fido2-0.9.1/ 0000755 0001750 0001750 00000000000 14006463366 012404 5 ustar dain dain 0000000 0000000 fido2-0.9.1/COPYING 0000644 0001750 0001750 00000002430 13275566137 013445 0 ustar dain dain 0000000 0000000 Copyright (c) 2018 Yubico AB
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided
with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
fido2-0.9.1/COPYING.APLv2 0000644 0001750 0001750 00000026136 13275566136 014340 0 ustar dain dain 0000000 0000000
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
fido2-0.9.1/COPYING.MPLv2 0000644 0001750 0001750 00000040526 13275566136 014353 0 ustar dain dain 0000000 0000000 Mozilla Public License Version 2.0
==================================
1. Definitions
--------------
1.1. "Contributor"
means each individual or legal entity that creates, contributes to
the creation of, or owns Covered Software.
1.2. "Contributor Version"
means the combination of the Contributions of others (if any) used
by a Contributor and that particular Contributor's Contribution.
1.3. "Contribution"
means Covered Software of a particular Contributor.
1.4. "Covered Software"
means Source Code Form to which the initial Contributor has attached
the notice in Exhibit A, the Executable Form of such Source Code
Form, and Modifications of such Source Code Form, in each case
including portions thereof.
1.5. "Incompatible With Secondary Licenses"
means
(a) that the initial Contributor has attached the notice described
in Exhibit B to the Covered Software; or
(b) that the Covered Software was made available under the terms of
version 1.1 or earlier of the License, but not also under the
terms of a Secondary License.
1.6. "Executable Form"
means any form of the work other than Source Code Form.
1.7. "Larger Work"
means a work that combines Covered Software with other material, in
a separate file or files, that is not Covered Software.
1.8. "License"
means this document.
1.9. "Licensable"
means having the right to grant, to the maximum extent possible,
whether at the time of the initial grant or subsequently, any and
all of the rights conveyed by this License.
1.10. "Modifications"
means any of the following:
(a) any file in Source Code Form that results from an addition to,
deletion from, or modification of the contents of Covered
Software; or
(b) any new file in Source Code Form that contains any Covered
Software.
1.11. "Patent Claims" of a Contributor
means any patent claim(s), including without limitation, method,
process, and apparatus claims, in any patent Licensable by such
Contributor that would be infringed, but for the grant of the
License, by the making, using, selling, offering for sale, having
made, import, or transfer of either its Contributions or its
Contributor Version.
1.12. "Secondary License"
means either the GNU General Public License, Version 2.0, the GNU
Lesser General Public License, Version 2.1, the GNU Affero General
Public License, Version 3.0, or any later versions of those
licenses.
1.13. "Source Code Form"
means the form of the work preferred for making modifications.
1.14. "You" (or "Your")
means an individual or a legal entity exercising rights under this
License. For legal entities, "You" includes any entity that
controls, is controlled by, or is under common control with You. For
purposes of this definition, "control" means (a) the power, direct
or indirect, to cause the direction or management of such entity,
whether by contract or otherwise, or (b) ownership of more than
fifty percent (50%) of the outstanding shares or beneficial
ownership of such entity.
2. License Grants and Conditions
--------------------------------
2.1. Grants
Each Contributor hereby grants You a world-wide, royalty-free,
non-exclusive license:
(a) under intellectual property rights (other than patent or trademark)
Licensable by such Contributor to use, reproduce, make available,
modify, display, perform, distribute, and otherwise exploit its
Contributions, either on an unmodified basis, with Modifications, or
as part of a Larger Work; and
(b) under Patent Claims of such Contributor to make, use, sell, offer
for sale, have made, import, and otherwise transfer either its
Contributions or its Contributor Version.
2.2. Effective Date
The licenses granted in Section 2.1 with respect to any Contribution
become effective for each Contribution on the date the Contributor first
distributes such Contribution.
2.3. Limitations on Grant Scope
The licenses granted in this Section 2 are the only rights granted under
this License. No additional rights or licenses will be implied from the
distribution or licensing of Covered Software under this License.
Notwithstanding Section 2.1(b) above, no patent license is granted by a
Contributor:
(a) for any code that a Contributor has removed from Covered Software;
or
(b) for infringements caused by: (i) Your and any other third party's
modifications of Covered Software, or (ii) the combination of its
Contributions with other software (except as part of its Contributor
Version); or
(c) under Patent Claims infringed by Covered Software in the absence of
its Contributions.
This License does not grant any rights in the trademarks, service marks,
or logos of any Contributor (except as may be necessary to comply with
the notice requirements in Section 3.4).
2.4. Subsequent Licenses
No Contributor makes additional grants as a result of Your choice to
distribute the Covered Software under a subsequent version of this
License (see Section 10.2) or under the terms of a Secondary License (if
permitted under the terms of Section 3.3).
2.5. Representation
Each Contributor represents that the Contributor believes its
Contributions are its original creation(s) or it has sufficient rights
to grant the rights to its Contributions conveyed by this License.
2.6. Fair Use
This License is not intended to limit any rights You have under
applicable copyright doctrines of fair use, fair dealing, or other
equivalents.
2.7. Conditions
Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
in Section 2.1.
3. Responsibilities
-------------------
3.1. Distribution of Source Form
All distribution of Covered Software in Source Code Form, including any
Modifications that You create or to which You contribute, must be under
the terms of this License. You must inform recipients that the Source
Code Form of the Covered Software is governed by the terms of this
License, and how they can obtain a copy of this License. You may not
attempt to alter or restrict the recipients' rights in the Source Code
Form.
3.2. Distribution of Executable Form
If You distribute Covered Software in Executable Form then:
(a) such Covered Software must also be made available in Source Code
Form, as described in Section 3.1, and You must inform recipients of
the Executable Form how they can obtain a copy of such Source Code
Form by reasonable means in a timely manner, at a charge no more
than the cost of distribution to the recipient; and
(b) You may distribute such Executable Form under the terms of this
License, or sublicense it under different terms, provided that the
license for the Executable Form does not attempt to limit or alter
the recipients' rights in the Source Code Form under this License.
3.3. Distribution of a Larger Work
You may create and distribute a Larger Work under terms of Your choice,
provided that You also comply with the requirements of this License for
the Covered Software. If the Larger Work is a combination of Covered
Software with a work governed by one or more Secondary Licenses, and the
Covered Software is not Incompatible With Secondary Licenses, this
License permits You to additionally distribute such Covered Software
under the terms of such Secondary License(s), so that the recipient of
the Larger Work may, at their option, further distribute the Covered
Software under the terms of either this License or such Secondary
License(s).
3.4. Notices
You may not remove or alter the substance of any license notices
(including copyright notices, patent notices, disclaimers of warranty,
or limitations of liability) contained within the Source Code Form of
the Covered Software, except that You may alter any license notices to
the extent required to remedy known factual inaccuracies.
3.5. Application of Additional Terms
You may choose to offer, and to charge a fee for, warranty, support,
indemnity or liability obligations to one or more recipients of Covered
Software. However, You may do so only on Your own behalf, and not on
behalf of any Contributor. You must make it absolutely clear that any
such warranty, support, indemnity, or liability obligation is offered by
You alone, and You hereby agree to indemnify every Contributor for any
liability incurred by such Contributor as a result of warranty, support,
indemnity or liability terms You offer. You may include additional
disclaimers of warranty and limitations of liability specific to any
jurisdiction.
4. Inability to Comply Due to Statute or Regulation
---------------------------------------------------
If it is impossible for You to comply with any of the terms of this
License with respect to some or all of the Covered Software due to
statute, judicial order, or regulation then You must: (a) comply with
the terms of this License to the maximum extent possible; and (b)
describe the limitations and the code they affect. Such description must
be placed in a text file included with all distributions of the Covered
Software under this License. Except to the extent prohibited by statute
or regulation, such description must be sufficiently detailed for a
recipient of ordinary skill to be able to understand it.
5. Termination
--------------
5.1. The rights granted under this License will terminate automatically
if You fail to comply with any of its terms. However, if You become
compliant, then the rights granted under this License from a particular
Contributor are reinstated (a) provisionally, unless and until such
Contributor explicitly and finally terminates Your grants, and (b) on an
ongoing basis, if such Contributor fails to notify You of the
non-compliance by some reasonable means prior to 60 days after You have
come back into compliance. Moreover, Your grants from a particular
Contributor are reinstated on an ongoing basis if such Contributor
notifies You of the non-compliance by some reasonable means, this is the
first time You have received notice of non-compliance with this License
from such Contributor, and You become compliant prior to 30 days after
Your receipt of the notice.
5.2. If You initiate litigation against any entity by asserting a patent
infringement claim (excluding declaratory judgment actions,
counter-claims, and cross-claims) alleging that a Contributor Version
directly or indirectly infringes any patent, then the rights granted to
You by any and all Contributors for the Covered Software under Section
2.1 of this License shall terminate.
5.3. In the event of termination under Sections 5.1 or 5.2 above, all
end user license agreements (excluding distributors and resellers) which
have been validly granted by You or Your distributors under this License
prior to termination shall survive termination.
************************************************************************
* *
* 6. Disclaimer of Warranty *
* ------------------------- *
* *
* Covered Software is provided under this License on an "as is" *
* basis, without warranty of any kind, either expressed, implied, or *
* statutory, including, without limitation, warranties that the *
* Covered Software is free of defects, merchantable, fit for a *
* particular purpose or non-infringing. The entire risk as to the *
* quality and performance of the Covered Software is with You. *
* Should any Covered Software prove defective in any respect, You *
* (not any Contributor) assume the cost of any necessary servicing, *
* repair, or correction. This disclaimer of warranty constitutes an *
* essential part of this License. No use of any Covered Software is *
* authorized under this License except under this disclaimer. *
* *
************************************************************************
************************************************************************
* *
* 7. Limitation of Liability *
* -------------------------- *
* *
* Under no circumstances and under no legal theory, whether tort *
* (including negligence), contract, or otherwise, shall any *
* Contributor, or anyone who distributes Covered Software as *
* permitted above, be liable to You for any direct, indirect, *
* special, incidental, or consequential damages of any character *
* including, without limitation, damages for lost profits, loss of *
* goodwill, work stoppage, computer failure or malfunction, or any *
* and all other commercial damages or losses, even if such party *
* shall have been informed of the possibility of such damages. This *
* limitation of liability shall not apply to liability for death or *
* personal injury resulting from such party's negligence to the *
* extent applicable law prohibits such limitation. Some *
* jurisdictions do not allow the exclusion or limitation of *
* incidental or consequential damages, so this exclusion and *
* limitation may not apply to You. *
* *
************************************************************************
8. Litigation
-------------
Any litigation relating to this License may be brought only in the
courts of a jurisdiction where the defendant maintains its principal
place of business and such litigation shall be governed by laws of that
jurisdiction, without reference to its conflict-of-law provisions.
Nothing in this Section shall prevent a party's ability to bring
cross-claims or counter-claims.
9. Miscellaneous
----------------
This License represents the complete agreement concerning the subject
matter hereof. If any provision of this License is held to be
unenforceable, such provision shall be reformed only to the extent
necessary to make it enforceable. Any law or regulation which provides
that the language of a contract shall be construed against the drafter
shall not be used to construe this License against a Contributor.
10. Versions of the License
---------------------------
10.1. New Versions
Mozilla Foundation is the license steward. Except as provided in Section
10.3, no one other than the license steward has the right to modify or
publish new versions of this License. Each version will be given a
distinguishing version number.
10.2. Effect of New Versions
You may distribute the Covered Software under the terms of the version
of the License under which You originally received the Covered Software,
or under the terms of any subsequent version published by the license
steward.
10.3. Modified Versions
If you create software not governed by this License, and you want to
create a new license for such software, you may create and use a
modified version of this License if you rename the license and remove
any references to the name of the license steward (except to note that
such modified license differs from this License).
10.4. Distributing Source Code Form that is Incompatible With Secondary
Licenses
If You choose to distribute Source Code Form that is Incompatible With
Secondary Licenses under the terms of this version of the License, the
notice described in Exhibit B of this License must be attached.
Exhibit A - Source Code Form License Notice
-------------------------------------------
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
If it is not possible or desirable to put the notice in a particular
file, then You may include the notice in a location (such as a LICENSE
file in a relevant directory) where a recipient would be likely to look
for such a notice.
You may add additional accurate notices of copyright ownership.
Exhibit B - "Incompatible With Secondary Licenses" Notice
---------------------------------------------------------
This Source Code Form is "Incompatible With Secondary Licenses", as
defined by the Mozilla Public License, v. 2.0.
fido2-0.9.1/examples/ 0000755 0001750 0001750 00000000000 14006463366 014222 5 ustar dain dain 0000000 0000000 fido2-0.9.1/examples/acr122u.py 0000644 0001750 0001750 00000004464 14002014354 015744 0 ustar dain dain 0000000 0000000 from fido2.pcsc import CtapPcscDevice
import time
class Acr122uPcscDevice(object):
def __init__(self, pcsc_device):
self.pcsc = pcsc_device
def reader_version(self):
"""
Get reader's version from reader
:return: string. Reader's version
"""
try:
result, sw1, sw2 = self.pcsc.apdu_exchange(b"\xff\x00\x48\x00\x00")
if len(result) > 0:
str_result = result + bytes([sw1]) + bytes([sw2])
str_result = str_result.decode("utf-8")
return str_result
except Exception as e:
print("Get version error:", e)
return "n/a"
def led_control(
self,
red=False,
green=False,
blink_count=0,
red_end_blink=False,
green_end_blink=False,
):
"""
Reader's led control
:param red: boolean. red led on
:param green: boolean. green let on
:param blink_count: int. if needs to blink value > 0. blinks count
:param red_end_blink: boolean.
state of red led at the end of blinking
:param green_end_blink: boolean.
state of green led at the end of blinking
:return:
"""
try:
if blink_count > 0:
cbyte = (
0b00001100
+ (0b01 if red_end_blink else 0b00)
+ (0b10 if green_end_blink else 0b00)
)
cbyte |= (0b01000000 if red else 0b00000000) + (
0b10000000 if green else 0b00000000
)
else:
cbyte = 0b00001100 + (0b01 if red else 0b00) + (0b10 if green else 0b00)
apdu = (
b"\xff\x00\x40"
+ bytes([cbyte & 0xFF])
+ b"\4"
+ b"\5\3"
+ bytes([blink_count])
+ b"\0"
)
self.pcsc.apdu_exchange(apdu)
except Exception as e:
print("LED control error:", e)
dev = next(CtapPcscDevice.list_devices())
print("CONNECT: %s" % dev)
pcsc_device = Acr122uPcscDevice(dev)
pcsc_device.led_control(False, True, 0)
print("version: %s" % pcsc_device.reader_version())
pcsc_device.led_control(True, False, 0)
time.sleep(1)
pcsc_device.led_control(False, True, 3)
fido2-0.9.1/examples/acr122usam.py 0000644 0001750 0001750 00000024644 14002014354 016447 0 ustar dain dain 0000000 0000000 # Copyright (c) 2019 Yubico AB
# Copyright (c) 2019 Oleg Moiseenko
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Sample work with reader:
ACR-122U-SAM or touchatag
drivers and manual link:
www.acs.com.hk/en/driver/100/acr122u-nfc-reader-with-sam-slot-proprietary/
"""
import time
import six
from fido2.utils import sha256
from fido2.ctap1 import CTAP1
from smartcard.Exceptions import CardConnectionException
from fido2.pcsc import CtapPcscDevice
class Acr122uSamPcscDevice(CtapPcscDevice):
def __init__(self, connection, name):
self.ats = b""
self.vparity = False
self.max_block_len = 29
try:
super().__init__(connection, name)
except (CardConnectionException, ValueError):
pass
except Exception as e:
print(e.__class__)
# setup reader
if not self.set_auto_iso14443_4_activation():
raise Exception("Set automatic iso-14443-4 activation error")
if not self.set_default_retry_timeout():
raise Exception("Set default retry timeout error")
self.ats = self.get_ats()
if self.ats == b"":
raise Exception("No card in field")
self._select()
def apdu_plain(self, apdu, protocol=None):
"""Exchange data with reader.
:param apdu: byte string. data to exchange with card
:param protocol: protocol to exchange with card. usually set by default
:return: byte string. response from card
"""
# print('>> %s' % b2a_hex(apdu))
resp, sw1, sw2 = self._conn.transmit(list(six.iterbytes(apdu)), protocol)
response = bytes(bytearray(resp))
# print('<< [0x%04x] %s' % (sw1 * 0x100 + sw2, b2a_hex(response)))
return response, sw1, sw2
def pseudo_apdu_ex(self, apdu, protocol=None):
req = b"\xff\x00\x00\x00" + bytes([len(apdu) & 0xFF]) + apdu
resp, sw1, sw2 = self.apdu_plain(req, protocol)
if sw1 != 0x61:
return resp, sw1, sw2
return self.apdu_plain(b"\xff\xc0\x00\x00" + bytes([sw2]), protocol)
# override base method
# commands in PN 532 User manual (UM0701-02)
# page 178. 7.4.5 DEP chaining mechanism
# page 136. 7.3.9 InCommunicateThru
# chaining ISO 14443-4:2001
# page 20. 7.5.2 Chaining
def apdu_exchange(self, apdu, protocol=None):
all_response = b""
alen = 0
while True:
vapdu = apdu[alen : alen + self.max_block_len]
# input chaining
chaining = alen + len(vapdu) < len(apdu)
vb = 0x02 | (0x01 if self.vparity else 0x00) | (0x10 if chaining else 0x00)
# 7.3.9 InCommunicateThru
resp, sw1, sw2 = self.pseudo_apdu_ex(
b"\xd4\x42" + bytes([vb]) + vapdu, protocol
)
self.vparity = not self.vparity
if len(resp) > 2 and resp[2] > 0:
print("Error: 0x%02x" % resp[2])
return b"", 0x6F, resp[2]
if sw1 != 0x90 or len(resp) < 3 or resp[0] != 0xD5 or resp[1] != 0x43:
return b"", 0x67, 0x00
alen += len(vapdu)
if not chaining:
break
if len(resp) > 3:
if resp[3] & 0x10 == 0:
return resp[4:-2], resp[-2], resp[-1]
else:
if resp[3] != 0xF2:
all_response = resp[4:]
else:
return b"", 0x90, 0x00
while True:
if len(resp) > 3 and resp[3] == 0xF2:
# WTX
answer = resp[3:5]
else:
# ACK
answer = bytes([0xA2 | (0x01 if self.vparity else 0x00)])
self.vparity = not self.vparity
# 7.3.9 InCommunicateThru
resp, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x42" + answer, protocol)
if len(resp) > 2 and resp[2] > 0:
print("Error: 0x%02x" % resp[2])
return b"", 0x6F, resp[2]
if sw1 != 0x90 or len(resp) < 3 or resp[0] != 0xD5 or resp[1] != 0x43:
return b"", 0x67, 0x00
response_chaining = len(resp) > 3 and resp[3] & 0x10 != 0
# if I block
if len(resp) > 3 and resp[3] & 0xE0 == 0x00:
all_response += resp[4:]
if not response_chaining:
break
return all_response[:-2], resp[-2], resp[-1]
def get_ats(self, verbose=False):
self.field_reset()
self.ats = b""
resp, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x4a\x01\x00")
if sw1 == 0x90 and len(resp) > 8 and resp[2] > 0x00:
if verbose:
print("ATQA 0x%02x%02x" % (resp[4], resp[5]))
print("SAK 0x%02x" % resp[6])
uid_len = resp[7]
if verbose:
print("UID [%d] %s" % (uid_len, resp[8 : 8 + uid_len].hex()))
self.ats = resp[8 + uid_len :]
if verbose:
print("ATS [%d] %s" % (len(self.ats), self.ats.hex()))
self.vparity = False
return self.ats
return b""
def set_default_retry_timeout(self):
result, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x32\x05\x00\x00\x00")
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x33":
print("set default retry time error")
return False
# 14443 timeout. UM0701-02 PN432 user manual. page 101.
# RFU, fATR_RES_Timeout, fRetryTimeout
# 0b 102ms, 0c - 204ms, 0d - 409ms, 0f - 1.6s
result, sw1, sw2 = self.pseudo_apdu_ex(b"\xd4\x32\x02\x00\x0c\x0f")
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x33":
print("set fRetryTimeout error")
return False
return True
def set_auto_iso14443_4_activation(self, activate=True):
result, sw1, sw2 = self.pseudo_apdu_ex(
b"\xd4\x12" + bytes([0x34 if activate else 0x24])
)
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x13":
print("set automatic iso-14443-4 activation error")
return False
return True
def field_control(self, field_on=True):
result, sw1, sw2 = self.pseudo_apdu_ex(
b"\xd4\x32\x01" + bytes([0x01 if field_on else 0x00])
)
if sw1 != 0x90 or sw2 != 0x00 or result != b"\xd5\x33":
print("set field state error")
return False
return True
def field_reset(self):
self.led_control(True, False)
result = self.field_control(False)
time.sleep(0.2)
result |= self.field_control(True)
self.led_control()
return result
def reader_version(self):
"""
Get reader's version from reader
:return: string. Reader's version
"""
try:
result, sw1, sw2 = self.apdu_plain(b"\xff\x00\x48\x00\x00")
if len(result) > 0:
str_result = result + bytes([sw1]) + bytes([sw2])
str_result = str_result.decode("utf-8")
return str_result
except Exception as e:
print("Get version error:", e)
return "n/a"
def led_control(
self,
red=False,
green=False,
blink_count=0,
red_end_blink=False,
green_end_blink=False,
):
"""
Reader's led control
:param red: boolean. red led on
:param green: boolean. green let on
:param blink_count: int. if needs to blink value > 0. blinks count
:param red_end_blink: boolean.
state of red led at the end of blinking
:param green_end_blink: boolean.
state of green led at the end of blinking
:return:
"""
try:
if blink_count > 0:
cbyte = (
0b00001100
+ (0b01 if red_end_blink else 0b00)
+ (0b10 if green_end_blink else 0b00)
)
cbyte |= (0b01000000 if red else 0b00000000) + (
0b10000000 if green else 0b00000000
)
else:
cbyte = 0b00001100 + (0b01 if red else 0b00) + (0b10 if green else 0b00)
apdu = (
b"\xff\x00\x40"
+ bytes([cbyte & 0xFF])
+ b"\4"
+ b"\5\3"
+ bytes([blink_count])
+ b"\0"
)
self.apdu_plain(apdu)
except Exception as e:
print("LED control error:", e)
dev = next(Acr122uSamPcscDevice.list_devices())
print("CONNECT: %s" % dev)
print("version: %s" % dev.reader_version())
print("atr: %s" % bytes(dev.get_atr()).hex())
print("ats: %s" % dev.ats.hex())
# uncomment if you want to see parameters from card's selection
# dev.get_ats(True)
# dev._select()
dev.led_control(False, True, 0)
chal = sha256(b"AAA")
appid = sha256(b"BBB")
ctap1 = CTAP1(dev)
print("ctap1 version:", ctap1.get_version())
reg = ctap1.register(chal, appid)
print("u2f register:", reg)
reg.verify(appid, chal)
print("Register message verify OK")
auth = ctap1.authenticate(chal, appid, reg.key_handle)
print("u2f authenticate: ", auth)
res = auth.verify(appid, chal, reg.public_key)
print("Authenticate message verify OK")
dev.led_control()
fido2-0.9.1/examples/acr1252u.py 0000644 0001750 0001750 00000013045 14002014354 016024 0 ustar dain dain 0000000 0000000 from fido2.pcsc import CtapPcscDevice
import time
# control codes:
# 3225264 - magic number!!!
# 0x42000000 + 3500 - cross platform way
C_CODE = 3225264
class Acr1252uPcscDevice(object):
def __init__(self, pcsc_device):
self.pcsc = pcsc_device
def reader_version(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x18\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == len(res) - 5:
strres = res[5 : 5 + reslen].decode("utf-8")
return strres
except Exception as e:
print("Get version error:", e)
return "n/a"
def reader_serial_number(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x33\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == len(res) - 5:
strres = res[5 : 5 + reslen].decode("utf-8")
return strres
except Exception as e:
print("Get serial number error:", e)
return "n/a"
def led_control(self, red=False, green=False):
try:
cbyte = (0b01 if red else 0b00) + (0b10 if green else 0b00)
result = self.pcsc.control_exchange(
C_CODE, b"\xe0\x00\x00\x29\x01" + bytes([cbyte])
)
if len(result) > 0 and result.find(b"\xe1\x00\x00\x00") == 0:
result_length = result[4]
if result_length == 1:
ex_red = bool(result[5] & 0b01)
ex_green = bool(result[5] & 0b10)
return True, ex_red, ex_green
except Exception as e:
print("LED control error:", e)
return False, False, False
def led_status(self):
try:
result = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x29\x00")
if len(result) > 0 and result.find(b"\xe1\x00\x00\x00") == 0:
result_length = result[4]
if result_length == 1:
ex_red = bool(result[5] & 0b01)
ex_green = bool(result[5] & 0b10)
return True, ex_red, ex_green
except Exception as e:
print("LED status error:", e)
return False, False, False
def get_polling_settings(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x23\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Get polling settings error:", e)
return False, 0
def set_polling_settings(self, settings):
try:
res = self.pcsc.control_exchange(
C_CODE, b"\xe0\x00\x00\x23\x01" + bytes([settings & 0xFF])
)
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Set polling settings error:", e)
return False, 0
def get_picc_operation_parameter(self):
try:
res = self.pcsc.control_exchange(C_CODE, b"\xe0\x00\x00\x20\x00")
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Get PICC Operating Parameter error:", e)
return False, 0
def set_picc_operation_parameter(self, param):
try:
res = self.pcsc.control_exchange(
C_CODE, b"\xe0\x00\x00\x20\x01" + bytes([param])
)
if len(res) > 0 and res.find(b"\xe1\x00\x00\x00") == 0:
reslen = res[4]
if reslen == 1:
return True, res[5]
except Exception as e:
print("Set PICC Operating Parameter error:", e)
return False, 0
dev = next(CtapPcscDevice.list_devices())
print("CONNECT: %s" % dev)
pcsc_device = Acr1252uPcscDevice(dev)
if pcsc_device is not None:
print("version: %s" % pcsc_device.reader_version())
print("serial number: %s" % pcsc_device.reader_serial_number())
print("")
result, settings = pcsc_device.set_polling_settings(0x8B)
print("write polling settings: %r 0x%x" % (result, settings))
result, settings = pcsc_device.get_polling_settings()
print("polling settings: %r 0x%x" % (result, settings))
set_desc = [
[0, "Auto PICC Polling"],
[1, "Turn off Antenna Field if no PICC is found"],
[2, "Turn off Antenna Field if the PICC is inactive"],
[3, "Activate the PICC when detected"],
[7, "Enforce ISO 14443-A Part 4"],
]
for x in set_desc:
print(x[1], "on" if settings & (1 << x[0]) else "off")
interval_desc = [250, 500, 1000, 2500]
print("PICC Poll Interval for PICC", interval_desc[(settings >> 4) & 0b11], "ms")
print("")
print(
"PICC operation parameter: %r 0x%x" % pcsc_device.get_picc_operation_parameter()
)
print("")
result, red, green = pcsc_device.led_control(True, False)
print("led control result:", result, "red:", red, "green:", green)
result, red, green = pcsc_device.led_status()
print("led state result:", result, "red:", red, "green:", green)
time.sleep(1)
pcsc_device.led_control(False, False)
fido2-0.9.1/examples/bio_enrollment.py 0000644 0001750 0001750 00000005557 14006451303 017604 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found over USB, and attempts to enroll a new
fingerprint. This requires that a PIN is already set.
NOTE: This uses a draft bio enrollment specification which is not yet final.
Consider this highly experimental.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.ctap2 import Ctap2, ClientPin, FPBioEnrollment, CaptureError
from getpass import getpass
import sys
pin = None
uv = "discouraged"
for dev in CtapHidDevice.list_devices():
try:
ctap = Ctap2(dev)
if "bioEnroll" in ctap.info.options:
break
except Exception: # nosec
continue
else:
print("No Authenticator supporting bioEnroll found")
sys.exit(1)
if not ctap.info.options.get("clientPin"):
print("PIN not set for the device!")
sys.exit(1)
# Authenticate with PIN
print("Preparing to enroll a new fingerprint.")
pin = getpass("Please enter PIN: ")
client_pin = ClientPin(ctap)
pin_token = client_pin.get_pin_token(pin, ClientPin.PERMISSION.BIO_ENROLL)
bio = FPBioEnrollment(ctap, client_pin.protocol, pin_token)
print(bio.enumerate_enrollments())
# Start enrollment
enroller = bio.enroll()
template_id = None
while template_id is None:
print("Press your fingerprint against the sensor now...")
try:
template_id = enroller.capture()
print(enroller.remaining, "more scans needed.")
except CaptureError as e:
print(e)
print("Fingerprint registered successfully with ID:", template_id)
fido2-0.9.1/examples/credential.py 0000644 0001750 0001750 00000011006 14002014354 016665 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
On Windows, the native WebAuthn API will be used.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client, WindowsClient
from fido2.server import Fido2Server
from getpass import getpass
import sys
import ctypes
use_prompt = False
pin = None
uv = "discouraged"
if WindowsClient.is_available() and not ctypes.windll.shell32.IsUserAnAdmin():
# Use the Windows WebAuthn API if available, and we're not running as admin
client = WindowsClient("https://example.com")
else:
# Locate a device
dev = next(CtapHidDevice.list_devices(), None)
if dev is not None:
print("Use USB HID channel.")
use_prompt = True
else:
try:
from fido2.pcsc import CtapPcscDevice
dev = next(CtapPcscDevice.list_devices(), None)
print("Use NFC channel.")
except Exception as e:
print("NFC channel search error:", e)
if not dev:
print("No FIDO device found")
sys.exit(1)
# Set up a FIDO 2 client using the origin https://example.com
client = Fido2Client(dev, "https://example.com")
# Prefer UV if supported
if client.info.options.get("uv"):
uv = "preferred"
print("Authenticator supports User Verification")
elif client.info.options.get("clientPin"):
# Prompt for PIN if needed
pin = getpass("Please enter PIN: ")
else:
print("PIN not set, won't use")
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user, user_verification=uv, authenticator_attachment="cross-platform"
)
# Create a credential
if use_prompt:
print("\nTouch your authenticator device now...\n")
result = client.make_credential(create_options["publicKey"], pin=pin)
# Complete registration
auth_data = server.register_complete(
state, result.client_data, result.attestation_object
)
credentials = [auth_data.credential_data]
print("New credential created!")
print("CLIENT DATA:", result.client_data)
print("ATTESTATION OBJECT:", result.attestation_object)
print()
print("CREDENTIAL DATA:", auth_data.credential_data)
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(credentials, user_verification=uv)
# Authenticate the credential
if use_prompt:
print("\nTouch your authenticator device now...\n")
# Only one cred in allowCredentials, only one response.
result = client.get_assertion(request_options["publicKey"], pin=pin).get_response(0)
# Complete authenticator
server.authenticate_complete(
state,
credentials,
result.credential_id,
result.client_data,
result.authenticator_data,
result.signature,
)
print("Credential authenticated!")
print("CLIENT DATA:", result.client_data)
print()
print("AUTH DATA:", result.authenticator_data)
fido2-0.9.1/examples/cred_blob.py 0000644 0001750 0001750 00000010031 14002014354 016463 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports the CredBlob extension,
creates a new credential for it with the extension enabled, and stores some data.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client
from fido2.server import Fido2Server
from getpass import getpass
import sys
import os
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
# Locate a device
for dev in enumerate_devices():
client = Fido2Client(dev, "https://example.com")
if "credBlob" in client.info.extensions:
break
else:
print("No Authenticator with the CredBlob extension found!")
sys.exit(1)
use_nfc = CtapPcscDevice and isinstance(dev, CtapPcscDevice)
# Prepare parameters for makeCredential
server = Fido2Server({"id": "example.com", "name": "Example RP"})
user = {"id": b"user_id", "name": "A. User"}
create_options, state = server.register_begin(user, resident_key=True)
# Add CredBlob extension, attach data
blob = os.urandom(32) # 32 random bytes
create_options["publicKey"]["extensions"] = {"credBlob": blob}
# Prompt for PIN if needed
pin = None
if client.info.options.get("clientPin"):
pin = getpass("Please enter PIN:")
else:
print("no pin")
# Create a credential
if not use_nfc:
print("\nTouch your authenticator device now...\n")
result = client.make_credential(create_options["publicKey"], pin=pin)
# Complete registration
auth_data = server.register_complete(
state, result.client_data, result.attestation_object
)
credentials = [auth_data.credential_data]
# CredBlob result:
if not auth_data.extensions.get("credBlob"):
print("Credential was registered, but credBlob was NOT saved.")
sys.exit(1)
print("New credential created, with the CredBlob extension.")
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin()
request_options["publicKey"]["extensions"] = {
"getCredBlob": True,
}
# Authenticate the credential
if not use_nfc:
print("\nTouch your authenticator device now...\n")
# Only one cred in allowCredentials, only one response.
result = client.get_assertion(request_options["publicKey"], pin=pin).get_response(0)
blob_res = result.authenticator_data.extensions.get("credBlob")
if blob == blob_res:
print("Authenticated, got correct blob:", blob.hex())
else:
print(
"Authenticated, got incorrect blob! (was %s, expected %s)"
% (blob_res.hex(), blob.hex())
)
sys.exit(1)
fido2-0.9.1/examples/get_info.py 0000644 0001750 0001750 00000004651 14006451303 016360 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to each attached FIDO device, and:
1. If the device supports CBOR commands, perform a getInfo command.
2. If the device supports WINK, perform the wink command.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice, CAPABILITY
from fido2.ctap2 import CTAP2
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
for dev in enumerate_devices():
print("CONNECT: %s" % dev)
print("CTAPHID protocol version: %d" % dev.version)
if dev.capabilities & CAPABILITY.CBOR:
ctap2 = CTAP2(dev)
info = ctap2.get_info()
print("DEVICE INFO: %s" % info)
else:
print("Device does not support CBOR")
if dev.capabilities & CAPABILITY.WINK:
dev.wink()
print("WINK sent!")
else:
print("Device does not support WINK")
dev.close()
fido2-0.9.1/examples/hmac_secret.py 0000644 0001750 0001750 00000011447 14002014354 017041 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports the HmacSecret extension,
creates a new credential for it with the extension enabled, and uses it to
derive two separate secrets.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client
from getpass import getpass
from binascii import b2a_hex
import sys
import os
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
# Locate a device
for dev in enumerate_devices():
client = Fido2Client(dev, "https://example.com")
if "hmac-secret" in client.info.extensions:
break
else:
print("No Authenticator with the HmacSecret extension found!")
sys.exit(1)
use_nfc = CtapPcscDevice and isinstance(dev, CtapPcscDevice)
# Prepare parameters for makeCredential
rp = {"id": "example.com", "name": "Example RP"}
user = {"id": b"user_id", "name": "A. User"}
challenge = b"Y2hhbGxlbmdl"
# Prompt for PIN if needed
pin = None
if client.info.options.get("clientPin"):
pin = getpass("Please enter PIN:")
else:
print("no pin")
# Create a credential with a HmacSecret
if not use_nfc:
print("\nTouch your authenticator device now...\n")
result = client.make_credential(
{
"rp": rp,
"user": user,
"challenge": challenge,
"pubKeyCredParams": [{"type": "public-key", "alg": -7}],
"extensions": {"hmacCreateSecret": True},
},
pin=pin,
)
# HmacSecret result:
if not result.extension_results.get("hmacCreateSecret"):
print("Failed to create credential with HmacSecret")
sys.exit(1)
credential = result.attestation_object.auth_data.credential_data
print("New credential created, with the HmacSecret extension.")
