+ hEcsa0t$^RIHt^RIt^RIt^RIHtHt^RIH t ^RI H t H t ^RI Ht^RIHtHt^RIHtHtHtHt^R IHt^R IHt^R IHtHtHtHt^R I H!t!^R I"H#t#H$t$^RI%H&t&H't']PP!])4t*] !RRR7!RR]#44t+] !RRR7!RR]#44t,] !RRR7!RR]#44t-] !RRR7!RR]#44t.] !RRR7!RR]#44t/] !RRR7!RR]#44t0] !RRR7!RR]#44t1] !RRR7!R R!]#44t2] !RRR7!R"R#]#44t3] !RRR7!R$R%]#44t4]!R&R']5]44t6] !RRR7!R(R)]#44t7] !RRR7!R*R+]#44t8] !RRR7!R,R-]#44t9] !RRR7!R.R/]#44t:] !RRR7!R0R1]#44t;]]:.]<3,t=]]:]]>,.]<3,t?R2R3lt@R4R5ltA] !R64tBR7]CR6&!R8R9]4tDR:R;ltER#)]tRt^ct$R]R&RtR]R&RtR]R&RtR#)PatternAccuracyDescriptorrZmin_complexityNr.r/r0rr1rr"r#r:r:cs"K"!%NJ%r"r:csP]tRt^jt$RtR]R&RtR]R&RtR]R&RtR]R &R t R#) VerificationMethodDescriptorN str | Noneuser_verification_methodzCodeAccuracyDescriptor | Noneca_descz"BiometricAccuracyDescriptor | Noneba_descz PatternAccuracyDescriptor | Nonepa_descr) rrrrr=r r>r?r@r!rr"r#r;r;js.+/j/-1G *126G /604G -4r"r;cs6]tRt^rt$R]R&R]R&R]R&RtR#)RgbPaletteEntryrrZgbrNrrr"r#rArArs F F Fr"rAcsl]tRt^yt$R]R&R]R&R]R&R]R&R]R&R]R&R]R&R tR ]R &R tR #) #DisplayPngCharacteristicsDescriptorrZwidthZheightZ bit_depthZ color_typeZ compressionZfilterZ interlaceNz Sequence[RgbPaletteEntry] | Noneplter)rrrrr rEr!rr"r#rDrDys1 J KNO KN-1D *1r"rDcs]tRt^t$]!]!RR7R7tR]R&]!]!RR7R7tR]R&R]R&R]R &R]R &]!]!R R7R7t R]R &R t R#)EcdaaTrustAnchorZXr3r5r'xZYycZsxZsyZG1Curveg1_curverN) rrrrrr9rHr rIrKr!rr"r#rFrFsK DcN +As+ DcN +As+ F G G4Y#78Hc8r"rFcsV]tRt^tRtRtRtRtRtRt Rt Rt R t R t R tR tR tRtRtRtRtR#)AuthenticatorStatuszStatus of an Authenitcator.NOT_FIDO_CERTIFIEDFIDO_CERTIFIEDUSER_VERIFICATION_BYPASSATTESTATION_KEY_COMPROMISEUSER_KEY_REMOTE_COMPROMISEUSER_KEY_PHYSICAL_COMPROMISEUPDATE_AVAILABLEREVOKEDSELF_ASSERTION_SUBMITTEDFIDO_CERTIFIED_L1FIDO_CERTIFIED_L1plusFIDO_CERTIFIED_L2FIDO_CERTIFIED_L2plusFIDO_CERTIFIED_L3FIDO_CERTIFIED_L3plusrN)rrrr__doc__rMrNrOrPrQrRrSrTrUrVrWrXrYrZr[r!rr"r#rLrLs]%-%N9!=!=#A )G9+3+3+3r"rLcs]tRt^t$R]R&]!]!]PRR7RR7t R]R&Rt R ]R &]!]!] R R7RR7t R ]R &Rt R]R&RtR]R&RtR]R&RtR]R&RtR]R&RtR#) StatusReportrLstatusc "VP4#NZ isoformatrH&r#StatusReport.  r"Z deserialize serializeNr5r4z date | Noner(r.authenticator_versionc s4\V4P4#r`rZdecoderbrcr#rdres1ATATAVr" bytes | None certificater<urlr)r*r+r,r)rrrrr rr9r fromisoformatr(rjrrmrnr)r*r+r,r!rr"r#r]r]s "'**-  #NK)-:, %)7VW!KC+/j/%) )/3 *359& 9r"r]csh]tRt^t$]!]!RR7R7tR]R&R]R&RtR]R &Rt R ]R &R t R#) ExtensionDescriptorfail_if_unknownr3rGboolr'ZidNr.tagr<datar) rrrrrr9rqr rsrtr!rr"r#rprps0!45F+GHOTH GCD*r"rpcsB]tRt^t$R]R&R]R&R]R&R]R&R]R &]!]!R R 7R 7tR ]R&R]R&R]R&R]R&R]R&]!]!RRR7R 7tR]R&Rt R]R&Rt R]R&]!]!] PRR7RR7t R]R&]!]!R R!R7RR7tR"]R#&RtR$]R%&RtR]R&&RtR']R(&RtR']R)&RtR*]R+&RtR*]R,&RtR-]R.&RtR]R/&RtR]R0&]!]!R1R27RR7tR3]R4&RtR5]R6&RtR]R7&RtR8]R9&RtR:]R;&Rs,S,QSrr-Br!d1gr-BS,Q-B,Qs2- 22)rhrGz0Sequence[Sequence[VerificationMethodDescriptor]]user_verification_detailsZkey_protectionZmatcher_protectionZattachment_hintZ tc_displayc sBVUu.uFp\V4NK up#uupir`)rrwrH& r#rdrxs"#="QIaL"#=#=sc s^VUu.uFp\V4P4NK up#uupir`rkrzr{r#rdrxs#!DA)A,"5"5"7!D!Ds"*rgSequence[bytes]attestation_root_certificatesNr< legal_headeraaidc \V4#r`r'rbrcr#rdrxAr"ri Aaguid | Noneaaguidc VVUu.uFp\PV4NK up#uupir`r%fromhexrzr{r#rdrxb#AbEMM!