaws.com
emrappui-prod.ap-southeast-2.amazonaws.com
emrnotebooks-prod.ap-southeast-2.amazonaws.com
emrstudio-prod.ap-southeast-2.amazonaws.com
emrappui-prod.ap-southeast-3.amazonaws.com
emrnotebooks-prod.ap-southeast-3.amazonaws.com
emrstudio-prod.ap-southeast-3.amazonaws.com
emrappui-prod.ap-southeast-4.amazonaws.com
emrnotebooks-prod.ap-southeast-4.amazonaws.com
emrstudio-prod.ap-southeast-4.amazonaws.com
emrappui-prod.ca-central-1.amazonaws.com
emrnotebooks-prod.ca-central-1.amazonaws.com
emrstudio-prod.ca-central-1.amazonaws.com
emrappui-prod.ca-west-1.amazonaws.com
emrnotebooks-prod.ca-west-1.amazonaws.com
emrstudio-prod.ca-west-1.amazonaws.com
emrappui-prod.eu-central-1.amazonaws.com
emrnotebooks-prod.eu-central-1.amazonaws.com
emrstudio-prod.eu-central-1.amazonaws.com
emrappui-prod.eu-central-2.amazonaws.com
emrnotebooks-prod.eu-central-2.amazonaws.com
emrstudio-prod.eu-central-2.amazonaws.com
emrappui-prod.eu-north-1.amazonaws.com
emrnotebooks-prod.eu-north-1.amazonaws.com
emrstudio-prod.eu-north-1.amazonaws.com
emrappui-prod.eu-south-1.amazonaws.com
emrnotebooks-prod.eu-south-1.amazonaws.com
emrstudio-prod.eu-south-1.amazonaws.com
emrappui-prod.eu-south-2.amazonaws.com
emrnotebooks-prod.eu-south-2.amazonaws.com
emrstudio-prod.eu-south-2.amazonaws.com
emrappui-prod.eu-west-1.amazonaws.com
emrnotebooks-prod.eu-west-1.amazonaws.com
emrstudio-prod.eu-west-1.amazonaws.com
emrappui-prod.eu-west-2.amazonaws.com
emrnotebooks-prod.eu-west-2.amazonaws.com
emrstudio-prod.eu-west-2.amazonaws.com
emrappui-prod.eu-west-3.amazonaws.com
emrnotebooks-prod.eu-west-3.amazonaws.com
emrstudio-prod.eu-west-3.amazonaws.com
emrappui-prod.il-central-1.amazonaws.com
emrnotebooks-prod.il-central-1.amazonaws.com
emrstudio-prod.il-central-1.amazonaws.com
emrappui-prod.me-central-1.amazonaws.com
emrnotebooks-prod.me-central-1.amazonaws.com
emrstudio-prod.me-central-1.amazonaws.com
emrappui-prod.me-south-1.amazonaws.com
emrnotebooks-prod.me-south-1.amazonaws.com
emrstudio-prod.me-south-1.amazonaws.com
emrappui-prod.sa-east-1.amazonaws.com
emrnotebooks-prod.sa-east-1.amazonaws.com
emrstudio-prod.sa-east-1.amazonaws.com
emrappui-prod.us-east-1.amazonaws.com
emrnotebooks-prod.us-east-1.amazonaws.com
emrstudio-prod.us-east-1.amazonaws.com
emrappui-prod.us-east-2.amazonaws.com
emrnotebooks-prod.us-east-2.amazonaws.com
emrstudio-prod.us-east-2.amazonaws.com
emrappui-prod.us-gov-east-1.amazonaws.com
emrnotebooks-prod.us-gov-east-1.amazonaws.com
emrstudio-prod.us-gov-east-1.amazonaws.com
emrappui-prod.us-gov-west-1.amazonaws.com
emrnotebooks-prod.us-gov-west-1.amazonaws.com
emrstudio-prod.us-gov-west-1.amazonaws.com
emrappui-prod.us-west-1.amazonaws.com
emrnotebooks-prod.us-west-1.amazonaws.com
emrstudio-prod.us-west-1.amazonaws.com
emrappui-prod.us-west-2.amazonaws.com
emrnotebooks-prod.us-west-2.amazonaws.com
emrstudio-prod.us-west-2.amazonaws.com
// Amazon Managed Workflows for Apache Airflow
// Submitted by AWS Security
// Reference: bfd043cc-2816-451d-894e-612c6b61a438
*.airflow.af-south-1.on.aws
*.airflow.ap-east-1.on.aws
*.airflow.ap-northeast-1.on.aws
*.airflow.ap-northeast-2.on.aws
*.airflow.ap-northeast-3.on.aws
*.airflow.ap-south-1.on.aws
*.airflow.ap-south-2.on.aws
*.airflow.ap-southeast-1.on.aws
*.airflow.ap-southeast-2.on.aws
*.airflow.ap-southeast-3.on.aws
*.airflow.ap-southeast-4.on.aws
*.airflow.ap-southeast-5.on.aws
*.airflow.ca-central-1.on.aws
*.airflow.ca-west-1.on.aws
*.airflow.eu-central-1.on.aws
*.airflow.eu-central-2.on.aws
*.airflow.eu-north-1.on.aws
*.airflow.eu-south-1.on.aws
*.airflow.eu-south-2.on.aws
*.airflow.eu-west-1.on.aws
*.airflow.eu-west-2.on.aws
*.airflow.eu-west-3.on.aws
*.airflow.il-central-1.on.aws
*.airflow.me-central-1.on.aws
*.airflow.me-south-1.on.aws
*.airflow.sa-east-1.on.aws
*.airflow.us-east-1.on.aws
*.airflow.us-east-2.on.aws
*.airflow.us-west-1.on.aws
*.airflow.us-west-2.on.aws
*.cn-north-1.airflow.amazonaws.com.cn
*.cn-northwest-1.airflow.amazonaws.com.cn
*.airflow.cn-north-1.on.amazonwebservices.com.cn
*.airflow.cn-northwest-1.on.amazonwebservices.com.cn
*.af-south-1.airflow.amazonaws.com
*.ap-east-1.airflow.amazonaws.com
*.ap-northeast-1.airflow.amazonaws.com
*.ap-northeast-2.airflow.amazonaws.com
*.ap-northeast-3.airflow.amazonaws.com
*.ap-south-1.airflow.amazonaws.com
*.ap-south-2.airflow.amazonaws.com
*.ap-southeast-1.airflow.amazonaws.com
*.ap-southeast-2.airflow.amazonaws.com
*.ap-southeast-3.airflow.amazonaws.com
*.ap-southeast-4.airflow.amazonaws.com
*.ap-southeast-5.airflow.amazonaws.com
*.ap-southeast-7.airflow.amazonaws.com
*.ca-central-1.airflow.amazonaws.com
*.ca-west-1.airflow.amazonaws.com
*.eu-central-1.airflow.amazonaws.com
*.eu-central-2.airflow.amazonaws.com
*.eu-north-1.airflow.amazonaws.com
*.eu-south-1.airflow.amazonaws.com
*.eu-south-2.airflow.amazonaws.com
*.eu-west-1.airflow.amazonaws.com
*.eu-west-2.airflow.amazonaws.com
*.eu-west-3.airflow.amazonaws.com
*.il-central-1.airflow.amazonaws.com
*.me-central-1.airflow.amazonaws.com
*.me-south-1.airflow.amazonaws.com
*.sa-east-1.airflow.amazonaws.com
*.us-east-1.airflow.amazonaws.com
*.us-east-2.airflow.amazonaws.com
*.us-west-1.airflow.amazonaws.com
*.us-west-2.airflow.amazonaws.com
// Amazon Relational Database Service
// Submitted by: AWS Security
