Supported authentication extensions

In accordance with the WebAuthn extensions specifications, the Thales Mobile FIDO SDK directly supports the usage of several authentication extensions during credential request.

The following extensions are supported:

• Transaction signing extension

• Challenge verification extension

Transaction signing extension

During authentication, Mobile FIDO SDK supports the usage of a transaction signing extension to display transaction details for end user verification. A FIDO2 server that supports the thalesgroup_txn_ext_v1 can support this extension.

In this extension, custom transaction details can be passed to the SDK, which are then relayed to the application via a callback. These details can be displayed to the end users.

The following content can be added to the extensions dictionary key during credential request.

{
  ...,
  ...,
  "extensions": {
      "thalesgroup_txn_ext_v1" : {
      "txnDigest" : "J-F-jAiNikix1hkji1zJtXUSMomtfIyTPI_8V_UqPSY",
      "nonce" : "AAABfSL8fMjQEa1JzgNNUKoToGS90Go8",
      "txnDetails" : [
        {
          "name" : "soybeans"
        },
        {
          "px" : "10.32"
        },
        {
          "qty" : "230"
        }
      ],
      "challengeDerivationScheme" : 1
    }
  }
}

When a credential creation options request contains this extension, the Mobile FIDO SDK invokes the following callbacks to allow the end user to verify these details:

public class SampleFido2UiCallback extends Fido2UiCallback {
    @Override
    public void showTransactionDetails(Map<String, String> transactionDetails, TransactionDetailsCallback callback) {
        // Display the JSON transaction details content to the end user

        // Proceed OR
        callback.onProceed();

        // Cancel
        callback.cancel();
    }
}

class SampleUiDelegate: TGFFido2UiDelegate {
    public func showTransactionDetails(_ transactionDetails: [String : String], proceedHandler: @escaping () -> Void, cancelHandler: @escaping () -> Void) {
        // Display the JSON transaction details content to the end user

        // Proceed OR
        proceedHandler()

        // Cancel
        cancelHandler()
    }
}

For more details on the format of this extension, see the FIDO2 server documentations.

Challenge verification extension

The Mobile FIDO SDK supports this extension to help prevent challenge flooding attacks, where a malicious actor rapidly sends multiple credential creation or authentication requests. A FIDO2 Server that supports the thalesgroup_chl_tkn_ext_v1 can support this extension.

The format of this extension is opaque and the Mobile FIDO SDK simply matches the clientExtensionResults output with the content of the request.