$4b#A#A&c JVUu.uFqP4NK up#uupir`Zhexrzr{r#rdrx2!62a%%'2!6!6 Sequence[bytes] | None'attestation_certificate_key_identifierszMapping[str, str] | Nonealternative_descriptionsprotocol_familyzSequence[str] | Noneauthentication_algorithmspublic_key_alg_and_encodingsz bool | Noneis_key_restricted#is_fresh_user_verification_requiredr.crypto_strength operating_envtc_display_content_typeZtcDisplayPNGCharacteristicsr3z4Sequence[DisplayPngCharacteristicsDescriptor] | Nonetc_display_png_characteristicsz!Sequence[EcdaaTrustAnchor] | Noneecdaa_trust_anchorsiconz$Sequence[ExtensionDescriptor] | Nonesupported_extensionszMapping[str, Any] | Noneauthenticator_get_infor)rrrrr rr9ryr}r~rrparserrrrrrrrrrrrrrrrr!rr"r#rurus K $$RW QRSO"!%%""5:=D 6!? $L*#D*! &  FMGLA6  G+-C:>6="&OZ&6:3:9= "6=%){)7;';"&OZ& $M:$*.Z. 89 #< >B:AD*AE>E7;4;r"rucst]tRt^t$R]R&]!]!]PRR7R7t R]R&Rt R ]R &]!]!] PR R7RR 7t R ]R&]!]!RRR7RR 7tR]R&RtR]R&RtR]R&]!]!RR7RR 7tR ]R&]!]!]P&RR7RR 7tR]R&RtR#)MetadataBlobPayloadEntryzSequence[StatusReport]status_reportsc r_r`rarbrcr#rd!MetadataBlobPayloadEntry.rfr"rgrGrtime_of_last_status_changeNr<rc rr`rrbrcr#rdrrr"rirrc rr`rrzr{r#rdrrrc rr`rrzr{r#rdrrrrrzMetadataStatement | Nonemetadata_statementz&Sequence[BiometricStatusReport] | Nonebiometric_status_reportsZ rogueListURLr3rogue_list_urlc r_r`rrbrcr#rdrs r"rlrogue_list_hashr)rrrrr rr9rrorrrrrrrrrr%rrr!rr"r#rrs**',**- ( D*! &  FMGLA6  G+-C4807GKDK!&.0ISW!XNJX$) '  %O\r"rcsx]tRtRt$R]R&R]R&]!]!]PRR7R7t R ]R &R ]R &R t R#)MetadataBlobPayloadir'r~rZnoc r_r`rarbrcr#rdZMetadataBlobPayload.&rfr"rgrGr next_updatez"Sequence[MetadataBlobPayloadEntry]entriesrN) rrrrr rr9rrorr!rr"r#rrs: G**- K 0/r"rc V^8dQhRRRR/#)entryrreturnrrrZformat"r# __annotate__r0s2tr"cs\;QJd0RVP4F'gK R'*# R'*#!RVP44'*#)zFilters out any revoked metadata entry. This filter will remove any metadata entry which has a status_report with the REVOKED status. c3sZ"TF!qP\P8HxK# R#5ir`)r^rLrT).0rBr{r# Z!filter_revoked..6s"9MA'///9Ms)+TF)Zanyr)rrcr#filter_revokedr0sZ s9>9M9Mss s s9>9M9M r"c$V^8dQhRRRRRR/#)rrrcertificate_chainr|rrrrrrr#rr;s$   # 8G   r"csVPF8pVP\P8XgK$VPV9gK7R# R#)zDenies any attestation that has a compromised attestation key. This filter checks the status reports of a metadata entry and ensures the attestation isn't signed by a key which is marked as compromised. FT)rr^rLrPrm)rrrBs&& r#"filter_attestation_key_compromisedr;s< ! ! 88*EE E}} 11" r" _last_entryz+ContextVar[MetadataBlobPayloadEntry | None]csfa]tRtRtRt]]R3RV3RllltRRltRR lt R t R R lt R t V;t #)MdsAttestationVerifieriMaMDS3 implementation of an AttestationVerifier. The entry_filter is an optional predicate used to filter which metadata entries to include in the lookup for verification. By default, a filter that removes any entries that have a status report indicating the authenticator is REVOKED is used. See: filter_revoked The attestation_filter is an optional predicate used to filter metadata entries while performing attestation validation, and may take into account the Authenticators attestation trust_chain. By default, a filter that will fail any verification that has a trust_chain where one of the certificates is marked as compromised by the metadata statement is used. See: filter_attestation_key_compromised NOTE: The attestation_filter is not used when calling find_entry_by_aaguid nor find_entry_by_chain as no