// Reference: 5aa87906-fd4f-4831-8727-4ffca6094159
*.rds.cn-north-1.amazonaws.com.cn
*.rds.cn-northwest-1.amazonaws.com.cn
*.af-south-1.rds.amazonaws.com
*.ap-east-1.rds.amazonaws.com
*.ap-east-2.rds.amazonaws.com
*.ap-northeast-1.rds.amazonaws.com
*.ap-northeast-2.rds.amazonaws.com
*.ap-northeast-3.rds.amazonaws.com
*.ap-south-1.rds.amazonaws.com
*.ap-south-2.rds.amazonaws.com
*.ap-southeast-1.rds.amazonaws.com
*.ap-southeast-2.rds.amazonaws.com
*.ap-southeast-3.rds.amazonaws.com
*.ap-southeast-4.rds.amazonaws.com
*.ap-southeast-5.rds.amazonaws.com
*.ap-southeast-6.rds.amazonaws.com
*.ap-southeast-7.rds.amazonaws.com
*.ca-central-1.rds.amazonaws.com
*.ca-west-1.rds.amazonaws.com
*.eu-central-1.rds.amazonaws.com
*.eu-central-2.rds.amazonaws.com
*.eu-west-1.rds.amazonaws.com
*.eu-west-2.rds.amazonaws.com
*.eu-west-3.rds.amazonaws.com
*.il-central-1.rds.amazonaws.com
*.me-central-1.rds.amazonaws.com
*.me-south-1.rds.amazonaws.com
*.mx-central-1.rds.amazonaws.com
*.sa-east-1.rds.amazonaws.com
*.us-east-1.rds.amazonaws.com
*.us-east-2.rds.amazonaws.com
*.us-gov-east-1.rds.amazonaws.com
*.us-gov-west-1.rds.amazonaws.com
*.us-northeast-1.rds.amazonaws.com
*.us-west-1.rds.amazonaws.com
*.us-west-2.rds.amazonaws.com
// Amazon S3
// Submitted by AWS Security
// Reference: 6f374c1c-1cc9-47de-8b2a-69ca56a3a3b6
s3.dualstack.cn-north-1.amazonaws.com.cn
s3-accesspoint.dualstack.cn-north-1.amazonaws.com.cn
s3-website.dualstack.cn-north-1.amazonaws.com.cn
s3.cn-north-1.amazonaws.com.cn
s3-accesspoint.cn-north-1.amazonaws.com.cn
s3-deprecated.cn-north-1.amazonaws.com.cn
s3-object-lambda.cn-north-1.amazonaws.com.cn
s3-website.cn-north-1.amazonaws.com.cn
s3.dualstack.cn-northwest-1.amazonaws.com.cn
s3-accesspoint.dualstack.cn-northwest-1.amazonaws.com.cn
s3.cn-northwest-1.amazonaws.com.cn
s3-accesspoint.cn-northwest-1.amazonaws.com.cn
s3-object-lambda.cn-northwest-1.amazonaws.com.cn
s3-website.cn-northwest-1.amazonaws.com.cn
s3.dualstack.af-south-1.amazonaws.com
s3-accesspoint.dualstack.af-south-1.amazonaws.com
s3-website.dualstack.af-south-1.amazonaws.com
s3.af-south-1.amazonaws.com
s3-accesspoint.af-south-1.amazonaws.com
s3-object-lambda.af-south-1.amazonaws.com
s3-website.af-south-1.amazonaws.com
s3.dualstack.ap-east-1.amazonaws.com
s3-accesspoint.dualstack.ap-east-1.amazonaws.com
s3.ap-east-1.amazonaws.com
s3-accesspoint.ap-east-1.amazonaws.com
s3-object-lambda.ap-east-1.amazonaws.com
s3-website.ap-east-1.amazonaws.com
s3.dualstack.ap-northeast-1.amazonaws.com
s3-accesspoint.dualstack.ap-northeast-1.amazonaws.com
s3-website.dualstack.ap-northeast-1.amazonaws.com
s3.ap-northeast-1.amazonaws.com
s3-accesspoint.ap-northeast-1.amazonaws.com
s3-object-lambda.ap-northeast-1.amazonaws.com
s3-website.ap-northeast-1.amazonaws.com
s3.dualstack.ap-northeast-2.amazonaws.com
s3-accesspoint.dualstack.ap-northeast-2.amazonaws.com
s3-website.dualstack.ap-northeast-2.amazonaws.com
s3.ap-northeast-2.amazonaws.com
s3-accesspoint.ap-northeast-2.amazonaws.com
s3-object-lambda.ap-northeast-2.amazonaws.com
s3-website.ap-northeast-2.amazonaws.com
s3.dualstack.ap-northeast-3.amazonaws.com
s3-accesspoint.dualstack.ap-northeast-3.amazonaws.com
s3-website.dualstack.ap-northeast-3.amazonaws.com
s3.ap-northeast-3.amazonaws.com
s3-accesspoint.ap-northeast-3.amazonaws.com
s3-object-lambda.ap-northeast-3.amazonaws.com
s3-website.ap-northeast-3.amazonaws.com
s3.dualstack.ap-south-1.amazonaws.com
s3-accesspoint.dualstack.ap-south-1.amazonaws.com
s3-website.dualstack.ap-south-1.amazonaws.com
s3.ap-south-1.amazonaws.com
s3-accesspoint.ap-south-1.amazonaws.com
s3-object-lambda.ap-south-1.amazonaws.com
s3-website.ap-south-1.amazonaws.com
s3.dualstack.ap-south-2.amazonaws.com
s3-accesspoint.dualstack.ap-south-2.amazonaws.com
s3-website.dualstack.ap-south-2.amazonaws.com
s3.ap-south-2.amazonaws.com
s3-accesspoint.ap-south-2.amazonaws.com
s3-object-lambda.ap-south-2.amazonaws.com
s3-website.ap-south-2.amazonaws.com
s3.dualstack.ap-southeast-1.amazonaws.com
s3-accesspoint.dualstack.ap-southeast-1.amazonaws.com
s3-website.dualstack.ap-southeast-1.amazonaws.com
s3.ap-southeast-1.amazonaws.com
s3-accesspoint.ap-southeast-1.amazonaws.com
s3-object-lambda.ap-southeast-1.amazonaws.com
s3-website.ap-southeast-1.amazonaws.com
s3.dualstack.ap-southeast-2.amazonaws.com
s3-accesspoint.dualstack.ap-southeast-2.amazonaws.com
s3-website.dualstack.ap-southeast-2.amazonaws.com
s3.ap-southeast-2.amazonaws.com
s3-accesspoint.ap-southeast-2.amazonaws.com
s3-object-lambda.ap-southeast-2.amazonaws.com
s3-website.ap-southeast-2.amazonaws.com
s3.dualstack.ap-southeast-3.amazonaws.com
s3-accesspoint.dualstack.ap-southeast-3.amazonaws.com
s3-website.dualstack.ap-southeast-3.amazonaws.com
s3.ap-southeast-3.amazonaws.com
s3-accesspoint.ap-southeast-3.amazonaws.com
s3-object-lambda.ap-southeast-3.amazonaws.com
s3-website.ap-southeast-3.amazonaws.com
s3.dualstack.ap-southeast-4.amazonaws.com
s3-accesspoint.dualstack.ap-southeast-4.amazonaws.com
s3-website.dualstack.ap-southeast-4.amazonaws.com
s3.ap-southeast-4.amazonaws.com
s3-accesspoint.ap-southeast-4.amazonaws.com
s3-object-lambda.ap-southeast-4.amazonaws.com
s3-website.ap-southeast-4.amazonaws.com
s3.dualstack.ap-southeast-5.amazonaws.com
s3-accesspoint.dualstack.ap-southeast-5.amazonaws.com