# Prepare parameters for getAssertion
challenge = b"Q0hBTExFTkdF" # Use a new challenge for each call.
allow_list = [{"type": "public-key", "id": credential.credential_id}]
# Generate a salt for HmacSecret:
salt = os.urandom(32)
print("Authenticate with salt:", b2a_hex(salt))
# Authenticate the credential
if not use_nfc:
print("\nTouch your authenticator device now...\n")
result = client.get_assertion(
{
"rpId": rp["id"],
"challenge": challenge,
"allowCredentials": allow_list,
"extensions": {"hmacGetSecret": {"salt1": salt}},
},
pin=pin,
).get_response(
0
) # Only one cred in allowList, only one response.
output1 = result.extension_results["hmacGetSecret"]["output1"]
print("Authenticated, secret:", b2a_hex(output1))
# Authenticate again, using two salts to generate two secrets:
# Generate a second salt for HmacSecret:
salt2 = os.urandom(32)
print("Authenticate with second salt:", b2a_hex(salt2))
if not use_nfc:
print("\nTouch your authenticator device now...\n")
# The first salt is reused, which should result in the same secret.
result = client.get_assertion(
{
"rpId": rp["id"],
"challenge": challenge,
"allowCredentials": allow_list,
"extensions": {"hmacGetSecret": {"salt1": salt, "salt2": salt2}},
},
pin=pin,
).get_response(
0
) # One cred in allowCredentials, single response.
output = result.extension_results["hmacGetSecret"]
print("Old secret:", b2a_hex(output["output1"]))
print("New secret:", b2a_hex(output["output2"]))
fido2-0.9.1/examples/large_blobs.py 0000644 0001750 0001750 00000012000 14006451303 017024 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
On Windows, the native WebAuthn API will be used.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.ctap2 import ClientPin, LargeBlobs
from fido2.client import Fido2Client
from fido2.server import Fido2Server
from getpass import getpass
import sys
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
# Locate a device
for dev in enumerate_devices():
client = Fido2Client(dev, "https://example.com")
if "largeBlobKey" in client.info.extensions:
break
else:
print("No Authenticator with the largeBlobKey extension found!")
sys.exit(1)
use_nfc = CtapPcscDevice and isinstance(dev, CtapPcscDevice)
pin = None
uv = "discouraged"
if not client.info.options.get("largeBlobs"):
print("Authenticator does not support large blobs!")
sys.exit(1)
# Prefer UV token if supported
if client.info.options.get("pinUvAuthToken") and client.info.options.get("uv"):
uv = "preferred"
print("Authenticator supports UV token")
elif client.info.options.get("clientPin"):
# Prompt for PIN if needed
pin = getpass("Please enter PIN: ")
else:
print("PIN not set, won't use")
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key=True,
user_verification=uv,
authenticator_attachment="cross-platform",
)
# Enable largeBlobKey
options = create_options["publicKey"]
options.extensions = {"largeBlobKey": True}
# Create a credential
print("\nTouch your authenticator device now...\n")
result = client.make_credential(options, pin=pin)
key = result.attestation_object.large_blob_key
# Complete registration
auth_data = server.register_complete(
state, result.client_data, result.attestation_object
)
credentials = [auth_data.credential_data]
print("New credential created!")
print("Large Blob Key:", key)
client_pin = ClientPin(client.ctap2)
if pin:
token = client_pin.get_pin_token(pin, ClientPin.PERMISSION.LARGE_BLOB_WRITE)
else:
token = client_pin.get_uv_token(ClientPin.PERMISSION.LARGE_BLOB_WRITE)
large_blobs = LargeBlobs(client.ctap2, client_pin.protocol, token)
# Write a large blob
print("Writing a large blob...")
large_blobs.put_blob(key, b"Here is some data to store!")
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(user_verification=uv)
# Enable largeBlobKey
options = request_options["publicKey"]
options.extensions = {"largeBlobKey": True}
# Authenticate the credential
print("\nTouch your authenticator device now...\n")
selection = client.get_assertion(options, pin=pin)
# Only one cred in allowCredentials, only one response.
assertion = selection.get_assertions()[0]
# This should match the key from MakeCredential.
key = assertion.large_blob_key
# Get a fresh PIN token
if pin:
token = client_pin.get_pin_token(pin, ClientPin.PERMISSION.LARGE_BLOB_WRITE)
else:
token = client_pin.get_uv_token(ClientPin.PERMISSION.LARGE_BLOB_WRITE)
large_blobs = LargeBlobs(client.ctap2, client_pin.protocol, token)
blob = large_blobs.get_blob(key)
print("Read blob", blob)
# Clean up
large_blobs.delete_blob(key)
fido2-0.9.1/examples/min_pin_length.py 0000644 0001750 0001750 00000006403 13746236541 017574 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports the CredBlob extension,
creates a new credential for it with the extension enabled, and stores some data.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client
from fido2.server import Fido2Server
from fido2.extensions import MinPinLengthExtension
from getpass import getpass
import sys
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
# Locate a device
for dev in enumerate_devices():
client = Fido2Client(dev, "https://example.com")
if MinPinLengthExtension.NAME in client.info.extensions:
break
else:
print("No Authenticator with the MinPinLength extension found!")
sys.exit(1)
use_nfc = CtapPcscDevice and isinstance(dev, CtapPcscDevice)
# Prepare parameters for makeCredential
server = Fido2Server({"id": "example.com", "name": "Example RP"})
user = {"id": b"user_id", "name": "A. User"}
create_options, state = server.register_begin(user)
# Add MinPinLength extension, attach data
min_pin = MinPinLengthExtension()
create_options["publicKey"]["extensions"] = min_pin.create_dict()
# Prompt for PIN if needed
pin = None
if client.info.options.get("clientPin"):
pin = getpass("Please enter PIN:")
else:
print("no pin")
# Create a credential
if not use_nfc:
print("\nTouch your authenticator device now...\n")
attestation_object, client_data = client.make_credential(
create_options["publicKey"], pin=pin
)
# Complete registration
auth_data = server.register_complete(state, client_data, attestation_object)
min_pin_length = min_pin.results_for(auth_data)
print("Credential registered, min PIN length: ", min_pin_length)
fido2-0.9.1/examples/multi_device.py 0000644 0001750 0001750 00000006453 14002014354 017236 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to each FIDO device found, and causes them all to blink until the user
triggers one to select it. A new credential is created for that authenticator,
and the operation is cancelled for the others.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice, STATUS
from fido2.client import Fido2Client, ClientError
from threading import Event, Thread
import sys
# Locate a device
devs = list(CtapHidDevice.list_devices())
if not devs:
print("No FIDO device found")
sys.exit(1)
clients = [Fido2Client(d, "https://example.com") for d in devs]
# Prepare parameters for makeCredential
rp = {"id": "example.com", "name": "Example RP"}
user = {"id": b"user_id", "name": "A. User"}
challenge = b"Y2hhbGxlbmdl"
cancel = Event()
attestation, client_data = None, None
has_prompted = False
def on_keepalive(status):
global has_prompted # Don't prompt for each device.
if status == STATUS.UPNEEDED and not has_prompted:
print("\nTouch your authenticator device now...\n")
has_prompted = True
def work(client):
global attestation, client_data
try:
attestation, client_data = client.make_credential(
{
"rp": rp,
"user": user,
"challenge": challenge,
"pubKeyCredParams": [{"type": "public-key", "alg": -7}],
},
event=cancel,
on_keepalive=on_keepalive,
)
except ClientError as e:
if e.code != ClientError.ERR.TIMEOUT:
raise
else:
return
cancel.set()
print("New credential created!")
print("ATTESTATION OBJECT:", attestation)
print()
print("CREDENTIAL DATA:", attestation.auth_data.credential_data)
threads = []
for client in clients:
t = Thread(target=work, args=(client,))
threads.append(t)
t.start()
for t in threads:
t.join()
if not cancel.is_set():
print("Operation timed out!")
fido2-0.9.1/examples/resident_key.py 0000644 0001750 0001750 00000011170 14002014354 017242 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
On Windows, the native WebAuthn API will be used.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client, WindowsClient
from fido2.server import Fido2Server
from getpass import getpass
import sys
import ctypes
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
use_prompt = False
pin = None
uv = "discouraged"
if WindowsClient.is_available() and not ctypes.windll.shell32.IsUserAnAdmin():
# Use the Windows WebAuthn API if available, and we're not running as admin
client = WindowsClient("https://example.com")
else:
# Locate a device
for dev in enumerate_devices():
client = Fido2Client(dev, "https://example.com")
if client.info.options.get("rk"):
use_prompt = not (CtapPcscDevice and isinstance(dev, CtapPcscDevice))
break
else:
print("No Authenticator with support for resident key found!")
sys.exit(1)
# Prefer UV if supported
if client.info.options.get("uv"):
uv = "preferred"
print("Authenticator supports User Verification")
elif client.info.options.get("clientPin"):
# Prompt for PIN if needed
pin = getpass("Please enter PIN: ")
else:
print("PIN not set, won't use")
server = Fido2Server({"id": "example.com", "name": "Example RP"}, attestation="direct")
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user,
resident_key=True,
user_verification=uv,
authenticator_attachment="cross-platform",
)
# Create a credential
if use_prompt:
print("\nTouch your authenticator device now...\n")
result = client.make_credential(create_options["publicKey"], pin=pin)
# Complete registration
auth_data = server.register_complete(
state, result.client_data, result.attestation_object
)
credentials = [auth_data.credential_data]
print("New credential created!")
print("CLIENT DATA:", result.client_data)
print("ATTESTATION OBJECT:", result.attestation_object)
print()
print("CREDENTIAL DATA:", auth_data.credential_data)
# Prepare parameters for getAssertion
request_options, state = server.authenticate_begin(user_verification=uv)
# Authenticate the credential
if use_prompt:
print("\nTouch your authenticator device now...\n")
selection = client.get_assertion(request_options["publicKey"], pin=pin)
result = selection.get_response(0) # There may be multiple responses, get the first.
print("USER ID:", result.user_handle)
# Complete authenticator
server.authenticate_complete(
state,
credentials,
result.credential_id,
result.client_data,
result.authenticator_data,
result.signature,
)
print("Credential authenticated!")
print("CLIENT DATA:", result.client_data)
print()
print("AUTHENTICATOR DATA:", result.authenticator_data)
fido2-0.9.1/examples/server/ 0000755 0001750 0001750 00000000000 14006463366 015530 5 ustar dain dain 0000000 0000000 fido2-0.9.1/examples/server/Pipfile 0000644 0001750 0001750 00000000356 14006451303 017033 0 ustar dain dain 0000000 0000000 [[source]]
verify_ssl = true
name = "pypi"
url = "https://pypi.org/simple"
[packages]
flask = "*"
pyOpenSSL = "*"
"5448283" = {editable = true, path = "./../.."}
[scripts]
server = "python server.py"
server-u2f = "python server-u2f.py"
fido2-0.9.1/examples/server/Pipfile.lock 0000644 0001750 0001750 00000026261 14006451303 017765 0 ustar dain dain 0000000 0000000 {
"_meta": {
"hash": {
"sha256": "bf2fa9b63243b7172b84ae28c7fc3abc291ed1bb91f4919f2b2c47bfc0ccdd4d"
},
"pipfile-spec": 6,
"requires": {},
"sources": [
{
"name": "pypi",
"url": "https://pypi.org/simple",
"verify_ssl": true
}
]
},
"default": {
"5448283": {
"editable": true,
"path": "./../.."
},
"cffi": {
"hashes": [
"sha256:005f2bfe11b6745d726dbb07ace4d53f057de66e336ff92d61b8c7e9c8f4777d",
"sha256:09e96138280241bd355cd585148dec04dbbedb4f46128f340d696eaafc82dd7b",
"sha256:0b1ad452cc824665ddc682400b62c9e4f5b64736a2ba99110712fdee5f2505c4",
"sha256:0ef488305fdce2580c8b2708f22d7785ae222d9825d3094ab073e22e93dfe51f",
"sha256:15f351bed09897fbda218e4db5a3d5c06328862f6198d4fb385f3e14e19decb3",
"sha256:22399ff4870fb4c7ef19fff6eeb20a8bbf15571913c181c78cb361024d574579",
"sha256:23e5d2040367322824605bc29ae8ee9175200b92cb5483ac7d466927a9b3d537",
"sha256:2791f68edc5749024b4722500e86303a10d342527e1e3bcac47f35fbd25b764e",
"sha256:2f9674623ca39c9ebe38afa3da402e9326c245f0f5ceff0623dccdac15023e05",
"sha256:3363e77a6176afb8823b6e06db78c46dbc4c7813b00a41300a4873b6ba63b171",
"sha256:33c6cdc071ba5cd6d96769c8969a0531be2d08c2628a0143a10a7dcffa9719ca",
"sha256:3b8eaf915ddc0709779889c472e553f0d3e8b7bdf62dab764c8921b09bf94522",
"sha256:3cb3e1b9ec43256c4e0f8d2837267a70b0e1ca8c4f456685508ae6106b1f504c",
"sha256:3eeeb0405fd145e714f7633a5173318bd88d8bbfc3dd0a5751f8c4f70ae629bc",
"sha256:44f60519595eaca110f248e5017363d751b12782a6f2bd6a7041cba275215f5d",
"sha256:4d7c26bfc1ea9f92084a1d75e11999e97b62d63128bcc90c3624d07813c52808",
"sha256:529c4ed2e10437c205f38f3691a68be66c39197d01062618c55f74294a4a4828",
"sha256:6642f15ad963b5092d65aed022d033c77763515fdc07095208f15d3563003869",
"sha256:85ba797e1de5b48aa5a8427b6ba62cf69607c18c5d4eb747604b7302f1ec382d",
"sha256:8f0f1e499e4000c4c347a124fa6a27d37608ced4fe9f7d45070563b7c4c370c9",
"sha256:a624fae282e81ad2e4871bdb767e2c914d0539708c0f078b5b355258293c98b0",
"sha256:b0358e6fefc74a16f745afa366acc89f979040e0cbc4eec55ab26ad1f6a9bfbc",
"sha256:bbd2f4dfee1079f76943767fce837ade3087b578aeb9f69aec7857d5bf25db15",
"sha256:bf39a9e19ce7298f1bd6a9758fa99707e9e5b1ebe5e90f2c3913a47bc548747c",
"sha256:c11579638288e53fc94ad60022ff1b67865363e730ee41ad5e6f0a17188b327a",
"sha256:c150eaa3dadbb2b5339675b88d4573c1be3cb6f2c33a6c83387e10cc0bf05bd3",
"sha256:c53af463f4a40de78c58b8b2710ade243c81cbca641e34debf3396a9640d6ec1",
"sha256:cb763ceceae04803adcc4e2d80d611ef201c73da32d8f2722e9d0ab0c7f10768",
"sha256:cc75f58cdaf043fe6a7a6c04b3b5a0e694c6a9e24050967747251fb80d7bce0d",
"sha256:d80998ed59176e8cba74028762fbd9b9153b9afc71ea118e63bbf5d4d0f9552b",
"sha256:de31b5164d44ef4943db155b3e8e17929707cac1e5bd2f363e67a56e3af4af6e",
"sha256:e66399cf0fc07de4dce4f588fc25bfe84a6d1285cc544e67987d22663393926d",
"sha256:f0620511387790860b249b9241c2f13c3a80e21a73e0b861a2df24e9d6f56730",
"sha256:f4eae045e6ab2bb54ca279733fe4eb85f1effda392666308250714e01907f394",
"sha256:f92cdecb618e5fa4658aeb97d5eb3d2f47aa94ac6477c6daf0f306c5a3b9e6b1",
"sha256:f92f789e4f9241cd262ad7a555ca2c648a98178a953af117ef7fad46aa1d5591"
],
"version": "==1.14.3"
},
"click": {
"hashes": [
"sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a",
"sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc"
],
"version": "==7.1.2"
},
"cryptography": {
"hashes": [
"sha256:07ca431b788249af92764e3be9a488aa1d39a0bc3be313d826bbec690417e538",
"sha256:13b88a0bd044b4eae1ef40e265d006e34dbcde0c2f1e15eb9896501b2d8f6c6f",
"sha256:32434673d8505b42c0de4de86da8c1620651abd24afe91ae0335597683ed1b77",
"sha256:3cd75a683b15576cfc822c7c5742b3276e50b21a06672dc3a800a2d5da4ecd1b",
"sha256:4e7268a0ca14536fecfdf2b00297d4e407da904718658c1ff1961c713f90fd33",
"sha256:545a8550782dda68f8cdc75a6e3bf252017aa8f75f19f5a9ca940772fc0cb56e",
"sha256:55d0b896631412b6f0c7de56e12eb3e261ac347fbaa5d5e705291a9016e5f8cb",
"sha256:5849d59358547bf789ee7e0d7a9036b2d29e9a4ddf1ce5e06bb45634f995c53e",
"sha256:6dc59630ecce8c1f558277ceb212c751d6730bd12c80ea96b4ac65637c4f55e7",
"sha256:7117319b44ed1842c617d0a452383a5a052ec6aa726dfbaffa8b94c910444297",
"sha256:75e8e6684cf0034f6bf2a97095cb95f81537b12b36a8fedf06e73050bb171c2d",
"sha256:7b8d9d8d3a9bd240f453342981f765346c87ade811519f98664519696f8e6ab7",
"sha256:a035a10686532b0587d58a606004aa20ad895c60c4d029afa245802347fab57b",
"sha256:a4e27ed0b2504195f855b52052eadcc9795c59909c9d84314c5408687f933fc7",
"sha256:a733671100cd26d816eed39507e585c156e4498293a907029969234e5e634bc4",
"sha256:a75f306a16d9f9afebfbedc41c8c2351d8e61e818ba6b4c40815e2b5740bb6b8",
"sha256:bd717aa029217b8ef94a7d21632a3bb5a4e7218a4513d2521c2a2fd63011e98b",
"sha256:d25cecbac20713a7c3bc544372d42d8eafa89799f492a43b79e1dfd650484851",
"sha256:d26a2557d8f9122f9bf445fc7034242f4375bd4e95ecda007667540270965b13",
"sha256:d3545829ab42a66b84a9aaabf216a4dce7f16dbc76eb69be5c302ed6b8f4a29b",
"sha256:d3d5e10be0cf2a12214ddee45c6bd203dab435e3d83b4560c03066eda600bfe3",
"sha256:efe15aca4f64f3a7ea0c09c87826490e50ed166ce67368a68f315ea0807a20df"
],
"version": "==3.2.1"
},
"flask": {
"hashes": [
"sha256:4efa1ae2d7c9865af48986de8aeb8504bf32c7f3d6fdc9353d34b21f4b127060",
"sha256:8a4fdd8936eba2512e9c85df320a37e694c93945b33ef33c89946a340a238557"
],
"index": "pypi",
"version": "==1.1.2"
},
"itsdangerous": {
"hashes": [
"sha256:321b033d07f2a4136d3ec762eac9f16a10ccd60f53c0c91af90217ace7ba1f19",
"sha256:b12271b2047cb23eeb98c8b5622e2e5c5e9abd9784a153e9d8ef9cb4dd09d749"
],
"version": "==1.1.0"
},
"jinja2": {
"hashes": [
"sha256:89aab215427ef59c34ad58735269eb58b1a5808103067f7bb9d5836c651b3bb0",
"sha256:f0a4641d3cf955324a89c04f3d94663aa4d638abe8f733ecd3582848e1c37035"
],
"version": "==2.11.2"
},
"markupsafe": {
"hashes": [
"sha256:00bc623926325b26bb9605ae9eae8a215691f33cae5df11ca5424f06f2d1f473",
"sha256:09027a7803a62ca78792ad89403b1b7a73a01c8cb65909cd876f7fcebd79b161",
"sha256:09c4b7f37d6c648cb13f9230d847adf22f8171b1ccc4d5682398e77f40309235",
"sha256:1027c282dad077d0bae18be6794e6b6b8c91d58ed8a8d89a89d59693b9131db5",
"sha256:13d3144e1e340870b25e7b10b98d779608c02016d5184cfb9927a9f10c689f42",
"sha256:24982cc2533820871eba85ba648cd53d8623687ff11cbb805be4ff7b4c971aff",
"sha256:29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b",
"sha256:43a55c2930bbc139570ac2452adf3d70cdbb3cfe5912c71cdce1c2c6bbd9c5d1",
"sha256:46c99d2de99945ec5cb54f23c8cd5689f6d7177305ebff350a58ce5f8de1669e",
"sha256:500d4957e52ddc3351cabf489e79c91c17f6e0899158447047588650b5e69183",
"sha256:535f6fc4d397c1563d08b88e485c3496cf5784e927af890fb3c3aac7f933ec66",
"sha256:596510de112c685489095da617b5bcbbac7dd6384aeebeda4df6025d0256a81b",
"sha256:62fe6c95e3ec8a7fad637b7f3d372c15ec1caa01ab47926cfdf7a75b40e0eac1",
"sha256:6788b695d50a51edb699cb55e35487e430fa21f1ed838122d722e0ff0ac5ba15",
"sha256:6dd73240d2af64df90aa7c4e7481e23825ea70af4b4922f8ede5b9e35f78a3b1",
"sha256:717ba8fe3ae9cc0006d7c451f0bb265ee07739daf76355d06366154ee68d221e",
"sha256:79855e1c5b8da654cf486b830bd42c06e8780cea587384cf6545b7d9ac013a0b",
"sha256:7c1699dfe0cf8ff607dbdcc1e9b9af1755371f92a68f706051cc8c37d447c905",
"sha256:88e5fcfb52ee7b911e8bb6d6aa2fd21fbecc674eadd44118a9cc3863f938e735",
"sha256:8defac2f2ccd6805ebf65f5eeb132adcf2ab57aa11fdf4c0dd5169a004710e7d",
"sha256:98c7086708b163d425c67c7a91bad6e466bb99d797aa64f965e9d25c12111a5e",
"sha256:9add70b36c5666a2ed02b43b335fe19002ee5235efd4b8a89bfcf9005bebac0d",
"sha256:9bf40443012702a1d2070043cb6291650a0841ece432556f784f004937f0f32c",
"sha256:ade5e387d2ad0d7ebf59146cc00c8044acbd863725f887353a10df825fc8ae21",
"sha256:b00c1de48212e4cc9603895652c5c410df699856a2853135b3967591e4beebc2",
"sha256:b1282f8c00509d99fef04d8ba936b156d419be841854fe901d8ae224c59f0be5",
"sha256:b2051432115498d3562c084a49bba65d97cf251f5a331c64a12ee7e04dacc51b",
"sha256:ba59edeaa2fc6114428f1637ffff42da1e311e29382d81b339c1817d37ec93c6",
"sha256:c8716a48d94b06bb3b2524c2b77e055fb313aeb4ea620c8dd03a105574ba704f",
"sha256:cd5df75523866410809ca100dc9681e301e3c27567cf498077e8551b6d20e42f",
"sha256:cdb132fc825c38e1aeec2c8aa9338310d29d337bebbd7baa06889d09a60a1fa2",
"sha256:e249096428b3ae81b08327a63a485ad0878de3fb939049038579ac0ef61e17e7",
"sha256:e8313f01ba26fbbe36c7be1966a7b7424942f670f38e666995b88d012765b9be"
],
"version": "==1.1.1"
},
"pycparser": {
"hashes": [
"sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0",
"sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705"
],
"version": "==2.20"
},
"pyopenssl": {
"hashes": [
"sha256:621880965a720b8ece2f1b2f54ea2071966ab00e2970ad2ce11d596102063504",
"sha256:9a24494b2602aaf402be5c9e30a0b82d4a5c67528fe8fb475e3f3bc00dd69507"
],
"index": "pypi",
"version": "==19.1.0"
},
"six": {
"hashes": [
"sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259",
"sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced"
],
"version": "==1.15.0"
},
"werkzeug": {
"hashes": [
"sha256:2de2a5db0baeae7b2d2664949077c2ac63fbd16d98da0ff71837f7d1dea3fd43",
"sha256:6c80b1e5ad3665290ea39320b91e1be1e0d5f60652b964a3070216de83d2e47c"
],
"version": "==1.0.1"
}
},
"develop": {}
}
fido2-0.9.1/examples/server/README.adoc 0000644 0001750 0001750 00000004571 14006451303 017310 0 ustar dain dain 0000000 0000000 == WebAuthn Server Example
This example shows a minimal website that uses python-fido2 to implement
WebAuthn credential registration, and use.
=== Running
To run this sample, you will need `pipenv`. For instructions on installing
`pipenv`, see https://docs.pipenv.org.
Run the following command in the `examples/server` directory to set up the
example:
$ pipenv install
Once the environment has been created, you can run the server by running:
$ pipenv run server
When the server is running, use a browser supporting WebAuthn and open
https://localhost:5000 to access the website.
NOTE: As this server uses a self-signed certificate, you will get warnings in
your browser about the connection not being secure. This is expected, and you
can safely proceed to the site.
=== Using the website
The site allows you to register a WebAuthn credential, and to authenticate it.
Credentials are only stored in memory, and stopping the server will cause it to
"forget" any registered credentials.
==== Registration
1. Click on the `Register` link to begin credential registration.
2. If not already inserted, insert your U2F/FIDO2 Authenticator now.
3. Touch the button to activate the Authenticator.
4. A popup will indicate whether the registration was successful. Click `OK`.
==== Authentication
NOTE: You must register a credential prior to authentication.
1. Click on the `Authenticate` link to begin authentication.
2. If not already inserted, insert your U2F/FIDO2 Authenticator now.
3. Touch the button to activate the Authenticator.
4. A popup will indicate whether the authentication was successful. Click `OK`.
=== Supporting existing U2F credentials
If you have existing U2F credentials that you wish to support, this library
offers a U2FFido2Server class which can help with this. This directory includes
a slightly altered version of the example server which uses this class to
authenticate U2F credentials as well as WebAuthn credentials. To run this
version of the server, run:
$ pipenv run server-u2f
This version allows registration both using the newer WebAuthn APIs and by using
the legacy U2F APIs, so that you can test authentication using both credential
types. The source code for this version of the server is in `server-u2f.py`.
NOTE: There should be no need to support registration of new U2F credentials as
new registrations should be using the WebAuthn APIs, even for existing users.
fido2-0.9.1/examples/server/server-u2f.py 0000644 0001750 0001750 00000014051 14006451303 020067 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Example demo server to use a supported web browser to call the WebAuthn APIs
to register and use a credential.
See the file README.adoc in this directory for details.
Navigate to https://localhost:5000 in a supported web browser.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.webauthn import PublicKeyCredentialRpEntity
from fido2.client import ClientData
from fido2.server import U2FFido2Server
from fido2.ctap2 import AttestationObject, AuthenticatorData
from fido2.ctap1 import RegistrationData
from fido2.utils import sha256, websafe_encode
from fido2 import cbor
from flask import Flask, session, request, redirect, abort
import os
app = Flask(__name__, static_url_path="")
app.secret_key = os.urandom(32) # Used for session.
rp = PublicKeyCredentialRpEntity("localhost", "Demo server")
# By using the U2FFido2Server class, we can support existing credentials
# registered by the legacy u2f.register API for an appId.
server = U2FFido2Server("https://localhost:5000", rp)
# Registered credentials are stored globally, in memory only. Single user
# support, state is lost when the server terminates.
credentials = []
@app.route("/")
def index():
return redirect("/index-u2f.html")
@app.route("/api/register/begin", methods=["POST"])
def register_begin():
registration_data, state = server.register_begin(
{
"id": b"user_id",
"name": "a_user",
"displayName": "A. User",
"icon": "https://example.com/image.png",
},
credentials,
)
session["state"] = state
print("\n\n\n\n")
print(registration_data)
print("\n\n\n\n")
return cbor.encode(registration_data)
@app.route("/api/register/complete", methods=["POST"])
def register_complete():
data = cbor.decode(request.get_data())
client_data = ClientData(data["clientDataJSON"])
att_obj = AttestationObject(data["attestationObject"])
print("clientData", client_data)
print("AttestationObject:", att_obj)
auth_data = server.register_complete(session["state"], client_data, att_obj)
credentials.append(auth_data.credential_data)
print("REGISTERED CREDENTIAL:", auth_data.credential_data)
return cbor.encode({"status": "OK"})
@app.route("/api/authenticate/begin", methods=["POST"])
def authenticate_begin():
if not credentials:
abort(404)
auth_data, state = server.authenticate_begin(credentials)
session["state"] = state
return cbor.encode(auth_data)
@app.route("/api/authenticate/complete", methods=["POST"])
def authenticate_complete():
if not credentials:
abort(404)
data = cbor.decode(request.get_data())
credential_id = data["credentialId"]
client_data = ClientData(data["clientDataJSON"])
auth_data = AuthenticatorData(data["authenticatorData"])
signature = data["signature"]
print("clientData", client_data)
print("AuthenticatorData", auth_data)
server.authenticate_complete(
session.pop("state"),
credentials,
credential_id,
client_data,
auth_data,
signature,
)
print("ASSERTION OK")
return cbor.encode({"status": "OK"})
###############################################################################
# WARNING!
#
# The below functions allow the registration of legacy U2F credentials.
# This is provided FOR TESTING PURPOSES ONLY. New credentials should be
# registered using the WebAuthn APIs.
###############################################################################
@app.route("/api/u2f/begin", methods=["POST"])
def u2f_begin():
registration_data, state = server.register_begin(
{
"id": b"user_id",
"name": "a_user",
"displayName": "A. User",
"icon": "https://example.com/image.png",
},
credentials,
)
session["state"] = state
print("\n\n\n\n")
print(registration_data)
print("\n\n\n\n")
return cbor.encode(websafe_encode(registration_data["publicKey"]["challenge"]))
@app.route("/api/u2f/complete", methods=["POST"])
def u2f_complete():
data = cbor.decode(request.get_data())
client_data = ClientData.from_b64(data["clientData"])
reg_data = RegistrationData.from_b64(data["registrationData"])
print("clientData", client_data)
print("U2F RegistrationData:", reg_data)
att_obj = AttestationObject.from_ctap1(sha256(b"https://localhost:5000"), reg_data)
print("AttestationObject:", att_obj)
auth_data = att_obj.auth_data
credentials.append(auth_data.credential_data)
print("REGISTERED U2F CREDENTIAL:", auth_data.credential_data)
return cbor.encode({"status": "OK"})
if __name__ == "__main__":
print(__doc__)
app.run(ssl_context="adhoc", debug=False)
fido2-0.9.1/examples/server/server.py 0000644 0001750 0001750 00000010643 14006451303 017400 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Example demo server to use a supported web browser to call the WebAuthn APIs
to register and use a credential.
See the file README.adoc in this directory for details.
Navigate to https://localhost:5000 in a supported web browser.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.webauthn import PublicKeyCredentialRpEntity
from fido2.client import ClientData
from fido2.server import Fido2Server
from fido2.ctap2 import AttestationObject, AuthenticatorData
from fido2 import cbor
from flask import Flask, session, request, redirect, abort
import os
app = Flask(__name__, static_url_path="")
app.secret_key = os.urandom(32) # Used for session.
rp = PublicKeyCredentialRpEntity("localhost", "Demo server")
server = Fido2Server(rp)
# Registered credentials are stored globally, in memory only. Single user
# support, state is lost when the server terminates.
credentials = []
@app.route("/")
def index():
return redirect("/index.html")
@app.route("/api/register/begin", methods=["POST"])
def register_begin():
registration_data, state = server.register_begin(
{
"id": b"user_id",
"name": "a_user",
"displayName": "A. User",
"icon": "https://example.com/image.png",
},
credentials,
user_verification="discouraged",
authenticator_attachment="cross-platform",
)
session["state"] = state
print("\n\n\n\n")
print(registration_data)
print("\n\n\n\n")
return cbor.encode(registration_data)
@app.route("/api/register/complete", methods=["POST"])
def register_complete():
data = cbor.decode(request.get_data())
client_data = ClientData(data["clientDataJSON"])
att_obj = AttestationObject(data["attestationObject"])
print("clientData", client_data)
print("AttestationObject:", att_obj)
auth_data = server.register_complete(session["state"], client_data, att_obj)
credentials.append(auth_data.credential_data)
print("REGISTERED CREDENTIAL:", auth_data.credential_data)
return cbor.encode({"status": "OK"})
@app.route("/api/authenticate/begin", methods=["POST"])
def authenticate_begin():
if not credentials:
abort(404)
auth_data, state = server.authenticate_begin(credentials)
session["state"] = state
return cbor.encode(auth_data)
@app.route("/api/authenticate/complete", methods=["POST"])
def authenticate_complete():
if not credentials:
abort(404)
data = cbor.decode(request.get_data())
credential_id = data["credentialId"]
client_data = ClientData(data["clientDataJSON"])
auth_data = AuthenticatorData(data["authenticatorData"])
signature = data["signature"]
print("clientData", client_data)
print("AuthenticatorData", auth_data)
server.authenticate_complete(
session.pop("state"),
credentials,
credential_id,
client_data,
auth_data,
signature,
)
print("ASSERTION OK")
return cbor.encode({"status": "OK"})
if __name__ == "__main__":
print(__doc__)
app.run(ssl_context="adhoc", debug=False)
fido2-0.9.1/examples/server/static/ 0000755 0001750 0001750 00000000000 14006463366 017017 5 ustar dain dain 0000000 0000000 fido2-0.9.1/examples/server/static/authenticate.html 0000644 0001750 0001750 00000003262 14006451303 022352 0 ustar dain dain 0000000 0000000
Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Authenticate using a credential
Touch your authenticator device now...