attestation is being verified! Setting either filter (including setting it to None) will replace it, removing the default behavior. :param blob: The MetadataBlobPayload to query for device metadata. :param entry_filter: An optional filter to exclude entries from lookup. :param attestation_filter: An optional filter to fail verification for a given attestation. :param attestation_types: A list of Attestation types to support. Ncs(V^8dQhRRRRRRRR/#) rblobr entry_filterzEntryFilter | Noneattestation_filterzLookupFilter | NonervzSequence[Attestation] | Nonerrrr#r#MdsAttestationVerifier.__annotate__is2  ! ) 0  8  r"c s<\SV`V4T;'gRVnV'd,VPUu.uFqR!V4'gKVNK upM VPpVUu/uF#qUP'gKVPVbK% upVnVUUu/uF"pVP ;'g.FpWubK K$ uppVnR#uupiuupiuuppi)csR#)Tr)ZarC&&r#rdZ1MdsAttestationVerifier.__init__..rsr"N)Zsuper__init___attestation_filterrr _aaguid_tabler _ski_table) selfrrrrvZerski __class__s &&&&& r#rZMdsAttestationVerifier.__init__is *+#5$ $    8 1 QQQ 8  4;G7ahhkahhk7G @@FFBF FF   9H s#C C&C>CC4Ccr)rrrrMetadataBlobPayloadEntry | Nonerrrr#rrs..6.6U.r"c s8VPPV4#)zFind an entry by AAGUID. Returns a MetadataBlobPayloadEntry with a matching aaguid field, if found. This method does not take the attestation_filter into account. )rget)rrrr#find_entry_by_aaguidZ+MdsAttestationVerifier.find_entry_by_aaguids !!%%f--r"cr)rrr|rrrrrr#rrs!0 (r"c sVF~p\P!V\44p\PP VP 44P pW@P9gKkVPV,u# R#)zFind an entry by trust chain. Returns a MetadataBlobPayloadEntry containing an attestationCertificateKeyIdentifier which matches one of the certificates in the given chain, if found. This method does not take the attestation_filter into account. N)r load_der_x509_certificaterZSubjectKeyIdentifierZfrom_public_key public_keyZdigestr)rrZderZcertrs&& r#find_entry_by_chainZ*MdsAttestationVerifier.find_entry_by_chainsd%C11#7HID++;;DOO   0."%N%%r"rcr)rrr% trust_rootrlrrrrrr#rrs"22U2 29L2r"cs:VPR^4wr#\V4pRVPR44wrVVeVPR.4Uu.uFp\ V4NK ppW., p\ V4\ P!V^,\44p \P!VR,4PV P44p V PW$4M\PR4\ P#V4#uupi)aParse a FIDO MDS3 blob and verifies its signature. See https://fidoalliance.org/metadata/ for details on obtaining the blob, as well as the CA certificate used to sign it. The resulting MetadataBlobPayload can be used to lookup metadata entries for specific Authenticators, or used with the MdsAttestationVerifier to verify that the attestation from a WebAuthn registration is valid and included in the metadata blob. NOTE: If trust_root is None, the signature of the blob will NOT be verified! s.c3s`"TF$p\P!\V44xK& R#5ir`)jsonZloadsr)rrHr{r#rZparse_blob..s#R>Qtzz."344>Qs,.Zx5cZalgz?Parsing MDS blob without trust anchor, CONTENT IS NOT VERIFIED!)ZrsplitrZsplitrrrr rrrZfor_nameZfrom_cryptography_keyrZverifyrZwarnrZ from_dict) rrZmessageZ signature_b64Z signatureZheaderZpayloadrJZchainZleafrs && r# parse_blobrs"[[q1G}-IRgmmD>QROF'-zz%'<='sD)F__conditional_annotations__Z __future__rrrZbase64rrZ contextvarsrZ dataclassesrrZdatetimerZenumrrZtypingr r r r Z cryptographyr Zcryptography.hazmat.backendsrZ attestationrrrrZcoserZutilsrrZwebauthnrrZ getLoggerrrrr$r&r-r2r:r;rArDrFr'rLr]rprurrrrZ EntryFilterr%Z LookupFilterrrrr rr)rrr#rs8#" '"(338 2/   8 $ eD!o"  eD!_"  eD!,O,", eD!&_&"& eD! &/ &" & eD!&&"&  eD!5?5"5 eD! o "  eD!2/2"2 eD!99"94#t44( eD!:?:":* eD!/" eD!5<5<"5