s3-website.dualstack.ap-southeast-5.amazonaws.com
s3.ap-southeast-5.amazonaws.com
s3-accesspoint.ap-southeast-5.amazonaws.com
s3-deprecated.ap-southeast-5.amazonaws.com
s3-object-lambda.ap-southeast-5.amazonaws.com
s3-website.ap-southeast-5.amazonaws.com
s3.dualstack.ca-central-1.amazonaws.com
s3-accesspoint.dualstack.ca-central-1.amazonaws.com
s3-accesspoint-fips.dualstack.ca-central-1.amazonaws.com
s3-fips.dualstack.ca-central-1.amazonaws.com
s3-website.dualstack.ca-central-1.amazonaws.com
s3.ca-central-1.amazonaws.com
s3-accesspoint.ca-central-1.amazonaws.com
s3-accesspoint-fips.ca-central-1.amazonaws.com
s3-fips.ca-central-1.amazonaws.com
s3-object-lambda.ca-central-1.amazonaws.com
s3-website.ca-central-1.amazonaws.com
s3.dualstack.ca-west-1.amazonaws.com
s3-accesspoint.dualstack.ca-west-1.amazonaws.com
s3-accesspoint-fips.dualstack.ca-west-1.amazonaws.com
s3-fips.dualstack.ca-west-1.amazonaws.com
s3-website.dualstack.ca-west-1.amazonaws.com
s3.ca-west-1.amazonaws.com
s3-accesspoint.ca-west-1.amazonaws.com
s3-accesspoint-fips.ca-west-1.amazonaws.com
s3-fips.ca-west-1.amazonaws.com
s3-object-lambda.ca-west-1.amazonaws.com
s3-website.ca-west-1.amazonaws.com
s3.dualstack.eu-central-1.amazonaws.com
s3-accesspoint.dualstack.eu-central-1.amazonaws.com
s3-website.dualstack.eu-central-1.amazonaws.com
s3.eu-central-1.amazonaws.com
s3-accesspoint.eu-central-1.amazonaws.com
s3-object-lambda.eu-central-1.amazonaws.com
s3-website.eu-central-1.amazonaws.com
s3.dualstack.eu-central-2.amazonaws.com
s3-accesspoint.dualstack.eu-central-2.amazonaws.com
s3-website.dualstack.eu-central-2.amazonaws.com
s3.eu-central-2.amazonaws.com
s3-accesspoint.eu-central-2.amazonaws.com
s3-object-lambda.eu-central-2.amazonaws.com
s3-website.eu-central-2.amazonaws.com
s3.dualstack.eu-north-1.amazonaws.com
s3-accesspoint.dualstack.eu-north-1.amazonaws.com
s3.eu-north-1.amazonaws.com
s3-accesspoint.eu-north-1.amazonaws.com
s3-object-lambda.eu-north-1.amazonaws.com
s3-website.eu-north-1.amazonaws.com
s3.dualstack.eu-south-1.amazonaws.com
s3-accesspoint.dualstack.eu-south-1.amazonaws.com
s3-website.dualstack.eu-south-1.amazonaws.com
s3.eu-south-1.amazonaws.com
s3-accesspoint.eu-south-1.amazonaws.com
s3-object-lambda.eu-south-1.amazonaws.com
s3-website.eu-south-1.amazonaws.com
s3.dualstack.eu-south-2.amazonaws.com
s3-accesspoint.dualstack.eu-south-2.amazonaws.com
s3-website.dualstack.eu-south-2.amazonaws.com
s3.eu-south-2.amazonaws.com
s3-accesspoint.eu-south-2.amazonaws.com
s3-object-lambda.eu-south-2.amazonaws.com
s3-website.eu-south-2.amazonaws.com
s3.dualstack.eu-west-1.amazonaws.com
s3-accesspoint.dualstack.eu-west-1.amazonaws.com
s3-website.dualstack.eu-west-1.amazonaws.com
s3.eu-west-1.amazonaws.com
s3-accesspoint.eu-west-1.amazonaws.com
s3-deprecated.eu-west-1.amazonaws.com
s3-object-lambda.eu-west-1.amazonaws.com
s3-website.eu-west-1.amazonaws.com
s3.dualstack.eu-west-2.amazonaws.com
s3-accesspoint.dualstack.eu-west-2.amazonaws.com
s3.eu-west-2.amazonaws.com
s3-accesspoint.eu-west-2.amazonaws.com
s3-object-lambda.eu-west-2.amazonaws.com
s3-website.eu-west-2.amazonaws.com
s3.dualstack.eu-west-3.amazonaws.com
s3-accesspoint.dualstack.eu-west-3.amazonaws.com
s3-website.dualstack.eu-west-3.amazonaws.com
s3.eu-west-3.amazonaws.com
s3-accesspoint.eu-west-3.amazonaws.com
s3-object-lambda.eu-west-3.amazonaws.com
s3-website.eu-west-3.amazonaws.com
s3.dualstack.il-central-1.amazonaws.com
s3-accesspoint.dualstack.il-central-1.amazonaws.com
s3-website.dualstack.il-central-1.amazonaws.com
s3.il-central-1.amazonaws.com
s3-accesspoint.il-central-1.amazonaws.com
s3-object-lambda.il-central-1.amazonaws.com
s3-website.il-central-1.amazonaws.com
s3.dualstack.me-central-1.amazonaws.com
s3-accesspoint.dualstack.me-central-1.amazonaws.com
s3-website.dualstack.me-central-1.amazonaws.com
s3.me-central-1.amazonaws.com
s3-accesspoint.me-central-1.amazonaws.com
s3-object-lambda.me-central-1.amazonaws.com
s3-website.me-central-1.amazonaws.com
s3.dualstack.me-south-1.amazonaws.com
s3-accesspoint.dualstack.me-south-1.amazonaws.com
s3.me-south-1.amazonaws.com
s3-accesspoint.me-south-1.amazonaws.com
s3-object-lambda.me-south-1.amazonaws.com
s3-website.me-south-1.amazonaws.com
s3.amazonaws.com
s3-1.amazonaws.com
s3-ap-east-1.amazonaws.com
s3-ap-northeast-1.amazonaws.com
s3-ap-northeast-2.amazonaws.com
s3-ap-northeast-3.amazonaws.com
s3-ap-south-1.amazonaws.com
s3-ap-southeast-1.amazonaws.com
s3-ap-southeast-2.amazonaws.com
s3-ca-central-1.amazonaws.com
s3-eu-central-1.amazonaws.com
s3-eu-north-1.amazonaws.com
s3-eu-west-1.amazonaws.com
s3-eu-west-2.amazonaws.com
s3-eu-west-3.amazonaws.com
s3-external-1.amazonaws.com
s3-fips-us-gov-east-1.amazonaws.com
s3-fips-us-gov-west-1.amazonaws.com
mrap.accesspoint.s3-global.amazonaws.com
s3-me-south-1.amazonaws.com
s3-sa-east-1.amazonaws.com
s3-us-east-2.amazonaws.com
s3-us-gov-east-1.amazonaws.com
s3-us-gov-west-1.amazonaws.com
s3-us-west-1.amazonaws.com
s3-us-west-2.amazonaws.com
s3-website-ap-northeast-1.amazonaws.com
s3-website-ap-southeast-1.amazonaws.com
s3-website-ap-southeast-2.amazonaws.com
s3-website-eu-west-1.amazonaws.com
s3-website-sa-east-1.amazonaws.com
s3-website-us-east-1.amazonaws.com
s3-website-us-gov-west-1.amazonaws.com
s3-website-us-west-1.amazonaws.com