Cancel
fido2-0.9.1/examples/server/static/cbor.js 0000644 0001750 0001750 00000027617 14006451303 020303 0 ustar dain dain 0000000 0000000 /*
* The MIT License (MIT)
*
* Copyright (c) 2014-2016 Patrick Gansterer
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
(function(global, undefined) { "use strict";
var POW_2_24 = 5.960464477539063e-8,
POW_2_32 = 4294967296,
POW_2_53 = 9007199254740992;
function encode(value) {
var data = new ArrayBuffer(256);
var dataView = new DataView(data);
var lastLength;
var offset = 0;
function prepareWrite(length) {
var newByteLength = data.byteLength;
var requiredLength = offset + length;
while (newByteLength < requiredLength)
newByteLength <<= 1;
if (newByteLength !== data.byteLength) {
var oldDataView = dataView;
data = new ArrayBuffer(newByteLength);
dataView = new DataView(data);
var uint32count = (offset + 3) >> 2;
for (var i = 0; i < uint32count; ++i)
dataView.setUint32(i << 2, oldDataView.getUint32(i << 2));
}
lastLength = length;
return dataView;
}
function commitWrite() {
offset += lastLength;
}
function writeFloat64(value) {
commitWrite(prepareWrite(8).setFloat64(offset, value));
}
function writeUint8(value) {
commitWrite(prepareWrite(1).setUint8(offset, value));
}
function writeUint8Array(value) {
var dataView = prepareWrite(value.length);
for (var i = 0; i < value.length; ++i)
dataView.setUint8(offset + i, value[i]);
commitWrite();
}
function writeUint16(value) {
commitWrite(prepareWrite(2).setUint16(offset, value));
}
function writeUint32(value) {
commitWrite(prepareWrite(4).setUint32(offset, value));
}
function writeUint64(value) {
var low = value % POW_2_32;
var high = (value - low) / POW_2_32;
var dataView = prepareWrite(8);
dataView.setUint32(offset, high);
dataView.setUint32(offset + 4, low);
commitWrite();
}
function writeTypeAndLength(type, length) {
if (length < 24) {
writeUint8(type << 5 | length);
} else if (length < 0x100) {
writeUint8(type << 5 | 24);
writeUint8(length);
} else if (length < 0x10000) {
writeUint8(type << 5 | 25);
writeUint16(length);
} else if (length < 0x100000000) {
writeUint8(type << 5 | 26);
writeUint32(length);
} else {
writeUint8(type << 5 | 27);
writeUint64(length);
}
}
function encodeItem(value) {
var i;
if (value === false)
return writeUint8(0xf4);
if (value === true)
return writeUint8(0xf5);
if (value === null)
return writeUint8(0xf6);
if (value === undefined)
return writeUint8(0xf7);
switch (typeof value) {
case "number":
if (Math.floor(value) === value) {
if (0 <= value && value <= POW_2_53)
return writeTypeAndLength(0, value);
if (-POW_2_53 <= value && value < 0)
return writeTypeAndLength(1, -(value + 1));
}
writeUint8(0xfb);
return writeFloat64(value);
case "string":
var utf8data = [];
for (i = 0; i < value.length; ++i) {
var charCode = value.charCodeAt(i);
if (charCode < 0x80) {
utf8data.push(charCode);
} else if (charCode < 0x800) {
utf8data.push(0xc0 | charCode >> 6);
utf8data.push(0x80 | charCode & 0x3f);
} else if (charCode < 0xd800) {
utf8data.push(0xe0 | charCode >> 12);
utf8data.push(0x80 | (charCode >> 6) & 0x3f);
utf8data.push(0x80 | charCode & 0x3f);
} else {
charCode = (charCode & 0x3ff) << 10;
charCode |= value.charCodeAt(++i) & 0x3ff;
charCode += 0x10000;
utf8data.push(0xf0 | charCode >> 18);
utf8data.push(0x80 | (charCode >> 12) & 0x3f);
utf8data.push(0x80 | (charCode >> 6) & 0x3f);
utf8data.push(0x80 | charCode & 0x3f);
}
}
writeTypeAndLength(3, utf8data.length);
return writeUint8Array(utf8data);
default:
var length;
if (Array.isArray(value)) {
length = value.length;
writeTypeAndLength(4, length);
for (i = 0; i < length; ++i)
encodeItem(value[i]);
} else if (value instanceof Uint8Array) {
writeTypeAndLength(2, value.length);
writeUint8Array(value);
} else {
var keys = Object.keys(value);
length = keys.length;
writeTypeAndLength(5, length);
for (i = 0; i < length; ++i) {
var key = keys[i];
encodeItem(key);
encodeItem(value[key]);
}
}
}
}
encodeItem(value);
if ("slice" in data)
return data.slice(0, offset);
var ret = new ArrayBuffer(offset);
var retView = new DataView(ret);
for (var i = 0; i < offset; ++i)
retView.setUint8(i, dataView.getUint8(i));
return ret;
}
function decode(data, tagger, simpleValue) {
var dataView = new DataView(data);
var offset = 0;
if (typeof tagger !== "function")
tagger = function(value) { return value; };
if (typeof simpleValue !== "function")
simpleValue = function() { return undefined; };
function commitRead(length, value) {
offset += length;
return value;
}
function readArrayBuffer(length) {
return commitRead(length, new Uint8Array(data, offset, length));
}
function readFloat16() {
var tempArrayBuffer = new ArrayBuffer(4);
var tempDataView = new DataView(tempArrayBuffer);
var value = readUint16();
var sign = value & 0x8000;
var exponent = value & 0x7c00;
var fraction = value & 0x03ff;
if (exponent === 0x7c00)
exponent = 0xff << 10;
else if (exponent !== 0)
exponent += (127 - 15) << 10;
else if (fraction !== 0)
return (sign ? -1 : 1) * fraction * POW_2_24;
tempDataView.setUint32(0, sign << 16 | exponent << 13 | fraction << 13);
return tempDataView.getFloat32(0);
}
function readFloat32() {
return commitRead(4, dataView.getFloat32(offset));
}
function readFloat64() {
return commitRead(8, dataView.getFloat64(offset));
}
function readUint8() {
return commitRead(1, dataView.getUint8(offset));
}
function readUint16() {
return commitRead(2, dataView.getUint16(offset));
}
function readUint32() {
return commitRead(4, dataView.getUint32(offset));
}
function readUint64() {
return readUint32() * POW_2_32 + readUint32();
}
function readBreak() {
if (dataView.getUint8(offset) !== 0xff)
return false;
offset += 1;
return true;
}
function readLength(additionalInformation) {
if (additionalInformation < 24)
return additionalInformation;
if (additionalInformation === 24)
return readUint8();
if (additionalInformation === 25)
return readUint16();
if (additionalInformation === 26)
return readUint32();
if (additionalInformation === 27)
return readUint64();
if (additionalInformation === 31)
return -1;
throw "Invalid length encoding";
}
function readIndefiniteStringLength(majorType) {
var initialByte = readUint8();
if (initialByte === 0xff)
return -1;
var length = readLength(initialByte & 0x1f);
if (length < 0 || (initialByte >> 5) !== majorType)
throw "Invalid indefinite length element";
return length;
}
function appendUtf16Data(utf16data, length) {
for (var i = 0; i < length; ++i) {
var value = readUint8();
if (value & 0x80) {
if (value < 0xe0) {
value = (value & 0x1f) << 6
| (readUint8() & 0x3f);
length -= 1;
} else if (value < 0xf0) {
value = (value & 0x0f) << 12
| (readUint8() & 0x3f) << 6
| (readUint8() & 0x3f);
length -= 2;
} else {
value = (value & 0x0f) << 18
| (readUint8() & 0x3f) << 12
| (readUint8() & 0x3f) << 6
| (readUint8() & 0x3f);
length -= 3;
}
}
if (value < 0x10000) {
utf16data.push(value);
} else {
value -= 0x10000;
utf16data.push(0xd800 | (value >> 10));
utf16data.push(0xdc00 | (value & 0x3ff));
}
}
}
function decodeItem() {
var initialByte = readUint8();
var majorType = initialByte >> 5;
var additionalInformation = initialByte & 0x1f;
var i;
var length;
if (majorType === 7) {
switch (additionalInformation) {
case 25:
return readFloat16();
case 26:
return readFloat32();
case 27:
return readFloat64();
}
}
length = readLength(additionalInformation);
if (length < 0 && (majorType < 2 || 6 < majorType))
throw "Invalid length";
switch (majorType) {
case 0:
return length;
case 1:
return -1 - length;
case 2:
if (length < 0) {
var elements = [];
var fullArrayLength = 0;
while ((length = readIndefiniteStringLength(majorType)) >= 0) {
fullArrayLength += length;
elements.push(readArrayBuffer(length));
}
var fullArray = new Uint8Array(fullArrayLength);
var fullArrayOffset = 0;
for (i = 0; i < elements.length; ++i) {
fullArray.set(elements[i], fullArrayOffset);
fullArrayOffset += elements[i].length;
}
return fullArray;
}
return readArrayBuffer(length);
case 3:
var utf16data = [];
if (length < 0) {
while ((length = readIndefiniteStringLength(majorType)) >= 0)
appendUtf16Data(utf16data, length);
} else
appendUtf16Data(utf16data, length);
return String.fromCharCode.apply(null, utf16data);
case 4:
var retArray;
if (length < 0) {
retArray = [];
while (!readBreak())
retArray.push(decodeItem());
} else {
retArray = new Array(length);
for (i = 0; i < length; ++i)
retArray[i] = decodeItem();
}
return retArray;
case 5:
var retObject = {};
for (i = 0; i < length || length < 0 && !readBreak(); ++i) {
var key = decodeItem();
retObject[key] = decodeItem();
}
return retObject;
case 6:
return tagger(decodeItem(), length);
case 7:
switch (length) {
case 20:
return false;
case 21:
return true;
case 22:
return null;
case 23:
return undefined;
default:
return simpleValue(length);
}
}
}
var ret = decodeItem();
if (offset !== data.byteLength)
throw "Remaining bytes";
return ret;
}
var obj = { encode: encode, decode: decode };
if (typeof define === "function" && define.amd)
define("cbor/cbor", obj);
else if (typeof module !== "undefined" && module.exports)
module.exports = obj;
else if (!global.CBOR)
global.CBOR = obj;
})(this);
fido2-0.9.1/examples/server/static/index-u2f.html 0000644 0001750 0001750 00000001401 14006451303 021466 0 ustar dain dain 0000000 0000000
Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Available actions
Register
Authenticate
To allow the testing of authenticating with legacy U2F credentials, you can
also register a U2F credential:
Register U2F
fido2-0.9.1/examples/server/static/index.html 0000644 0001750 0001750 00000001134 14006451303 020777 0 ustar dain dain 0000000 0000000
Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Available actions
Register
Authenticate
fido2-0.9.1/examples/server/static/register.html 0000644 0001750 0001750 00000003041 14006451303 021513 0 ustar dain dain 0000000 0000000
Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Register a credential
Touch your authenticator device now...
Cancel
fido2-0.9.1/examples/server/static/u2f-api.js 0000644 0001750 0001750 00000050620 14006451303 020607 0 ustar dain dain 0000000 0000000 //Copyright 2014-2015 Google Inc. All rights reserved.
//Use of this source code is governed by a BSD-style
//license that can be found in the LICENSE file or at
//https://developers.google.com/open-source/licenses/bsd
/**
* @fileoverview The U2F api.
*/
'use strict';
/**
* Namespace for the U2F api.
* @type {Object}
*/
var u2f = u2f || {};
/**
* FIDO U2F Javascript API Version
* @number
*/
var js_api_version;
/**
* The U2F extension id
* @const {string}
*/
// The Chrome packaged app extension ID.
// Uncomment this if you want to deploy a server instance that uses
// the package Chrome app and does not require installing the U2F Chrome extension.
u2f.EXTENSION_ID = 'kmendfapggjehodndflmmgagdbamhnfd';
// The U2F Chrome extension ID.
// Uncomment this if you want to deploy a server instance that uses
// the U2F Chrome extension to authenticate.
// u2f.EXTENSION_ID = 'pfboblefjcgdjicmnffhdgionmgcdmne';
/**
* Message types for messsages to/from the extension
* @const
* @enum {string}
*/
u2f.MessageTypes = {
'U2F_REGISTER_REQUEST': 'u2f_register_request',
'U2F_REGISTER_RESPONSE': 'u2f_register_response',
'U2F_SIGN_REQUEST': 'u2f_sign_request',
'U2F_SIGN_RESPONSE': 'u2f_sign_response',
'U2F_GET_API_VERSION_REQUEST': 'u2f_get_api_version_request',
'U2F_GET_API_VERSION_RESPONSE': 'u2f_get_api_version_response'
};
/**
* Response status codes
* @const
* @enum {number}
*/
u2f.ErrorCodes = {
'OK': 0,
'OTHER_ERROR': 1,
'BAD_REQUEST': 2,
'CONFIGURATION_UNSUPPORTED': 3,
'DEVICE_INELIGIBLE': 4,
'TIMEOUT': 5
};
/**
* A message for registration requests
* @typedef {{
* type: u2f.MessageTypes,
* appId: ?string,
* timeoutSeconds: ?number,
* requestId: ?number
* }}
*/
u2f.U2fRequest;
/**
* A message for registration responses
* @typedef {{
* type: u2f.MessageTypes,
* responseData: (u2f.Error | u2f.RegisterResponse | u2f.SignResponse),
* requestId: ?number
* }}
*/
u2f.U2fResponse;
/**
* An error object for responses
* @typedef {{
* errorCode: u2f.ErrorCodes,
* errorMessage: ?string
* }}
*/
u2f.Error;
/**
* Data object for a single sign request.
* @typedef {enum {BLUETOOTH_RADIO, BLUETOOTH_LOW_ENERGY, USB, NFC}}
*/
u2f.Transport;
/**
* Data object for a single sign request.
* @typedef {Array}
*/
u2f.Transports;
/**
* Data object for a single sign request.
* @typedef {{
* version: string,
* challenge: string,
* keyHandle: string,
* appId: string
* }}
*/
u2f.SignRequest;
/**
* Data object for a sign response.
* @typedef {{
* keyHandle: string,
* signatureData: string,
* clientData: string
* }}
*/
u2f.SignResponse;
/**
* Data object for a registration request.
* @typedef {{
* version: string,
* challenge: string
* }}
*/
u2f.RegisterRequest;
/**
* Data object for a registration response.
* @typedef {{
* version: string,
* keyHandle: string,
* transports: Transports,
* appId: string
* }}
*/
u2f.RegisterResponse;
/**
* Data object for a registered key.
* @typedef {{
* version: string,
* keyHandle: string,
* transports: ?Transports,
* appId: ?string
* }}
*/
u2f.RegisteredKey;
/**
* Data object for a get API register response.
* @typedef {{
* js_api_version: number
* }}
*/
u2f.GetJsApiVersionResponse;
//Low level MessagePort API support
/**
* Sets up a MessagePort to the U2F extension using the
* available mechanisms.
* @param {function((MessagePort|u2f.WrappedChromeRuntimePort_))} callback
*/
u2f.getMessagePort = function(callback) {
if (typeof chrome != 'undefined' && chrome.runtime) {
// The actual message here does not matter, but we need to get a reply
// for the callback to run. Thus, send an empty signature request
// in order to get a failure response.
var msg = {
type: u2f.MessageTypes.U2F_SIGN_REQUEST,
signRequests: []
};
chrome.runtime.sendMessage(u2f.EXTENSION_ID, msg, function() {
if (!chrome.runtime.lastError) {
// We are on a whitelisted origin and can talk directly
// with the extension.
u2f.getChromeRuntimePort_(callback);
} else {
// chrome.runtime was available, but we couldn't message
// the extension directly, use iframe
u2f.getIframePort_(callback);
}
});
} else if (u2f.isAndroidChrome_()) {
u2f.getAuthenticatorPort_(callback);
} else if (u2f.isIosChrome_()) {
u2f.getIosPort_(callback);
} else {
// chrome.runtime was not available at all, which is normal
// when this origin doesn't have access to any extensions.
u2f.getIframePort_(callback);
}
};
/**
* Detect chrome running on android based on the browser's useragent.
* @private
*/
u2f.isAndroidChrome_ = function() {
var userAgent = navigator.userAgent;
return userAgent.indexOf('Chrome') != -1 &&
userAgent.indexOf('Android') != -1;
};
/**
* Detect chrome running on iOS based on the browser's platform.
* @private
*/
u2f.isIosChrome_ = function() {
return ["iPhone", "iPad", "iPod"].indexOf(navigator.platform) > -1;
};
/**
* Connects directly to the extension via chrome.runtime.connect.
* @param {function(u2f.WrappedChromeRuntimePort_)} callback
* @private
*/
u2f.getChromeRuntimePort_ = function(callback) {
var port = chrome.runtime.connect(u2f.EXTENSION_ID,
{'includeTlsChannelId': true});
setTimeout(function() {
callback(new u2f.WrappedChromeRuntimePort_(port));
}, 0);
};
/**
* Return a 'port' abstraction to the Authenticator app.
* @param {function(u2f.WrappedAuthenticatorPort_)} callback
* @private
*/
u2f.getAuthenticatorPort_ = function(callback) {
setTimeout(function() {
callback(new u2f.WrappedAuthenticatorPort_());
}, 0);
};
/**
* Return a 'port' abstraction to the iOS client app.
* @param {function(u2f.WrappedIosPort_)} callback
* @private
*/
u2f.getIosPort_ = function(callback) {
setTimeout(function() {
callback(new u2f.WrappedIosPort_());
}, 0);
};
/**
* A wrapper for chrome.runtime.Port that is compatible with MessagePort.
* @param {Port} port
* @constructor
* @private
*/
u2f.WrappedChromeRuntimePort_ = function(port) {
this.port_ = port;
};
/**
* Format and return a sign request compliant with the JS API version supported by the extension.
* @param {Array} signRequests
* @param {number} timeoutSeconds
* @param {number} reqId
* @return {Object}
*/
u2f.formatSignRequest_ =
function(appId, challenge, registeredKeys, timeoutSeconds, reqId) {
if (js_api_version === undefined || js_api_version < 1.1) {
// Adapt request to the 1.0 JS API
var signRequests = [];
for (var i = 0; i < registeredKeys.length; i++) {
signRequests[i] = {
version: registeredKeys[i].version,
challenge: challenge,
keyHandle: registeredKeys[i].keyHandle,
appId: appId
};
}
return {
type: u2f.MessageTypes.U2F_SIGN_REQUEST,
signRequests: signRequests,
timeoutSeconds: timeoutSeconds,
requestId: reqId
};
}
// JS 1.1 API
return {
type: u2f.MessageTypes.U2F_SIGN_REQUEST,
appId: appId,
challenge: challenge,
registeredKeys: registeredKeys,
timeoutSeconds: timeoutSeconds,
requestId: reqId
};
};
/**
* Format and return a register request compliant with the JS API version supported by the extension..
* @param {Array} signRequests
* @param {Array} signRequests
* @param {number} timeoutSeconds
* @param {number} reqId
* @return {Object}
*/
u2f.formatRegisterRequest_ =
function(appId, registeredKeys, registerRequests, timeoutSeconds, reqId) {
if (js_api_version === undefined || js_api_version < 1.1) {
// Adapt request to the 1.0 JS API
for (var i = 0; i < registerRequests.length; i++) {
registerRequests[i].appId = appId;
}
var signRequests = [];
for (var i = 0; i < registeredKeys.length; i++) {
signRequests[i] = {
version: registeredKeys[i].version,
challenge: registerRequests[0],
keyHandle: registeredKeys[i].keyHandle,
appId: appId
};
}
return {
type: u2f.MessageTypes.U2F_REGISTER_REQUEST,
signRequests: signRequests,
registerRequests: registerRequests,
timeoutSeconds: timeoutSeconds,
requestId: reqId
};
}
// JS 1.1 API
return {
type: u2f.MessageTypes.U2F_REGISTER_REQUEST,
appId: appId,
registerRequests: registerRequests,
registeredKeys: registeredKeys,
timeoutSeconds: timeoutSeconds,
requestId: reqId
};
};
/**
* Posts a message on the underlying channel.
* @param {Object} message
*/
u2f.WrappedChromeRuntimePort_.prototype.postMessage = function(message) {
this.port_.postMessage(message);
};
/**
* Emulates the HTML 5 addEventListener interface. Works only for the
* onmessage event, which is hooked up to the chrome.runtime.Port.onMessage.
* @param {string} eventName
* @param {function({data: Object})} handler
*/
u2f.WrappedChromeRuntimePort_.prototype.addEventListener =
function(eventName, handler) {
var name = eventName.toLowerCase();
if (name == 'message' || name == 'onmessage') {
this.port_.onMessage.addListener(function(message) {
// Emulate a minimal MessageEvent object
handler({'data': message});
});
} else {
console.error('WrappedChromeRuntimePort only supports onMessage');
}
};
/**
* Wrap the Authenticator app with a MessagePort interface.
* @constructor
* @private
*/
u2f.WrappedAuthenticatorPort_ = function() {
this.requestId_ = -1;
this.requestObject_ = null;
}
/**
* Launch the Authenticator intent.
* @param {Object} message
*/
u2f.WrappedAuthenticatorPort_.prototype.postMessage = function(message) {
var intentUrl =
u2f.WrappedAuthenticatorPort_.INTENT_URL_BASE_ +
';S.request=' + encodeURIComponent(JSON.stringify(message)) +
';end';
document.location = intentUrl;
};
/**
* Tells what type of port this is.
* @return {String} port type
*/
u2f.WrappedAuthenticatorPort_.prototype.getPortType = function() {
return "WrappedAuthenticatorPort_";
};
/**
* Emulates the HTML 5 addEventListener interface.
* @param {string} eventName
* @param {function({data: Object})} handler
*/
u2f.WrappedAuthenticatorPort_.prototype.addEventListener = function(eventName, handler) {
var name = eventName.toLowerCase();
if (name == 'message') {
var self = this;
/* Register a callback to that executes when
* chrome injects the response. */
window.addEventListener(
'message', self.onRequestUpdate_.bind(self, handler), false);
} else {
console.error('WrappedAuthenticatorPort only supports message');
}
};
/**
* Callback invoked when a response is received from the Authenticator.
* @param function({data: Object}) callback
* @param {Object} message message Object
*/
u2f.WrappedAuthenticatorPort_.prototype.onRequestUpdate_ =
function(callback, message) {
var messageObject = JSON.parse(message.data);
var intentUrl = messageObject['intentURL'];
var errorCode = messageObject['errorCode'];
var responseObject = null;
if (messageObject.hasOwnProperty('data')) {
responseObject = /** @type {Object} */ (
JSON.parse(messageObject['data']));
}
callback({'data': responseObject});
};
/**
* Base URL for intents to Authenticator.
* @const
* @private
*/
u2f.WrappedAuthenticatorPort_.INTENT_URL_BASE_ =
'intent:#Intent;action=com.google.android.apps.authenticator.AUTHENTICATE';
/**
* Wrap the iOS client app with a MessagePort interface.
* @constructor
* @private
*/
u2f.WrappedIosPort_ = function() {};
/**
* Launch the iOS client app request
* @param {Object} message
*/
u2f.WrappedIosPort_.prototype.postMessage = function(message) {
var str = JSON.stringify(message);
var url = "u2f://auth?" + encodeURI(str);
location.replace(url);
};
/**
* Tells what type of port this is.
* @return {String} port type
*/
u2f.WrappedIosPort_.prototype.getPortType = function() {
return "WrappedIosPort_";
};
/**
* Emulates the HTML 5 addEventListener interface.
* @param {string} eventName
* @param {function({data: Object})} handler
*/
u2f.WrappedIosPort_.prototype.addEventListener = function(eventName, handler) {
var name = eventName.toLowerCase();
if (name !== 'message') {
console.error('WrappedIosPort only supports message');
}
};
/**
* Sets up an embedded trampoline iframe, sourced from the extension.
* @param {function(MessagePort)} callback
* @private
*/
u2f.getIframePort_ = function(callback) {
// Create the iframe
var iframeOrigin = 'chrome-extension://' + u2f.EXTENSION_ID;
var iframe = document.createElement('iframe');
iframe.src = iframeOrigin + '/u2f-comms.html';
iframe.setAttribute('style', 'display:none');
document.body.appendChild(iframe);
var channel = new MessageChannel();
var ready = function(message) {
if (message.data == 'ready') {
channel.port1.removeEventListener('message', ready);
callback(channel.port1);
} else {
console.error('First event on iframe port was not "ready"');
}
};
channel.port1.addEventListener('message', ready);
channel.port1.start();
iframe.addEventListener('load', function() {
// Deliver the port to the iframe and initialize
iframe.contentWindow.postMessage('init', iframeOrigin, [channel.port2]);
});
};
//High-level JS API
/**
* Default extension response timeout in seconds.
* @const
*/
u2f.EXTENSION_TIMEOUT_SEC = 30;
/**
* A singleton instance for a MessagePort to the extension.
* @type {MessagePort|u2f.WrappedChromeRuntimePort_}
* @private
*/
u2f.port_ = null;
/**
* Callbacks waiting for a port
* @type {Array}
* @private
*/
u2f.waitingForPort_ = [];
/**
* A counter for requestIds.
* @type {number}
* @private
*/
u2f.reqCounter_ = 0;
/**
* A map from requestIds to client callbacks
* @type {Object.}
* @private
*/
u2f.callbackMap_ = {};
/**
* Creates or retrieves the MessagePort singleton to use.
* @param {function((MessagePort|u2f.WrappedChromeRuntimePort_))} callback
* @private
*/
u2f.getPortSingleton_ = function(callback) {
if (u2f.port_) {
callback(u2f.port_);
} else {
if (u2f.waitingForPort_.length == 0) {
u2f.getMessagePort(function(port) {
u2f.port_ = port;
u2f.port_.addEventListener('message',
/** @type {function(Event)} */ (u2f.responseHandler_));
// Careful, here be async callbacks. Maybe.
while (u2f.waitingForPort_.length)
u2f.waitingForPort_.shift()(u2f.port_);
});
}
u2f.waitingForPort_.push(callback);
}
};
/**
* Handles response messages from the extension.
* @param {MessageEvent.} message
* @private
*/
u2f.responseHandler_ = function(message) {
var response = message.data;
var reqId = response['requestId'];
if (!reqId || !u2f.callbackMap_[reqId]) {
console.error('Unknown or missing requestId in response.');
return;
}
var cb = u2f.callbackMap_[reqId];
delete u2f.callbackMap_[reqId];
cb(response['responseData']);
};
/**
* Dispatches an array of sign requests to available U2F tokens.
* If the JS API version supported by the extension is unknown, it first sends a
* message to the extension to find out the supported API version and then it sends
* the sign request.
* @param {string=} appId
* @param {string=} challenge
* @param {Array} registeredKeys
* @param {function((u2f.Error|u2f.SignResponse))} callback
* @param {number=} opt_timeoutSeconds
*/
u2f.sign = function(appId, challenge, registeredKeys, callback, opt_timeoutSeconds) {
if (js_api_version === undefined) {
// Send a message to get the extension to JS API version, then send the actual sign request.
u2f.getApiVersion(
function (response) {
js_api_version = response['js_api_version'] === undefined ? 0 : response['js_api_version'];
console.log("Extension JS API Version: ", js_api_version);
u2f.sendSignRequest(appId, challenge, registeredKeys, callback, opt_timeoutSeconds);
});
} else {
// We know the JS API version. Send the actual sign request in the supported API version.
u2f.sendSignRequest(appId, challenge, registeredKeys, callback, opt_timeoutSeconds);
}
};
/**
* Dispatches an array of sign requests to available U2F tokens.
* @param {string=} appId
* @param {string=} challenge
* @param {Array} registeredKeys
* @param {function((u2f.Error|u2f.SignResponse))} callback
* @param {number=} opt_timeoutSeconds
*/
u2f.sendSignRequest = function(appId, challenge, registeredKeys, callback, opt_timeoutSeconds) {
u2f.getPortSingleton_(function(port) {
var reqId = ++u2f.reqCounter_;
u2f.callbackMap_[reqId] = callback;
var timeoutSeconds = (typeof opt_timeoutSeconds !== 'undefined' ?
opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC);
var req = u2f.formatSignRequest_(appId, challenge, registeredKeys, timeoutSeconds, reqId);
port.postMessage(req);
});
};
/**
* Dispatches register requests to available U2F tokens. An array of sign
* requests identifies already registered tokens.
* If the JS API version supported by the extension is unknown, it first sends a
* message to the extension to find out the supported API version and then it sends
* the register request.
* @param {string=} appId
* @param {Array} registerRequests
* @param {Array} registeredKeys
* @param {function((u2f.Error|u2f.RegisterResponse))} callback
* @param {number=} opt_timeoutSeconds
*/
u2f.register = function(appId, registerRequests, registeredKeys, callback, opt_timeoutSeconds) {
if (js_api_version === undefined) {
// Send a message to get the extension to JS API version, then send the actual register request.
u2f.getApiVersion(
function (response) {
js_api_version = response['js_api_version'] === undefined ? 0: response['js_api_version'];
console.log("Extension JS API Version: ", js_api_version);
u2f.sendRegisterRequest(appId, registerRequests, registeredKeys,
callback, opt_timeoutSeconds);
});
} else {
// We know the JS API version. Send the actual register request in the supported API version.
u2f.sendRegisterRequest(appId, registerRequests, registeredKeys,
callback, opt_timeoutSeconds);
}
};
/**
* Dispatches register requests to available U2F tokens. An array of sign
* requests identifies already registered tokens.
* @param {string=} appId
* @param {Array} registerRequests
* @param {Array} registeredKeys
* @param {function((u2f.Error|u2f.RegisterResponse))} callback
* @param {number=} opt_timeoutSeconds
*/
u2f.sendRegisterRequest = function(appId, registerRequests, registeredKeys, callback, opt_timeoutSeconds) {
u2f.getPortSingleton_(function(port) {
var reqId = ++u2f.reqCounter_;
u2f.callbackMap_[reqId] = callback;
var timeoutSeconds = (typeof opt_timeoutSeconds !== 'undefined' ?
opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC);
var req = u2f.formatRegisterRequest_(
appId, registeredKeys, registerRequests, timeoutSeconds, reqId);
port.postMessage(req);
});
};
/**
* Dispatches a message to the extension to find out the supported
* JS API version.
* If the user is on a mobile phone and is thus using Google Authenticator instead
* of the Chrome extension, don't send the request and simply return 0.
* @param {function((u2f.Error|u2f.GetJsApiVersionResponse))} callback
* @param {number=} opt_timeoutSeconds
*/
u2f.getApiVersion = function(callback, opt_timeoutSeconds) {
u2f.getPortSingleton_(function(port) {
// If we are using Android Google Authenticator or iOS client app,
// do not fire an intent to ask which JS API version to use.
if (port.getPortType) {
var apiVersion;
switch (port.getPortType()) {
case 'WrappedIosPort_':
case 'WrappedAuthenticatorPort_':
apiVersion = 1.1;
break;
default:
apiVersion = 0;
break;
}
callback({ 'js_api_version': apiVersion });
return;
}
var reqId = ++u2f.reqCounter_;
u2f.callbackMap_[reqId] = callback;
var req = {
type: u2f.MessageTypes.U2F_GET_API_VERSION_REQUEST,
timeoutSeconds: (typeof opt_timeoutSeconds !== 'undefined' ?
opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC),
requestId: reqId
};
port.postMessage(req);
});
};
fido2-0.9.1/examples/server/static/u2f.html 0000644 0001750 0001750 00000003325 14006451303 020370 0 ustar dain dain 0000000 0000000
Fido 2.0 webauthn demo
WebAuthn demo using python-fido2
This demo requires a browser supporting the WebAuthn API!
Register a U2F credential
Touch your authenticator device now...
Cancel
fido2-0.9.1/examples/test_config.py 0000644 0001750 0001750 00000005047 14005771254 017103 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to the first FIDO device found which supports Authenticator Config.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.ctap2 import Ctap2
from fido2.ctap2.pin import ClientPin, PERMISSIONS
from fido2.ctap2.config import Config
from getpass import getpass
import sys
try:
from fido2.pcsc import CtapPcscDevice
except ImportError:
CtapPcscDevice = None
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
# Locate a device
for dev in enumerate_devices():
ctap = Ctap2(dev)
if ctap.info.options.get("authnrCfg"):
break
else:
print("No Authenticator with the MinPinLength extension found!")
sys.exit(1)
use_nfc = CtapPcscDevice and isinstance(dev, CtapPcscDevice)
if not ctap.info.options.get("clientPin"):
print("PIN must be configured")
sys.exit(1)
pin = getpass("Please enter PIN:")
client_pin = ClientPin(ctap)
token = client_pin.get_pin_token(pin, PERMISSIONS.AUTHENTICATOR_CFG)
config = Config(ctap, client_pin.protocol, token)
config.set_min_pin_length(8)
fido2-0.9.1/examples/u2f_nfc.py 0000644 0001750 0001750 00000001742 14002014354 016103 0 ustar dain dain 0000000 0000000 from fido2.pcsc import CtapPcscDevice
from fido2.utils import sha256
from fido2.ctap1 import CTAP1
import sys
dev = next(CtapPcscDevice.list_devices(), None)
if not dev:
print("No NFC u2f device found")
sys.exit(1)
chal = sha256(b"AAA")
appid = sha256(b"BBB")
ctap1 = CTAP1(dev)
print("version:", ctap1.get_version())
# True - make extended APDU and send it to key
# ISO 7816-3:2006. page 33, 12.1.3 Decoding conventions for command APDUs
# ISO 7816-3:2006. page 34, 12.2 Command-response pair transmission by T=0
# False - make group of short (less than 255 bytes length) APDU
# and send them to key. ISO 7816-3:2005, page 9, 5.1.1.1 Command chaining
dev.use_ext_apdu = False
reg = ctap1.register(chal, appid)
print("register:", reg)
reg.verify(appid, chal)
print("Register message verify OK")
auth = ctap1.authenticate(chal, appid, reg.key_handle)
print("authenticate result: ", auth)
res = auth.verify(appid, chal, reg.public_key)
print("Authenticate message verify OK")
fido2-0.9.1/examples/verify_attestation.py 0000644 0001750 0001750 00000013151 14002014354 020501 0 ustar dain dain 0000000 0000000 # Copyright (c) 2021 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
This example shows how to use an AttestationVerifier to only allow credentials signed
by a specific CA.
It connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and verifies that attestation is signed by the
Yubico FIDO root CA (this will only work for Yubico devices).
On Windows, the native WebAuthn API will be used.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client, WindowsClient
from fido2.server import Fido2Server, AttestationVerifier
from base64 import b64decode
from getpass import getpass
from binascii import b2a_hex
import sys
import ctypes
# Official Yubico root CA for FIDO Authenticators
YUBICO_CA = b64decode(
"""
MIIDHjCCAgagAwIBAgIEG0BT9zANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZ
dWJpY28gVTJGIFJvb3QgQ0EgU2VyaWFsIDQ1NzIwMDYzMTAgFw0xNDA4MDEwMDAw
MDBaGA8yMDUwMDkwNDAwMDAwMFowLjEsMCoGA1UEAxMjWXViaWNvIFUyRiBSb290
IENBIFNlcmlhbCA0NTcyMDA2MzEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC/jwYuhBVlqaiYWEMsrWFisgJ+PtM91eSrpI4TK7U53mwCIawSDHy8vUmk
5N2KAj9abvT9NP5SMS1hQi3usxoYGonXQgfO6ZXyUA9a+KAkqdFnBnlyugSeCOep
8EdZFfsaRFtMjkwz5Gcz2Py4vIYvCdMHPtwaz0bVuzneueIEz6TnQjE63Rdt2zbw
nebwTG5ZybeWSwbzy+BJ34ZHcUhPAY89yJQXuE0IzMZFcEBbPNRbWECRKgjq//qT
9nmDOFVlSRCt2wiqPSzluwn+v+suQEBsUjTGMEd25tKXXTkNW21wIWbxeSyUoTXw
LvGS6xlwQSgNpk2qXYwf8iXg7VWZAgMBAAGjQjBAMB0GA1UdDgQWBBQgIvz0bNGJ
hjgpToksyKpP9xv9oDAPBgNVHRMECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAN
BgkqhkiG9w0BAQsFAAOCAQEAjvjuOMDSa+JXFCLyBKsycXtBVZsJ4Ue3LbaEsPY4
MYN/hIQ5ZM5p7EjfcnMG4CtYkNsfNHc0AhBLdq45rnT87q/6O3vUEtNMafbhU6kt
hX7Y+9XFN9NpmYxr+ekVY5xOxi8h9JDIgoMP4VB1uS0aunL1IGqrNooL9mmFnL2k
LVVee6/VR6C5+KSTCMCWppMuJIZII2v9o4dkoZ8Y7QRjQlLfYzd3qGtKbw7xaF1U
sG/5xUb/Btwb2X2g4InpiB/yt/3CpQXpiWX/K4mBvUKiGn05ZsqeY1gx4g0xLBqc
U9psmyPzK+Vsgw2jeRQ5JlKDyqE0hebfC1tvFu0CCrJFcw==
"""
)
class YubicoAttestationVerifier(AttestationVerifier):
"""Example implementation of an AttestationVerifier.
This simple example will attempt to verify all trust paths using the Yubico CA.
A real implementation can use the information in the attestation result, or the
authenticator data, to determine which CA should be used to verify the path.
"""
def ca_lookup(self, result, auth_data):
return [YUBICO_CA]
use_prompt = False
pin = None
uv = "discouraged"
if WindowsClient.is_available() and not ctypes.windll.shell32.IsUserAnAdmin():
# Use the Windows WebAuthn API if available, and we're not running as admin
client = WindowsClient("https://example.com")
else:
# Locate a device
dev = next(CtapHidDevice.list_devices(), None)
if dev is not None:
print("Use USB HID channel.")
use_prompt = True
else:
try:
from fido2.pcsc import CtapPcscDevice
dev = next(CtapPcscDevice.list_devices(), None)
print("Use NFC channel.")
except Exception as e:
print("NFC channel search error:", e)
if not dev:
print("No FIDO device found")
sys.exit(1)
# Set up a FIDO 2 client using the origin https://example.com
client = Fido2Client(dev, "https://example.com")
# Prefer UV if supported
if client.info.options.get("uv"):
uv = "preferred"
print("Authenticator supports User Verification")
elif client.info.options.get("clientPin"):
# Prompt for PIN if needed
pin = getpass("Please enter PIN: ")
else:
print("PIN not set, won't use")
server = Fido2Server(
{"id": "example.com", "name": "Example RP"},
attestation="direct",
verify_attestation=YubicoAttestationVerifier(),
)
user = {"id": b"user_id", "name": "A. User"}
# Prepare parameters for makeCredential
create_options, state = server.register_begin(
user, user_verification=uv, authenticator_attachment="cross-platform"
)
# Create a credential
if use_prompt:
print("\nTouch your authenticator device now...\n")
result = client.make_credential(create_options["publicKey"], pin=pin)
# Complete registration
auth_data = server.register_complete(
state, result.client_data, result.attestation_object
)
credentials = [auth_data.credential_data]
print("New credential created, attestation verified!")
print("Yubico device AAGUID:", b2a_hex(auth_data.credential_data.aaguid))
fido2-0.9.1/fido2/ 0000755 0001750 0001750 00000000000 14006463366 013407 5 ustar dain dain 0000000 0000000 fido2-0.9.1/fido2/attestation/ 0000755 0001750 0001750 00000000000 14006463366 015746 5 ustar dain dain 0000000 0000000 fido2-0.9.1/fido2/attestation/android.py 0000644 0001750 0001750 00000006043 14006451303 017727 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .base import (
Attestation,
AttestationType,
AttestationResult,
InvalidData,
catch_builtins,
)
from ..cose import CoseKey
from ..utils import sha256, websafe_decode
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.constant_time import bytes_eq
import json
class AndroidSafetynetAttestation(Attestation):
FORMAT = "android-safetynet"
def __init__(self, allow_rooted=False):
self.allow_rooted = allow_rooted
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
jwt = statement["response"]
header, payload, sig = (websafe_decode(x) for x in jwt.split(b"."))
data = json.loads(payload.decode("utf8"))
if not self.allow_rooted and data["ctsProfileMatch"] is not True:
raise InvalidData("ctsProfileMatch must be true!")
expected_nonce = sha256(auth_data + client_data_hash)
if not bytes_eq(expected_nonce, websafe_decode(data["nonce"])):
raise InvalidData("Nonce does not match!")
data = json.loads(header.decode("utf8"))
x5c = [websafe_decode(x) for x in data["x5c"]]
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
cn = cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)
if cn[0].value != "attest.android.com":
raise InvalidData("Certificate not issued to attest.android.com!")
