pps-php/examples/07-context-binding.php at master · pps-protocol/pps-php · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
<?php

/**
 * PPS-PHP Example 07: Context Binding
 *
 * Demonstrates environmental and session context binding:
 * 1. Server creates context with session and BLE data
 * 2. Client binds context hash to the Pulse
 * 3. Server verifies context hash matches
 *
 * Usage:
 *   php examples/07-context-binding.php
 */

declare(strict_types=1);

require_once __DIR__ . '/../vendor/autoload.php';

use Pps\Client\AuthenticatorClient;
use Pps\Crypto\Base64Url;
use Pps\Crypto\Random;
use Pps\Key\KeyManager;
use Pps\Payload\ContextObject;
use Pps\Server\AuthenticationHandler;
use Pps\Server\ChallengeGenerator;
use Pps\Storage\InMemoryStorage;
use Pps\Util\SystemTimeProvider;

echo "=== PPS-PHP Example 07: Context Binding ===\n\n";

$storage = new InMemoryStorage();
$timeProvider = new SystemTimeProvider();
$rpId = 'example.com';

// Setup: Register device
$clientState = KeyManager::createClientState($rpId);
$kid = $clientState['kid'];
$normalSeed = Base64Url::decode($clientState['current_seed']);
$normalKey = KeyManager::keyPairFromSeed($normalSeed);

$storage->saveDeviceState($kid, [
    'kid' => $kid,
    'current_pk' => $normalKey->publicKeyB64u(),
    'key_seq' => 0,
    'last_counter' => 0,
    'revoked' => false,
]);

// ---------------------------------------------------------------
// Step 1: Create context
// ---------------------------------------------------------------

echo "Step 1: Create context\n";

$context = new ContextObject();
$context->sessionId = Random::bytes(16);
$context->bleHash = hash('sha256', 'ble-beacon-payload', true);
$context->acousticHash = hash('sha256', 'acoustic-nonce', true);
$context->deviceIntegrityHash = hash('sha256', 'integrity-data', true);

echo "  Context hash: " . Base64Url::encode($context->hash()) . "\n\n";

// ---------------------------------------------------------------
// Step 2: Client creates Pulse with context binding
// ---------------------------------------------------------------

echo "Step 2: Client creates Pulse with context binding\n";

$challengeGen = new ChallengeGenerator($timeProvider);
$challenge = $challengeGen->create($rpId);

$client = new AuthenticatorClient($clientState, $timeProvider);
$pulse = $client
    ->rpId($rpId)
    ->nonce($challenge->nonceB64u)
    ->context($context)
    ->createPulse();

echo "  Trust Code: " . $pulse['trust_code'] . "\n\n";

// ---------------------------------------------------------------
// Step 3: Server verifies context binding
// ---------------------------------------------------------------

echo "Step 3: Server verifies context binding\n";

$handler = new AuthenticationHandler($storage, $timeProvider);
$result = $handler->verify(
    pulseToken: $pulse['token'],
    rpId: $rpId,
    nonceB64u: $challenge->nonceB64u,
    context: $context
);

if ($result->ok) {
    echo "  Verification: SUCCESS\n";
    echo "  Context binding verified: YES\n";
} else {
    echo "  Verification: FAILED\n";
    echo "  Error: " . $result->error . "\n";
    exit(1);
}

echo "\n=== Example 07 Complete ===\n";