s3-website-us-west-2.amazonaws.com
s3.dualstack.sa-east-1.amazonaws.com
s3-accesspoint.dualstack.sa-east-1.amazonaws.com
s3-website.dualstack.sa-east-1.amazonaws.com
s3.sa-east-1.amazonaws.com
s3-accesspoint.sa-east-1.amazonaws.com
s3-object-lambda.sa-east-1.amazonaws.com
s3-website.sa-east-1.amazonaws.com
s3.dualstack.us-east-1.amazonaws.com
s3-accesspoint.dualstack.us-east-1.amazonaws.com
s3-accesspoint-fips.dualstack.us-east-1.amazonaws.com
s3-fips.dualstack.us-east-1.amazonaws.com
s3-website.dualstack.us-east-1.amazonaws.com
s3.us-east-1.amazonaws.com
s3-accesspoint.us-east-1.amazonaws.com
s3-accesspoint-fips.us-east-1.amazonaws.com
s3-deprecated.us-east-1.amazonaws.com
s3-fips.us-east-1.amazonaws.com
s3-object-lambda.us-east-1.amazonaws.com
s3-website.us-east-1.amazonaws.com
s3.dualstack.us-east-2.amazonaws.com
s3-accesspoint.dualstack.us-east-2.amazonaws.com
s3-accesspoint-fips.dualstack.us-east-2.amazonaws.com
s3-fips.dualstack.us-east-2.amazonaws.com
s3-website.dualstack.us-east-2.amazonaws.com
s3.us-east-2.amazonaws.com
s3-accesspoint.us-east-2.amazonaws.com
s3-accesspoint-fips.us-east-2.amazonaws.com
s3-deprecated.us-east-2.amazonaws.com
s3-fips.us-east-2.amazonaws.com
s3-object-lambda.us-east-2.amazonaws.com
s3-website.us-east-2.amazonaws.com
s3.dualstack.us-gov-east-1.amazonaws.com
s3-accesspoint.dualstack.us-gov-east-1.amazonaws.com
s3-accesspoint-fips.dualstack.us-gov-east-1.amazonaws.com
s3-fips.dualstack.us-gov-east-1.amazonaws.com
s3-website.dualstack.us-gov-east-1.amazonaws.com
s3.us-gov-east-1.amazonaws.com
s3-accesspoint.us-gov-east-1.amazonaws.com
s3-accesspoint-fips.us-gov-east-1.amazonaws.com
s3-fips.us-gov-east-1.amazonaws.com
s3-object-lambda.us-gov-east-1.amazonaws.com
s3-website.us-gov-east-1.amazonaws.com
s3.dualstack.us-gov-west-1.amazonaws.com
s3-accesspoint.dualstack.us-gov-west-1.amazonaws.com
s3-accesspoint-fips.dualstack.us-gov-west-1.amazonaws.com
s3-fips.dualstack.us-gov-west-1.amazonaws.com
s3-website.dualstack.us-gov-west-1.amazonaws.com
s3.us-gov-west-1.amazonaws.com
s3-accesspoint.us-gov-west-1.amazonaws.com
s3-accesspoint-fips.us-gov-west-1.amazonaws.com
s3-fips.us-gov-west-1.amazonaws.com
s3-object-lambda.us-gov-west-1.amazonaws.com
s3-website.us-gov-west-1.amazonaws.com
s3.dualstack.us-west-1.amazonaws.com
s3-accesspoint.dualstack.us-west-1.amazonaws.com
s3-accesspoint-fips.dualstack.us-west-1.amazonaws.com
s3-fips.dualstack.us-west-1.amazonaws.com
s3-website.dualstack.us-west-1.amazonaws.com
s3.us-west-1.amazonaws.com
s3-accesspoint.us-west-1.amazonaws.com
s3-accesspoint-fips.us-west-1.amazonaws.com
s3-fips.us-west-1.amazonaws.com
s3-object-lambda.us-west-1.amazonaws.com
s3-website.us-west-1.amazonaws.com
s3.dualstack.us-west-2.amazonaws.com
s3-accesspoint.dualstack.us-west-2.amazonaws.com
s3-accesspoint-fips.dualstack.us-west-2.amazonaws.com
s3-fips.dualstack.us-west-2.amazonaws.com
s3-website.dualstack.us-west-2.amazonaws.com
s3.us-west-2.amazonaws.com
s3-accesspoint.us-west-2.amazonaws.com
s3-accesspoint-fips.us-west-2.amazonaws.com
s3-deprecated.us-west-2.amazonaws.com
s3-fips.us-west-2.amazonaws.com
s3-object-lambda.us-west-2.amazonaws.com
s3-website.us-west-2.amazonaws.com
// Amazon SageMaker Ground Truth
// Submitted by AWS Security
// Reference: 98dbfde4-7802-48c3-8751-b60f204e0d9c
labeling.ap-northeast-1.sagemaker.aws
labeling.ap-northeast-2.sagemaker.aws
labeling.ap-south-1.sagemaker.aws
labeling.ap-southeast-1.sagemaker.aws
labeling.ap-southeast-2.sagemaker.aws
labeling.ca-central-1.sagemaker.aws
labeling.eu-central-1.sagemaker.aws
labeling.eu-west-1.sagemaker.aws
labeling.eu-west-2.sagemaker.aws
labeling.us-east-1.sagemaker.aws
labeling.us-east-2.sagemaker.aws
labeling.us-west-2.sagemaker.aws
// Amazon SageMaker Notebook Instances
// Submitted by AWS Security
// Reference: b5ea56df-669e-43cc-9537-14aa172f5dfc
notebook.af-south-1.sagemaker.aws
notebook.ap-east-1.sagemaker.aws
notebook.ap-northeast-1.sagemaker.aws
notebook.ap-northeast-2.sagemaker.aws
notebook.ap-northeast-3.sagemaker.aws
notebook.ap-south-1.sagemaker.aws
notebook.ap-south-2.sagemaker.aws
notebook.ap-southeast-1.sagemaker.aws
notebook.ap-southeast-2.sagemaker.aws
notebook.ap-southeast-3.sagemaker.aws
notebook.ap-southeast-4.sagemaker.aws
notebook.ca-central-1.sagemaker.aws
notebook-fips.ca-central-1.sagemaker.aws
notebook.ca-west-1.sagemaker.aws
notebook-fips.ca-west-1.sagemaker.aws
notebook.eu-central-1.sagemaker.aws
notebook.eu-central-2.sagemaker.aws
notebook.eu-north-1.sagemaker.aws
notebook.eu-south-1.sagemaker.aws
notebook.eu-south-2.sagemaker.aws
notebook.eu-west-1.sagemaker.aws
notebook.eu-west-2.sagemaker.aws
notebook.eu-west-3.sagemaker.aws
notebook.il-central-1.sagemaker.aws
notebook.me-central-1.sagemaker.aws
notebook.me-south-1.sagemaker.aws
notebook.sa-east-1.sagemaker.aws
notebook.us-east-1.sagemaker.aws
notebook-fips.us-east-1.sagemaker.aws
notebook.us-east-2.sagemaker.aws
notebook-fips.us-east-2.sagemaker.aws
notebook.us-gov-east-1.sagemaker.aws
notebook-fips.us-gov-east-1.sagemaker.aws
notebook.us-gov-west-1.sagemaker.aws
notebook-fips.us-gov-west-1.sagemaker.aws
notebook.us-west-1.sagemaker.aws
notebook-fips.us-west-1.sagemaker.aws
notebook.us-west-2.sagemaker.aws
notebook-fips.us-west-2.sagemaker.aws