CoseKey.for_name(data["alg"]).from_cryptography_key(cert.public_key()).verify(
jwt.rsplit(b".", 1)[0], sig
)
return AttestationResult(AttestationType.BASIC, x5c)
fido2-0.9.1/fido2/attestation/apple.py 0000644 0001750 0001750 00000004565 14006451303 017417 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .base import (
Attestation,
AttestationType,
AttestationResult,
InvalidData,
catch_builtins,
)
from ..utils import sha256
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.constant_time import bytes_eq
OID_APPLE = x509.ObjectIdentifier("1.2.840.113635.100.8.2")
class AppleAttestation(Attestation):
FORMAT = "apple"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
x5c = statement["x5c"]
expected_nonce = sha256(auth_data + client_data_hash)
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
ext = cert.extensions.get_extension_for_oid(OID_APPLE)
ext_nonce = ext.value.value[6:] # Sequence of single element of octet string
if not bytes_eq(expected_nonce, ext_nonce):
raise InvalidData("Nonce does not match!")
return AttestationResult(AttestationType.ANON_CA, x5c)
fido2-0.9.1/fido2/attestation/base.py 0000644 0001750 0001750 00000012032 14006451303 017214 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from enum import Enum, auto
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import padding, ec, rsa
from cryptography.exceptions import InvalidSignature as _InvalidSignature
from collections import namedtuple
from functools import wraps
import abc
class InvalidAttestation(Exception):
pass
class InvalidData(InvalidAttestation):
pass
class InvalidSignature(InvalidAttestation):
pass
class UntrustedAttestation(InvalidAttestation):
pass
class UnsupportedType(InvalidAttestation):
def __init__(self, auth_data, fmt=None):
super(UnsupportedType, self).__init__(
'Attestation format "{}" is not supported'.format(fmt)
if fmt
else "This attestation format is not supported!"
)
self.auth_data = auth_data
self.fmt = fmt
AttestationResult = namedtuple("AttestationResult", ["attestation_type", "trust_path"])
class AttestationType(Enum):
BASIC = auto()
SELF = auto()
ATT_CA = auto()
ANON_CA = auto()
NONE = auto
def catch_builtins(f):
@wraps(f)
def inner(*args, **kwargs):
try:
return f(*args, **kwargs)
except (ValueError, KeyError, IndexError) as e:
raise InvalidData(e)
return inner
@catch_builtins
def verify_x509_chain(chain):
certs = [x509.load_der_x509_certificate(der, default_backend()) for der in chain]
cert = certs.pop(0)
while certs:
child = cert
cert = certs.pop(0)
pub = cert.public_key()
try:
if isinstance(pub, rsa.RSAPublicKey):
pub.verify(
child.signature,
child.tbs_certificate_bytes,
padding.PKCS1v15(),
child.signature_hash_algorithm,
)
elif isinstance(pub, ec.EllipticCurvePublicKey):
pub.verify(
child.signature,
child.tbs_certificate_bytes,
ec.ECDSA(child.signature_hash_algorithm),
)
except _InvalidSignature:
raise InvalidSignature()
class Attestation(abc.ABC):
@abc.abstractmethod
def verify(self, statement, auth_data, client_data_hash):
"""Verifies attestation statement.
:return: An AttestationResult if successful.
"""
@staticmethod
def for_type(fmt):
for cls in Attestation.__subclasses__():
if getattr(cls, "FORMAT", None) == fmt:
return cls
class TypedUnsupportedAttestation(UnsupportedAttestation):
def __init__(self):
super(TypedUnsupportedAttestation, self).__init__(fmt)
return TypedUnsupportedAttestation
class UnsupportedAttestation(Attestation):
def __init__(self, fmt=None):
self.fmt = fmt
def verify(self, statement, auth_data, client_data_hash):
raise UnsupportedType(auth_data, self.fmt)
class NoneAttestation(Attestation):
FORMAT = "none"
def verify(self, statement, auth_data, client_data_hash):
if statement != {}:
raise InvalidData("None Attestation requires empty statement.")
return AttestationResult(AttestationType.NONE, [])
def _validate_cert_common(cert):
if cert.version != x509.Version.v3:
raise InvalidData("Attestation certificate must use version 3!")
try:
bc = cert.extensions.get_extension_for_class(x509.BasicConstraints)
if bc.value.ca:
raise InvalidData("Attestation certificate must have CA=false!")
except x509.ExtensionNotFound:
raise InvalidData("Attestation certificate must have Basic Constraints!")
fido2-0.9.1/fido2/attestation/packed.py 0000644 0001750 0001750 00000010311 14006451303 017527 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .base import (
Attestation,
AttestationType,
AttestationResult,
InvalidData,
InvalidSignature,
catch_builtins,
_validate_cert_common,
)
from ..cose import CoseKey
from cryptography import x509
from cryptography.exceptions import InvalidSignature as _InvalidSignature
from cryptography.hazmat.backends import default_backend
OID_AAGUID = x509.ObjectIdentifier("1.3.6.1.4.1.45724.1.1.4")
def _validate_packed_cert(cert, aaguid):
# https://www.w3.org/TR/webauthn/#packed-attestation-cert-requirements
_validate_cert_common(cert)
c = cert.subject.get_attributes_for_oid(x509.NameOID.COUNTRY_NAME)
if not c:
raise InvalidData("Subject must have C set!")
o = cert.subject.get_attributes_for_oid(x509.NameOID.ORGANIZATION_NAME)
if not o:
raise InvalidData("Subject must have O set!")
ous = cert.subject.get_attributes_for_oid(x509.NameOID.ORGANIZATIONAL_UNIT_NAME)
if not ous:
raise InvalidData('Subject must have OU = "Authenticator Attestation"!')
ou = ous[0]
if ou.value != "Authenticator Attestation":
raise InvalidData('Subject must have OU = "Authenticator Attestation"!')
cn = cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)
if not cn:
raise InvalidData("Subject must have CN set!")
try:
ext = cert.extensions.get_extension_for_oid(OID_AAGUID)
if ext.critical:
raise InvalidData("AAGUID extension must not be marked as critical")
ext_aaguid = ext.value.value[2:]
if ext_aaguid != aaguid:
raise InvalidData(
"AAGUID in Authenticator data does not "
"match attestation certificate!"
)
except x509.ExtensionNotFound:
pass # If missing, ignore
class PackedAttestation(Attestation):
FORMAT = "packed"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
if "ecdaaKeyId" in statement:
raise NotImplementedError("ECDAA not implemented")
alg = statement["alg"]
x5c = statement.get("x5c")
if x5c:
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
_validate_packed_cert(cert, auth_data.credential_data.aaguid)
pub_key = CoseKey.for_alg(alg).from_cryptography_key(cert.public_key())
att_type = AttestationType.BASIC
else:
pub_key = CoseKey.parse(auth_data.credential_data.public_key)
if pub_key.ALGORITHM != alg:
raise InvalidData("Wrong algorithm of public key!")
att_type = AttestationType.SELF
try:
pub_key.verify(auth_data + client_data_hash, statement["sig"])
return AttestationResult(att_type, x5c or [])
except _InvalidSignature:
raise InvalidSignature()
fido2-0.9.1/fido2/attestation/tpm.py 0000644 0001750 0001750 00000051636 14006451303 017117 0 ustar dain dain 0000000 0000000 # -*- coding: utf-8 -*-
# Copyright (c) 2019 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .base import (
Attestation,
AttestationType,
AttestationResult,
InvalidData,
InvalidSignature,
catch_builtins,
_validate_cert_common,
)
from ..cose import CoseKey
from ..utils import bytes2int, ByteBuffer
from enum import IntEnum
from collections import namedtuple
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import rsa, ec
from cryptography.hazmat.primitives import hashes
from cryptography import x509
from cryptography.exceptions import InvalidSignature as _InvalidSignature
import struct
import six
if six.PY2:
# Workaround for int max size on Python 2.
from enum import Enum
class _LongEnum(long, Enum): # noqa F821
"""Like IntEnum, but supports larger values"""
IntEnum = _LongEnum # Use instead of IntEnum # noqa F811
TPM_ALG_NULL = 0x0010
OID_AIK_CERTIFICATE = x509.ObjectIdentifier("2.23.133.8.3")
class TpmRsaScheme(IntEnum):
RSASSA = 0x0014
RSAPSS = 0x0016
OAEP = 0x0017
RSAES = 0x0015
class TpmAlgAsym(IntEnum):
RSA = 0x0001
ECC = 0x0023
class TpmAlgHash(IntEnum):
SHA1 = 0x0004
SHA256 = 0x000B
SHA384 = 0x000C
SHA512 = 0x000D
def _hash_alg(self):
if self == TpmAlgHash.SHA1:
return hashes.SHA1() # nosec
elif self == TpmAlgHash.SHA256:
return hashes.SHA256()
elif self == TpmAlgHash.SHA384:
return hashes.SHA384()
elif self == TpmAlgHash.SHA512:
return hashes.SHA512()
return NotImplementedError(
"_hash_alg is not implemented for {0!r}".format(self)
)
TpmsCertifyInfo = namedtuple("TpmsCertifyInfo", "name qualified_name")
class TpmAttestationFormat(object):
"""the signature data is defined by [TPMv2-Part2] Section 10.12.8 (TPMS_ATTEST)
as:
TPM_GENERATED_VALUE (0xff544347 aka "\xffTCG")
TPMI_ST_ATTEST - always TPM_ST_ATTEST_CERTIFY (0x8017)
because signing procedure defines it should call TPM_Certify
[TPMv2-Part3] Section 18.2
TPM2B_NAME
size (uint16)
name (size long)
TPM2B_DATA
size (uint16)
name (size long)
TPMS_CLOCK_INFO
clock (uint64)
resetCount (uint32)
restartCount (uint32)
safe (byte) 1 yes, 0 no
firmwareVersion uint64
attested TPMS_CERTIFY_INFO (because TPM_ST_ATTEST_CERTIFY)
name TPM2B_NAME
qualified_name TPM2B_NAME
See:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf
"""
TPM_GENERATED_VALUE = b"\xffTCG"
TPM_ST_ATTEST_CERTIFY = b"\x80\x17"
@classmethod
def parse(cls, data):
reader = ByteBuffer(data)
generated_value = reader.read(4)
# Verify that magic is set to TPM_GENERATED_VALUE.
# see https://w3c.github.io/webauthn/#sctn-tpm-attestation
# verification procedure
if generated_value != cls.TPM_GENERATED_VALUE:
raise ValueError("generated value field is invalid")
# Verify that type is set to TPM_ST_ATTEST_CERTIFY.
# see https://w3c.github.io/webauthn/#sctn-tpm-attestation
# verification procedure
tpmi_st_attest = reader.read(2)
if tpmi_st_attest != cls.TPM_ST_ATTEST_CERTIFY:
raise ValueError("tpmi_st_attest field is invalid")
try:
name = reader.read(reader.unpack("!H"))
data = reader.read(reader.unpack("!H"))
clock = reader.unpack("!Q")
reset_count = reader.unpack("!L")
restart_count = reader.unpack("!L")
safe_value = reader.unpack("B")
if safe_value not in (0, 1):
raise ValueError("invalid value 0x{0:x} for boolean".format(safe_value))
safe = safe_value == 1
firmware_version = reader.unpack("!Q")
attested_name = reader.read(reader.unpack("!H"))
attested_qualified_name = reader.read(reader.unpack("!H"))
except struct.error as e:
raise ValueError(e)
return cls(
name=name,
data=data,
clock_info=(clock, reset_count, restart_count, safe),
firmware_version=firmware_version,
attested=TpmsCertifyInfo(
name=attested_name, qualified_name=attested_qualified_name
),
)
def __init__(self, name, data, clock_info, firmware_version, attested):
self.name = name
self.data = data
self.clock_info = clock_info
self.firmware_version = firmware_version
self.attested = attested
def __repr__(self):
return (
"".format(self=self)
)
class TpmsRsaParms(object):
"""Parse TPMS_RSA_PARMS struct
See:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 12.2.3.5
"""
@classmethod
def parse(cls, reader, attributes):
ATTRIBUTES = TpmPublicFormat.ATTRIBUTES
symmetric = reader.unpack("!H")
restricted_decryption = attributes & (
ATTRIBUTES.RESTRICTED | ATTRIBUTES.DECRYPT
)
is_restricted_decryption_key = restricted_decryption == (
ATTRIBUTES.DECRYPT | ATTRIBUTES.RESTRICTED
)
if not is_restricted_decryption_key and symmetric != TPM_ALG_NULL:
# if the key is not a restricted decryption key, this field
# shall be set to TPM_ALG_NULL.
raise ValueError("symmetric is expected to be NULL")
# Otherwise should be set to a supported symmetric algorithm, keysize and mode
# TODO(baloo): Should we have non-null value here, do we expect more data?
scheme = reader.unpack("!H")
restricted_sign = attributes & (ATTRIBUTES.RESTRICTED | ATTRIBUTES.SIGN_ENCRYPT)
is_unrestricted_signing_key = restricted_sign == ATTRIBUTES.SIGN_ENCRYPT
if is_unrestricted_signing_key and scheme not in (
TPM_ALG_NULL,
TpmRsaScheme.RSASSA,
TpmRsaScheme.RSAPSS,
):
raise ValueError(
"key is an unrestricted signing key, scheme is "
"expected to be TPM_ALG_RSAPSS, TPM_ALG_RSASSA, "
"or TPM_ALG_NULL"
)
is_restricted_signing_key = restricted_sign == (
ATTRIBUTES.RESTRICTED | ATTRIBUTES.SIGN_ENCRYPT
)
if is_restricted_signing_key and scheme not in (
TpmRsaScheme.RSASSA,
TpmRsaScheme.RSAPSS,
):
raise ValueError(
"key is a restricted signing key, scheme is "
"expected to be TPM_ALG_RSAPSS, or TPM_ALG_RSASSA"
)
is_unrestricted_decryption_key = restricted_decryption == ATTRIBUTES.DECRYPT
if is_unrestricted_decryption_key and scheme not in (
TpmRsaScheme.OAEP,
TpmRsaScheme.RSAES,
TPM_ALG_NULL,
):
raise ValueError(
"key is an unrestricted decryption key, scheme is "
"expected to be TPM_ALG_RSAES, TPM_ALG_OAEP, or "
"TPM_ALG_NULL"
)
if is_restricted_decryption_key and scheme not in (TPM_ALG_NULL,):
raise ValueError(
"key is an restricted decryption key, scheme is "
"expected to be TPM_ALG_NULL"
)
key_bits = reader.unpack("!H")
exponent = reader.unpack("!L")
if exponent == 0:
# When zero, indicates that the exponent is the default of 2^16 + 1
exponent = (2 ** 16) + 1
return cls(symmetric, scheme, key_bits, exponent)
def __init__(self, symmetric, scheme, key_bits, exponent):
self.symmetric = symmetric
self.scheme = scheme
self.key_bits = key_bits
self.exponent = exponent
def __repr__(self):
return (
"".format(self=self)
)
class Tpm2bPublicKeyRsa(bytes):
@classmethod
def parse(cls, reader):
buffer = reader.read(reader.unpack("!H"))
return cls(buffer)
class TpmEccCurve(IntEnum):
"""TPM_ECC_CURVE
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 6.4
"""
NONE = 0x0000
NIST_P192 = 0x0001
NIST_P224 = 0x0002
NIST_P256 = 0x0003
NIST_P384 = 0x0004
NIST_P521 = 0x0005
BN_P256 = 0x0010
BN_P638 = 0x0011
SM2_P256 = 0x0020
def to_curve(self):
if self == TpmEccCurve.NONE:
raise ValueError("No such curve")
elif self == TpmEccCurve.NIST_P192:
return ec.SECP192R1()
elif self == TpmEccCurve.NIST_P224:
return ec.SECP224R1()
elif self == TpmEccCurve.NIST_P256:
return ec.SECP256R1()
elif self == TpmEccCurve.NIST_P384:
return ec.SECP384R1()
elif self == TpmEccCurve.NIST_P521:
return ec.SECP521R1()
raise ValueError("curve is not supported", self)
class TpmiAlgKdf(IntEnum):
"""TPMI_ALG_KDF
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
section 9.28
"""
NULL = TPM_ALG_NULL
KDF1_SP800_56A = 0x0020
KDF2 = 0x0021
KDF1_SP800_108 = 0x0022
class TpmsEccParms(object):
@classmethod
def parse(cls, reader):
symmetric = reader.unpack("!H")
scheme = reader.unpack("!H")
if symmetric != TPM_ALG_NULL:
raise ValueError("symmetric is expected to be NULL")
if scheme != TPM_ALG_NULL:
raise ValueError("scheme is expected to be NULL")
curve_id = TpmEccCurve(reader.unpack("!H"))
kdf_scheme = TpmiAlgKdf(reader.unpack("!H"))
return cls(symmetric, scheme, curve_id, kdf_scheme)
def __init__(self, symmetric, scheme, curve_id, kdf):
self.symmetric = symmetric
self.scheme = scheme
self.curve_id = curve_id
self.kdf = kdf
def __repr__(self):
return (
"".format(self=self)
)
class TpmsEccPoint(object):
"""TPMS_ECC_POINT
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
Section 11.2.5.2
"""
@classmethod
def parse(cls, reader):
x = reader.read(reader.unpack("!H"))
y = reader.read(reader.unpack("!H"))
return cls(x, y)
def __init__(self, x, y):
self.x = y
self.y = y
def __repr__(self):
return "".format(self=self)
class TpmPublicFormat(object):
"""the public area structure is defined by [TPMv2-Part2] Section 12.2.4 (TPMT_PUBLIC)
as:
TPMI_ALG_PUBLIC - type
TPMI_ALG_HASH - nameAlg
or + to indicate TPM_ALG_NULL
TPMA_OBJECT - objectAttributes
TPM2B_DIGEST - authPolicy
TPMU_PUBLIC_PARMS - type parameters
TPMU_PUBLIC_ID - uniq
See:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
"""
class ATTRIBUTES(IntEnum):
"""Object attributes
see section 8.3
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
"""
FIXED_TPM = 1 << 1
ST_CLEAR = 1 << 2
FIXED_PARENT = 1 << 4
SENSITIVE_DATA_ORIGIN = 1 << 5
USER_WITH_AUTH = 1 << 6
ADMIN_WITH_POLICY = 1 << 7
NO_DA = 1 << 10
ENCRYPTED_DUPLICATION = 1 << 11
RESTRICTED = 1 << 16
DECRYPT = 1 << 17
SIGN_ENCRYPT = 1 << 18
SHALL_BE_ZERO = (
(1 << 0) # 0 Reserved
| (1 << 3) # 3 Reserved
| (0x3 << 8) # 9:8 Reserved
| (0xF << 12) # 15:12 Reserved
| ((0xFFFFFFFF << 19) & (2 ** 32 - 1)) # 31:19 Reserved
)
@classmethod
def parse(cls, data):
reader = ByteBuffer(data)
sign_alg = TpmAlgAsym(reader.unpack("!H"))
name_alg = TpmAlgHash(reader.unpack("!H"))
attributes = reader.unpack("!L")
if attributes & TpmPublicFormat.ATTRIBUTES.SHALL_BE_ZERO != 0:
raise ValueError(
"attributes is not formated correctly: 0x{:x}".format(attributes)
)
auth_policy = reader.read(reader.unpack("!H"))
if sign_alg == TpmAlgAsym.RSA:
parameters = TpmsRsaParms.parse(reader, attributes)
unique = Tpm2bPublicKeyRsa.parse(reader)
elif sign_alg == TpmAlgAsym.ECC:
parameters = TpmsEccParms.parse(reader)
unique = TpmsEccPoint.parse(reader)
else:
raise NotImplementedError(
"sign alg {:x} is not " "supported".format(sign_alg)
)
rest = reader.read()
if len(rest) != 0:
raise ValueError("there should not be any data left in buffer")
return cls(
sign_alg, name_alg, attributes, auth_policy, parameters, unique, data
)
def __init__(
self, sign_alg, name_alg, attributes, auth_policy, parameters, unique, data
):
self.sign_alg = sign_alg
self.name_alg = name_alg
self.attributes = attributes
self.auth_policy = auth_policy
self.parameters = parameters
self.unique = unique
self.data = data
def __repr__(self):
return (
"".format(self=self)
)
def public_key(self):
if self.sign_alg == TpmAlgAsym.RSA:
exponent = self.parameters.exponent
modulus = bytes2int(self.unique)
return rsa.RSAPublicNumbers(exponent, modulus).public_key(default_backend())
elif self.sign_alg == TpmAlgAsym.ECC:
return ec.EllipticCurvePublicNumbers(
bytes2int(self.unique.x),
bytes2int(self.unique.y),
self.parameters.to_curve(),
).public_key(default_backend())
raise NotImplementedError(
"public_key not implemented for {0!r}".format(self.sign_alg)
)
def name(self):
"""
Computing Entity Names
see:
https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf
section 16 Names
Name ≔ nameAlg || HnameAlg (handle→nvPublicArea)
where
nameAlg algorithm used to compute Name
HnameAlg hash using the nameAlg parameter in the NV Index location
associated with handle
nvPublicArea contents of the TPMS_NV_PUBLIC associated with handle
"""
output = struct.pack("!H", self.name_alg)
digest = hashes.Hash(self.name_alg._hash_alg(), backend=default_backend())
digest.update(self.data)
output += digest.finalize()
return output
def _validate_tpm_cert(cert):
# https://www.w3.org/TR/webauthn/#tpm-cert-requirements
_validate_cert_common(cert)
s = cert.subject.get_attributes_for_oid(x509.NameOID)
if s:
raise InvalidData("Certificate should not have Subject")
s = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
if not s:
raise InvalidData("Certificate should have SubjectAlternativeName")
ext = cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)
has_aik = [x == OID_AIK_CERTIFICATE for x in ext.value]
if True not in has_aik:
raise InvalidData(
'Extended key usage MUST contain the "joint-iso-itu-t(2) '
"internationalorganizations(23) 133 tcg-kp(8) "
'tcg-kp-AIKCertificate(3)" OID.'
)
class TpmAttestation(Attestation):
FORMAT = "tpm"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
if "ecdaaKeyId" in statement:
raise NotImplementedError("ECDAA not implemented")
alg = statement["alg"]
x5c = statement["x5c"]
cert_info = statement["certInfo"]
cert = x509.load_der_x509_certificate(x5c[0], default_backend())
_validate_tpm_cert(cert)
pub_key = CoseKey.for_alg(alg).from_cryptography_key(cert.public_key())
try:
pub_area = TpmPublicFormat.parse(statement["pubArea"])
except Exception as e:
raise InvalidData("unable to parse pubArea", e)
# Verify that the public key specified by the parameters and unique
# fields of pubArea is identical to the credentialPublicKey in the
# attestedCredentialData in authenticatorData.
if (
auth_data.credential_data.public_key.from_cryptography_key(
pub_area.public_key()
)
!= auth_data.credential_data.public_key
):
raise InvalidSignature(
"attestation pubArea does not match attestedCredentialData"
)
try:
# TpmAttestationFormat.parse is reponsible for:
# Verify that magic is set to TPM_GENERATED_VALUE.
# Verify that type is set to TPM_ST_ATTEST_CERTIFY.
tpm = TpmAttestationFormat.parse(cert_info)
# Verify that extraData is set to the hash of attToBeSigned
# using the hash algorithm employed in "alg".
att_to_be_signed = auth_data + client_data_hash
digest = hashes.Hash(pub_key._HASH_ALG, backend=default_backend())
digest.update(att_to_be_signed)
data = digest.finalize()
if tpm.data != data:
raise InvalidSignature(
"attestation does not sign for authData and ClientData"
)
# Verify that attested contains a TPMS_CERTIFY_INFO structure as
# specified in [TPMv2-Part2] section 10.12.3, whose name field
# contains a valid Name for pubArea, as computed using the
# algorithm in the nameAlg field of pubArea using the procedure
# specified in [TPMv2-Part1] section 16.
# [TPMv2-Part2]:
# https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf
# [TPMv2-Part1]:
# https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf
if tpm.attested.name != pub_area.name():
raise InvalidData(
"TPMS_CERTIFY_INFO does not include a valid name for pubArea"
)
pub_key.verify(cert_info, statement["sig"])
return AttestationResult(AttestationType.ATT_CA, x5c)
except _InvalidSignature:
raise InvalidSignature("signature of certInfo does not match")
fido2-0.9.1/fido2/attestation/u2f.py 0000644 0001750 0001750 00000005264 14006451303 017007 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .base import (
Attestation,
AttestationType,
AttestationResult,
InvalidSignature,
catch_builtins,
)
from ..cose import ES256
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.exceptions import InvalidSignature as _InvalidSignature
class FidoU2FAttestation(Attestation):
FORMAT = "fido-u2f"
@catch_builtins
def verify(self, statement, auth_data, client_data_hash):
cd = auth_data.credential_data
pk = b"\x04" + cd.public_key[-2] + cd.public_key[-3]
x5c = statement["x5c"]
FidoU2FAttestation.verify_signature(
auth_data.rp_id_hash,
client_data_hash,
cd.credential_id,
pk,
x5c[0],
statement["sig"],
)
return AttestationResult(AttestationType.BASIC, x5c)
@staticmethod
def verify_signature(
app_param, client_param, key_handle, public_key, cert_bytes, signature
):
m = b"\0" + app_param + client_param + key_handle + public_key
cert = x509.load_der_x509_certificate(cert_bytes, default_backend())
try:
ES256.from_cryptography_key(cert.public_key()).verify(m, signature)
except _InvalidSignature:
raise InvalidSignature()
fido2-0.9.1/fido2/attestation/__init__.py 0000644 0001750 0001750 00000003610 14006451303 020043 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import
from .base import ( # noqa: F401
Attestation,
NoneAttestation,
AttestationType,
AttestationResult,
InvalidData,
InvalidSignature,
UnsupportedType,
UnsupportedAttestation,
UntrustedAttestation,
verify_x509_chain,
)
from .apple import AppleAttestation # noqa: F401
from .android import AndroidSafetynetAttestation # noqa: F401
from .packed import PackedAttestation # noqa: F401
from .u2f import FidoU2FAttestation # noqa: F401
from .tpm import TpmAttestation # noqa: F401
fido2-0.9.1/fido2/cbor.py 0000644 0001750 0001750 00000010607 14006451303 014676 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
"""
Minimal CBOR implementation supporting a subset of functionality and types
required for FIDO 2 CTAP.
"""
import struct
import six
def dump_int(data, mt=0):
if data < 0:
mt = 1
data = -1 - data
mt = mt << 5
if data <= 23:
args = (">B", mt | data)
elif data <= 0xFF:
args = (">BB", mt | 24, data)
elif data <= 0xFFFF:
args = (">BH", mt | 25, data)
elif data <= 0xFFFFFFFF:
args = (">BI", mt | 26, data)
else:
args = (">BQ", mt | 27, data)
return struct.pack(*args)
def dump_bool(data):
return b"\xf5" if data else b"\xf4"
def dump_list(data):
return dump_int(len(data), mt=4) + b"".join([encode(x) for x in data])
def _sort_keys(entry):
key = entry[0]
return six.indexbytes(key, 0), len(key), key
def dump_dict(data):
items = [(encode(k), encode(v)) for k, v in data.items()]
items.sort(key=_sort_keys)
return dump_int(len(items), mt=5) + b"".join([k + v for (k, v) in items])
def dump_bytes(data):
return dump_int(len(data), mt=2) + data
def dump_text(data):
data_bytes = data.encode("utf8")
return dump_int(len(data_bytes), mt=3) + data_bytes
_SERIALIZERS = [
(bool, dump_bool),
(six.integer_types, dump_int),
(dict, dump_dict),
(list, dump_list),
(six.text_type, dump_text),
(six.binary_type, dump_bytes),
]
def encode(data):
for k, v in _SERIALIZERS:
if isinstance(data, k):
return v(data)
raise ValueError("Unsupported value: {}".format(data))
def load_int(ai, data):
if ai < 24:
return ai, data
elif ai == 24:
return six.indexbytes(data, 0), data[1:]
elif ai == 25:
return struct.unpack_from(">H", data)[0], data[2:]
elif ai == 26:
return struct.unpack_from(">I", data)[0], data[4:]
elif ai == 27:
return struct.unpack_from(">Q", data)[0], data[8:]
raise ValueError("Invalid additional information")
def load_nint(ai, data):
val, rest = load_int(ai, data)
return -1 - val, rest
def load_bool(ai, data):
return ai == 21, data
def load_bytes(ai, data):
l, data = load_int(ai, data)
return data[:l], data[l:]
def load_text(ai, data):
enc, rest = load_bytes(ai, data)
return enc.decode("utf8"), rest
def load_array(ai, data):
l, data = load_int(ai, data)
values = []
for i in range(l):
val, data = decode_from(data)
values.append(val)
return values, data
def load_map(ai, data):
l, data = load_int(ai, data)
values = {}
for i in range(l):
k, data = decode_from(data)
v, data = decode_from(data)
values[k] = v
return values, data
_DESERIALIZERS = {
0: load_int,
1: load_nint,
2: load_bytes,
3: load_text,
4: load_array,
5: load_map,
7: load_bool,
}
def decode_from(data):
fb = six.indexbytes(data, 0)
return _DESERIALIZERS[fb >> 5](fb & 0b11111, data[1:])
def decode(data):
value, rest = decode_from(data)
if rest != b"":
raise ValueError("Extraneous data")
return value
fido2-0.9.1/fido2/client.py 0000644 0001750 0001750 00000070333 14006451303 015231 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals, division
from .hid import STATUS
from .ctap import CtapError
from .ctap1 import Ctap1, APDU, ApduError
from .ctap2 import (
Ctap2,
AttestationObject,
AssertionResponse,
Info,
ClientPin,
)
from .ctap2.extensions import Ctap2Extension
from .webauthn import (
PublicKeyCredentialCreationOptions,
PublicKeyCredentialRequestOptions,
AuthenticatorSelectionCriteria,
UserVerificationRequirement,
AuthenticatorAttestationResponse,
AuthenticatorAssertionResponse,
)
from .cose import ES256
from .rpid import verify_rp_id, verify_app_id
from .utils import sha256, websafe_decode, websafe_encode
from enum import Enum, IntEnum, unique
from threading import Timer, Event
import json
import six
import platform
class ClientData(bytes):
def __init__(self, _):
super(ClientData, self).__init__()
self.data = json.loads(self.decode())
def get(self, key):
return self.data[key]
@property
def challenge(self):
return websafe_decode(self.get("challenge"))
@property
def b64(self):
return websafe_encode(self)
@property
def hash(self):
return sha256(self)
@classmethod
def build(cls, **kwargs):
return cls(json.dumps(kwargs).encode())
@classmethod
def from_b64(cls, data):
return cls(websafe_decode(data))
def __repr__(self):
return self.decode()
def __str__(self):
return self.decode()
class ClientError(Exception):
@unique
class ERR(IntEnum):
OTHER_ERROR = 1
BAD_REQUEST = 2
CONFIGURATION_UNSUPPORTED = 3
DEVICE_INELIGIBLE = 4
TIMEOUT = 5
def __call__(self, cause=None):
return ClientError(self, cause)
def __init__(self, code, cause=None):
self.code = ClientError.ERR(code)
self.cause = cause
def __repr__(self):
r = "Client error: {0} - {0.name}".format(self.code)
if self.cause:
r += ". Caused by {}".format(self.cause)
return r
def _ctap2client_err(e):
if e.code in [CtapError.ERR.CREDENTIAL_EXCLUDED, CtapError.ERR.NO_CREDENTIALS]:
ce = ClientError.ERR.DEVICE_INELIGIBLE
elif e.code in [
CtapError.ERR.KEEPALIVE_CANCEL,
CtapError.ERR.ACTION_TIMEOUT,
CtapError.ERR.USER_ACTION_TIMEOUT,
]:
ce = ClientError.ERR.TIMEOUT
elif e.code in [
CtapError.ERR.UNSUPPORTED_ALGORITHM,
CtapError.ERR.UNSUPPORTED_OPTION,
CtapError.ERR.UNSUPPORTED_EXTENSION,
CtapError.ERR.KEY_STORE_FULL,
]:
ce = ClientError.ERR.CONFIGURATION_UNSUPPORTED
elif e.code in [
CtapError.ERR.INVALID_COMMAND,
CtapError.ERR.CBOR_UNEXPECTED_TYPE,
CtapError.ERR.INVALID_CBOR,
CtapError.ERR.MISSING_PARAMETER,
CtapError.ERR.INVALID_OPTION,
CtapError.ERR.PIN_REQUIRED,
CtapError.ERR.PIN_INVALID,
CtapError.ERR.PIN_BLOCKED,
CtapError.ERR.PIN_NOT_SET,
CtapError.ERR.PIN_POLICY_VIOLATION,
CtapError.ERR.PIN_TOKEN_EXPIRED,
CtapError.ERR.PIN_AUTH_INVALID,
CtapError.ERR.PIN_AUTH_BLOCKED,
CtapError.ERR.REQUEST_TOO_LARGE,
CtapError.ERR.OPERATION_DENIED,
]:
ce = ClientError.ERR.BAD_REQUEST
else:
ce = ClientError.ERR.OTHER_ERROR
return ce(e)
def _call_polling(poll_delay, event, on_keepalive, func, *args, **kwargs):
event = event or Event()
while not event.is_set():
try:
return func(*args, **kwargs)
except ApduError as e:
if e.code == APDU.USE_NOT_SATISFIED:
if on_keepalive:
on_keepalive(STATUS.UPNEEDED)
on_keepalive = None
event.wait(poll_delay)
else:
raise ClientError.ERR.OTHER_ERROR(e)
except CtapError as e:
raise _ctap2client_err(e)
raise ClientError.ERR.TIMEOUT()
@unique
class U2F_TYPE(six.text_type, Enum):
REGISTER = "navigator.id.finishEnrollment"
SIGN = "navigator.id.getAssertion"
class U2fClient(object):
"""U2F-like client implementation.
The client allows registration and authentication of U2F credentials against
an Authenticator using CTAP 1. Prefer using Fido2Client if possible.
:param device: CtapDevice to use.
:param str origin: The origin to use.
:param verify: Function to verify an APP ID for a given origin.
"""
def __init__(self, device, origin, verify=verify_app_id):
self.poll_delay = 0.25
self.ctap = Ctap1(device)
self.origin = origin
self._verify = verify
def _verify_app_id(self, app_id):
try:
if self._verify(app_id, self.origin):
return
except Exception: # nosec
pass # Fall through to ClientError
raise ClientError.ERR.BAD_REQUEST()
def register(
self, app_id, register_requests, registered_keys, event=None, on_keepalive=None
):
self._verify_app_id(app_id)
version = self.ctap.get_version()
dummy_param = b"\0" * 32
for key in registered_keys:
if key["version"] != version:
continue
key_app_id = key.get("appId", app_id)
app_param = sha256(key_app_id.encode())
self._verify_app_id(key_app_id)
key_handle = websafe_decode(key["keyHandle"])
try:
self.ctap.authenticate(dummy_param, app_param, key_handle, True)
raise ClientError.ERR.DEVICE_INELIGIBLE() # Bad response
except ApduError as e:
if e.code == APDU.USE_NOT_SATISFIED:
raise ClientError.ERR.DEVICE_INELIGIBLE()
except CtapError as e:
raise _ctap2client_err(e)
for request in register_requests:
if request["version"] == version:
challenge = request["challenge"]
break
else:
raise ClientError.ERR.DEVICE_INELIGIBLE()
client_data = ClientData.build(
typ=U2F_TYPE.REGISTER, challenge=challenge, origin=self.origin
)
app_param = sha256(app_id.encode())
reg_data = _call_polling(
self.poll_delay,
event,
on_keepalive,
self.ctap.register,
client_data.hash,
app_param,
)
return {"registrationData": reg_data.b64, "clientData": client_data.b64}
def sign(self, app_id, challenge, registered_keys, event=None, on_keepalive=None):
client_data = ClientData.build(
typ=U2F_TYPE.SIGN, challenge=challenge, origin=self.origin
)
version = self.ctap.get_version()
for key in registered_keys:
if key["version"] == version:
key_app_id = key.get("appId", app_id)
self._verify_app_id(key_app_id)
key_handle = websafe_decode(key["keyHandle"])
app_param = sha256(key_app_id.encode())
try:
signature_data = _call_polling(
self.poll_delay,
event,
on_keepalive,
self.ctap.authenticate,
client_data.hash,
app_param,
key_handle,
)
break
except ClientError: # nosec
pass # Ignore and try next key
else:
raise ClientError.ERR.DEVICE_INELIGIBLE()
return {
"clientData": client_data.b64,
"signatureData": signature_data.b64,
"keyHandle": key["keyHandle"],
}
@unique
class WEBAUTHN_TYPE(six.text_type, Enum):
MAKE_CREDENTIAL = "webauthn.create"
GET_ASSERTION = "webauthn.get"
class _BaseClient(object):
def __init__(self, origin, verify):
self.origin = origin
self._verify = verify
def _verify_rp_id(self, rp_id):
try:
if self._verify(rp_id, self.origin):
return
except Exception: # nosec
pass # Fall through to ClientError
raise ClientError.ERR.BAD_REQUEST()
def _build_client_data(self, typ, challenge, extensions={}):
return ClientData.build(
type=typ,
origin=self.origin,
challenge=websafe_encode(challenge),
clientExtensions=extensions,
)
class AssertionSelection(object):
"""GetAssertion result holding one or more assertions.
