src/Server.php
public function register(RegisterResponse $resp): RegistrationInterface
    {
        if (!$this->registerRequest) {
            throw new BadMethodCallException(
                'Before calling register(), provide a RegisterRequest '.
                'with setRegisterRequest()'
            );
        }
        $this->validateChallenge($resp->getClientData(), $this->registerRequest);
        // Check the Application Parameter?

        // https://fidoalliance.org/specs/fido-u2f-v1.0-nfc-bt-amendment-20150514/fido-u2f-raw-message-formats.html#registration-response-message-success
        $signed_data = sprintf(
            '%s%s%s%s%s',
            chr(0),
            $this->registerRequest->getApplicationParameter(),
            $resp->getClientData()->getChallengeParameter(),
            $resp->getKeyHandleBinary(),
            $resp->getPublicKeyBinary()
        );

        $pem = $resp->getAttestationCertificatePem();
        if ($this->verifyCA) {
            $resp->verifyIssuerAgainstTrustedCAs($this->trustedCAs);
        }

        // Signature must validate against device issuer's public key
        $sig_check = openssl_verify(
            $signed_data,
            $resp->getSignature(),
            $pem,
            \OPENSSL_ALGO_SHA256
        );
        if ($sig_check !== 1) {
            throw new SE(SE::SIGNATURE_INVALID);
        }

        return (new Registration())
            ->setAttestationCertificate($resp->getAttestationCertificateBinary())
            ->setCounter(0) // The response does not include this
            ->setKeyHandle($resp->getKeyHandleBinary())
            ->setPublicKey($resp->getPublicKeyBinary());
    }
public function register(RegisterResponse $resp): RegistrationInterface
    {
        if (!$this->registerRequest) {
            throw new BadMethodCallException(
                'Before calling register(), provide a RegisterRequest '.
                'with setRegisterRequest()'
            );
        }
        $this->validateChallenge($resp->getClientData(), $this->registerRequest);
        // Check the Application Parameter?

        // https://fidoalliance.org/specs/fido-u2f-v1.0-nfc-bt-amendment-20150514/fido-u2f-raw-message-formats.html#registration-response-message-success
        $signed_data = sprintf(
            '%s%s%s%s%s',
            chr(0),
            $this->registerRequest->getApplicationParameter(),
            $resp->getClientData()->getChallengeParameter(),
            $resp->getKeyHandleBinary(),
            $resp->getPublicKeyBinary()
        );

        $pem = $resp->getAttestationCertificatePem();
        if ($this->verifyCA) {
            $resp->verifyIssuerAgainstTrustedCAs($this->trustedCAs);
        }

        // Signature must validate against device issuer's public key
        $sig_check = openssl_verify(
            $signed_data,
            $resp->getSignature(),
            $pem,
            \OPENSSL_ALGO_SHA256
        );
        if ($sig_check !== 1) {
            throw new SE(SE::SIGNATURE_INVALID);
        }

        return (new Registration())
            ->setAttestationCertificate($resp->getAttestationCertificateBinary())
            ->setCounter(0) // The response does not include this
            ->setKeyHandle($resp->getKeyHandleBinary())
            ->setPublicKey($resp->getPublicKeyBinary());
    }
public function register ( RegisterResponse $ resp ) : RegistrationInterface { if ( ! $ this -> registerRequest ) { throw new BadMethodCallException ( 'Before calling register(), provide a RegisterRequest ' . 'with setRegisterRequest()' ) ; } $ this -> validateChallenge ( $ resp -> getClientData ( ) , $ this -> registerRequest ) ; // Check the Application Parameter? // https://fidoalliance.org/specs/fido-u2f-v1.0-nfc-bt-amendment-20150514/fido-u2f-raw-message-formats.html#registration-response-message-success $ signed_data = sprintf ( '%s%s%s%s%s' , chr ( 0 ) , $ this -> registerRequest -> getApplicationParameter ( ) , $ resp -> getClientData ( ) -> getChallengeParameter ( ) , $ resp -> getKeyHandleBinary ( ) , $ resp -> getPublicKeyBinary ( ) ) ; $ pem = $ resp -> getAttestationCertificatePem ( ) ; if ( $ this -> verifyCA ) { $ resp -> verifyIssuerAgainstTrustedCAs ( $ this -> trustedCAs ) ; } // Signature must validate against device issuer's public key $ sig_check = openssl_verify ( $ signed_data , $ resp -> getSignature ( ) , $ pem , \ OPENSSL_ALGO_SHA256 ) ; if ( $ sig_check !== 1 ) { throw new SE ( SE :: SIGNATURE_INVALID ) ; } return ( new Registration ( ) ) -> setAttestationCertificate ( $ resp -> getAttestationCertificateBinary ( ) ) -> setCounter ( 0 ) // The response does not include this -> setKeyHandle ( $ resp -> getKeyHandleBinary ( ) ) -> setPublicKey ( $ resp -> getPublicKeyBinary ( ) ) ; }
This method authenticates a RegisterResponse against its corresponding
RegisterRequest by verifying the certificate and signature. If valid, it
returns a registration; if not, a SE will be thrown and attempt to
register the key must be aborted.

@param RegisterResponse $resp The response to verify
@return RegistrationInterface if the response is proven authentic
@throws SE if the response cannot be proven authentic
@throws BadMethodCallException if a precondition is not met
This method authenticates a RegisterResponse against its corresponding RegisterRequest by verifying the certificate and signature . If valid it returns a registration ; if not a SE will be thrown and attempt to register the key must be aborted .