notebook.cn-north-1.sagemaker.com.cn
notebook.cn-northwest-1.sagemaker.com.cn
// Amazon SageMaker Studio
// Submitted by AWS Security
// Reference: 475f237e-ab88-4041-9f41-7cfccdf66aeb
studio.af-south-1.sagemaker.aws
studio.ap-east-1.sagemaker.aws
studio.ap-northeast-1.sagemaker.aws
studio.ap-northeast-2.sagemaker.aws
studio.ap-northeast-3.sagemaker.aws
studio.ap-south-1.sagemaker.aws
studio.ap-southeast-1.sagemaker.aws
studio.ap-southeast-2.sagemaker.aws
studio.ap-southeast-3.sagemaker.aws
studio.ca-central-1.sagemaker.aws
studio.eu-central-1.sagemaker.aws
studio.eu-central-2.sagemaker.aws
studio.eu-north-1.sagemaker.aws
studio.eu-south-1.sagemaker.aws
studio.eu-south-2.sagemaker.aws
studio.eu-west-1.sagemaker.aws
studio.eu-west-2.sagemaker.aws
studio.eu-west-3.sagemaker.aws
studio.il-central-1.sagemaker.aws
studio.me-central-1.sagemaker.aws
studio.me-south-1.sagemaker.aws
studio.sa-east-1.sagemaker.aws
studio.us-east-1.sagemaker.aws
studio.us-east-2.sagemaker.aws
studio.us-gov-east-1.sagemaker.aws
studio-fips.us-gov-east-1.sagemaker.aws
studio.us-gov-west-1.sagemaker.aws
studio-fips.us-gov-west-1.sagemaker.aws
studio.us-west-1.sagemaker.aws
studio.us-west-2.sagemaker.aws
studio.cn-north-1.sagemaker.com.cn
studio.cn-northwest-1.sagemaker.com.cn
// Amazon SageMaker with MLflow
// Submited by: AWS Security
// Reference: c19f92b3-a82a-452d-8189-831b572eea7e
*.experiments.sagemaker.aws
// Analytics on AWS
// Submitted by AWS Security
// Reference: 955f9f40-a495-4e73-ae85-67b77ac9cadd
analytics-gateway.ap-northeast-1.amazonaws.com
analytics-gateway.ap-northeast-2.amazonaws.com
analytics-gateway.ap-south-1.amazonaws.com
analytics-gateway.ap-southeast-1.amazonaws.com
analytics-gateway.ap-southeast-2.amazonaws.com
analytics-gateway.eu-central-1.amazonaws.com
analytics-gateway.eu-west-1.amazonaws.com
analytics-gateway.us-east-1.amazonaws.com
analytics-gateway.us-east-2.amazonaws.com
analytics-gateway.us-west-2.amazonaws.com
// AWS Amplify
// Submitted by AWS Security
// Reference: c35bed18-6f4f-424f-9298-5756f2f7d72b
amplifyapp.com
// AWS App Runner
// Submitted by AWS Security
// Reference: 6828c008-ba5d-442f-ade5-48da4e7c2316
*.awsapprunner.com
// AWS Cloud9
// Submitted by: AWS Security
// Reference: 30717f72-4007-4f0f-8ed4-864c6f2efec9
webview-assets.aws-cloud9.af-south-1.amazonaws.com
vfs.cloud9.af-south-1.amazonaws.com
webview-assets.cloud9.af-south-1.amazonaws.com
webview-assets.aws-cloud9.ap-east-1.amazonaws.com
vfs.cloud9.ap-east-1.amazonaws.com
webview-assets.cloud9.ap-east-1.amazonaws.com
webview-assets.aws-cloud9.ap-northeast-1.amazonaws.com
vfs.cloud9.ap-northeast-1.amazonaws.com
webview-assets.cloud9.ap-northeast-1.amazonaws.com
webview-assets.aws-cloud9.ap-northeast-2.amazonaws.com
vfs.cloud9.ap-northeast-2.amazonaws.com
webview-assets.cloud9.ap-northeast-2.amazonaws.com
webview-assets.aws-cloud9.ap-northeast-3.amazonaws.com
vfs.cloud9.ap-northeast-3.amazonaws.com
webview-assets.cloud9.ap-northeast-3.amazonaws.com
webview-assets.aws-cloud9.ap-south-1.amazonaws.com
vfs.cloud9.ap-south-1.amazonaws.com
webview-assets.cloud9.ap-south-1.amazonaws.com
webview-assets.aws-cloud9.ap-southeast-1.amazonaws.com
vfs.cloud9.ap-southeast-1.amazonaws.com
webview-assets.cloud9.ap-southeast-1.amazonaws.com
webview-assets.aws-cloud9.ap-southeast-2.amazonaws.com
vfs.cloud9.ap-southeast-2.amazonaws.com
webview-assets.cloud9.ap-southeast-2.amazonaws.com
webview-assets.aws-cloud9.ca-central-1.amazonaws.com
vfs.cloud9.ca-central-1.amazonaws.com
webview-assets.cloud9.ca-central-1.amazonaws.com
webview-assets.aws-cloud9.eu-central-1.amazonaws.com
vfs.cloud9.eu-central-1.amazonaws.com
webview-assets.cloud9.eu-central-1.amazonaws.com
webview-assets.aws-cloud9.eu-north-1.amazonaws.com
vfs.cloud9.eu-north-1.amazonaws.com
webview-assets.cloud9.eu-north-1.amazonaws.com
webview-assets.aws-cloud9.eu-south-1.amazonaws.com
vfs.cloud9.eu-south-1.amazonaws.com
webview-assets.cloud9.eu-south-1.amazonaws.com
webview-assets.aws-cloud9.eu-west-1.amazonaws.com
vfs.cloud9.eu-west-1.amazonaws.com
webview-assets.cloud9.eu-west-1.amazonaws.com
webview-assets.aws-cloud9.eu-west-2.amazonaws.com
vfs.cloud9.eu-west-2.amazonaws.com
webview-assets.cloud9.eu-west-2.amazonaws.com
webview-assets.aws-cloud9.eu-west-3.amazonaws.com
vfs.cloud9.eu-west-3.amazonaws.com
webview-assets.cloud9.eu-west-3.amazonaws.com
webview-assets.aws-cloud9.il-central-1.amazonaws.com
vfs.cloud9.il-central-1.amazonaws.com
webview-assets.aws-cloud9.me-south-1.amazonaws.com
vfs.cloud9.me-south-1.amazonaws.com
webview-assets.cloud9.me-south-1.amazonaws.com
webview-assets.aws-cloud9.sa-east-1.amazonaws.com
vfs.cloud9.sa-east-1.amazonaws.com
webview-assets.cloud9.sa-east-1.amazonaws.com
webview-assets.aws-cloud9.us-east-1.amazonaws.com
vfs.cloud9.us-east-1.amazonaws.com
webview-assets.cloud9.us-east-1.amazonaws.com
webview-assets.aws-cloud9.us-east-2.amazonaws.com
vfs.cloud9.us-east-2.amazonaws.com
webview-assets.cloud9.us-east-2.amazonaws.com
webview-assets.aws-cloud9.us-west-1.amazonaws.com
vfs.cloud9.us-west-1.amazonaws.com
webview-assets.cloud9.us-west-1.amazonaws.com
webview-assets.aws-cloud9.us-west-2.amazonaws.com
vfs.cloud9.us-west-2.amazonaws.com
webview-assets.cloud9.us-west-2.amazonaws.com
// AWS Directory Service
// Submitted by AWS Security