Since multiple assertions may be retured by Fido2Client.get_assertion, this result
is returned which can be used to select a specific response to get.
"""
def __init__(self, client_data, assertions):
self._client_data = client_data
self._assertions = assertions
def get_assertions(self):
"""Get the raw AssertionResponses available to inspect before selecting one."""
return self._assertions
def _get_extension_results(self, assertion):
return {}
def get_response(self, index):
"""Get a single response."""
assertion = self._assertions[index]
return AuthenticatorAssertionResponse(
self._client_data,
assertion.auth_data,
assertion.signature,
assertion.user["id"] if assertion.user else None,
assertion.credential["id"] if assertion.credential else None,
self._get_extension_results(assertion),
)
class Fido2ClientAssertionSelection(AssertionSelection):
def __init__(self, client_data, assertions, extensions):
super(Fido2ClientAssertionSelection, self).__init__(client_data, assertions)
self._extensions = extensions
def _get_extension_results(self, assertion):
# Process extenstion outputs
extension_outputs = {}
for ext in self._extensions:
output = ext.process_get_output(assertion.auth_data)
if output is not None:
extension_outputs.update(output)
return extension_outputs
def _default_extensions():
return [cls for cls in Ctap2Extension.__subclasses__() if hasattr(cls, "NAME")]
_CTAP1_INFO = Info.create(["U2F_V2"])
class Fido2Client(_BaseClient):
"""WebAuthn-like client implementation.
The client allows registration and authentication of WebAuthn credentials against
an Authenticator using CTAP (1 or 2).
:param device: CtapDevice to use.
:param str origin: The origin to use.
:param verify: Function to verify an RP ID for a given origin.
"""
def __init__(self, device, origin, verify=verify_rp_id, extension_types=None):
super(Fido2Client, self).__init__(origin, verify)
self.extensions = extension_types or _default_extensions()
self.ctap1_poll_delay = 0.25
try:
self.ctap2 = Ctap2(device)
self.info = self.ctap2.info
try:
self.client_pin = ClientPin(self.ctap2)
except ValueError:
self.client_pin = None
self._do_make_credential = self._ctap2_make_credential
self._do_get_assertion = self._ctap2_get_assertion
except (ValueError, CtapError):
self.ctap1 = Ctap1(device)
self.info = _CTAP1_INFO
self._do_make_credential = self._ctap1_make_credential
self._do_get_assertion = self._ctap1_get_assertion
def _get_ctap_uv(self, uv_requirement, pin_provided):
pin_supported = "clientPin" in self.info.options
pin_set = self.info.options.get("clientPin", False)
if pin_provided:
if not pin_set:
raise ClientError.ERR.BAD_REQUEST("PIN provided, but not set/supported")
else:
return False # If PIN is provided, internal uv is not used
uv_supported = "uv" in self.info.options
uv_set = self.info.options.get("uv", False)
if uv_requirement == UserVerificationRequirement.REQUIRED:
if not uv_set:
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(
"User verification not configured/supported"
)
return True
elif uv_requirement == UserVerificationRequirement.PREFERRED:
if not uv_set and (uv_supported or pin_supported):
raise ClientError.ERR.CONFIGURATION_UNSUPPORTED(
"User verification supported but not configured"
)
return uv_set
return False
def make_credential(self, options, **kwargs):
"""Creates a credential.
:param options: PublicKeyCredentialCreationOptions data.
:param pin: (optional) Used if PIN verification is required.
:param threading.Event event: (optional) Signal to abort the operation.
:param on_keepalive: (optional) function to call with CTAP status updates.
"""
options = PublicKeyCredentialCreationOptions._wrap(options)
pin = kwargs.get("pin")
event = kwargs.get("event", Event())
if options.timeout:
timer = Timer(options.timeout / 1000, event.set)
timer.daemon = True
timer.start()
self._verify_rp_id(options.rp.id)
client_data = self._build_client_data(
WEBAUTHN_TYPE.MAKE_CREDENTIAL, options.challenge
)
selection = options.authenticator_selection or AuthenticatorSelectionCriteria()
try:
att_obj, extension_outputs = self._do_make_credential(
client_data,
options.rp,
options.user,
options.pub_key_cred_params,
options.exclude_credentials,
options.extensions,
selection.require_resident_key,
self._get_ctap_uv(selection.user_verification, pin is not None),
pin,
event,
kwargs.get("on_keepalive"),
)
return AuthenticatorAttestationResponse(
client_data, att_obj, extension_outputs,
)
except CtapError as e:
raise _ctap2client_err(e)
finally:
if options.timeout:
timer.cancel()
def _ctap2_make_credential(
self,
client_data,
rp,
user,
key_params,
exclude_list,
extensions,
rk,
uv,
pin,
event,
on_keepalive,
):
self.info = self.ctap2.get_info() # Make sure we have "fresh" info
pin_auth = None
pin_protocol = None
if pin:
pin_protocol = self.client_pin.protocol.VERSION
pin_token = self.client_pin.get_pin_token(
pin, ClientPin.PERMISSION.MAKE_CREDENTIAL, rp["id"]
)
pin_auth = self.client_pin.protocol.authenticate(
pin_token, client_data.hash
)
elif self.info.options.get("clientPin") and not uv:
raise ClientError.ERR.BAD_REQUEST("PIN required but not provided")
if not (rk or uv):
options = None
else:
options = {}
if rk:
options["rk"] = True
if uv:
options["uv"] = True
if exclude_list:
# Filter out credential IDs which are too long
max_len = self.info.max_cred_id_length
if max_len:
exclude_list = [e for e in exclude_list if len(e) <= max_len]
# Reject the request if too many credentials remain.
max_creds = self.info.max_creds_in_list
if max_creds and len(exclude_list) > max_creds:
raise ClientError.ERR.BAD_REQUEST("exclude_list too long")
# Process extensions
client_inputs = extensions or {}
extension_inputs = {}
used_extensions = []
for ext in [cls(self.ctap2) for cls in self.extensions]:
auth_input = ext.process_create_input(client_inputs)
if auth_input is not None:
used_extensions.append(ext)
extension_inputs[ext.NAME] = auth_input
att_obj = self.ctap2.make_credential(
client_data.hash,
rp,
user,
key_params,
exclude_list or None,
extension_inputs or None,
options,
pin_auth,
pin_protocol,
event,
on_keepalive,
)
# Process extenstion outputs
extension_outputs = {}
for ext in used_extensions:
output = ext.process_create_output(att_obj.auth_data)
if output is not None:
extension_outputs.update(output)
return att_obj, extension_outputs
def _ctap1_make_credential(
self,
client_data,
rp,
user,
key_params,
exclude_list,
extensions,
rk,
uv,
pin,
event,
on_keepalive,
):
if rk or uv or ES256.ALGORITHM not in [p.alg for p in key_params]:
raise CtapError(CtapError.ERR.UNSUPPORTED_OPTION)
app_param = sha256(rp["id"].encode())
dummy_param = b"\0" * 32
for cred in exclude_list or []:
key_handle = cred["id"]
try:
self.ctap1.authenticate(dummy_param, app_param, key_handle, True)
raise ClientError.ERR.OTHER_ERROR() # Shouldn't happen
except ApduError as e:
if e.code == APDU.USE_NOT_SATISFIED:
_call_polling(
self.ctap1_poll_delay,
event,
on_keepalive,
self.ctap1.register,
dummy_param,
dummy_param,
)
raise ClientError.ERR.DEVICE_INELIGIBLE()
return (
AttestationObject.from_ctap1(
app_param,
_call_polling(
self.ctap1_poll_delay,
event,
on_keepalive,
self.ctap1.register,
client_data.hash,
app_param,
),
),
{},
)
def get_assertion(self, options, **kwargs):
"""Get an assertion.
:param options: PublicKeyCredentialRequestOptions data.
:param pin: (optional) Used if PIN verification is required.
:param threading.Event event: (optional) Signal to abort the operation.
:param on_keepalive: (optional) Not implemented.
"""
options = PublicKeyCredentialRequestOptions._wrap(options)
pin = kwargs.get("pin")
event = kwargs.get("event", Event())
if options.timeout:
timer = Timer(options.timeout / 1000, event.set)
timer.daemon = True
timer.start()
self._verify_rp_id(options.rp_id)
client_data = self._build_client_data(
WEBAUTHN_TYPE.GET_ASSERTION, options.challenge
)
try:
assertions, used_extensions = self._do_get_assertion(
client_data,
options.rp_id,
options.allow_credentials,
options.extensions,
self._get_ctap_uv(options.user_verification, pin is not None),
pin,
event,
kwargs.get("on_keepalive"),
)
return Fido2ClientAssertionSelection(
client_data, assertions, used_extensions,
)
except CtapError as e:
raise _ctap2client_err(e)
finally:
if options.timeout:
timer.cancel()
def _ctap2_get_assertion(
self, client_data, rp_id, allow_list, extensions, uv, pin, event, on_keepalive
):
self.info = self.ctap2.get_info() # Make sure we have "fresh" info
pin_auth = None
pin_protocol = None
if pin:
pin_protocol = self.client_pin.protocol.VERSION
pin_token = self.client_pin.get_pin_token(
pin, ClientPin.PERMISSION.GET_ASSERTION, rp_id
)
pin_auth = self.client_pin.protocol.authenticate(
pin_token, client_data.hash
)
elif self.info.options.get("clientPin") and not uv:
raise ClientError.ERR.BAD_REQUEST("PIN required but not provided")
if uv:
options = {"uv": True}
else:
options = None
if allow_list:
# Filter out credential IDs which are too long
max_len = self.info.max_cred_id_length
if max_len:
allow_list = [e for e in allow_list if len(e) <= max_len]
if not allow_list:
raise CtapError(CtapError.ERR.NO_CREDENTIALS)
# Reject the request if too many credentials remain.
max_creds = self.info.max_creds_in_list
if max_creds and len(allow_list) > max_creds:
raise ClientError.ERR.BAD_REQUEST("allow_list too long")
# Process extensions
client_inputs = extensions or {}
extension_inputs = {}
used_extensions = []
for ext in [cls(self.ctap2) for cls in self.extensions]:
auth_input = ext.process_get_input(client_inputs)
if auth_input is not None:
used_extensions.append(ext)
extension_inputs[ext.NAME] = auth_input
assertions = self.ctap2.get_assertions(
rp_id,
client_data.hash,
allow_list or None,
extension_inputs or None,
options,
pin_auth,
pin_protocol,
event,
on_keepalive,
)
return assertions, used_extensions
def _ctap1_get_assertion(
self, client_data, rp_id, allow_list, extensions, uv, pin, event, on_keepalive
):
if uv or not allow_list:
raise CtapError(CtapError.ERR.UNSUPPORTED_OPTION)
app_param = sha256(rp_id.encode())
client_param = client_data.hash
for cred in allow_list:
try:
auth_resp = _call_polling(
self.ctap1_poll_delay,
event,
on_keepalive,
self.ctap1.authenticate,
client_param,
app_param,
cred["id"],
)
assertions = [AssertionResponse.from_ctap1(app_param, cred, auth_resp)]
return assertions, []
except ClientError as e:
if e.code == ClientError.ERR.TIMEOUT:
raise # Other errors are ignored so we move to the next.
raise ClientError.ERR.DEVICE_INELIGIBLE()
_WIN_INFO = Info.create(["U2F_V2", "FIDO_2_0"])
if platform.system().lower() == "windows":
try:
from .win_api import (
WinAPI,
WebAuthNAuthenticatorAttachment,
WebAuthNUserVerificationRequirement,
WebAuthNAttestationConvoyancePreference,
)
except Exception: # nosec # TODO: Make this less generic
pass
class WindowsClient(_BaseClient):
"""Fido2Client-like class using the Windows WebAuthn API.
Note: This class only works on Windows 10 19H1 or later. This is also when Windows
started restricting access to FIDO devices, causing the standard client classes to
require admin priveleges to run (unlike this one).
The make_credential and get_assertion methods are intended to work as a drop-in
replacement for the Fido2Client methods of the same name.
:param str origin: The origin to use.
:param verify: Function to verify an RP ID for a given origin.
:param ctypes.wintypes.HWND handle: (optional) Window reference to use.
"""
def __init__(self, origin, verify=verify_rp_id, handle=None):
super(WindowsClient, self).__init__(origin, verify)
self.api = WinAPI(handle)
@property
def info(self):
return _WIN_INFO
@staticmethod
def is_available():
return platform.system().lower() == "windows" and WinAPI.version > 0
def make_credential(self, options, **kwargs):
"""Create a credential using Windows WebAuthN APIs.
:param options: PublicKeyCredentialCreationOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
options = PublicKeyCredentialCreationOptions._wrap(options)
self._verify_rp_id(options.rp.id)
client_data = self._build_client_data(
WEBAUTHN_TYPE.MAKE_CREDENTIAL, options.challenge
)
selection = options.authenticator_selection or AuthenticatorSelectionCriteria()
try:
result = self.api.make_credential(
options.rp,
options.user,
options.pub_key_cred_params,
client_data,
options.timeout or 0,
selection.require_resident_key or False,
WebAuthNAuthenticatorAttachment.from_string(
selection.authenticator_attachment or "any"
),
WebAuthNUserVerificationRequirement.from_string(
selection.user_verification or "discouraged"
),
WebAuthNAttestationConvoyancePreference.from_string(
options.attestation or "none"
),
options.exclude_credentials,
options.extensions,
kwargs.get("event"),
)
except OSError as e:
raise ClientError.ERR.OTHER_ERROR(e)
return AuthenticatorAttestationResponse(
client_data, AttestationObject(result), {}
)
def get_assertion(self, options, **kwargs):
"""Get assertion using Windows WebAuthN APIs.
:param options: PublicKeyCredentialRequestOptions data.
:param threading.Event event: (optional) Signal to abort the operation.
"""
options = PublicKeyCredentialRequestOptions._wrap(options)
self._verify_rp_id(options.rp_id)
client_data = self._build_client_data(
WEBAUTHN_TYPE.GET_ASSERTION, options.challenge
)
try:
(credential, auth_data, signature, user_id) = self.api.get_assertion(
options.rp_id,
client_data,
options.timeout or 0,
WebAuthNAuthenticatorAttachment.ANY,
WebAuthNUserVerificationRequirement.from_string(
options.user_verification or "discouraged"
),
options.allow_credentials,
options.extensions,
kwargs.get("event"),
)
except OSError as e:
raise ClientError.ERR.OTHER_ERROR(e)
user = {"id": user_id} if user_id else None
return AssertionSelection(
client_data,
[AssertionResponse.create(credential, auth_data, signature, user)],
)
fido2-0.9.1/fido2/cose.py 0000644 0001750 0001750 00000016346 14006451303 014710 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .utils import bytes2int, int2bytes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec, rsa, padding
try:
from cryptography.hazmat.primitives.asymmetric import ed25519
except ImportError: # EdDSA requires Cryptography >= 2.6.
ed25519 = None
class CoseKey(dict):
"""A COSE formatted public key.
:param _: The COSE key paramters.
:cvar ALGORITHM: COSE algorithm identifier.
"""
ALGORITHM = None
def verify(self, message, signature):
"""Validates a digital signature over a given message.
:param message: The message which was signed.
:param signature: The signature to check.
"""
raise NotImplementedError("Signature verification not supported.")
@classmethod
def from_cryptography_key(cls, public_key):
"""Converts a PublicKey object from Cryptography into a COSE key.
:param public_key: Either an EC or RSA public key.
:return: A CoseKey.
"""
raise NotImplementedError("Creation from cryptography not supported.")
@staticmethod
def for_alg(alg):
"""Get a subclass of CoseKey corresponding to an algorithm identifier.
:param alg: The COSE identifier of the algorithm.
:return: A CoseKey.
"""
if alg == EdDSA.ALGORITHM and ed25519 is None:
# EdDSA requires Cryptography >= 2.6.
return UnsupportedKey
for cls in CoseKey.__subclasses__():
if cls.ALGORITHM == alg:
return cls
return UnsupportedKey
@staticmethod
def for_name(name):
"""Get a subclass of CoseKey corresponding to an algorithm identifier.
:param alg: The COSE identifier of the algorithm.
:return: A CoseKey.
"""
for cls in CoseKey.__subclasses__():
if cls.__name__ == name:
return cls
return UnsupportedKey
@staticmethod
def parse(cose):
"""Create a CoseKey from a dict"""
alg = cose.get(3)
if not alg:
raise ValueError("COSE alg identifier must be provided.")
return CoseKey.for_alg(alg)(cose)
@staticmethod
def supported_algorithms():
"""Get a list of all supported algorithm identifiers"""
if ed25519:
algs = (ES256, EdDSA, PS256, RS256)
else:
algs = (ES256, PS256, RS256)
return [cls.ALGORITHM for cls in algs]
class UnsupportedKey(CoseKey):
"""A COSE key with an unsupported algorithm."""
class ES256(CoseKey):
ALGORITHM = -7
_HASH_ALG = hashes.SHA256()
def verify(self, message, signature):
if self[-1] != 1:
raise ValueError("Unsupported elliptic curve")
ec.EllipticCurvePublicNumbers(
bytes2int(self[-2]), bytes2int(self[-3]), ec.SECP256R1()
).public_key(default_backend()).verify(
signature, message, ec.ECDSA(self._HASH_ALG)
)
@classmethod
def from_cryptography_key(cls, public_key):
pn = public_key.public_numbers()
return cls(
{
1: 2,
3: cls.ALGORITHM,
-1: 1,
-2: int2bytes(pn.x, 32),
-3: int2bytes(pn.y, 32),
}
)
@classmethod
def from_ctap1(cls, data):
"""Creates an ES256 key from a CTAP1 formatted public key byte string.
:param data: A 65 byte SECP256R1 public key.
:return: A ES256 key.
"""
return cls({1: 2, 3: cls.ALGORITHM, -1: 1, -2: data[1:33], -3: data[33:65]})
class RS256(CoseKey):
ALGORITHM = -257
_HASH_ALG = hashes.SHA256()
def verify(self, message, signature):
rsa.RSAPublicNumbers(bytes2int(self[-2]), bytes2int(self[-1])).public_key(
default_backend()
).verify(signature, message, padding.PKCS1v15(), self._HASH_ALG)
@classmethod
def from_cryptography_key(cls, public_key):
pn = public_key.public_numbers()
return cls({1: 3, 3: cls.ALGORITHM, -1: int2bytes(pn.n), -2: int2bytes(pn.e)})
class PS256(CoseKey):
ALGORITHM = -37
_HASH_ALG = hashes.SHA256()
def verify(self, message, signature):
rsa.RSAPublicNumbers(bytes2int(self[-2]), bytes2int(self[-1])).public_key(
default_backend()
).verify(
signature,
message,
padding.PSS(
mgf=padding.MGF1(self._HASH_ALG), salt_length=padding.PSS.MAX_LENGTH
),
self._HASH_ALG,
)
@classmethod
def from_cryptography_key(cls, public_key):
pn = public_key.public_numbers()
return cls({1: 3, 3: cls.ALGORITHM, -1: int2bytes(pn.n), -2: int2bytes(pn.e)})
class EdDSA(CoseKey):
ALGORITHM = -8
def verify(self, message, signature):
if self[-1] != 6:
raise ValueError("Unsupported elliptic curve")
ed25519.Ed25519PublicKey.from_public_bytes(self[-2]).verify(signature, message)
@classmethod
def from_cryptography_key(cls, public_key):
return cls(
{
1: 1,
3: cls.ALGORITHM,
-1: 6,
-2: public_key.public_bytes(
serialization.Encoding.Raw, serialization.PublicFormat.Raw
),
}
)
class RS1(CoseKey):
ALGORITHM = -65535
_HASH_ALG = hashes.SHA1() # nosec
def verify(self, message, signature):
rsa.RSAPublicNumbers(bytes2int(self[-2]), bytes2int(self[-1])).public_key(
default_backend()
).verify(signature, message, padding.PKCS1v15(), self._HASH_ALG)
@classmethod
def from_cryptography_key(cls, public_key):
pn = public_key.public_numbers()
return cls({1: 3, 3: cls.ALGORITHM, -1: int2bytes(pn.n), -2: int2bytes(pn.e)})
fido2-0.9.1/fido2/ctap.py 0000644 0001750 0001750 00000011726 14006451303 014703 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import
from enum import IntEnum, unique
import abc
@unique
class STATUS(IntEnum):
PROCESSING = 1
UPNEEDED = 2
class CtapDevice(abc.ABC):
"""
CTAP-capable device. Subclasses of this should implement call, as well as
list_devices, which should return a generator over discoverable devices.
"""
@abc.abstractmethod
def call(self, cmd, data=b"", event=None, on_keepalive=None):
"""Sends a command to the authenticator, and reads the response.
:param cmd: The integer value of the command.
:param data: The payload of the command.
:param event: An optional threading.Event which can be used to cancel
the invocation.
:param on_keepalive: An optional callback to handle keep-alive messages
from the authenticator. The function is only called once for
consecutive keep-alive messages with the same status.
:return: The response from the authenticator.
"""
def close(self):
"""Close the device, releasing any held resources."""
def __enter__(self):
return self
def __exit__(self, typ, value, traceback):
self.close()
@classmethod
@abc.abstractmethod
def list_devices(cls):
"""Generates instances of cls for discoverable devices."""
class CtapError(Exception):
class UNKNOWN_ERR(int):
name = "UNKNOWN_ERR"
@property
def value(self):
return int(self)
def __repr__(self):
return "" % self
def __str__(self):
return "0x%02X - UNKNOWN" % self
@unique
class ERR(IntEnum):
SUCCESS = 0x00
INVALID_COMMAND = 0x01
INVALID_PARAMETER = 0x02
INVALID_LENGTH = 0x03
INVALID_SEQ = 0x04
TIMEOUT = 0x05
CHANNEL_BUSY = 0x06
LOCK_REQUIRED = 0x0A
INVALID_CHANNEL = 0x0B
CBOR_UNEXPECTED_TYPE = 0x11
INVALID_CBOR = 0x12
MISSING_PARAMETER = 0x14
LIMIT_EXCEEDED = 0x15
UNSUPPORTED_EXTENSION = 0x16
FP_DATABASE_FULL = 0x17
LARGE_BLOB_STORAGE_FULL = 0x18
CREDENTIAL_EXCLUDED = 0x19
PROCESSING = 0x21
INVALID_CREDENTIAL = 0x22
USER_ACTION_PENDING = 0x23
OPERATION_PENDING = 0x24
NO_OPERATIONS = 0x25
UNSUPPORTED_ALGORITHM = 0x26
OPERATION_DENIED = 0x27
KEY_STORE_FULL = 0x28
NOT_BUSY = 0x29
NO_OPERATION_PENDING = 0x2A
UNSUPPORTED_OPTION = 0x2B
INVALID_OPTION = 0x2C
KEEPALIVE_CANCEL = 0x2D
NO_CREDENTIALS = 0x2E
USER_ACTION_TIMEOUT = 0x2F
NOT_ALLOWED = 0x30
PIN_INVALID = 0x31
PIN_BLOCKED = 0x32
PIN_AUTH_INVALID = 0x33
PIN_AUTH_BLOCKED = 0x34
PIN_NOT_SET = 0x35
PIN_REQUIRED = 0x36
PIN_POLICY_VIOLATION = 0x37
PIN_TOKEN_EXPIRED = 0x38
REQUEST_TOO_LARGE = 0x39
ACTION_TIMEOUT = 0x3A
UP_REQUIRED = 0x3B
UV_BLOCKD = 0x3C
INTEGRITY_FAILURE = 0x3D
INVALID_SUBCOMMAND = 0x3E
UV_INVALID = 0x3F
UNAUTHORIZED_PERMISSION = 0x40
OTHER = 0x7F
SPEC_LAST = 0xDF
EXTENSION_FIRST = 0xE0
EXTENSION_LAST = 0xEF
VENDOR_FIRST = 0xF0
VENDOR_LAST = 0xFF
def __str__(self):
return "0x%02X - %s" % (self.value, self.name)
def __init__(self, code):
try:
code = CtapError.ERR(code)
except ValueError:
code = CtapError.UNKNOWN_ERR(code)
self.code = code
super(CtapError, self).__init__("CTAP error: %s" % code)
fido2-0.9.1/fido2/ctap1.py 0000644 0001750 0001750 00000022341 14006451303 014757 0 ustar dain dain 0000000 0000000 # Copyright (c) 2013 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .hid import CTAPHID
from .utils import websafe_encode, websafe_decode, bytes2int, ByteBuffer
from .cose import ES256
from .attestation import FidoU2FAttestation
from enum import IntEnum, unique
from binascii import b2a_hex
import struct
import six
@unique
class APDU(IntEnum):
"""APDU response codes."""
OK = 0x9000
USE_NOT_SATISFIED = 0x6985
WRONG_DATA = 0x6A80
class ApduError(Exception):
"""An Exception thrown when a response APDU doesn't have an OK (0x9000)
status.
:param code: APDU response code.
:param data: APDU response body.
"""
def __init__(self, code, data=b""):
self.code = code
self.data = data
def __repr__(self):
return "APDU error: 0x{:04X} {:d} bytes of data".format(
self.code, len(self.data)
)
class RegistrationData(bytes):
"""Binary response data for a CTAP1 registration.
:param _: The binary contents of the response data.
:ivar public_key: Binary representation of the credential public key.
:ivar key_handle: Binary key handle of the credential.
:ivar certificate: Attestation certificate of the authenticator, DER
encoded.
:ivar signature: Attestation signature.
"""
def __init__(self, _):
super(RegistrationData, self).__init__()
if six.indexbytes(self, 0) != 0x05:
raise ValueError("Reserved byte != 0x05")
self.public_key = self[1:66]
kh_len = six.indexbytes(self, 66)
self.key_handle = self[67 : 67 + kh_len]
cert_offs = 67 + kh_len
cert_len = six.indexbytes(self, cert_offs + 1)
if cert_len > 0x80:
n_bytes = cert_len - 0x80
cert_len = (
bytes2int(self[cert_offs + 2 : cert_offs + 2 + n_bytes]) + n_bytes
)
cert_len += 2
self.certificate = self[cert_offs : cert_offs + cert_len]
self.signature = self[cert_offs + cert_len :]
@property
def b64(self):
"""Websafe base64 encoded string of the RegistrationData."""
return websafe_encode(self)
def verify(self, app_param, client_param):
"""Verify the included signature with regard to the given app and client
params.
:param app_param: SHA256 hash of the app ID used for the request.
:param client_param: SHA256 hash of the ClientData used for the request.
"""
FidoU2FAttestation.verify_signature(
app_param,
client_param,
self.key_handle,
self.public_key,
self.certificate,
self.signature,
)
def __repr__(self):
return (
"RegistrationData(public_key: h'%s', key_handle: h'%s', "
"certificate: h'%s', signature: h'%s')"
) % tuple(
b2a_hex(x).decode()
for x in (
self.public_key,
self.key_handle,
self.certificate,
self.signature,
)
)
def __str__(self):
return "%r" % self
@classmethod
def from_b64(cls, data):
"""Parse a RegistrationData from a websafe base64 encoded string.
:param data: Websafe base64 encoded string.
:return: The decoded and parsed RegistrationData.
"""
return cls(websafe_decode(data))
class SignatureData(bytes):
"""Binary response data for a CTAP1 authentication.
:param _: The binary contents of the response data.
:ivar user_presence: User presence byte.
:ivar counter: Signature counter.
:ivar signature: Cryptographic signature.
"""
def __init__(self, _):
super(SignatureData, self).__init__()
reader = ByteBuffer(self)
self.user_presence = reader.unpack("B")
self.counter = reader.unpack(">I")
self.signature = reader.read()
@property
def b64(self):
"""str: Websafe base64 encoded string of the SignatureData."""
return websafe_encode(self)
def verify(self, app_param, client_param, public_key):
"""Verify the included signature with regard to the given app and client
params, using the given public key.
:param app_param: SHA256 hash of the app ID used for the request.
:param client_param: SHA256 hash of the ClientData used for the request.
:param public_key: Binary representation of the credential public key.
"""
m = app_param + self[:5] + client_param
ES256.from_ctap1(public_key).verify(m, self.signature)
def __repr__(self):
return (
"SignatureData(user_presence: 0x%02x, counter: %d, " "signature: h'%s'"
) % (self.user_presence, self.counter, b2a_hex(self.signature))
def __str__(self):
return "%r" % self
@classmethod
def from_b64(cls, data):
"""Parse a SignatureData from a websafe base64 encoded string.
:param data: Websafe base64 encoded string.
:return: The decoded and parsed SignatureData.
"""
return cls(websafe_decode(data))
class Ctap1(object):
"""Implementation of the CTAP1 specification.
:param device: A CtapHidDevice handle supporting CTAP1.
"""
@unique
class INS(IntEnum):
REGISTER = 0x01
AUTHENTICATE = 0x02
VERSION = 0x03
def __init__(self, device):
self.device = device
def send_apdu(self, cla=0, ins=0, p1=0, p2=0, data=b""):
"""Packs and sends an APDU for use in CTAP1 commands.
This is a low-level method mainly used internally. Avoid calling it
directly if possible, and use the get_version, register, and
authenticate methods if possible instead.
:param cla: The CLA parameter of the request.
:param ins: The INS parameter of the request.
:param p1: The P1 parameter of the request.
:param p2: The P2 parameter of the request.
:param data: The body of the request.
:return: The response APDU data of a successful request.
:raise: ApduError
"""
apdu = struct.pack(">BBBBBH", cla, ins, p1, p2, 0, len(data)) + data + b"\0\0"
response = self.device.call(CTAPHID.MSG, apdu)
status = struct.unpack(">H", response[-2:])[0]
data = response[:-2]
if status != APDU.OK:
raise ApduError(status, data)
return data
def get_version(self):
"""Get the U2F version implemented by the authenticator.
The only version specified is "U2F_V2".
:return: A U2F version string.
"""
return self.send_apdu(ins=Ctap1.INS.VERSION).decode()
def register(self, client_param, app_param):
"""Register a new U2F credential.
:param client_param: SHA256 hash of the ClientData used for the request.
:param app_param: SHA256 hash of the app ID used for the request.
:return: The registration response from the authenticator.
"""
data = client_param + app_param
response = self.send_apdu(ins=Ctap1.INS.REGISTER, data=data)
return RegistrationData(response)
def authenticate(self, client_param, app_param, key_handle, check_only=False):
"""Authenticate a previously registered credential.
:param client_param: SHA256 hash of the ClientData used for the request.
:param app_param: SHA256 hash of the app ID used for the request.
:param key_handle: The binary key handle of the credential.
:param check_only: True to send a "check-only" request, which is used to
determine if a key handle is known.
:return: The authentication response from the authenticator.
"""
data = (
client_param + app_param + struct.pack(">B", len(key_handle)) + key_handle
)
p1 = 0x07 if check_only else 0x03
response = self.send_apdu(ins=Ctap1.INS.AUTHENTICATE, p1=p1, data=data)
return SignatureData(response)
CTAP1 = Ctap1
fido2-0.9.1/fido2/ctap2/ 0000755 0001750 0001750 00000000000 14006463366 014420 5 ustar dain dain 0000000 0000000 fido2-0.9.1/fido2/ctap2/base.py 0000644 0001750 0001750 00000104373 14006451303 015700 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .. import cbor
from ..ctap import CtapError
from ..cose import CoseKey, ES256
from ..hid import CTAPHID, CAPABILITY
from ..utils import ByteBuffer
from ..attestation import FidoU2FAttestation
from binascii import b2a_hex
from enum import IntEnum, unique
import struct
import six
import re
def args(*params):
"""Constructs a dict from a list of arguments for sending a CBOR command.
None elements will be omitted.
:param params: Arguments, in order, to add to the command.
:return: The input parameters as a dict.
"""
return dict((i, v) for i, v in enumerate(params, 1) if v is not None)
def hexstr(bs):
"""Formats a byte string as a human readable hex string.
:param bs: The bytes to format.
:return: A readable string representation of the input.
"""
return "h'%s'" % b2a_hex(bs).decode()
class Info(bytes):
"""Binary CBOR encoded response data returned by the CTAP2 GET_INFO command.
:param _: The binary content of the Info data.
:ivar versions: The versions supported by the authenticator.
:ivar extensions: The extensions supported by the authenticator.
:ivar aaguid: The AAGUID of the authenticator.
:ivar options: The options supported by the authenticator.
:ivar max_msg_size: The max message size supported by the authenticator.
:ivar pin_uv_protocols: The PIN/UV protocol versions supported by the authenticator.
:ivar max_creds_in_list: Max number of credentials supported in list at a time.
:ivar max_cred_id_length: Max length of Credential ID supported.
:ivar transports: List of supported transports.
:ivar algorithms: List of supported algorithms for credential creation.
:ivar data: The Info members, in the form of a dict.
"""
@unique
class KEY(IntEnum):
VERSIONS = 0x01
EXTENSIONS = 0x02
AAGUID = 0x03
OPTIONS = 0x04
MAX_MSG_SIZE = 0x05
PIN_UV_PROTOCOLS = 0x06
MAX_CREDS_IN_LIST = 0x07
MAX_CRED_ID_LENGTH = 0x08
TRANSPORTS = 0x09
ALGORITHMS = 0x0A
MAX_LARGE_BLOB = 0x0B
FORCE_PIN_CHANGE = 0x0C
MIN_PIN_LENGTH = 0x0D
FIRMWARE_VERSION = 0x0E
MAX_CRED_BLOB_LENGTH = 0x0F
MAX_RPIDS_FOR_MIN_PIN = 0x10
PREFERRED_PLATFORM_UV_ATTEMPTS = 0x11
UV_MODALITY = 0x12
CERTIFICATIONS = 0x13
REMAINING_DISC_CREDS = 0x14
@classmethod
def get(cls, key):
try:
return cls(key)
except ValueError:
return key
def __repr__(self):
return "<%s: 0x%02X>" % (self.name, self)
def __init__(self, _):
super(Info, self).__init__()
data = dict((Info.KEY.get(k), v) for (k, v) in cbor.decode(self).items())
self.versions = data[Info.KEY.VERSIONS]
self.extensions = data.get(Info.KEY.EXTENSIONS, [])
self.aaguid = data[Info.KEY.AAGUID]
self.options = data.get(Info.KEY.OPTIONS, {})
self.max_msg_size = data.get(Info.KEY.MAX_MSG_SIZE, 1024)
self.pin_uv_protocols = data.get(Info.KEY.PIN_UV_PROTOCOLS, [])
self.max_creds_in_list = data.get(Info.KEY.MAX_CREDS_IN_LIST)
self.max_cred_id_length = data.get(Info.KEY.MAX_CRED_ID_LENGTH)
self.transports = data.get(Info.KEY.TRANSPORTS, [])
self.algorithms = data.get(Info.KEY.ALGORITHMS)
self.max_large_blob = data.get(Info.KEY.MAX_LARGE_BLOB)
self.force_pin_change = data.get(Info.KEY.FORCE_PIN_CHANGE, False)
self.min_pin_length = data.get(Info.KEY.MIN_PIN_LENGTH, 4)
self.firmware_version = data.get(Info.KEY.FIRMWARE_VERSION)
self.max_cred_blob_length = data.get(Info.KEY.MAX_CRED_BLOB_LENGTH)
self.max_rpids_for_min_pin = data.get(Info.KEY.MAX_RPIDS_FOR_MIN_PIN, 0)
self.uv_modality = data.get(Info.KEY.UV_MODALITY)
self.certifications = data.get(Info.KEY.CERTIFICATIONS, {})
self.remaining_disc_creds = data.get(Info.KEY.REMAINING_DISC_CREDS)
self.data = data
def __repr__(self):
return "%s" % self.data
def __str__(self):
return self.__repr__()
@classmethod
def create(
cls,
versions,
extensions=None,
aaguid=b"\0" * 16,
options=None,
max_msg_size=None,
pin_uv_protocols=None,
max_creds_in_list=None,
max_cred_id_length=None,
transports=None,
algorithms=None,
):
"""Create an Info by providing its components.
See class docstring for parameter descriptions.