// Reference: a13203e8-42dc-4045-a0d2-2ee67bed1068
awsapps.com
// AWS Elastic Beanstalk
// Submitted by AWS Security
// Reference: e4e02a54-eaf9-4fe7-b662-39ccbc011a04
cn-north-1.eb.amazonaws.com.cn
cn-northwest-1.eb.amazonaws.com.cn
elasticbeanstalk.com
af-south-1.elasticbeanstalk.com
ap-east-1.elasticbeanstalk.com
ap-northeast-1.elasticbeanstalk.com
ap-northeast-2.elasticbeanstalk.com
ap-northeast-3.elasticbeanstalk.com
ap-south-1.elasticbeanstalk.com
ap-southeast-1.elasticbeanstalk.com
ap-southeast-2.elasticbeanstalk.com
ap-southeast-3.elasticbeanstalk.com
ap-southeast-5.elasticbeanstalk.com
ap-southeast-7.elasticbeanstalk.com
ca-central-1.elasticbeanstalk.com
eu-central-1.elasticbeanstalk.com
eu-north-1.elasticbeanstalk.com
eu-south-1.elasticbeanstalk.com
eu-south-2.elasticbeanstalk.com
eu-west-1.elasticbeanstalk.com
eu-west-2.elasticbeanstalk.com
eu-west-3.elasticbeanstalk.com
il-central-1.elasticbeanstalk.com
me-central-1.elasticbeanstalk.com
me-south-1.elasticbeanstalk.com
sa-east-1.elasticbeanstalk.com
us-east-1.elasticbeanstalk.com
us-east-2.elasticbeanstalk.com
us-gov-east-1.elasticbeanstalk.com
us-gov-west-1.elasticbeanstalk.com
us-west-1.elasticbeanstalk.com
us-west-2.elasticbeanstalk.com
// (AWS) Elastic Load Balancing
// Submitted by Luke Wells
// Reference: 12a3d528-1bac-4433-a359-a395867ffed2
*.elb.amazonaws.com.cn
*.elb.amazonaws.com
// AWS Global Accelerator
// Submitted by Daniel Massaguer
// Reference: d916759d-a08b-4241-b536-4db887383a6a
awsglobalaccelerator.com
// AWS Lambda Function URLs
// Submitted by AWS Security
// Reference: 57df74ca-0820-46a5-89ea-0f0d0c4714b7
lambda-url.af-south-1.on.aws
lambda-url.ap-east-1.on.aws
lambda-url.ap-northeast-1.on.aws
lambda-url.ap-northeast-2.on.aws
lambda-url.ap-northeast-3.on.aws
lambda-url.ap-south-1.on.aws
lambda-url.ap-southeast-1.on.aws
lambda-url.ap-southeast-2.on.aws
lambda-url.ap-southeast-3.on.aws
lambda-url.ca-central-1.on.aws
lambda-url.eu-central-1.on.aws
lambda-url.eu-north-1.on.aws
lambda-url.eu-south-1.on.aws
lambda-url.eu-west-1.on.aws
lambda-url.eu-west-2.on.aws
lambda-url.eu-west-3.on.aws
lambda-url.me-south-1.on.aws
lambda-url.sa-east-1.on.aws
lambda-url.us-east-1.on.aws
lambda-url.us-east-2.on.aws
lambda-url.us-west-1.on.aws
lambda-url.us-west-2.on.aws
// AWS re:Post Private
// Submitted by AWS Security
// Reference: 83385945-225f-416e-9aa0-ad0632bfdcee
*.private.repost.aws
// AWS Transfer Family web apps
// Submitted by AWS Security
// Reference: 9265cdd3-f017-42ab-98bb-08bf427d3fc9
transfer-webapp.af-south-1.on.aws
transfer-webapp.ap-east-1.on.aws
transfer-webapp.ap-northeast-1.on.aws
transfer-webapp.ap-northeast-2.on.aws
transfer-webapp.ap-northeast-3.on.aws
transfer-webapp.ap-south-1.on.aws
transfer-webapp.ap-south-2.on.aws
transfer-webapp.ap-southeast-1.on.aws
transfer-webapp.ap-southeast-2.on.aws
transfer-webapp.ap-southeast-3.on.aws
transfer-webapp.ap-southeast-4.on.aws
transfer-webapp.ap-southeast-5.on.aws
transfer-webapp.ap-southeast-7.on.aws
transfer-webapp.ca-central-1.on.aws
transfer-webapp.ca-west-1.on.aws
transfer-webapp.eu-central-1.on.aws
transfer-webapp.eu-central-2.on.aws
transfer-webapp.eu-north-1.on.aws
transfer-webapp.eu-south-1.on.aws
transfer-webapp.eu-south-2.on.aws
transfer-webapp.eu-west-1.on.aws
transfer-webapp.eu-west-2.on.aws
transfer-webapp.eu-west-3.on.aws
transfer-webapp.il-central-1.on.aws
transfer-webapp.me-central-1.on.aws
transfer-webapp.me-south-1.on.aws
transfer-webapp.mx-central-1.on.aws
transfer-webapp.sa-east-1.on.aws
transfer-webapp.us-east-1.on.aws
transfer-webapp.us-east-2.on.aws
transfer-webapp.us-gov-east-1.on.aws
transfer-webapp-fips.us-gov-east-1.on.aws
transfer-webapp.us-gov-west-1.on.aws
transfer-webapp-fips.us-gov-west-1.on.aws
transfer-webapp.us-west-1.on.aws
transfer-webapp.us-west-2.on.aws
transfer-webapp.cn-north-1.on.amazonwebservices.com.cn
transfer-webapp.cn-northwest-1.on.amazonwebservices.com.cn
// eero
// Submitted by Yue Kang
// Reference: 264afe70-f62c-4c02-8ab9-b5281ed24461
eero.online
eero-stage.online
// concludes Amazon
// Anomaly : https://opencode.ai
// Submitted by Dax Raad
opentunnel.xyz
// Antagonist B.V. : https://www.antagonist.nl/
// Submitted by Sander Hoentjen
antagonist.cloud
// Anthropic : https://www.anthropic.com/
// Submitted by Sid Bidasaria
claude.app
// Apigee : https://apigee.com/
// Submitted by Apigee Security Team
apigee.io
// Apis Networks : https://apisnetworks.com
// Submitted by Matt Saladna
panel.dev
// Apphud : https://apphud.com
// Submitted by Alexander Selivanov
siiites.com
// Apple : https://www.apple.com
// Submitted by Apple DNS
int.apple
*.cloud.int.apple
*.r.cloud.int.apple
*.ap-north-1.r.cloud.int.apple
*.ap-south-1.r.cloud.int.apple
*.ap-south-2.r.cloud.int.apple
*.eu-central-1.r.cloud.int.apple
*.eu-north-1.r.cloud.int.apple
*.us-central-1.r.cloud.int.apple
*.us-central-2.r.cloud.int.apple
*.us-east-1.r.cloud.int.apple
*.us-east-2.r.cloud.int.apple
*.us-west-1.r.cloud.int.apple
*.us-west-2.r.cloud.int.apple
*.us-west-3.r.cloud.int.apple
// Appspace : https://www.appspace.com
// Submitted by Appspace Security Team
appspacehosted.com
appspaceusercontent.com
// Appudo UG (haftungsbeschränkt) : https://www.appudo.com
// Submitted by Alexander Hochbaum
appudo.net
// Appwrite : https://appwrite.io
// Submitted by Steven Nguyen
appwrite.global
appwrite.network
*.appwrite.run
// Aptible : https://www.aptible.com/
// Submitted by Thomas Orozco
on-aptible.com
// Aquapal : https://aquapal.net/
// Submitted by Aki Ueno
f5.si
// ArvanCloud EdgeCompute
// Submitted by ArvanCloud CDN
arvanedge.ir
// ASEINet : https://www.aseinet.com/
// Submitted by Asei SEKIGUCHI
user.aseinet.ne.jp
gv.vc
d.gv.vc
// Asociación Amigos de la Informática "Euskalamiga" : http://encounter.eus/
// Submitted by Hector Martin
user.party.eus
// Association potager.org : https://potager.org/
// Submitted by Lunar
pimienta.org
poivron.org
potager.org
sweetpepper.org
// ASUSTOR Inc. : http://www.asustor.com
// Submitted by Vincent Tseng
myasustor.com
// Atlassian : https://atlassian.com
// Submitted by Benjamin McAlary
*.atlassian-3p.com
*.atlassian-3p-us-gov-mod.com
*.atlassian-isolated-3p.com
cdn.prod.atlassian-dev.net
// AVM : https://avm.de
// Submitted by Andreas Weise
myfritz.link
myfritz.net
// AW AdvisorWebsites.com Software Inc : https://advisorwebsites.com
// Submitted by James Kennedy
*.awdev.ca
*.advisor.ws
// AZ.pl sp. z.o.o : https://az.pl
// Submitted by Krzysztof Wolski
ecommerce-shop.pl
// b-data GmbH : https://www.b-data.io
// Submitted by Olivier Benz
b-data.io
// Balena : https://www.balena.io
// Submitted by Petros Angelatos
balena-devices.com
// BASE, Inc. : https://binc.jp
// Submitted by Yuya NAGASAWA
base.ec
official.ec
buyshop.jp
fashionstore.jp
handcrafted.jp
kawaiishop.jp
supersale.jp
theshop.jp
shopselect.net
base.shop
// BeagleBoard.org Foundation : https://beagleboard.org
// Submitted by Jason Kridner
beagleboard.io
// Bear Blog : https://bearblog.dev
// Submitted by Herman Martinus
bearblog.dev
// Beget LLC : https://beget.com
// Submitted by Lev Nekrasov & Nikita Radchenko
*.beget.app
*.begetcdn.cloud
// Besties : https://besties.house
// Submitted by Hazel Cora
pages.gay
// BinaryLane : http://www.binarylane.com
// Submitted by Nathan O'Sullivan
bnr.la
// Bitbucket : http://bitbucket.org
// Submitted by Andy Ortlieb
bitbucket.io
// Blackbaud, Inc. : https://www.blackbaud.com
// Submitted by Paul Crowder
blackbaudcdn.net
// Blatech : http://www.blatech.net
// Submitted by Luke Bratch
of.je
// Block, Inc. : https://block.xyz
// Submitted by Jonathan Boice
square.site
// Blue Bite, LLC : https://bluebite.com
// Submitted by Joshua Weiss
bluebite.io
// Boomla : https://boomla.com
// Submitted by Tibor Halter
boomla.net
// Boutir : https://www.boutir.com
// Submitted by Eric Ng Ka Ka
boutir.com
// Boxfuse : https://boxfuse.com
// Submitted by Axel Fontaine
boxfuse.io
// bplaced : https://www.bplaced.net/
// Submitted by Miroslav Bozic
square7.ch
bplaced.com
bplaced.de
square7.de
bplaced.net
square7.net
// Brave : https://brave.com
// Submitted by Andrea Brancaleoni
brave.app
*.s.brave.app
brave.dev
*.s.brave.dev
brave.io
*.s.brave.io
// Brendly : https://brendly.rs
// Submitted by Dusan Radovanovic
shop.brendly.ba
shop.brendly.hr
shop.brendly.rs
// BrowserSafetyMark
// Submitted by Dave Tharp
browsersafetymark.io
// BRS Media : https://brsmedia.com/
// Submitted by Gavin Brown
radio.am
radio.fm
// Bubble : https://bubble.io/
// Submitted by Merlin Zhao
cdn.bubble.io
bubbleapps.io
// bwCloud-OS : https://bwcloud-os.de/
// Submitted by Klara Mall
*.bwcloud-os-instance.de
// Bytemark Hosting : https://www.bytemark.co.uk
// Submitted by Paul Cammish
uk0.bigv.io
dh.bytemark.co.uk
vm.bytemark.co.uk
// Caf.js Labs LLC : https://www.cafjs.com
// Submitted by Antonio Lain
cafjs.com
// Canva Pty Ltd : https://canva.com/
// Submitted by Joel Aquilina
canva-apps.cn
my.canvasite.cn
khsj.cn
canva-apps.com
canva-hosted-embed.com
canvacode.com
rice-labs.com
canva.link
canva.run
my.canva.site
// Carrd : https://carrd.co
// Submitted by AJ
drr.ac
uwu.ai
carrd.co
crd.co
ju.mp
// CDDO : https://www.gov.uk/guidance/get-an-api-domain-on-govuk
// Submitted by Jamie Tanna
api.gov.uk
// CDN77.com : http://www.cdn77.com
// Submitted by Jan Krpes
cdn77-storage.com
rsc.contentproxy9.cz
r.cdn77.net
cdn77-ssl.net
c.cdn77.org
rsc.cdn77.org
ssl.origin.cdn77-secure.org
// CentralNic : https://teaminternet.com/
// Submitted by registry
za.bz
br.com
cn.com
de.com
eu.com
jpn.com
mex.com
ru.com
sa.com
uk.com
us.com
za.com
com.de
gb.net
hu.net
jp.net
se.net
uk.net
ae.org
com.se
// Cityhost LLC : https://cityhost.ua
// Submitted by Maksym Rivtin
cx.ua
// Civilized Discourse Construction Kit, Inc. : https://www.discourse.org/
// Submitted by Rishabh Nambiar, Michael Brown, Rafael dos Santos Silva
discourse.diy
discourse.group
discourse.team
// Clerk : https://www.clerk.dev
// Submitted by Colin Sidoti
clerk.app
clerkstage.app
*.lcl.dev
*.lclstage.dev
*.stg.dev
*.stgstage.dev
// Clever Cloud : https://www.clever-cloud.com/
// Submitted by Quentin Adam
cleverapps.cc
*.services.clever-cloud.com
cleverapps.io
cleverapps.tech
// ClickRising : https://clickrising.com/
// Submitted by Umut Gumeli
clickrising.net
// Cloud DNS Ltd : http://www.cloudns.net
// Submitted by Aleksander Hristov & Boyan Peychev
cloudns.asia
cloudns.be
cloud-ip.biz
cloudns.biz
cloud-ip.cc
cloudns.cc
cloudns.ch
cloudns.cl
cloudns.club
abrdns.com
dnsabr.com
ip-ddns.com
cloudns.cx
cloudns.eu