"""
return cls(
cbor.encode(
args(
versions,
extensions,
aaguid,
options,
max_msg_size,
pin_uv_protocols,
max_creds_in_list,
max_cred_id_length,
transports,
algorithms,
)
)
)
class AttestedCredentialData(bytes):
"""Binary encoding of the attested credential data.
:param _: The binary representation of the attested credential data.
:ivar aaguid: The AAGUID of the authenticator.
:ivar credential_id: The binary ID of the credential.
:ivar public_key: The public key of the credential.
"""
def __init__(self, _):
super(AttestedCredentialData, self).__init__()
parsed = AttestedCredentialData.parse(self)
self.aaguid = parsed[0]
self.credential_id = parsed[1]
self.public_key = parsed[2]
if parsed[3]:
raise ValueError("Wrong length")
def __repr__(self):
return (
"AttestedCredentialData(aaguid: %s, credential_id: %s, " "public_key: %s"
) % (hexstr(self.aaguid), hexstr(self.credential_id), self.public_key)
def __str__(self):
return self.__repr__()
@staticmethod
def parse(data):
"""Parse the components of an AttestedCredentialData from a binary
string, and return them.
:param data: A binary string containing an attested credential data.
:return: AAGUID, credential ID, public key, and remaining data.
"""
reader = ByteBuffer(data)
aaguid = reader.read(16)
cred_id = reader.read(reader.unpack(">H"))
pub_key, rest = cbor.decode_from(reader.read())
return aaguid, cred_id, CoseKey.parse(pub_key), rest
@classmethod
def create(cls, aaguid, credential_id, public_key):
"""Create an AttestedCredentialData by providing its components.
:param aaguid: The AAGUID of the authenticator.
:param credential_id: The binary ID of the credential.
:param public_key: A COSE formatted public key.
:return: The attested credential data.
"""
return cls(
aaguid
+ struct.pack(">H", len(credential_id))
+ credential_id
+ cbor.encode(public_key)
)
@classmethod
def unpack_from(cls, data):
"""Unpack an AttestedCredentialData from a byte string, returning it and
any remaining data.
:param data: A binary string containing an attested credential data.
:return: The parsed AttestedCredentialData, and any remaining data from
the input.
"""
parts = cls.parse(data)
return cls.create(*parts[:-1]), parts[-1]
@classmethod
def from_ctap1(cls, key_handle, public_key):
"""Create an AttestatedCredentialData from a CTAP1 RegistrationData
instance.
:param key_handle: The CTAP1 credential key_handle.
:type key_handle: bytes
:param public_key: The CTAP1 65 byte public key.
:type public_key: bytes
:return: The credential data, using an all-zero AAGUID.
:rtype: AttestedCredentialData
"""
return cls.create(
b"\0" * 16, key_handle, ES256.from_ctap1(public_key) # AAGUID
)
class AuthenticatorData(bytes):
"""Binary encoding of the authenticator data.
:param _: The binary representation of the authenticator data.
:ivar rp_id_hash: SHA256 hash of the RP ID.
:ivar flags: The flags of the authenticator data, see
AuthenticatorData.FLAG.
:ivar counter: The signature counter of the authenticator.
:ivar credential_data: Attested credential data, if available.
:ivar extensions: Authenticator extensions, if available.
"""
@unique
class FLAG(IntEnum):
"""Authenticator data flags
See https://www.w3.org/TR/webauthn/#sec-authenticator-data for details
"""
USER_PRESENT = 0x01
USER_VERIFIED = 0x04
ATTESTED = 0x40
EXTENSION_DATA = 0x80
def __init__(self, _):
super(AuthenticatorData, self).__init__()
reader = ByteBuffer(self)
self.rp_id_hash = reader.read(32)
self.flags = reader.unpack("B")
self.counter = reader.unpack(">I")
rest = reader.read()
if self.flags & AuthenticatorData.FLAG.ATTESTED:
self.credential_data, rest = AttestedCredentialData.unpack_from(rest)
else:
self.credential_data = None
if self.flags & AuthenticatorData.FLAG.EXTENSION_DATA:
self.extensions, rest = cbor.decode_from(rest)
else:
self.extensions = None
if rest:
raise ValueError("Wrong length")
@classmethod
def create(cls, rp_id_hash, flags, counter, credential_data=b"", extensions=None):
"""Create an AuthenticatorData instance.
:param rp_id_hash: SHA256 hash of the RP ID.
:param flags: Flags of the AuthenticatorData.
:param counter: Signature counter of the authenticator data.
:param credential_data: Authenticated credential data (only if attested
credential data flag is set).
:param extensions: Authenticator extensions (only if ED flag is set).
:return: The authenticator data.
"""
return cls(
rp_id_hash
+ struct.pack(">BI", flags, counter)
+ credential_data
+ (cbor.encode(extensions) if extensions is not None else b"")
)
def is_user_present(self):
"""Return true if the User Present flag is set.
:return: True if User Present is set, False otherwise.
:rtype: bool
"""
return bool(self.flags & AuthenticatorData.FLAG.USER_PRESENT)
def is_user_verified(self):
"""Return true if the User Verified flag is set.
:return: True if User Verified is set, False otherwise.
:rtype: bool
"""
return bool(self.flags & AuthenticatorData.FLAG.USER_VERIFIED)
def is_attested(self):
"""Return true if the Attested credential data flag is set.
:return: True if Attested credential data is set, False otherwise.
:rtype: bool
"""
return bool(self.flags & AuthenticatorData.FLAG.ATTESTED)
def has_extension_data(self):
"""Return true if the Extenstion data flag is set.
:return: True if Extenstion data is set, False otherwise.
:rtype: bool
"""
return bool(self.flags & AuthenticatorData.FLAG.EXTENSION_DATA)
def __repr__(self):
r = "AuthenticatorData(rp_id_hash: %s, flags: 0x%02x, counter: %d" % (
hexstr(self.rp_id_hash),
self.flags,
self.counter,
)
if self.credential_data:
r += ", credential_data: %s" % self.credential_data
if self.extensions:
r += ", extensions: %s" % self.extensions
return r + ")"
def __str__(self):
return self.__repr__()
class AttestationObject(bytes):
"""Binary CBOR encoded attestation object.
:param _: The binary representation of the attestation object.
:type _: bytes
:ivar fmt: The type of attestation used.
:type fmt: str
:ivar auth_data: The attested authenticator data.
:type auth_data: AuthenticatorData
:ivar att_statement: The attestation statement.
:type att_statement: Dict[str, Any]
:ivar data: The AttestationObject members, in the form of a dict.
:type data: Dict[AttestationObject.KEY, Any]
"""
@unique
class KEY(IntEnum):
FMT = 1
AUTH_DATA = 2
ATT_STMT = 3
EP_ATT = 4
LARGE_BLOB_KEY = 5
@classmethod
def for_key(cls, key):
"""Get an AttestationObject.KEY by number or by name, using the
numeric ID or the Webauthn key string.
:param key: The numeric key value, or the string name of a member.
:type key: Union[str, int]
:return: The KEY corresponding to the input.
:rtype: AttestationObject.KEY
"""
if isinstance(key, int):
return cls(key)
name = re.sub("([a-z])([A-Z])", r"\1_\2", key).upper()
return getattr(cls, name)
@property
def string_key(self):
"""Get the string used for this key in the Webauthn specification.
:return: The Webauthn string used for a key.
:rtype: str
"""
value = "".join(w.capitalize() for w in self.name.split("_"))
return value[0].lower() + value[1:]
def __init__(self, _):
super(AttestationObject, self).__init__()
data = dict(
(AttestationObject.KEY.for_key(k), v)
for (k, v) in cbor.decode(self).items()
)
self.fmt = data[AttestationObject.KEY.FMT]
self.auth_data = AuthenticatorData(data[AttestationObject.KEY.AUTH_DATA])
data[AttestationObject.KEY.AUTH_DATA] = self.auth_data
self.att_statement = data[AttestationObject.KEY.ATT_STMT]
self.ep_att = data.get(AttestationObject.KEY.EP_ATT)
self.large_blob_key = data.get(AttestationObject.KEY.LARGE_BLOB_KEY)
self.data = data
def __repr__(self):
return (
"AttestationObject(fmt: %r, auth_data: %r, att_statement: %r, "
"ep_attr: %r, large_blob_key: %r)"
) % (
self.fmt,
self.auth_data,
self.att_statement,
self.ep_att,
self.large_blob_key,
)
def __str__(self):
return self.__repr__()
@classmethod
def create(cls, fmt, auth_data, att_stmt):
"""Create an AttestationObject instance.
:param fmt: The type of attestation used.
:type fmt: str
:param auth_data: Binary representation of the authenticator data.
:type auth_data: bytes
:param att_stmt: The attestation statement.
:type att_stmt: dict
:return: The attestation object.
:rtype: AttestationObject
"""
return cls(cbor.encode(args(fmt, auth_data, att_stmt)))
@classmethod
def from_ctap1(cls, app_param, registration):
"""Create an AttestationObject from a CTAP1 RegistrationData instance.
:param app_param: SHA256 hash of the RP ID used for the CTAP1 request.
:type app_param: bytes
:param registration: The CTAP1 registration data.
:type registration: RegistrationData
:return: The attestation object, using the "fido-u2f" format.
:rtype: AttestationObject
"""
return cls.create(
FidoU2FAttestation.FORMAT,
AuthenticatorData.create(
app_param,
0x41,
0,
AttestedCredentialData.from_ctap1(
registration.key_handle, registration.public_key
),
),
{ # att_statement
"x5c": [registration.certificate],
"sig": registration.signature,
},
)
def with_int_keys(self):
"""Get a copy of this AttestationObject, using CTAP2 integer values as
map keys in the CBOR representation.
:return: The attestation object, using int keys.
:rtype: AttestationObject
"""
return AttestationObject(cbor.encode(self.data))
def with_string_keys(self):
"""Get a copy of this AttestationObject, using Webauthn string values as
map keys in the CBOR representation.
:return: The attestation object, using str keys.
:rtype: AttestationObject
"""
return AttestationObject(
cbor.encode(dict((k.string_key, v) for k, v in self.data.items()))
)
class AssertionResponse(bytes):
"""Binary CBOR encoded assertion response.
:param _: The binary representation of the assertion response.
:ivar credential: The credential used for the assertion.
:ivar auth_data: The authenticator data part of the response.
:ivar signature: The digital signature of the assertion.
:ivar user: The user data of the credential.
:ivar number_of_credentials: The total number of responses available
(only set for the first response, if > 1).
"""
@unique
class KEY(IntEnum):
CREDENTIAL = 1
AUTH_DATA = 2
SIGNATURE = 3
USER = 4
N_CREDS = 5
USER_SELECTED = 6
LARGE_BLOB_KEY = 7
def __init__(self, _):
super(AssertionResponse, self).__init__()
data = dict(
(AssertionResponse.KEY(k), v) for (k, v) in cbor.decode(self).items()
)
self.credential = data.get(AssertionResponse.KEY.CREDENTIAL)
self.auth_data = AuthenticatorData(data[AssertionResponse.KEY.AUTH_DATA])
self.signature = data[AssertionResponse.KEY.SIGNATURE]
self.user = data.get(AssertionResponse.KEY.USER)
self.number_of_credentials = data.get(AssertionResponse.KEY.N_CREDS)
self.user_selected = data.get(AssertionResponse.KEY.USER_SELECTED, False)
self.large_blob_key = data.get(AssertionResponse.KEY.LARGE_BLOB_KEY)
self.data = data
def __repr__(self):
r = "AssertionResponse(credential: %r, auth_data: %r, signature: %s" % (
self.credential,
self.auth_data,
hexstr(self.signature),
)
if self.user:
r += ", user: %s" % self.user
if self.number_of_credentials is not None:
r += ", number_of_credentials: %d" % self.number_of_credentials
return r + ")"
def __str__(self):
return self.__repr__()
def verify(self, client_param, public_key):
"""Verify the digital signature of the response with regard to the
client_param, using the given public key.
:param client_param: SHA256 hash of the ClientData used for the request.
:param public_key: The public key of the credential, to verify.
"""
public_key.verify(self.auth_data + client_param, self.signature)
@classmethod
def create(cls, credential, auth_data, signature, user=None, n_creds=None):
"""Create an AssertionResponse instance.
:param credential: The credential used for the response.
:param auth_data: The binary encoded authenticator data.
:param signature: The digital signature of the response.
:param user: The user data of the credential, if any.
:param n_creds: The number of responses available.
:return: The assertion response.
"""
return cls(cbor.encode(args(credential, auth_data, signature, user, n_creds)))
@classmethod
def from_ctap1(cls, app_param, credential, authentication):
"""Create an AssertionResponse from a CTAP1 SignatureData instance.
:param app_param: SHA256 hash of the RP ID used for the CTAP1 request.
:param credential: Credential used for the CTAP1 request (from the
allowList).
:param authentication: The CTAP1 signature data.
:return: The assertion response.
"""
return cls.create(
credential,
AuthenticatorData.create(
app_param, authentication.user_presence & 0x01, authentication.counter
),
authentication.signature,
)
class Ctap2(object):
"""Implementation of the CTAP2 specification.
:param device: A CtapHidDevice handle supporting CTAP2.
:param strict_cbor: Validate that CBOR returned from the Authenticator is
canonical, defaults to True.
"""
@unique
class CMD(IntEnum):
MAKE_CREDENTIAL = 0x01
GET_ASSERTION = 0x02
GET_INFO = 0x04
CLIENT_PIN = 0x06
RESET = 0x07
GET_NEXT_ASSERTION = 0x08
BIO_ENROLLMENT = 0x09
CREDENTIAL_MGMT = 0x0A
SELECTION = 0x0B
LARGE_BLOBS = 0x0C
CONFIG = 0x0D
BIO_ENROLLMENT_PRE = 0x40
CREDENTIAL_MGMT_PRE = 0x41
def __init__(self, device, strict_cbor=True):
if not device.capabilities & CAPABILITY.CBOR:
raise ValueError("Device does not support CTAP2.")
self.device = device
self._strict_cbor = strict_cbor
self._info = self.get_info()
@property
def info(self):
"""Get a cached Info object which can be used to determine capabilities.
:rtype: Info
:return: The response of calling GetAuthenticatorInfo.
"""
return self._info
def send_cbor(
self, cmd, data=None, event=None, parse=cbor.decode, on_keepalive=None
):
"""Sends a CBOR message to the device, and waits for a response.
:param cmd: The command byte of the request.
:param data: The payload to send (to be CBOR encoded).
:param event: Optional threading.Event used to cancel the request.
:param parse: Function used to parse the binary response data, defaults
to parsing the CBOR.
:param on_keepalive: Optional function called when keep-alive is sent by
the authenticator.
:return: The result of calling the parse function on the response data
(defaults to the CBOR decoded value).
"""
request = struct.pack(">B", cmd)
if data is not None:
request += cbor.encode(data)
response = self.device.call(CTAPHID.CBOR, request, event, on_keepalive)
status = six.indexbytes(response, 0)
if status != 0x00:
raise CtapError(status)
if len(response) == 1:
return None
enc = response[1:]
if self._strict_cbor:
expected = cbor.encode(cbor.decode(enc))
if expected != enc:
enc_h = b2a_hex(enc)
exp_h = b2a_hex(expected)
raise ValueError(
"Non-canonical CBOR from Authenticator.\n"
"Got: {}\n".format(enc_h) + "Expected: {}".format(exp_h)
)
return parse(enc)
def get_info(self):
"""CTAP2 getInfo command.
:return: Information about the authenticator.
"""
return self.send_cbor(Ctap2.CMD.GET_INFO, parse=Info)
def client_pin(
self,
pin_uv_protocol,
sub_cmd,
key_agreement=None,
pin_uv_param=None,
new_pin_enc=None,
pin_hash_enc=None,
permissions=None,
permissions_rpid=None,
):
"""CTAP2 clientPin command, used for various PIN operations.
This method is not intended to be called directly. It is intended to be used by
an instance of the PinProtocolV1 class.
:param pin_uv_protocol: The PIN/UV protocol version to use.
:param sub_cmd: A clientPin sub command.
:param key_agreement: The keyAgreement parameter.
:param pin_uv_param: The pinAuth parameter.
:param new_pin_enc: The newPinEnc parameter.
:param pin_hash_enc: The pinHashEnc parameter.
:param permissions: The permissions parameter.
:param permissions_rpid: The permissions RPID parameter.
:return: The response of the command, decoded.
"""
return self.send_cbor(
Ctap2.CMD.CLIENT_PIN,
args(
pin_uv_protocol,
sub_cmd,
key_agreement,
pin_uv_param,
new_pin_enc,
pin_hash_enc,
None,
None,
permissions,
permissions_rpid,
),
)
def reset(self, event=None, on_keepalive=None):
"""CTAP2 reset command, erases all credentials and PIN.
:param event: Optional threading.Event object used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive
messages from the authenticator.
"""
self.send_cbor(Ctap2.CMD.RESET, event=event, on_keepalive=on_keepalive)
def make_credential(
self,
client_data_hash,
rp,
user,
key_params,
exclude_list=None,
extensions=None,
options=None,
pin_uv_param=None,
pin_uv_protocol=None,
event=None,
on_keepalive=None,
):
"""CTAP2 makeCredential operation.
:param client_data_hash: SHA256 hash of the ClientData.
:param rp: PublicKeyCredentialRpEntity parameters.
:param user: PublicKeyCredentialUserEntity parameters.
:param key_params: List of acceptable credential types.
:param exclude_list: Optional list of PublicKeyCredentialDescriptors.
:param extensions: Optional dict of extensions.
:param options: Optional dict of options.
:param pin_uv_param: Optional PIN/UV auth parameter.
:param pin_uv_protocol: The version of PIN/UV protocol used, if any.
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive
messages from the authenticator.
:return: The new credential.
"""
return self.send_cbor(
Ctap2.CMD.MAKE_CREDENTIAL,
args(
client_data_hash,
rp,
user,
key_params,
exclude_list,
extensions,
options,
pin_uv_param,
pin_uv_protocol,
),
event,
AttestationObject,
on_keepalive,
)
def get_assertion(
self,
rp_id,
client_data_hash,
allow_list=None,
extensions=None,
options=None,
pin_uv_param=None,
pin_uv_protocol=None,
event=None,
on_keepalive=None,
):
"""CTAP2 getAssertion command.
:param rp_id: The RP ID of the credential.
:param client_data_hash: SHA256 hash of the ClientData used.
:param allow_list: Optional list of PublicKeyCredentialDescriptors.
:param extensions: Optional dict of extensions.
:param options: Optional dict of options.
:param pin_uv_param: Optional PIN/UV auth parameter.
:param pin_uv_protocol: The version of PIN/UV protocol used, if any.
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive messages
from the authenticator.
:return: The new assertion.
"""
return self.send_cbor(
Ctap2.CMD.GET_ASSERTION,
args(
rp_id,
client_data_hash,
allow_list,
extensions,
options,
pin_uv_param,
pin_uv_protocol,
),
event,
AssertionResponse,
on_keepalive,
)
def get_next_assertion(self):
"""CTAP2 getNextAssertion command.
:return: The next available assertion response.
"""
return self.send_cbor(Ctap2.CMD.GET_NEXT_ASSERTION, parse=AssertionResponse)
def get_assertions(self, *args, **kwargs):
"""Convenience method to get list of assertions.
See get_assertion and get_next_assertion for details.
"""
first = self.get_assertion(*args, **kwargs)
rest = [
self.get_next_assertion()
for _ in range(1, first.number_of_credentials or 1)
]
return [first] + rest
def credential_mgmt(
self, sub_cmd, sub_cmd_params=None, pin_uv_protocol=None, pin_uv_param=None
):
"""CTAP2 credentialManagement command, used to manage resident
credentials.
NOTE: This implements the current draft version of the CTAP2 specification and
should be considered highly experimental.
This method is not intended to be called directly. It is intended to be used by
an instance of the CredentialManagement class.
:param sub_cmd: A CredentialManagement sub command.
:param sub_cmd_params: Sub command specific parameters.
:param pin_uv_protocol: PIN/UV auth protocol version used.
:param pin_uv_param: PIN/UV Auth parameter.
"""
if "credMgmt" in self.info.options:
cmd = Ctap2.CMD.CREDENTIAL_MGMT
elif "credentialMgmtPreview" in self.info.options:
cmd = Ctap2.CMD.CREDENTIAL_MGMT_PRE
else:
raise ValueError(
"Credential Management not supported by this Authenticator"
)
return self.send_cbor(
cmd, args(sub_cmd, sub_cmd_params, pin_uv_protocol, pin_uv_param),
)
def bio_enrollment(
self,
modality=None,
sub_cmd=None,
sub_cmd_params=None,
pin_uv_protocol=None,
pin_uv_param=None,
get_modality=None,
event=None,
on_keepalive=None,
):
"""CTAP2 bio enrollment command. Used to provision/enumerate/delete bio
enrollments in the authenticator.
NOTE: This implements the current draft version of the CTAP2 specification and
should be considered highly experimental.
This method is not intended to be called directly. It is intended to be used by
an instance of the BioEnrollment class.
:param modality: The user verification modality being used.
:param sub_cmd: A BioEnrollment sub command.
:param sub_cmd_params: Sub command specific parameters.
:param pin_uv_protocol: PIN/UV protocol version used.
:param pin_uv_param: PIN/UV auth param.
:param get_modality: Get the user verification type modality.
"""
if "bioEnroll" in self.info.options:
cmd = Ctap2.CMD.BIO_ENROLLMENT
elif "userVerificationMgmtPreview" in self.info.options:
cmd = Ctap2.CMD.BIO_ENROLLMENT_PRE
else:
raise ValueError("Authenticator does not support Bio Enroll")
return self.send_cbor(
cmd,
args(
modality,
sub_cmd,
sub_cmd_params,
pin_uv_protocol,
pin_uv_param,
get_modality,
),
event=event,
on_keepalive=on_keepalive,
)
def selection(self, event=None, on_keepalive=None):
"""CTAP2 authenticator selection command.
This command allows the platform to let a user select a certain authenticator
by asking for user presence.
:param event: Optional threading.Event used to cancel the request.
:param on_keepalive: Optional callback function to handle keep-alive messages
from the authenticator.
"""
self.send_cbor(Ctap2.CMD.SELECTION, event=event, on_keepalive=on_keepalive)
def large_blobs(
self,
offset,
get=None,
set=None,
length=None,
pin_uv_param=None,
pin_uv_protocol=None,
):
"""CTAP2 authenticator large blobs command.
This command is used to read and write the large blob array.
This method is not intended to be called directly. It is intended to be used by
an instance of the LargeBlobs class.
:param offset: The offset of where to start reading/writing data.
:param get: Optional (max) length of data to read.
:param set: Optional data to write.
:param length: Length of the payload in set.
:param pin_uv_protocol: PIN/UV protocol version used.
:param pin_uv_param: PIN/UV auth param.
"""
return self.send_cbor(
Ctap2.CMD.LARGE_BLOBS,
args(get, set, offset, length, pin_uv_param, pin_uv_protocol),
)
def config(
self, sub_cmd, sub_cmd_params=None, pin_uv_protocol=None, pin_uv_param=None
):
"""CTAP2 authenticator config command.
This command is used to configure various authenticator features through the
use of its subcommands.
This method is not intended to be called directly. It is intended to be used by
an instance of the Config class.
:param sub_cmd: A Config sub command.
:param sub_cmd_params: Sub command specific parameters.
:param pin_uv_protocol: PIN/UV auth protocol version used.
:param pin_uv_param: PIN/UV Auth parameter.
"""
return self.send_cbor(
Ctap2.CMD.CONFIG,
args(sub_cmd, sub_cmd_params, pin_uv_protocol, pin_uv_param),
)
fido2-0.9.1/fido2/ctap2/bio.py 0000644 0001750 0001750 00000026032 14006451303 015532 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .. import cbor
from ..ctap import CtapError
from enum import IntEnum, unique
import struct
class BioEnrollment(object):
@unique
class RESULT(IntEnum):
MODALITY = 0x01
FINGERPRINT_KIND = 0x02
MAX_SAMPLES_REQUIRED = 0x03
TEMPLATE_ID = 0x04
LAST_SAMPLE_STATUS = 0x05
REMAINING_SAMPLES = 0x06
TEMPLATE_INFOS = 0x07
@unique
class TEMPLATE_INFO(IntEnum):
ID = 0x01
NAME = 0x02
@unique
class MODALITY(IntEnum):
FINGERPRINT = 0x01
def __init__(self, ctap, modality):
if "bioEnroll" not in ctap.info.options:
# We also support the Prototype command
if not (
"FIDO_2_1_PRE" in ctap.info.versions
and ctap.info.options.get("credentialMgmtPreview")
):
raise ValueError("Authenticator does not support BioEnroll")
self.ctap = ctap
self.modality = self.get_modality()
if modality != self.modality:
raise ValueError("Device does not support {%s}".format(modality))
def get_modality(self):
"""Get bio modality.
:return: The type of modality supported by the authenticator.
"""
return self.ctap.bio_enrollment(get_modality=True)[
BioEnrollment.RESULT.MODALITY
]
class CaptureError(Exception):
def __init__(self, code):
self.code = code
super(CaptureError, self).__init__("Fingerprint capture error: %s" % code)
class FPEnrollmentContext(object):
"""Helper object to perform fingerprint enrollment.
:param bio: An instance of FPBioEnrollment.
:param timeout: Optional timeout for fingerprint captures (ms).
:ivar remaining: The number of (estimated) remaining samples needed.
:ivar template_id: The ID of the new template (only available after the initial
sample has been captured).
"""
def __init__(self, bio, timeout=None):
self._bio = bio
self.timeout = timeout
self.template_id = None
self.remaining = None
def capture(self, event=None, on_keepalive=None):
"""Capture a fingerprint sample.
This call will block for up to timeout milliseconds (or indefinitely, if
timeout not specified) waiting for the user to scan their fingerprint to
collect one sample.
:return: None, if more samples are needed, or the template ID if enrollment is
completed.
"""
if self.template_id is None:
self.template_id, status, self.remaining = self._bio.enroll_begin(
self.timeout, event, on_keepalive
)
else:
status, self.remaining = self._bio.enroll_capture_next(
self.template_id, self.timeout, event, on_keepalive
)
if status != FPBioEnrollment.FEEDBACK.FP_GOOD:
raise CaptureError(status)
if self.remaining == 0:
return self.template_id
return None
def cancel(self):
"""Cancels ongoing enrollment."""
self._bio.enroll_cancel()
self.template_id = None
class FPBioEnrollment(BioEnrollment):
"""Implementation of a draft specification of the bio enrollment API.
WARNING: This specification is not final and this class is likely to change.
NOTE: The get_fingerprint_sensor_info method does not require authentication, and
can be used by setting pin_uv_protocol and pin_uv_token to None.
:param ctap: An instance of a CTAP2 object.
:param pin_uv_protocol: The PIN/UV protocol version used.
:param pin_uv_token: A valid PIN/UV Auth Token for the current CTAP session.
"""
@unique
class CMD(IntEnum):
ENROLL_BEGIN = 0x01
ENROLL_CAPTURE_NEXT = 0x02
ENROLL_CANCEL = 0x03
ENUMERATE_ENROLLMENTS = 0x04
SET_NAME = 0x05
REMOVE_ENROLLMENT = 0x06
GET_SENSOR_INFO = 0x07
@unique
class PARAM(IntEnum):
TEMPLATE_ID = 0x01
TEMPLATE_NAME = 0x02
TIMEOUT_MS = 0x03
@unique
class FEEDBACK(IntEnum):
FP_GOOD = 0x00
FP_TOO_HIGH = 0x01
FP_TOO_LOW = 0x02
FP_TOO_LEFT = 0x03
FP_TOO_RIGHT = 0x04
FP_TOO_FAST = 0x05
FP_TOO_SLOW = 0x06
FP_POOR_QUALITY = 0x07
FP_TOO_SKEWED = 0x08
FP_TOO_SHORT = 0x09
FP_MERGE_FAILURE = 0x0A
FP_EXISTS = 0x0B
FP_DATABASE_FULL = 0x0C
NO_USER_ACTIVITY = 0x0D
NO_UP_TRANSITION = 0x0E
def __str__(self):
return "0x%02X - %s" % (self.value, self.name)
def __init__(self, ctap, pin_uv_protocol, pin_uv_token):
super(FPBioEnrollment, self).__init__(ctap, BioEnrollment.MODALITY.FINGERPRINT)
self.pin_uv_protocol = pin_uv_protocol
self.pin_uv_token = pin_uv_token
def _call(self, sub_cmd, params=None, auth=True, event=None, on_keepalive=None):
if params is not None:
params = {k: v for k, v in params.items() if v is not None}
kwargs = {
"modality": self.modality,
"sub_cmd": sub_cmd,
"sub_cmd_params": params,
"event": event,
"on_keepalive": on_keepalive,
}
if auth:
msg = struct.pack(">BB", self.modality, sub_cmd)
if params is not None:
msg += cbor.encode(params)
kwargs["pin_uv_protocol"] = self.pin_uv_protocol.VERSION
kwargs["pin_uv_param"] = self.pin_uv_protocol.authenticate(
self.pin_uv_token, msg
)
return self.ctap.bio_enrollment(**kwargs)
def get_fingerprint_sensor_info(self):
"""Get fingerprint sensor info.
:return: A dict containing FINGERPRINT_KIND and MAX_SAMPLES_REQUIRES.
"""
return self._call(FPBioEnrollment.CMD.GET_SENSOR_INFO, auth=False)
def enroll_begin(self, timeout=None, event=None, on_keepalive=None):
"""Start fingerprint enrollment.
Starts the process of enrolling a new fingerprint, and will wait for the user
to scan their fingerprint once to provide an initial sample.
:param timeout: Optional timeout in milliseconds.
:return: A tuple containing the new template ID, the sample status, and the
number of samples remaining to complete the enrollment.
"""
result = self._call(
FPBioEnrollment.CMD.ENROLL_BEGIN,
{FPBioEnrollment.PARAM.TIMEOUT_MS: timeout},
event=event,
on_keepalive=on_keepalive,
)
return (
result[BioEnrollment.RESULT.TEMPLATE_ID],
FPBioEnrollment.FEEDBACK(result[BioEnrollment.RESULT.LAST_SAMPLE_STATUS]),
result[BioEnrollment.RESULT.REMAINING_SAMPLES],
)
def enroll_capture_next(
self, template_id, timeout=None, event=None, on_keepalive=None
):
"""Continue fingerprint enrollment.
Continues enrolling a new fingerprint and will wait for the user to scan their
fingerpring once to provide a new sample.
Once the number of samples remaining is 0, the enrollment is completed.
:param template_id: The template ID returned by a call to `enroll_begin`.
:param timeout: Optional timeout in milliseconds.
:return: A tuple containing the sample status, and the number of samples
remaining to complete the enrollment.
"""
result = self._call(
FPBioEnrollment.CMD.ENROLL_CAPTURE_NEXT,
{
FPBioEnrollment.PARAM.TEMPLATE_ID: template_id,
FPBioEnrollment.PARAM.TIMEOUT_MS: timeout,
},
event=event,
on_keepalive=on_keepalive,
)
return (
FPBioEnrollment.FEEDBACK(result[BioEnrollment.RESULT.LAST_SAMPLE_STATUS]),
result[BioEnrollment.RESULT.REMAINING_SAMPLES],
)
def enroll_cancel(self):
"""Cancel any ongoing fingerprint enrollment."""
self._call(FPBioEnrollment.CMD.ENROLL_CANCEL, auth=False)
def enroll(self, timeout=None):
"""Convenience wrapper for doing fingerprint enrollment.
See FPEnrollmentContext for details.
:return: An initialized FPEnrollmentContext.
"""
return FPEnrollmentContext(self, timeout)
def enumerate_enrollments(self):
"""Get a dict of enrolled fingerprint templates which maps template ID's to
their friendly names.
:return: A dict of enrolled template_id -> name pairs.
"""
try:
return {
t[BioEnrollment.TEMPLATE_INFO.ID]: t[BioEnrollment.TEMPLATE_INFO.NAME]
for t in self._call(FPBioEnrollment.CMD.ENUMERATE_ENROLLMENTS)[
BioEnrollment.RESULT.TEMPLATE_INFOS
]
}
except CtapError as e:
if e.code == CtapError.ERR.INVALID_OPTION:
return {}
raise
def set_name(self, template_id, name):
"""Set/Change the friendly name of a previously enrolled fingerprint template.
:param template_id: The ID of the template to change.
:param name: A friendly name to give the template.
"""
self._call(
FPBioEnrollment.CMD.SET_NAME,
{
BioEnrollment.TEMPLATE_INFO.ID: template_id,
BioEnrollment.TEMPLATE_INFO.NAME: name,
},
)
def remove_enrollment(self, template_id):
"""Remove a previously enrolled fingerprint template.
:param template_id: The Id of the template to remove.
"""
self._call(
FPBioEnrollment.CMD.REMOVE_ENROLLMENT,
{BioEnrollment.TEMPLATE_INFO.ID: template_id},
)
fido2-0.9.1/fido2/ctap2/blob.py 0000644 0001750 0001750 00000015474 14006451303 015707 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .. import cbor
from ..utils import sha256
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.exceptions import InvalidTag
import struct
import zlib
import os
def _lb_ad(orig_size):
return b"blob" + struct.pack("B", sub_cmd)
if params is not None:
msg += cbor.encode(params)
kwargs["pin_uv_protocol"] = self.pin_uv_protocol.VERSION
kwargs["pin_uv_param"] = self.pin_uv_protocol.authenticate(
self.pin_uv_token, msg
)
return self.ctap.credential_mgmt(**kwargs)
def get_metadata(self):
"""Get credentials metadata.
This returns the existing resident credentials count, and the max
possible number of remaining resident credentials (the actual number of
remaining credentials may depend on algorithm choice, etc).
:return: A dict containing EXISTING_CRED_COUNT, and MAX_REMAINING_COUNT.
"""
return self._call(CredentialManagement.CMD.GET_CREDS_METADATA)
def enumerate_rps_begin(self):
"""Start enumeration of RP entities of resident credentials.
This will begin enumeration of stored RP entities, returning the first
entity, as well as a count of the total number of entities stored.
:return: A dict containing RP, RP_ID_HASH, and TOTAL_RPS.
"""
return self._call(CredentialManagement.CMD.ENUMERATE_RPS_BEGIN)
def enumerate_rps_next(self):
"""Get the next RP entity stored.
This continues enumeration of stored RP entities, returning the next
entity.
:return: A dict containing RP, and RP_ID_HASH.
"""
return self._call(CredentialManagement.CMD.ENUMERATE_RPS_NEXT, auth=False)
def enumerate_rps(self):
"""Convenience method to enumerate all RPs.
See enumerate_rps_begin and enumerate_rps_next for details.
"""
first = self.enumerate_rps_begin()
n_rps = first[CredentialManagement.RESULT.TOTAL_RPS]
if n_rps == 0:
return []
rest = [self.enumerate_rps_next() for _ in range(1, n_rps)]
return [first] + rest
def enumerate_creds_begin(self, rp_id_hash):
"""Start enumeration of resident credentials.
This will begin enumeration of resident credentials for a given RP,
returning the first credential, as well as a count of the total number
of resident credentials stored for the given RP.
:param rp_id_hash: SHA256 hash of the RP ID.
:return: A dict containing USER, CREDENTIAL_ID, PUBLIC_KEY, and
TOTAL_CREDENTIALS.
"""
return self._call(
CredentialManagement.CMD.ENUMERATE_CREDS_BEGIN,
{CredentialManagement.PARAM.RP_ID_HASH: rp_id_hash},
)
def enumerate_creds_next(self):
"""Get the next resident credential stored.
This continues enumeration of resident credentials, returning the next
credential.
:return: A dict containing USER, CREDENTIAL_ID, and PUBLIC_KEY.
"""
return self._call(CredentialManagement.CMD.ENUMERATE_CREDS_NEXT, auth=False)
def enumerate_creds(self, *args, **kwargs):
"""Convenience method to enumerate all resident credentials for an RP.
See enumerate_creds_begin and enumerate_creds_next for details.
"""
try:
first = self.enumerate_creds_begin(*args, **kwargs)
except CtapError as e:
if e.code == CtapError.ERR.NO_CREDENTIALS:
return []
raise # Other error
rest = [
self.enumerate_creds_next()
for _ in range(
1, first.get(CredentialManagement.RESULT.TOTAL_CREDENTIALS, 1)
)
]
return [first] + rest
def delete_cred(self, cred_id):
"""Delete a resident credential.
:param cred_id: The PublicKeyCredentialDescriptor of the credential to delete.
"""
return self._call(
CredentialManagement.CMD.DELETE_CREDENTIAL,
{CredentialManagement.PARAM.CREDENTIAL_ID: cred_id},
)
def update_user_info(self, cred_id, user_info):
"""Update the user entity of a resident key.