cloudns.in
cloudns.info
ddns-ip.net
dns-cloud.net
dns-dynamic.net
cloudns.nz
cloudns.org
ip-dynamic.org
cloudns.ph
cloudns.pro
cloudns.pw
cloudns.us
// Cloud66 : https://www.cloud66.com/
// Submitted by Khash Sajadi
c66.me
cloud66.ws
// CloudAccess.net : https://www.cloudaccess.net/
// Submitted by Pawel Panek
jdevcloud.com
wpdevcloud.com
cloudaccess.host
freesite.host
cloudaccess.net
// Cloudbees, Inc. : https://www.cloudbees.com/
// Submitted by Mohideen Shajith
cloudbeesusercontent.io
// Cloudera, Inc. : https://www.cloudera.com/
// Submitted by Kedarnath Waikar
*.cloudera.site
// Cloudflare, Inc. : https://www.cloudflare.com/
// Submitted by Cloudflare Team
cloudflare.app
cf-ipfs.com
cloudflare-ipfs.com
trycloudflare.com
pages.dev
r2.dev
workers.dev
cloudflare.net
cdn.cloudflare.net
cdn.cloudflareanycast.net
cdn.cloudflarecn.net
cdn.cloudflareglobal.net
// cloudscale.ch AG : https://www.cloudscale.ch/
// Submitted by Gaudenz Steinlin
cust.cloudscale.ch
objects.lpg.cloudscale.ch
objects.rma.cloudscale.ch
lpg.objectstorage.ch
rma.objectstorage.ch
// Clovyr : https://clovyr.io
// Submitted by Patrick Nielsen
wnext.app
// CNPY : https://cnpy.gdn
// Submitted by Angelo Gladding
cnpy.gdn
// Co & Co : https://co-co.nl/
// Submitted by Govert Versluis
*.otap.co
// co.ca : http://registry.co.ca/
co.ca
// co.com Registry, LLC : https://registry.co.com
// Submitted by Gavin Brown
co.com
// Codeberg e. V. : https://codeberg.org
// Submitted by Moritz Marquardt
codeberg.page
// CodeSandbox B.V. : https://codesandbox.io
// Submitted by Ives van Hoorne
csb.app
preview.csb.app
// CoDNS B.V.
co.nl
co.no
// Cognition AI, Inc. : https://cognition.ai
// Submitted by Philip Papurt
*.devinapps.com
// Combell.com : https://www.combell.com
// Submitted by Combell Team
webhosting.be
prvw.eu
hosting-cluster.nl
// Contentful GmbH : https://www.contentful.com
// Submitted by Contentful Developer Experience Team
ctfcloud.net
// Convex : https://convex.dev/
// Submitted by James Cowling
convex.app
convex.cloud
eu-west-1.convex.cloud
us-east-1.convex.cloud
convex.site
eu-west-1.convex.site
us-east-1.convex.site
// Coordination Center for TLD RU and XN--P1AI : https://cctld.ru/en/domains/domens_ru/reserved/
// Submitted by George Georgievsky
ac.ru
edu.ru
gov.ru
int.ru
mil.ru
// CoreSpeed, Inc. : https://corespeed.io
// Submitted by CoreSpeed Team
corespeed.app
// COSIMO GmbH : http://www.cosimo.de
// Submitted by Rene Marticke
dyn.cosidns.de
dnsupdater.de
dynamisches-dns.de
internet-dns.de
l-o-g-i-n.de
dynamic-dns.info
feste-ip.net
knx-server.net
static-access.net
// Craft Docs Ltd : https://www.craft.do/
// Submitted by Zsombor Fuszenecker
craft.me
// Craynic, s.r.o. : http://www.craynic.com/
// Submitted by Ales Krajnik
realm.cz
// Cryptonomic : https://cryptonomic.net/
// Submitted by Andrew Cady
*.cryptonomic.net
// cyber_Folks S.A. : https://cyberfolks.pl
// Submitted by Bartlomiej Kida
cfolks.pl
// cyon GmbH : https://www.cyon.ch/
// Submitted by Dominic Luechinger
cyon.link
cyon.site
// Dansk.net : http://www.dansk.net/
// Submitted by Anani Voule
biz.dk
co.dk
firm.dk
reg.dk
store.dk
// dappnode.io : https://dappnode.io/
// Submitted by Abel Boldu / DAppNode Team
dyndns.dappnode.io
// Dark, Inc. : https://darklang.com
// Submitted by Paul Biggar
builtwithdark.com
darklang.io
// DataDetect, LLC. : https://datadetect.com
// Submitted by Andrew Banchich
demo.datadetect.com
instance.datadetect.com
// Datawire, Inc : https://www.datawire.io
// Submitted by Richard Li
edgestack.me
// Datto, Inc. : https://www.datto.com/
// Submitted by Philipp Heckel
dattolocal.com
dattorelay.com
dattoweb.com
mydatto.com
dattolocal.net
mydatto.net
// ddnss.de : https://www.ddnss.de/
// Submitted by Robert Niedziela
ddnss.de
dyn.ddnss.de
dyndns.ddnss.de
dyn-ip24.de
dyndns1.de
home-webserver.de
dyn.home-webserver.de
myhome-server.de
ddnss.org
// Debian : https://www.debian.org/
// Submitted by Peter Palfrader / Debian Sysadmin Team
debian.net
// Definima : http://www.definima.com/
// Submitted by Maxence Bitterli
definima.io
definima.net
// Deno Land Inc : https://deno.com/
// Submitted by Luca Casonato
deno.dev
deno-staging.dev
deno.net
sandbox.deno.net
// DeployAgent : https://deployagent.com
// Submitted by Danny
deployagent.com
piebox.site
deployagent.space
// deSEC : https://desec.io/
// Submitted by Peter Thomassen
dedyn.io
// Deta : https://www.deta.sh/
// Submitted by Aavash Shrestha
deta.app
deta.dev
// Deuxfleurs : https://deuxfleurs.fr
// Submitted by Aeddis Desauw
deuxfleurs.eu
deuxfleurs.page
// Developed Methods LLC : https://methods.dev
// Submitted by Patrick Lorio
*.at.ply.gg
d6.ply.gg
joinmc.link
playit.plus
*.at.playit.plus
with.playit.plus
// Dfinity Foundation: https://dfinity.org/
// Submitted by Dfinity Team
icp0.io
*.raw.icp0.io
icp1.io
*.raw.icp1.io
*.icp.net
caffeine.site
caffeine.xyz
// dhosting.pl Sp. z o.o. : https://dhosting.pl/
// Submitted by Szczepan Redzioch
mybox.company
intouch.email
mybox.me
mybox.page
dfirma.pl
dkonto.pl
you2.pl
// DigitalOcean App Platform : https://www.digitalocean.com/products/app-platform/
// Submitted by Braxton Huggins
ondigitalocean.app
// DigitalOcean Spaces : https://www.digitalocean.com/products/spaces/
// Submitted by Robin H. Johnson