:param cred_id: The PublicKeyCredentialDescriptor of the credential to update.
:param user_info: The user info update.
"""
return self._call(
CredentialManagement.CMD.UPDATE_USER_INFO,
{
CredentialManagement.PARAM.CREDENTIAL_ID: cred_id,
CredentialManagement.PARAM.USER: user_info,
},
)
fido2-0.9.1/fido2/ctap2/extensions.py 0000644 0001750 0001750 00000014434 14006451303 017163 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from ..ctap import CtapError
from .pin import ClientPin
from enum import Enum, unique
import abc
class Ctap2Extension(abc.ABC):
"""Base class for Ctap2 extensions.
Subclasses are instantiated for a single request, if the Authenticator supports
the extension.
"""
def __init__(self, ctap):
self.ctap = ctap
def is_supported(self):
return self.NAME in self.ctap.info.extensions
def process_create_input(self, inputs):
"""Returns a value to include in the authenticator extension input,
or None.
"""
return None
def process_create_output(self, auth_data):
"""Return client extension output given auth_data, or None."""
return None
def process_get_input(self, inputs):
"""Returns a value to include in the authenticator extension input,
or None.
"""
return None
def process_get_output(self, auth_data):
"""Return client extension output given auth_data, or None."""
return None
class HmacSecretExtension(Ctap2Extension):
"""
Implements the hmac-secret CTAP2 extension.
"""
NAME = "hmac-secret"
SALT_LEN = 32
def __init__(self, ctap, pin_protocol=None):
super(HmacSecretExtension, self).__init__(ctap)
self.pin_protocol = pin_protocol
def process_create_input(self, inputs):
if self.is_supported() and inputs.get("hmacCreateSecret") is True:
return True
def process_create_output(self, auth_data):
if auth_data.extensions.get(self.NAME):
return {"hmacCreateSecret": True}
def process_get_input(self, inputs):
data = self.is_supported() and inputs.get("hmacGetSecret")
if not data:
return
salt1 = data["salt1"]
salt2 = data.get("salt2", b"")
if not (
len(salt1) == HmacSecretExtension.SALT_LEN
and (not salt2 or len(salt2) == HmacSecretExtension.SALT_LEN)
):
raise ValueError("Invalid salt length")
client_pin = ClientPin(self.ctap, self.pin_protocol)
key_agreement, self.shared_secret = client_pin._get_shared_secret()
if self.pin_protocol is None:
self.pin_protocol = client_pin.protocol
salt_enc = self.pin_protocol.encrypt(self.shared_secret, salt1 + salt2)
salt_auth = self.pin_protocol.authenticate(self.shared_secret, salt_enc)
return {
1: key_agreement,
2: salt_enc,
3: salt_auth,
4: self.pin_protocol.VERSION,
}
def process_get_output(self, auth_data):
value = auth_data.extensions.get(self.NAME)
decrypted = self.pin_protocol.decrypt(self.shared_secret, value)
output1 = decrypted[: HmacSecretExtension.SALT_LEN]
output2 = decrypted[HmacSecretExtension.SALT_LEN :]
outputs = {"output1": output1}
if output2:
outputs["output2"] = output2
return {"hmacGetSecret": outputs}
class LargeBlobKeyExtension(Ctap2Extension):
"""
Implements the Large Blob Key CTAP2 extension.
"""
NAME = "largeBlobKey"
def process_create_input(self, inputs):
if self.is_supported() and inputs.get("largeBlobKey") is True:
return True
def process_get_input(self, inputs):
if self.is_supported() and inputs.get("largeBlobKey") is True:
return True
class CredBlobExtension(Ctap2Extension):
"""
Implements the Credential Blob CTAP2 extension.
"""
NAME = "credBlob"
def process_create_input(self, inputs):
blob = self.is_supported() and inputs.get("credBlob")
if blob and len(blob) <= self.ctap.info.max_cred_blob_length:
return blob
def process_get_input(self, inputs):
if self.is_supported() and inputs.get("getCredBlob") is True:
return True
class CredProtectExtension(Ctap2Extension):
"""
Implements the Credential Protection CTAP2 extension.
"""
@unique
class POLICY(Enum):
OPTIONAL = "userVerificationOptional"
OPTIONAL_WITH_LIST = "userVerificationOptionalWithCredentialIDList"
REQUIRED = "userVerificationRequired"
ALWAYS_RUN = True
NAME = "credProtect"
def process_create_input(self, inputs):
policy = inputs.get("credentialProtectionPolicy")
if policy:
index = list(CredProtectExtension.POLICY).index(policy)
enforce = inputs.get("enforceCredentialProtectionPolicy", False)
if enforce and not self.is_supported() and index > 0:
raise CtapError(CtapError.ERR.UNSUPPORTED_EXTENSION)
return index + 1
class MinPinLengthExtension(Ctap2Extension):
"""
Implements the Minimum PIN Length CTAP2 extension.
"""
NAME = "minPinLength"
def process_create_input(self, inputs):
if self.is_supported() and inputs.get(self.NAME) is True:
return True
fido2-0.9.1/fido2/ctap2/pin.py 0000644 0001750 0001750 00000030607 14006451303 015552 0 ustar dain dain 0000000 0000000 # Copyright (c) 2018 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from ..utils import sha256, hmac_sha256, bytes2int, int2bytes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from enum import IntEnum, unique
import six
import os
def _pad_pin(pin):
if not isinstance(pin, six.string_types):
raise ValueError("PIN of wrong type, expecting %s" % six.string_types)
if len(pin) < 4:
raise ValueError("PIN must be >= 4 characters")
pin = pin.encode("utf8").ljust(64, b"\0")
pin += b"\0" * (-(len(pin) - 16) % 16)
if len(pin) > 255:
raise ValueError("PIN must be <= 255 bytes")
return pin
class PinProtocolV1(object):
"""Implementation of the CTAP2 PIN/UV protocol v1.
:param ctap: An instance of a CTAP2 object.
:cvar VERSION: The version number of the PIV/UV protocol.
:cvar IV: An all-zero IV used for some cryptographic operations.
"""
VERSION = 1
IV = b"\x00" * 16
def kdf(self, z):
return sha256(z)
def encapsulate(self, peer_cose_key):
be = default_backend()
sk = ec.generate_private_key(ec.SECP256R1(), be)
pn = sk.public_key().public_numbers()
key_agreement = {
1: 2,
3: -25, # Per the spec, "although this is NOT the algorithm actually used"
-1: 1,
-2: int2bytes(pn.x, 32),
-3: int2bytes(pn.y, 32),
}
x = bytes2int(peer_cose_key[-2])
y = bytes2int(peer_cose_key[-3])
pk = ec.EllipticCurvePublicNumbers(x, y, ec.SECP256R1()).public_key(be)
shared_secret = self.kdf(sk.exchange(ec.ECDH(), pk)) # x-coordinate, 32b
return key_agreement, shared_secret
def _get_cipher(self, secret):
be = default_backend()
return Cipher(algorithms.AES(secret), modes.CBC(PinProtocolV1.IV), be)
def encrypt(self, key, plaintext):
cipher = self._get_cipher(key)
enc = cipher.encryptor()
return enc.update(plaintext) + enc.finalize()
def decrypt(self, key, ciphertext):
cipher = self._get_cipher(key)
dec = cipher.decryptor()
return dec.update(ciphertext) + dec.finalize()
def authenticate(self, key, message):
return hmac_sha256(key, message)[:16]
def validate_token(self, token):
if len(token) not in (16, 32):
raise ValueError("PIN/UV token must be 16 or 32 bytes")
return token
class PinProtocolV2(PinProtocolV1):
"""Implementation of the CTAP2 PIN/UV protocol v2.
:param ctap: An instance of a CTAP2 object.
:cvar VERSION: The version number of the PIV/UV protocol.
:cvar IV: An all-zero IV used for some cryptographic operations.
"""
VERSION = 2
HKDF_SALT = b"\x00" * 32
HKDF_INFO_HMAC = b"CTAP2 HMAC key"
HKDF_INFO_AES = b"CTAP2 AES key"
def kdf(self, z):
be = default_backend()
hmac_key = HKDF(
algorithm=hashes.SHA256(),
length=32,
salt=PinProtocolV2.HKDF_SALT,
info=PinProtocolV2.HKDF_INFO_HMAC,
backend=be,
).derive(z)
aes_key = HKDF(
algorithm=hashes.SHA256(),
length=32,
salt=PinProtocolV2.HKDF_SALT,
info=PinProtocolV2.HKDF_INFO_AES,
backend=be,
).derive(z)
return hmac_key + aes_key
def _get_cipher(self, secret, iv):
be = default_backend()
return Cipher(algorithms.AES(secret), modes.CBC(iv), be)
def encrypt(self, key, plaintext):
aes_key = key[32:]
iv = os.urandom(16)
cipher = self._get_cipher(aes_key, iv)
enc = cipher.encryptor()
return iv + enc.update(plaintext) + enc.finalize()
def decrypt(self, key, ciphertext):
aes_key = key[32:]
iv, ciphertext = ciphertext[:16], ciphertext[16:]
cipher = self._get_cipher(aes_key, iv)
dec = cipher.decryptor()
return dec.update(ciphertext) + dec.finalize()
def authenticate(self, key, message):
hmac_key = key[:32]
return hmac_sha256(hmac_key, message)
def validate_token(self, token):
if len(token) != 32:
raise ValueError("PIN/UV token must be 32 bytes")
return token
class ClientPin(object):
"""Implementation of the CTAP2 Client PIN API.
:param ctap: An instance of a CTAP2 object.
:param protocol: An optional instance of a PinUvAuthProtocol object. If None is
provided then the latest protocol supported by both library and Authenticator
will be used.
"""
PROTOCOLS = [
PinProtocolV2,
PinProtocolV1,
]
@unique
class CMD(IntEnum):
GET_PIN_RETRIES = 0x01
GET_KEY_AGREEMENT = 0x02
SET_PIN = 0x03
CHANGE_PIN = 0x04
GET_TOKEN_USING_PIN_LEGACY = 0x05
GET_TOKEN_USING_UV = 0x06
GET_UV_RETRIES = 0x07
GET_TOKEN_USING_PIN = 0x09
@unique
class RESULT(IntEnum):
KEY_AGREEMENT = 0x01
PIN_UV_TOKEN = 0x02
PIN_RETRIES = 0x03
POWER_CYCLE_STATE = 0x04
UV_RETRIES = 0x05
@unique
class PERMISSION(IntEnum):
MAKE_CREDENTIAL = 0x01
GET_ASSERTION = 0x02
CREDENTIAL_MGMT = 0x04
BIO_ENROLL = 0x08
LARGE_BLOB_WRITE = 0x10
AUTHENTICATOR_CFG = 0x20
def __init__(self, ctap, protocol=None):
if "clientPin" not in ctap.info.options:
raise ValueError("Authenticator does not support ClientPin")
self.ctap = ctap
if protocol is None:
for proto in ClientPin.PROTOCOLS:
if proto.VERSION in ctap.info.pin_uv_protocols:
protocol = proto()
break
else:
raise ValueError("No compatible PIN/UV protocols supported!")
self.protocol = protocol
self._supports_permissions = ctap.info.options.get("pinUvAuthToken")
def _get_shared_secret(self):
resp = self.ctap.client_pin(
self.protocol.VERSION, ClientPin.CMD.GET_KEY_AGREEMENT
)
pk = resp[ClientPin.RESULT.KEY_AGREEMENT]
return self.protocol.encapsulate(pk)
def get_pin_token(self, pin, permissions=None, permissions_rpid=None):
"""Get a PIN/UV token from the authenticator using PIN.
:param pin: The PIN of the authenticator.
:param permissions: The permissions to associate with the token.
:param permissions_rpid: The permissions RPID to associate with the token.
:return: A PIN/UV token.
"""
key_agreement, shared_secret = self._get_shared_secret()
pin_hash = sha256(pin.encode())[:16]
pin_hash_enc = self.protocol.encrypt(shared_secret, pin_hash)
if self._supports_permissions:
cmd = ClientPin.CMD.GET_TOKEN_USING_PIN
else:
cmd = ClientPin.CMD.GET_TOKEN_USING_PIN_LEGACY
# Ignore permissions if not supported
permissions = None
permissions_rpid = None
resp = self.ctap.client_pin(
self.protocol.VERSION,
cmd,
key_agreement=key_agreement,
pin_hash_enc=pin_hash_enc,
permissions=permissions,
permissions_rpid=permissions_rpid,
)
pin_token_enc = resp[ClientPin.RESULT.PIN_UV_TOKEN]
return self.protocol.validate_token(
self.protocol.decrypt(shared_secret, pin_token_enc)
)
def get_uv_token(self, permissions, permissions_rpid=None):
"""Get a PIN/UV token from the authenticator using built-in UV.
:param permissions: The permissions to associate with the token.
:param permissions_rpid: The permissions RPID to associate with the token.
:return: A PIN/UV token.
"""
if not self.ctap.info.options.get("pinUvAuthToken"):
raise ValueError("Authenticator does not support get_uv_token")
key_agreement, shared_secret = self._get_shared_secret()
resp = self.ctap.client_pin(
self.protocol.VERSION,
ClientPin.CMD.GET_TOKEN_USING_UV,
key_agreement=key_agreement,
permissions=permissions,
permissions_rpid=permissions_rpid,
)
pin_token_enc = resp[ClientPin.RESULT.PIN_UV_TOKEN]
return self.protocol.validate_token(
self.protocol.decrypt(shared_secret, pin_token_enc)
)
def get_pin_retries(self):
"""Get the number of PIN retries remaining.
:return: A tuple of the number of PIN attempts remaining until the
authenticator is locked, and the power cycle state, if available.
"""
resp = self.ctap.client_pin(
self.protocol.VERSION, ClientPin.CMD.GET_PIN_RETRIES
)
return (
resp[ClientPin.RESULT.PIN_RETRIES],
resp.get(ClientPin.RESULT.POWER_CYCLE_STATE),
)
def get_uv_retries(self):
"""Get the number of UV retries remaining.
:return: A tuple of the number of UV attempts remaining until the
authenticator is locked, and the power cycle state, if available.
"""
resp = self.ctap.client_pin(self.protocol.VERSION, ClientPin.CMD.GET_UV_RETRIES)
return (
resp[ClientPin.RESULT.UV_RETRIES],
resp.get(ClientPin.RESULT.POWER_CYCLE_STATE),
)
def set_pin(self, pin):
"""Set the PIN of the autenticator.
This only works when no PIN is set. To change the PIN when set, use
change_pin.
:param pin: A PIN to set.
"""
pin = _pad_pin(pin)
key_agreement, shared_secret = self._get_shared_secret()
pin_enc = self.protocol.encrypt(shared_secret, pin)
pin_uv_param = self.protocol.authenticate(shared_secret, pin_enc)
self.ctap.client_pin(
self.protocol.VERSION,
ClientPin.CMD.SET_PIN,
key_agreement=key_agreement,
new_pin_enc=pin_enc,
pin_uv_param=pin_uv_param,
)
def change_pin(self, old_pin, new_pin):
"""Change the PIN of the authenticator.
This only works when a PIN is already set. If no PIN is set, use
set_pin.
:param old_pin: The currently set PIN.
:param new_pin: The new PIN to set.
"""
new_pin = _pad_pin(new_pin)
key_agreement, shared_secret = self._get_shared_secret()
pin_hash = sha256(old_pin.encode())[:16]
pin_hash_enc = self.protocol.encrypt(shared_secret, pin_hash)
new_pin_enc = self.protocol.encrypt(shared_secret, new_pin)
pin_uv_param = self.protocol.authenticate(
shared_secret, new_pin_enc + pin_hash_enc
)
self.ctap.client_pin(
self.protocol.VERSION,
ClientPin.CMD.CHANGE_PIN,
key_agreement=key_agreement,
pin_hash_enc=pin_hash_enc,
new_pin_enc=new_pin_enc,
pin_uv_param=pin_uv_param,
)
fido2-0.9.1/fido2/ctap2/__init__.py 0000644 0001750 0001750 00000003515 14006451303 016521 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import
from .base import ( # noqa
Ctap2,
Info,
AuthenticatorData,
AttestedCredentialData,
AttestationObject,
AssertionResponse,
)
from .pin import ClientPin, PinProtocolV1, PinProtocolV2 # noqa
from .credman import CredentialManagement # noqa
from .bio import FPBioEnrollment, CaptureError # noqa
from .blob import LargeBlobs # noqa
from .config import Config # noqa
# Alias for compatibility, this will be going away
CTAP2 = Ctap2
fido2-0.9.1/fido2/hid/ 0000755 0001750 0001750 00000000000 14006463366 014153 5 ustar dain dain 0000000 0000000 fido2-0.9.1/fido2/hid/base.py 0000644 0001750 0001750 00000010474 14006451303 015431 0 ustar dain dain 0000000 0000000 # Copyright (c) 2020 Yubico AB
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import
from collections import namedtuple
import struct
import abc
import os
FIDO_USAGE_PAGE = 0xF1D0
FIDO_USAGE = 0x1
class HidDescriptor(
namedtuple(
"HidDescriptor", ["path", "vid", "pid", "report_size_in", "report_size_out"]
)
):
__slots__ = ()
class CtapHidConnection(abc.ABC):
@abc.abstractmethod
def read_packet(self):
"""Reads a CTAP HID packet"""
@abc.abstractmethod
def write_packet(self, data):
"""Writes a CTAP HID packet"""
@abc.abstractmethod
def close(self):
"""Closes the connection"""
class FileCtapHidConnection(CtapHidConnection):
"""Basic CtapHidConnection implementation which uses a path to a file descriptor"""
def __init__(self, descriptor):
self.handle = os.open(descriptor.path, os.O_RDWR)
self.descriptor = descriptor
def close(self):
os.close(self.handle)
def write_packet(self, packet):
if os.write(self.handle, packet) != len(packet):
raise OSError("failed to write entire packet")
def read_packet(self):
return os.read(self.handle, self.descriptor.report_size_in)
REPORT_DESCRIPTOR_KEY_MASK = 0xFC
SIZE_MASK = ~REPORT_DESCRIPTOR_KEY_MASK
OUTPUT_ITEM = 0x90
INPUT_ITEM = 0x80
COLLECTION_ITEM = 0xA0
REPORT_COUNT = 0x94
REPORT_SIZE = 0x74
USAGE_PAGE = 0x04
USAGE = 0x08
def parse_report_descriptor(data):
# Parse report descriptor data
usage, usage_page = None, None
max_input_size, max_output_size = None, None
report_count, report_size = None, None
remaining = 4
while data and remaining:
head, data = struct.unpack_from(">B", data)[0], data[1:]
key, size = REPORT_DESCRIPTOR_KEY_MASK & head, SIZE_MASK & head
value = struct.unpack_from("IBBBBB", response)
self._device_version = (v1, v2, v3)
def __repr__(self):
return "CtapHidDevice(%s)" % self.descriptor.path
@property
def version(self):
"""CTAP HID protocol version.
:rtype: int
"""
return self._u2fhid_version
@property
def device_version(self):
"""Device version number."""
return self._device_version
@property
def capabilities(self):
"""Capabilities supported by the device."""
return self._capabilities
def call(self, cmd, data=b"", event=None, on_keepalive=None):
event = event or Event()
remaining = data
packet_size = self.descriptor.report_size_out
seq = 0
# Send request
header = struct.pack(">IBH", self._channel_id, TYPE_INIT | cmd, len(remaining))
while remaining or seq == 0:
size = min(len(remaining), packet_size - len(header))
body, remaining = remaining[:size], remaining[size:]
packet = header + body
logger.debug("SEND: %s", b2a_hex(packet))
self._connection.write_packet(packet.ljust(packet_size, b"\0"))
header = struct.pack(">IB", self._channel_id, 0x7F & seq)
seq += 1
try:
# Read response
seq = 0
response = None
last_ka = None
while True:
if event.is_set():
# Cancel
logger.debug("Sending cancel...")
packet = struct.pack(
">IB", self._channel_id, TYPE_INIT | CTAPHID.CANCEL
).ljust(packet_size, b"\0")
self._connection.write_packet(packet)
recv = self._connection.read_packet()
logger.debug("RECV: %s", b2a_hex(recv))
r_channel = struct.unpack_from(">I", recv)[0]
recv = recv[4:]
if r_channel != self._channel_id:
raise Exception("Wrong channel")
if response is None: # Initialization packet
r_cmd, r_len = struct.unpack_from(">BH", recv)
recv = recv[3:]
if r_cmd == TYPE_INIT | cmd:
response = b""
elif r_cmd == TYPE_INIT | CTAPHID.KEEPALIVE:
ka_status = struct.unpack_from(">B", recv)[0]
logger.debug("Got keepalive status: %02x" % ka_status)
if on_keepalive and ka_status != last_ka:
try:
ka_status = STATUS(ka_status)
except ValueError:
pass # Unknown status value
last_ka = ka_status
on_keepalive(ka_status)
continue
elif r_cmd == TYPE_INIT | CTAPHID.ERROR:
raise CtapError(struct.unpack_from(">B", recv)[0])
else:
raise CtapError(CtapError.ERR.INVALID_COMMAND)
else: # Continuation packet
r_seq = struct.unpack_from(">B", recv)[0]
recv = recv[1:]
if r_seq != seq:
raise Exception("Wrong sequence number")
seq += 1
response += recv
if len(response) >= r_len:
break
return response[:r_len]
except KeyboardInterrupt:
logger.debug("Keyboard interrupt, sending cancel...")
packet = struct.pack(
">IB", self._channel_id, TYPE_INIT | CTAPHID.CANCEL
).ljust(packet_size, b"\0")
self._connection.write_packet(packet)
raise
def wink(self):
"""Causes the authenticator to blink."""
self.call(CTAPHID.WINK)
def ping(self, msg=b"Hello FIDO"):
"""Sends data to the authenticator, which echoes it back.
:param msg: The data to send.
:return: The response from the authenticator.
"""
return self.call(CTAPHID.PING, msg)
def lock(self, lock_time=10):
"""Locks the channel."""
self.call(CTAPHID.LOCK, struct.pack(">B", lock_time))
def close(self):
if self._connection:
self._connection.close()
self._connection = None
@classmethod
def list_devices(cls):
for d in list_descriptors():
yield cls(d, open_connection(d))
def list_devices():
return CtapHidDevice.list_devices()
def open_device(path):
descriptor = get_descriptor(path)
return CtapHidDevice(descriptor, open_connection(descriptor))
fido2-0.9.1/fido2/nfc.py 0000644 0001750 0001750 00000013722 14006451303 014520 0 ustar dain dain 0000000 0000000 # Copyright (c) 2019 Yubico AB
# Copyright (c) 2019 Oleg Moiseenko
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .ctap import CtapDevice, CtapError, STATUS
from .hid import CAPABILITY, CTAPHID
from .pcsc import PCSCDevice
from smartcard.Exceptions import CardConnectionException
from threading import Event
import struct
import six
AID_FIDO = b"\xa0\x00\x00\x06\x47\x2f\x00\x01"
SW_SUCCESS = (0x90, 0x00)
SW_UPDATE = (0x91, 0x00)
SW1_MORE_DATA = 0x61
class CardSelectException(Exception):
"""can't select u2f/fido2 application on the card"""
pass
class CtapNfcDevice(CtapDevice):
"""
CtapDevice implementation using the pcsc NFC transport.
"""
def __init__(self, dev):
self._dev = dev
self._dev.connect()
self._capabilities = 0
result, sw1, sw2 = self._dev.select_applet(AID_FIDO)
if (sw1, sw2) != SW_SUCCESS:
raise CardSelectException("Select error")
if result == b"U2F_V2":
self._capabilities |= CAPABILITY.NMSG
try: # Probe for CTAP2 by calling GET_INFO
self.call(CTAPHID.CBOR, b"\x04")
self._capabilities |= CAPABILITY.CBOR
except CtapError:
pass
@property
def pcsc_device(self):
return self._dev
def __repr__(self):
return "CtapNfcDevice(%s)" % self._dev.reader.name
@property
def version(self):
"""CTAP NFC protocol version.
:rtype: int
"""
return 2 if self._capabilities & CAPABILITY.CBOR else 1
@property
def capabilities(self):
"""Capabilities supported by the device."""
return self._capabilities
def _chain_apdus(self, cla, ins, p1, p2, data=b""):
while len(data) > 250:
to_send, data = data[:250], data[250:]
header = struct.pack("!BBBBB", 0x90, ins, p1, p2, len(to_send))
resp, sw1, sw2 = self._dev.apdu_exchange(header + to_send)
if (sw1, sw2) != SW_SUCCESS:
return resp, sw1, sw2
apdu = struct.pack("!BBBB", cla, ins, p1, p2)
if data:
apdu += struct.pack("!B", len(data)) + data
resp, sw1, sw2 = self._dev.apdu_exchange(apdu + b"\x00")
while sw1 == SW1_MORE_DATA:
apdu = b"\x00\xc0\x00\x00" + struct.pack("!B", sw2) # sw2 == le
lres, sw1, sw2 = self._dev.apdu_exchange(apdu)
resp += lres
return resp, sw1, sw2
def _call_apdu(self, apdu):
if len(apdu) >= 7 and six.indexbytes(apdu, 4) == 0:
# Extended APDU
data_len = struct.unpack("!H", apdu[5:7])[0]
data = apdu[7 : 7 + data_len]
else:
# Short APDU
data_len = six.indexbytes(apdu, 4)
data = apdu[5 : 5 + data_len]
(cla, ins, p1, p2) = six.iterbytes(apdu[:4])
resp, sw1, sw2 = self._chain_apdus(cla, ins, p1, p2, data)
return resp + struct.pack("!BB", sw1, sw2)
def _call_cbor(self, data=b"", event=None, on_keepalive=None):
event = event or Event()
# NFCCTAP_MSG
resp, sw1, sw2 = self._chain_apdus(0x80, 0x10, 0x80, 0x00, data)
last_ka = None
while not event.is_set():
while (sw1, sw2) == SW_UPDATE:
ka_status = six.indexbytes(resp, 0)
if on_keepalive and last_ka != ka_status:
try:
ka_status = STATUS(ka_status)
except ValueError:
pass # Unknown status value
last_ka = ka_status
on_keepalive(ka_status)
# NFCCTAP_GETRESPONSE
resp, sw1, sw2 = self._chain_apdus(0x80, 0x11, 0x00, 0x00, b"")
if (sw1, sw2) != SW_SUCCESS:
raise CtapError(CtapError.ERR.OTHER) # TODO: Map from SW error
return resp
raise CtapError(CtapError.ERR.KEEPALIVE_CANCEL)
def call(self, cmd, data=b"", event=None, on_keepalive=None):
if cmd == CTAPHID.MSG:
return self._call_apdu(data)
elif cmd == CTAPHID.CBOR:
return self._call_cbor(data, event, on_keepalive)
else:
raise CtapError(CtapError.ERR.INVALID_COMMAND)
@classmethod # selector='CL'
def list_devices(cls, selector="", pcsc_device=PCSCDevice):
"""
Returns list of readers in the system. Iterator.
:param selector:
:param pcsc_device: device to work with. PCSCDevice by default.
:return: iterator. next reader
"""
for d in pcsc_device.list_devices(selector):
try:
yield cls(d)
except CardConnectionException:
pass
fido2-0.9.1/fido2/pcsc.py 0000644 0001750 0001750 00000017752 14006451303 014711 0 ustar dain dain 0000000 0000000 # Copyright (c) 2019 Yubico AB
# Copyright (c) 2019 Oleg Moiseenko
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
from __future__ import absolute_import, unicode_literals
from .ctap import CtapDevice, CtapError, STATUS
from .hid import CAPABILITY, CTAPHID
from smartcard import System
from smartcard.pcsc.PCSCExceptions import ListReadersException
from smartcard.pcsc.PCSCContext import PCSCContext
from binascii import b2a_hex as _b2a_hex
from threading import Event
import struct
import six
import logging
AID_FIDO = b"\xa0\x00\x00\x06\x47\x2f\x00\x01"
SW_SUCCESS = (0x90, 0x00)
SW_UPDATE = (0x91, 0x00)
SW1_MORE_DATA = 0x61
logger = logging.getLogger(__name__)
def b2a_hex(data):
return _b2a_hex(data).decode("ascii")
class CtapPcscDevice(CtapDevice):
"""
CtapDevice implementation using pyscard (PCSC).
This class is intended for use with NFC readers.
"""
def __init__(self, connection, name):
self._capabilities = 0
self.use_ext_apdu = False
self._conn = connection
self._conn.connect()
self._name = name
self._select()
try: # Probe for CTAP2 by calling GET_INFO
self.call(CTAPHID.CBOR, b"\x04")
self._capabilities |= CAPABILITY.CBOR
except CtapError:
if self._capabilities == 0:
raise ValueError("Unsupported device")
def __repr__(self):
return "CtapPcscDevice(%s)" % self._name
@property
def version(self):
"""CTAPHID protocol version.
:rtype: int
"""
return 2 if self._capabilities & CAPABILITY.CBOR else 1
@property
def capabilities(self):
"""Capabilities supported by the device."""
return self._capabilities
def get_atr(self):
"""Get the ATR/ATS of the connected card."""
return self._conn.getATR()
def apdu_exchange(self, apdu, protocol=None):
"""Exchange data with smart card.
:param apdu: byte string. data to exchange with card
:return: byte string. response from card
"""
logger.debug("SEND: %s", b2a_hex(apdu))
resp, sw1, sw2 = self._conn.transmit(list(six.iterbytes(apdu)), protocol)
response = bytes(bytearray(resp))
logger.debug("RECV: %s SW=%04X", b2a_hex(response), sw1 << 8 + sw2)
return response, sw1, sw2
def control_exchange(self, control_code, control_data=b""):
"""Sends control sequence to reader's driver.
:param control_code: int. code to send to reader driver.
:param control_data: byte string. data to send to driver
:return: byte string. response
"""
logger.debug("control %s", b2a_hex(control_data))
response = self._conn.control(control_code, list(six.iterbytes(control_data)))
response = bytes(bytearray(response))
logger.debug("response %s", b2a_hex(response))
return response
def _select(self):
apdu = b"\x00\xa4\x04\x00" + struct.pack("!B", len(AID_FIDO)) + AID_FIDO
resp, sw1, sw2 = self.apdu_exchange(apdu)
if (sw1, sw2) != SW_SUCCESS:
raise ValueError("FIDO applet selection failure.")
if resp == b"U2F_V2":
self._capabilities |= 0x08
def _chain_apdus(self, cla, ins, p1, p2, data=b""):
if self.use_ext_apdu:
header = struct.pack("!BBBBBH", cla, ins, p1, p2, 0x00, len(data))
resp, sw1, sw2 = self.apdu_exchange(header + data)
return resp, sw1, sw2
else:
while len(data) > 250:
to_send, data = data[:250], data[250:]
header = struct.pack("!BBBBB", 0x10 | cla, ins, p1, p2, len(to_send))
resp, sw1, sw2 = self.apdu_exchange(header + to_send)
if (sw1, sw2) != SW_SUCCESS:
return resp, sw1, sw2
apdu = struct.pack("!BBBB", cla, ins, p1, p2)
if data:
apdu += struct.pack("!B", len(data)) + data
resp, sw1, sw2 = self.apdu_exchange(apdu + b"\x00")
while sw1 == SW1_MORE_DATA:
apdu = b"\x00\xc0\x00\x00" + struct.pack("!B", sw2) # sw2 == le
lres, sw1, sw2 = self.apdu_exchange(apdu)
resp += lres
return resp, sw1, sw2
def _call_apdu(self, apdu):
if len(apdu) >= 7 and six.indexbytes(apdu, 4) == 0:
# Extended APDU
data_len = struct.unpack("!H", apdu[5:7])[0]
data = apdu[7 : 7 + data_len]
elif len(apdu) == 4:
data = b""
else:
# Short APDU
data_len = six.indexbytes(apdu, 4)
data = apdu[5 : 5 + data_len]
(cla, ins, p1, p2) = six.iterbytes(apdu[:4])
resp, sw1, sw2 = self._chain_apdus(cla, ins, p1, p2, data)
return resp + struct.pack("!BB", sw1, sw2)
def _call_cbor(self, data=b"", event=None, on_keepalive=None):
event = event or Event()
# NFCCTAP_MSG
resp, sw1, sw2 = self._chain_apdus(0x80, 0x10, 0x80, 0x00, data)
last_ka = None
while not event.is_set():
while (sw1, sw2) == SW_UPDATE:
ka_status = six.indexbytes(resp, 0)
if on_keepalive and last_ka != ka_status:
try:
ka_status = STATUS(ka_status)
except ValueError:
pass # Unknown status value
last_ka = ka_status
on_keepalive(ka_status)
# NFCCTAP_GETRESPONSE
resp, sw1, sw2 = self._chain_apdus(0x80, 0x11, 0x00, 0x00)
if (sw1, sw2) != SW_SUCCESS:
raise CtapError(CtapError.ERR.OTHER) # TODO: Map from SW error
return resp
raise CtapError(CtapError.ERR.KEEPALIVE_CANCEL)
def call(self, cmd, data=b"", event=None, on_keepalive=None):
if cmd == CTAPHID.CBOR:
return self._call_cbor(data, event, on_keepalive)
elif cmd == CTAPHID.MSG:
return self._call_apdu(data)
else:
raise CtapError(CtapError.ERR.INVALID_COMMAND)
def close(self):
self._conn.disconnect()
@classmethod
def list_devices(cls, name=""):
for reader in _list_readers():
if name in reader.name:
try:
yield cls(reader.createConnection(), reader.name)
except Exception as e:
logger.debug("Error %r", e)
def _list_readers():
try:
return System.readers()
except ListReadersException:
# If the PCSC system has restarted the context might be stale, try
# forcing a new context (This happens on Windows if the last reader is
# removed):
PCSCContext.instance = None
return System.readers()
fido2-0.9.1/fido2/public_suffix_list.dat 0000644 0001750 0001750 00000645551 14002014354 017777 0 ustar dain dain 0000000 0000000 // This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at https://mozilla.org/MPL/2.0/.
// Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
// rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
// Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
// ===BEGIN ICANN DOMAINS===
// ac : https://en.wikipedia.org/wiki/.ac
ac
com.ac
edu.ac
gov.ac
net.ac
mil.ac
org.ac
// ad : https://en.wikipedia.org/wiki/.ad
ad
nom.ad
// ae : https://en.wikipedia.org/wiki/.ae
// see also: "Domain Name Eligibility Policy" at http://www.aeda.ae/eng/aepolicy.php
ae
co.ae
net.ae
org.ae
sch.ae
ac.ae
gov.ae
mil.ae
// aero : see https://www.information.aero/index.php?id=66
aero
accident-investigation.aero
accident-prevention.aero
aerobatic.aero
aeroclub.aero
aerodrome.aero
agents.aero
aircraft.aero
airline.aero
airport.aero
air-surveillance.aero
airtraffic.aero
air-traffic-control.aero
ambulance.aero
amusement.aero
association.aero
author.aero
ballooning.aero
broker.aero
caa.aero
cargo.aero
catering.aero
certification.aero
championship.aero
charter.aero
civilaviation.aero
club.aero
conference.aero
consultant.aero
consulting.aero
control.aero
council.aero
crew.aero
design.aero
dgca.aero
educator.aero
emergency.aero
engine.aero
engineer.aero
entertainment.aero
equipment.aero
exchange.aero
express.aero
federation.aero
flight.aero
freight.aero
fuel.aero
gliding.aero
government.aero
groundhandling.aero
group.aero
hanggliding.aero
homebuilt.aero
insurance.aero
journal.aero
journalist.aero
leasing.aero
logistics.aero
magazine.aero
maintenance.aero
media.aero
microlight.aero
modelling.aero
navigation.aero
parachuting.aero
paragliding.aero
passenger-association.aero
pilot.aero
press.aero
production.aero
recreation.aero
repbody.aero
res.aero
research.aero
rotorcraft.aero
safety.aero
scientist.aero
services.aero
show.aero
skydiving.aero
software.aero
student.aero
trader.aero
trading.aero
trainer.aero
union.aero
workinggroup.aero
works.aero
// af : http://www.nic.af/help.jsp
af
gov.af
com.af
org.af
net.af
edu.af
// ag : http://www.nic.ag/prices.htm
ag
com.ag
org.ag
net.ag
co.ag
nom.ag
// ai : http://nic.com.ai/
ai
off.ai
com.ai
net.ai
org.ai
// al : http://www.ert.gov.al/ert_alb/faq_det.html?Id=31
al
com.al
edu.al
gov.al
mil.al
net.al
org.al
// am : https://www.amnic.net/policy/en/Policy_EN.pdf
am
co.am
com.am
commune.am
net.am
org.am
// ao : https://en.wikipedia.org/wiki/.ao
// http://www.dns.ao/REGISTR.DOC
ao
ed.ao
gv.ao
og.ao
co.ao
pb.ao
it.ao
// aq : https://en.wikipedia.org/wiki/.aq
aq
// ar : https://nic.ar/nic-argentina/normativa-vigente
ar
com.ar
edu.ar
gob.ar
gov.ar
int.ar
mil.ar
musica.ar
net.ar
org.ar
tur.ar
// arpa : https://en.wikipedia.org/wiki/.arpa
// Confirmed by registry 2008-06-18
arpa
e164.arpa
in-addr.arpa
ip6.arpa
iris.arpa
uri.arpa
urn.arpa
// as : https://en.wikipedia.org/wiki/.as
as
gov.as
// asia : https://en.wikipedia.org/wiki/.asia
asia
// at : https://en.wikipedia.org/wiki/.at
// Confirmed by registry 2008-06-17
at
ac.at
co.at
gv.at
or.at
// au : https://en.wikipedia.org/wiki/.au
// http://www.auda.org.au/
au
// 2LDs
com.au
net.au
org.au
edu.au
gov.au
asn.au
id.au
// Historic 2LDs (closed to new registration, but sites still exist)
info.au
conf.au
oz.au
// CGDNs - http://www.cgdn.org.au/
act.au
nsw.au
nt.au
qld.au
sa.au
tas.au
vic.au
wa.au
// 3LDs
act.edu.au
catholic.edu.au
eq.edu.au
nsw.edu.au
nt.edu.au
qld.edu.au
sa.edu.au
tas.edu.au
vic.edu.au
wa.edu.au
// act.gov.au Bug 984824 - Removed at request of Greg Tankard
// nsw.gov.au Bug 547985 - Removed at request of
// nt.gov.au Bug 940478 - Removed at request of Greg Connors
qld.gov.au
sa.gov.au
tas.gov.au
vic.gov.au
wa.gov.au
// 4LDs
education.tas.edu.au
schools.nsw.edu.au
// aw : https://en.wikipedia.org/wiki/.aw
aw
com.aw
// ax : https://en.wikipedia.org/wiki/.ax
ax
// az : https://en.wikipedia.org/wiki/.az
az
com.az
net.az
int.az
gov.az
org.az
edu.az
info.az
pp.az
mil.az
name.az
pro.az
biz.az
// ba : http://nic.ba/users_data/files/pravilnik_o_registraciji.pdf
ba
com.ba
edu.ba
gov.ba
mil.ba
net.ba
org.ba
// bb : https://en.wikipedia.org/wiki/.bb
bb
biz.bb
co.bb
com.bb
edu.bb
gov.bb
info.bb
net.bb
org.bb
store.bb
tv.bb
// bd : https://en.wikipedia.org/wiki/.bd
*.bd
// be : https://en.wikipedia.org/wiki/.be
// Confirmed by registry 2008-06-08
be
ac.be
// bf : https://en.wikipedia.org/wiki/.bf
bf
gov.bf
// bg : https://en.wikipedia.org/wiki/.bg
// https://www.register.bg/user/static/rules/en/index.html
bg
a.bg
b.bg
c.bg
d.bg
e.bg
f.bg
g.bg
h.bg
i.bg
j.bg
k.bg
l.bg
m.bg
n.bg
o.bg
p.bg
q.bg
r.bg
s.bg
t.bg
u.bg
v.bg
w.bg
x.bg
y.bg
z.bg
0.bg
1.bg
2.bg
3.bg
4.bg
5.bg
6.bg
7.bg
8.bg
9.bg
// bh : https://en.wikipedia.org/wiki/.bh
bh
com.bh
edu.bh
net.bh
org.bh
gov.bh
// bi : https://en.wikipedia.org/wiki/.bi
// http://whois.nic.bi/
bi
co.bi
com.bi
edu.bi
or.bi
org.bi
// biz : https://en.wikipedia.org/wiki/.biz
biz
// bj : https://en.wikipedia.org/wiki/.bj
bj
asso.bj
barreau.bj
gouv.bj
// bm : http://www.bermudanic.bm/dnr-text.txt
bm
com.bm
edu.bm
gov.bm
net.bm
org.bm
// bn : http://www.bnnic.bn/faqs
bn
com.bn
edu.bn
gov.bn
net.bn
org.bn
// bo : https://nic.bo/delegacion2015.php#h-1.10
bo
com.bo
edu.bo
gob.bo
int.bo
org.bo
net.bo
mil.bo
tv.bo
web.bo
// Social Domains
academia.bo
agro.bo
arte.bo
blog.bo
bolivia.bo
ciencia.bo
cooperativa.bo
democracia.bo
deporte.bo
ecologia.bo
economia.bo
empresa.bo
indigena.bo
industria.bo
info.bo
medicina.bo
movimiento.bo
musica.bo
natural.bo
nombre.bo
noticias.bo
patria.bo
politica.bo
profesional.bo
plurinacional.bo
pueblo.bo
revista.bo
salud.bo
tecnologia.bo
tksat.bo
transporte.bo
wiki.bo
// br : http://registro.br/dominio/categoria.html
// Submitted by registry
br
9guacu.br
abc.br
adm.br
adv.br
agr.br
aju.br
am.br
anani.br
aparecida.br
arq.br
art.br
ato.br
b.br
barueri.br
belem.br
bhz.br
bio.br
blog.br
bmd.br
boavista.br
bsb.br
campinagrande.br
campinas.br
caxias.br
cim.br
cng.br
cnt.br
com.br
contagem.br
coop.br
cri.br
cuiaba.br
curitiba.br
def.br
ecn.br
eco.br
edu.br
emp.br
eng.br
esp.br
etc.br
eti.br
far.br
feira.br
flog.br
floripa.br
fm.br
fnd.br
fortal.br
fot.br
foz.br
fst.br
g12.br
ggf.br
goiania.br
gov.br
// gov.br 26 states + df https://en.wikipedia.org/wiki/States_of_Brazil
ac.gov.br
al.gov.br
am.gov.br
ap.gov.br
ba.gov.br
ce.gov.br
df.gov.br
es.gov.br
go.gov.br
ma.gov.br
mg.gov.br
ms.gov.br
mt.gov.br
pa.gov.br
pb.gov.br
pe.gov.br
pi.gov.br
pr.gov.br
rj.gov.br
rn.gov.br
ro.gov.br
rr.gov.br
rs.gov.br
sc.gov.br
se.gov.br
sp.gov.br
to.gov.br
gru.br
imb.br
ind.br
inf.br
jab.br
jampa.br
jdf.br
joinville.br
jor.br
jus.br
leg.br
lel.br
londrina.br
macapa.br
maceio.br
manaus.br
maringa.br
mat.br
med.br
mil.br
morena.br
mp.br
mus.br
natal.br
net.br
niteroi.br
*.nom.br
not.br
ntr.br
odo.br
ong.br
org.br
osasco.br
palmas.br
poa.br
ppg.br
pro.br
psc.br
psi.br
pvh.br
qsl.br
radio.br
rec.br
recife.br
ribeirao.br
rio.br
riobranco.br
riopreto.br
salvador.br
sampa.br
santamaria.br
santoandre.br
saobernardo.br
saogonca.br
sjc.br
slg.br
slz.br
sorocaba.br
srv.br
taxi.br
tc.br
teo.br
the.br
tmp.br
trd.br
tur.br
tv.br
udi.br
vet.br
vix.br
vlog.br
wiki.br
zlg.br
// bs : http://www.nic.bs/rules.html
bs
com.bs
net.bs
org.bs
edu.bs
gov.bs
// bt : https://en.wikipedia.org/wiki/.bt
bt
com.bt
edu.bt
gov.bt
net.bt
org.bt
// bv : No registrations at this time.
// Submitted by registry
bv
// bw : https://en.wikipedia.org/wiki/.bw
// http://www.gobin.info/domainname/bw.doc
// list of other 2nd level tlds ?
bw
co.bw
org.bw
// by : https://en.wikipedia.org/wiki/.by
// http://tld.by/rules_2006_en.html
// list of other 2nd level tlds ?
by
gov.by
mil.by
// Official information does not indicate that com.by is a reserved
// second-level domain, but it's being used as one (see www.google.com.by and
// www.yahoo.com.by, for example), so we list it here for safety's sake.
com.by
// http://hoster.by/
of.by
// bz : https://en.wikipedia.org/wiki/.bz
// http://www.belizenic.bz/
bz
com.bz
net.bz
org.bz
edu.bz
gov.bz
// ca : https://en.wikipedia.org/wiki/.ca
ca
// ca geographical names
ab.ca
bc.ca
mb.ca
nb.ca
nf.ca
nl.ca
ns.ca
nt.ca
nu.ca
on.ca
pe.ca
qc.ca
sk.ca
yk.ca
// gc.ca: https://en.wikipedia.org/wiki/.gc.ca
// see also: http://registry.gc.ca/en/SubdomainFAQ
gc.ca
// cat : https://en.wikipedia.org/wiki/.cat
cat
// cc : https://en.wikipedia.org/wiki/.cc
cc
// cd : https://en.wikipedia.org/wiki/.cd
// see also: https://www.nic.cd/domain/insertDomain_2.jsp?act=1
cd
gov.cd
// cf : https://en.wikipedia.org/wiki/.cf
cf
// cg : https://en.wikipedia.org/wiki/.cg
cg
// ch : https://en.wikipedia.org/wiki/.ch
ch
// ci : https://en.wikipedia.org/wiki/.ci
// http://www.nic.ci/index.php?page=charte
ci
org.ci
or.ci
com.ci
co.ci
edu.ci
ed.ci
ac.ci
net.ci
go.ci
asso.ci
aéroport.ci
int.ci
presse.ci
md.ci
gouv.ci
// ck : https://en.wikipedia.org/wiki/.ck
*.ck
!www.ck
// cl : https://en.wikipedia.org/wiki/.cl
cl
gov.cl
gob.cl
co.cl
mil.cl
// cm : https://en.wikipedia.org/wiki/.cm plus bug 981927
cm
co.cm
com.cm
gov.cm
net.cm
// cn : https://en.wikipedia.org/wiki/.cn
// Submitted by registry
cn
ac.cn
com.cn
edu.cn
gov.cn
net.cn
org.cn
mil.cn
公司.cn
网络.cn
網絡.cn
// cn geographic names
ah.cn
bj.cn
cq.cn
fj.cn
gd.cn
gs.cn
gz.cn
gx.cn
ha.cn
hb.cn
he.cn
hi.cn
hl.cn
hn.cn
jl.cn
js.cn
jx.cn
ln.cn
nm.cn
nx.cn
qh.cn
sc.cn
sd.cn
sh.cn
sn.cn
sx.cn
tj.cn
xj.cn
xz.cn
yn.cn
zj.cn
hk.cn
mo.cn
tw.cn
// co : https://en.wikipedia.org/wiki/.co
// Submitted by registry
co
arts.co
com.co
edu.co
firm.co
gov.co
info.co
int.co
mil.co
net.co
nom.co
org.co
rec.co
web.co
// com : https://en.wikipedia.org/wiki/.com
com
// coop : https://en.wikipedia.org/wiki/.coop
coop
// cr : http://www.nic.cr/niccr_publico/showRegistroDominiosScreen.do
cr
ac.cr
co.cr
ed.cr
fi.cr
go.cr
or.cr
sa.cr
// cu : https://en.wikipedia.org/wiki/.cu
cu
com.cu
edu.cu
org.cu
net.cu
gov.cu
inf.cu
// cv : https://en.wikipedia.org/wiki/.cv
cv
// cw : http://www.una.cw/cw_registry/
// Confirmed by registry 2013-03-26
cw
com.cw
edu.cw
net.cw
org.cw
// cx : https://en.wikipedia.org/wiki/.cx
// list of other 2nd level tlds ?
cx
gov.cx
// cy : http://www.nic.cy/
// Submitted by registry Panayiotou Fotia
cy
ac.cy
biz.cy
com.cy
ekloges.cy
gov.cy
ltd.cy
name.cy
net.cy
org.cy
parliament.cy
press.cy
pro.cy
tm.cy
// cz : https://en.wikipedia.org/wiki/.cz
cz
// de : https://en.wikipedia.org/wiki/.de
// Confirmed by registry (with technical
// reservations) 2008-07-01
de
// dj : https://en.wikipedia.org/wiki/.dj
dj
// dk : https://en.wikipedia.org/wiki/.dk
// Confirmed by registry 2008-06-17
dk
// dm : https://en.wikipedia.org/wiki/.dm
dm
com.dm
net.dm
org.dm
edu.dm
gov.dm
// do : https://en.wikipedia.org/wiki/.do
do
art.do
com.do
edu.do
gob.do
gov.do
mil.do
net.do
org.do
sld.do
web.do
// dz : https://en.wikipedia.org/wiki/.dz
dz
com.dz
org.dz
net.dz
gov.dz
edu.dz
asso.dz
pol.dz
art.dz
// ec : http://www.nic.ec/reg/paso1.asp
// Submitted by registry
ec
com.ec
info.ec
net.ec
fin.ec
k12.ec
med.ec
pro.ec
org.ec
edu.ec
gov.ec
gob.ec
mil.ec
// edu : https://en.wikipedia.org/wiki/.edu
edu
// ee : http://www.eenet.ee/EENet/dom_reeglid.html#lisa_B
ee
edu.ee
gov.ee
riik.ee
lib.ee
med.ee
com.ee
pri.ee
aip.ee
org.ee
fie.ee
// eg : https://en.wikipedia.org/wiki/.eg
eg
com.eg
edu.eg
eun.eg
gov.eg
mil.eg
name.eg
net.eg
org.eg
sci.eg
// er : https://en.wikipedia.org/wiki/.er
*.er
// es : https://www.nic.es/site_ingles/ingles/dominios/index.html
es
com.es
nom.es
org.es
gob.es
edu.es
// et : https://en.wikipedia.org/wiki/.et
et
com.et
gov.et
org.et
edu.et
biz.et
name.et
info.et
net.et
// eu : https://en.wikipedia.org/wiki/.eu
eu
// fi : https://en.wikipedia.org/wiki/.fi
fi
// aland.fi : https://en.wikipedia.org/wiki/.ax
// This domain is being phased out in favor of .ax. As there are still many
// domains under aland.fi, we still keep it on the list until aland.fi is
// completely removed.
// TODO: Check for updates (expected to be phased out around Q1/2009)
aland.fi
// fj : https://en.wikipedia.org/wiki/.fj
*.fj
// fk : https://en.wikipedia.org/wiki/.fk
*.fk
// fm : https://en.wikipedia.org/wiki/.fm
fm
// fo : https://en.wikipedia.org/wiki/.fo
fo
// fr : http://www.afnic.fr/
// domaines descriptifs : https://www.afnic.fr/medias/documents/Cadre_legal/Afnic_Naming_Policy_12122016_VEN.pdf
fr
asso.fr
com.fr
gouv.fr
nom.fr
prd.fr
tm.fr
// domaines sectoriels : https://www.afnic.fr/en/products-and-services/the-fr-tld/sector-based-fr-domains-4.html
aeroport.fr
avocat.fr
avoues.fr
cci.fr
chambagri.fr
chirurgiens-dentistes.fr
experts-comptables.fr
geometre-expert.fr
greta.fr
huissier-justice.fr
medecin.fr
notaires.fr
pharmacien.fr
port.fr
veterinaire.fr
// ga : https://en.wikipedia.org/wiki/.ga
ga
// gb : This registry is effectively dormant
// Submitted by registry
gb
// gd : https://en.wikipedia.org/wiki/.gd
gd
// ge : http://www.nic.net.ge/policy_en.pdf
ge
com.ge
edu.ge
gov.ge
org.ge
mil.ge
net.ge
pvt.ge
// gf : https://en.wikipedia.org/wiki/.gf
gf
// gg : http://www.channelisles.net/register-domains/
// Confirmed by registry 2013-11-28
gg
co.gg
net.gg
org.gg
// gh : https://en.wikipedia.org/wiki/.gh
// see also: http://www.nic.gh/reg_now.php
// Although domains directly at second level are not possible at the moment,
// they have been possible for some time and may come back.
gh
com.gh
edu.gh
gov.gh
org.gh
mil.gh
// gi : http://www.nic.gi/rules.html
gi
com.gi
ltd.gi
gov.gi
mod.gi
edu.gi
org.gi
// gl : https://en.wikipedia.org/wiki/.gl
// http://nic.gl
gl
co.gl
com.gl
edu.gl
net.gl
org.gl
// gm : http://www.nic.gm/htmlpages%5Cgm-policy.htm
gm
// gn : http://psg.com/dns/gn/gn.txt
// Submitted by registry
gn
ac.gn
com.gn
edu.gn
gov.gn
org.gn
net.gn
// gov : https://en.wikipedia.org/wiki/.gov
gov
// gp : http://www.nic.gp/index.php?lang=en
gp
com.gp
net.gp
mobi.gp
edu.gp
org.gp
asso.gp
// gq : https://en.wikipedia.org/wiki/.gq
gq
// gr : https://grweb.ics.forth.gr/english/1617-B-2005.html
// Submitted by registry
gr
com.gr
edu.gr
net.gr
org.gr
gov.gr
// gs : https://en.wikipedia.org/wiki/.gs
gs
// gt : http://www.gt/politicas_de_registro.html
gt
com.gt
edu.gt
gob.gt
ind.gt
mil.gt
net.gt
org.gt
// gu : http://gadao.gov.gu/register.html
// University of Guam : https://www.uog.edu
// Submitted by uognoc@triton.uog.edu
gu
com.gu
edu.gu
gov.gu
guam.gu
info.gu
net.gu
org.gu
web.gu
// gw : https://en.wikipedia.org/wiki/.gw
gw
// gy : https://en.wikipedia.org/wiki/.gy
// http://registry.gy/
gy
co.gy
com.gy
edu.gy
gov.gy
net.gy
org.gy
// hk : https://www.hkirc.hk
// Submitted by registry
hk
com.hk
edu.hk
gov.hk
idv.hk
net.hk
org.hk
公司.hk
教育.hk
敎育.hk
政府.hk
個人.hk
个人.hk
箇人.hk
網络.hk
网络.hk
组織.hk
網絡.hk
网絡.hk
组织.hk
組織.hk
組织.hk
// hm : https://en.wikipedia.org/wiki/.hm
hm
// hn : http://www.nic.hn/politicas/ps02,,05.html
hn
com.hn
edu.hn
org.hn
net.hn
mil.hn
gob.hn
// hr : http://www.dns.hr/documents/pdf/HRTLD-regulations.pdf
hr
iz.hr
from.hr
name.hr
com.hr
// ht : http://www.nic.ht/info/charte.cfm
ht
com.ht
shop.ht
firm.ht
info.ht
adult.ht
net.ht
pro.ht
org.ht
med.ht
art.ht
coop.ht
pol.ht
asso.ht
edu.ht
rel.ht
gouv.ht
perso.ht
// hu : http://www.domain.hu/domain/English/sld.html
// Confirmed by registry 2008-06-12
hu
co.hu
info.hu
org.hu
priv.hu
sport.hu
tm.hu
2000.hu
agrar.hu
bolt.hu
casino.hu
city.hu
erotica.hu
erotika.hu
film.hu
forum.hu
games.hu
hotel.hu
ingatlan.hu
jogasz.hu
konyvelo.hu
lakas.hu
media.hu
news.hu
reklam.hu
sex.hu
shop.hu
suli.hu
szex.hu
tozsde.hu
utazas.hu
video.hu
// id : https://pandi.id/en/domain/registration-requirements/
id
ac.id
biz.id
co.id
desa.id
go.id
mil.id
my.id
net.id
or.id
ponpes.id
sch.id
web.id
// ie : https://en.wikipedia.org/wiki/.ie
ie
gov.ie
// il : http://www.isoc.org.il/domains/
il
ac.il
co.il
gov.il
idf.il
k12.il
muni.il
net.il
org.il
// im : https://www.nic.im/
// Submitted by registry
im
ac.im
co.im
com.im
ltd.co.im
net.im
org.im
plc.co.im
tt.im
tv.im
// in : https://en.wikipedia.org/wiki/.in
// see also: https://registry.in/Policies
// Please note, that nic.in is not an official eTLD, but used by most
// government institutions.
in
co.in
firm.in
net.in
org.in
gen.in
ind.in
nic.in
ac.in
edu.in
res.in
gov.in
mil.in
// info : https://en.wikipedia.org/wiki/.info
info
// int : https://en.wikipedia.org/wiki/.int
// Confirmed by registry 2008-06-18
int
eu.int
// io : http://www.nic.io/rules.html
// list of other 2nd level tlds ?
io
com.io
// iq : http://www.cmc.iq/english/iq/iqregister1.htm
iq
gov.iq
edu.iq
mil.iq
com.iq
org.iq
net.iq
// ir : http://www.nic.ir/Terms_and_Conditions_ir,_Appendix_1_Domain_Rules
// Also see http://www.nic.ir/Internationalized_Domain_Names
// Two .ir entries added at request of , 2010-04-16
ir
ac.ir
co.ir
gov.ir
id.ir
net.ir
org.ir
sch.ir
// xn--mgba3a4f16a.ir (.ir, Persian YEH)
ایران.ir
// xn--mgba3a4fra.ir (.ir, Arabic YEH)
ايران.ir
// is : http://www.isnic.is/domain/rules.php
// Confirmed by registry 2008-12-06
is
net.is
com.is
edu.is
gov.is
org.is
int.is
// it : https://en.wikipedia.org/wiki/.it
it
gov.it
edu.it
// Reserved geo-names (regions and provinces):
// https://www.nic.it/sites/default/files/archivio/docs/Regulation_assignation_v7.1.pdf
// Regions
abr.it
abruzzo.it
aosta-valley.it
aostavalley.it
bas.it
basilicata.it
cal.it
calabria.it
cam.it
campania.it
emilia-romagna.it
emiliaromagna.it
emr.it
friuli-v-giulia.it
friuli-ve-giulia.it
friuli-vegiulia.it
friuli-venezia-giulia.it
friuli-veneziagiulia.it
friuli-vgiulia.it
friuliv-giulia.it
friulive-giulia.it
friulivegiulia.it
friulivenezia-giulia.it
friuliveneziagiulia.it
friulivgiulia.it
fvg.it
laz.it
lazio.it
lig.it
liguria.it
lom.it
lombardia.it
lombardy.it
lucania.it
mar.it
marche.it
mol.it
molise.it
piedmont.it
piemonte.it
pmn.it
pug.it
puglia.it
sar.it
sardegna.it
sardinia.it
sic.it
sicilia.it
sicily.it
taa.it
tos.it
toscana.it
trentin-sud-tirol.it
trentin-süd-tirol.it
trentin-sudtirol.it
trentin-südtirol.it
trentin-sued-tirol.it
trentin-suedtirol.it
trentino-a-adige.it
trentino-aadige.it
trentino-alto-adige.it
trentino-altoadige.it
trentino-s-tirol.it
trentino-stirol.it
trentino-sud-tirol.it
trentino-süd-tirol.it
trentino-sudtirol.it
trentino-südtirol.it
trentino-sued-tirol.it
trentino-suedtirol.it
trentino.it
trentinoa-adige.it
trentinoaadige.it
trentinoalto-adige.it
trentinoaltoadige.it
trentinos-tirol.it
trentinostirol.it
trentinosud-tirol.it
trentinosüd-tirol.it
trentinosudtirol.it
trentinosüdtirol.it
trentinosued-tirol.it
trentinosuedtirol.it
trentinsud-tirol.it
trentinsüd-tirol.it
trentinsudtirol.it
trentinsüdtirol.it
trentinsued-tirol.it
trentinsuedtirol.it
tuscany.it
umb.it
umbria.it
val-d-aosta.it
val-daosta.it
vald-aosta.it
valdaosta.it
valle-aosta.it
valle-d-aosta.it
valle-daosta.it
valleaosta.it
valled-aosta.it
valledaosta.it
vallee-aoste.it
vallée-aoste.it
vallee-d-aoste.it
vallée-d-aoste.it
valleeaoste.it
valléeaoste.it
valleedaoste.it
valléedaoste.it
vao.it
vda.it
ven.it
veneto.it
// Provinces
ag.it
agrigento.it
al.it
alessandria.it
alto-adige.it
altoadige.it
an.it
ancona.it
andria-barletta-trani.it
andria-trani-barletta.it
andriabarlettatrani.it
andriatranibarletta.it
ao.it
aosta.it
aoste.it
ap.it
aq.it
aquila.it
ar.it
arezzo.it
ascoli-piceno.it
ascolipiceno.it
asti.it
at.it
av.it
avellino.it
ba.it
balsan-sudtirol.it
balsan-südtirol.it
balsan-suedtirol.it
balsan.it
bari.it
barletta-trani-andria.it
barlettatraniandria.it
belluno.it
benevento.it
bergamo.it
bg.it
bi.it
biella.it
bl.it
bn.it
bo.it
bologna.it
bolzano-altoadige.it
bolzano.it
bozen-sudtirol.it
bozen-südtirol.it
bozen-suedtirol.it
bozen.it
br.it
brescia.it
brindisi.it
bs.it
bt.it
bulsan-sudtirol.it
bulsan-südtirol.it
bulsan-suedtirol.it
bulsan.it
bz.it
ca.it
cagliari.it
caltanissetta.it
campidano-medio.it
campidanomedio.it
campobasso.it
carbonia-iglesias.it
carboniaiglesias.it
carrara-massa.it
carraramassa.it
caserta.it
catania.it
catanzaro.it
cb.it
ce.it
cesena-forli.it
cesena-forlì.it
cesenaforli.it
cesenaforlì.it
ch.it
chieti.it
ci.it
cl.it
cn.it
co.it
como.it
cosenza.it
cr.it
cremona.it
crotone.it
cs.it
ct.it
cuneo.it
cz.it
dell-ogliastra.it
dellogliastra.it
en.it
enna.it
fc.it
fe.it
fermo.it
ferrara.it
fg.it
fi.it
firenze.it
florence.it
fm.it
foggia.it
forli-cesena.it
forlì-cesena.it
forlicesena.it
forlìcesena.it
fr.it
frosinone.it
ge.it
genoa.it
genova.it
go.it
gorizia.it
gr.it
grosseto.it
iglesias-carbonia.it
iglesiascarbonia.it
im.it
imperia.it
is.it
isernia.it
kr.it
la-spezia.it
laquila.it
laspezia.it
latina.it
lc.it
le.it
lecce.it
lecco.it
li.it
livorno.it
lo.it
lodi.it
lt.it
lu.it
lucca.it
macerata.it
mantova.it
massa-carrara.it
massacarrara.it
matera.it
mb.it
mc.it
me.it
medio-campidano.it
mediocampidano.it
messina.it
mi.it
milan.it
milano.it
mn.it
mo.it
modena.it
monza-brianza.it
monza-e-della-brianza.it
monza.it
monzabrianza.it
monzaebrianza.it
monzaedellabrianza.it
ms.it
mt.it
na.it
naples.it
napoli.it
no.it
novara.it
nu.it
nuoro.it
og.it
ogliastra.it
olbia-tempio.it
olbiatempio.it
or.it
oristano.it
ot.it
pa.it
padova.it
padua.it
palermo.it
parma.it
pavia.it
pc.it
pd.it
pe.it
perugia.it
pesaro-urbino.it
pesarourbino.it
pescara.it
pg.it
pi.it
piacenza.it
pisa.it
pistoia.it
pn.it
po.it
pordenone.it
potenza.it
pr.it
prato.it
pt.it
pu.it
pv.it
pz.it
ra.it
ragusa.it
ravenna.it
rc.it
re.it
reggio-calabria.it
reggio-emilia.it
reggiocalabria.it
reggioemilia.it
rg.it
ri.it
rieti.it
rimini.it
rm.it
rn.it
ro.it
roma.it
rome.it
rovigo.it
sa.it
salerno.it
sassari.it
savona.it
si.it
siena.it
siracusa.it
so.it
sondrio.it
sp.it
sr.it
ss.it
suedtirol.it
südtirol.it
sv.it
ta.it
taranto.it
te.it
tempio-olbia.it
tempioolbia.it
teramo.it
terni.it
tn.it
to.it
torino.it
tp.it
tr.it
trani-andria-barletta.it
trani-barletta-andria.it
traniandriabarletta.it
tranibarlettaandria.it
trapani.it
trento.it
treviso.it
trieste.it
ts.it
turin.it
tv.it
ud.it
udine.it
urbino-pesaro.it
urbinopesaro.it
va.it
varese.it
vb.it
vc.it
ve.it
venezia.it
venice.it
verbania.it
vercelli.it
verona.it
vi.it
vibo-valentia.it
vibovalentia.it
vicenza.it
viterbo.it
vr.it
vs.it
vt.it
vv.it
// je : http://www.channelisles.net/register-domains/
// Confirmed by registry 2013-11-28
je
co.je
net.je
org.je
// jm : http://www.com.jm/register.html
*.jm
// jo : http://www.dns.jo/Registration_policy.aspx
jo
com.jo
org.jo
net.jo
edu.jo
sch.jo
gov.jo
mil.jo
name.jo
// jobs : https://en.wikipedia.org/wiki/.jobs
jobs
// jp : https://en.wikipedia.org/wiki/.jp
// http://jprs.co.jp/en/jpdomain.html
// Submitted by registry
jp
// jp organizational type names
ac.jp
ad.jp
co.jp
ed.jp
go.jp
gr.jp
lg.jp
ne.jp
or.jp
// jp prefecture type names
aichi.jp
akita.jp
aomori.jp
chiba.jp
ehime.jp
fukui.jp
fukuoka.jp
fukushima.jp
gifu.jp
gunma.jp
hiroshima.jp
hokkaido.jp
hyogo.jp
ibaraki.jp
ishikawa.jp
iwate.jp
kagawa.jp
kagoshima.jp
kanagawa.jp
kochi.jp
kumamoto.jp
kyoto.jp
mie.jp
miyagi.jp
miyazaki.jp
nagano.jp
nagasaki.jp
nara.jp
niigata.jp
oita.jp
okayama.jp
okinawa.jp
osaka.jp
saga.jp
saitama.jp
shiga.jp
shimane.jp
shizuoka.jp
tochigi.jp
tokushima.jp
tokyo.jp
tottori.jp
toyama.jp
wakayama.jp
yamagata.jp
yamaguchi.jp
yamanashi.jp
栃木.jp
愛知.jp
愛媛.jp
兵庫.jp
熊本.jp
茨城.jp
北海道.jp
千葉.jp
和歌山.jp
長崎.jp
長野.jp
新潟.jp
青森.jp
静岡.jp
東京.jp
石川.jp
埼玉.jp
三重.jp
京都.jp
佐賀.jp
大分.jp
大阪.jp
奈良.jp
宮城.jp
宮崎.jp
富山.jp
山口.jp
山形.jp
山梨.jp
岩手.jp
岐阜.jp
岡山.jp
島根.jp
広島.jp
徳島.jp
沖縄.jp
滋賀.jp
神奈川.jp
福井.jp
福岡.jp
福島.jp
秋田.jp
群馬.jp
香川.jp
高知.jp
鳥取.jp
鹿児島.jp
// jp geographic type names
// http://jprs.jp/doc/rule/saisoku-1.html
*.kawasaki.jp
*.kitakyushu.jp
*.kobe.jp
*.nagoya.jp
*.sapporo.jp
*.sendai.jp
*.yokohama.jp
!city.kawasaki.jp
!city.kitakyushu.jp
!city.kobe.jp
!city.nagoya.jp
!city.sapporo.jp
!city.sendai.jp
!city.yokohama.jp
// 4th level registration
aisai.aichi.jp
ama.aichi.jp
anjo.aichi.jp
asuke.aichi.jp
chiryu.aichi.jp
chita.aichi.jp
fuso.aichi.jp
gamagori.aichi.jp
handa.aichi.jp
hazu.aichi.jp
hekinan.aichi.jp
higashiura.aichi.jp
ichinomiya.aichi.jp
inazawa.aichi.jp
inuyama.aichi.jp
isshiki.aichi.jp
iwakura.aichi.jp
kanie.aichi.jp
kariya.aichi.jp
kasugai.aichi.jp
kira.aichi.jp
kiyosu.aichi.jp
komaki.aichi.jp
konan.aichi.jp
kota.aichi.jp
mihama.aichi.jp
miyoshi.aichi.jp
nishio.aichi.jp
nisshin.aichi.jp
obu.aichi.jp
oguchi.aichi.jp
oharu.aichi.jp
okazaki.aichi.jp
owariasahi.aichi.jp
seto.aichi.jp
shikatsu.aichi.jp
shinshiro.aichi.jp
shitara.aichi.jp
tahara.aichi.jp
takahama.aichi.jp
tobishima.aichi.jp
toei.aichi.jp
togo.aichi.jp
tokai.aichi.jp
tokoname.aichi.jp
toyoake.aichi.jp
toyohashi.aichi.jp
toyokawa.aichi.jp
toyone.aichi.jp
toyota.aichi.jp
tsushima.aichi.jp
yatomi.aichi.jp
akita.akita.jp
daisen.akita.jp
fujisato.akita.jp
gojome.akita.jp
hachirogata.akita.jp
happou.akita.jp
higashinaruse.akita.jp
honjo.akita.jp
honjyo.akita.jp
ikawa.akita.jp
kamikoani.akita.jp
kamioka.akita.jp
katagami.akita.jp
kazuno.akita.jp
kitaakita.akita.jp
kosaka.akita.jp
kyowa.akita.jp
misato.akita.jp
mitane.akita.jp
moriyoshi.akita.jp
nikaho.akita.jp
noshiro.akita.jp
odate.akita.jp
oga.akita.jp
ogata.akita.jp
semboku.akita.jp
yokote.akita.jp
yurihonjo.akita.jp
aomori.aomori.jp
gonohe.aomori.jp
hachinohe.aomori.jp
hashikami.aomori.jp
hiranai.aomori.jp
hirosaki.aomori.jp
itayanagi.aomori.jp
kuroishi.aomori.jp
misawa.aomori.jp
mutsu.aomori.jp
nakadomari.aomori.jp
noheji.aomori.jp
oirase.aomori.jp
owani.aomori.jp
rokunohe.aomori.jp
sannohe.aomori.jp
shichinohe.aomori.jp
shingo.aomori.jp
takko.aomori.jp
towada.aomori.jp
tsugaru.aomori.jp
tsuruta.aomori.jp
abiko.chiba.jp
asahi.chiba.jp
chonan.chiba.jp
chosei.chiba.jp
choshi.chiba.jp
chuo.chiba.jp
funabashi.chiba.jp
futtsu.chiba.jp
hanamigawa.chiba.jp
ichihara.chiba.jp
ichikawa.chiba.jp
ichinomiya.chiba.jp
inzai.chiba.jp
isumi.chiba.jp
kamagaya.chiba.jp
kamogawa.chiba.jp
kashiwa.chiba.jp
katori.chiba.jp
katsuura.chiba.jp
kimitsu.chiba.jp
kisarazu.chiba.jp
kozaki.chiba.jp
kujukuri.chiba.jp
kyonan.chiba.jp
matsudo.chiba.jp
midori.chiba.jp
mihama.chiba.jp
minamiboso.chiba.jp
mobara.chiba.jp
mutsuzawa.chiba.jp
nagara.chiba.jp
nagareyama.chiba.jp
narashino.chiba.jp
narita.chiba.jp
noda.chiba.jp
oamishirasato.chiba.jp
omigawa.chiba.jp
onjuku.chiba.jp
otaki.chiba.jp
sakae.chiba.jp
sakura.chiba.jp
shimofusa.chiba.jp
shirako.chiba.jp
shiroi.chiba.jp
shisui.chiba.jp
sodegaura.chiba.jp
sosa.chiba.jp
tako.chiba.jp
tateyama.chiba.jp
togane.chiba.jp
tohnosho.chiba.jp
tomisato.chiba.jp
urayasu.chiba.jp
yachimata.chiba.jp
yachiyo.chiba.jp
yokaichiba.chiba.jp
yokoshibahikari.chiba.jp
yotsukaido.chiba.jp
ainan.ehime.jp
honai.ehime.jp
ikata.ehime.jp
imabari.ehime.jp
iyo.ehime.jp
kamijima.ehime.jp
kihoku.ehime.jp
kumakogen.ehime.jp
masaki.ehime.jp
matsuno.ehime.jp
matsuyama.ehime.jp
namikata.ehime.jp
niihama.ehime.jp
ozu.ehime.jp
saijo.ehime.jp
seiyo.ehime.jp
shikokuchuo.ehime.jp
tobe.ehime.jp
toon.ehime.jp
uchiko.ehime.jp
uwajima.ehime.jp
yawatahama.ehime.jp
echizen.fukui.jp
eiheiji.fukui.jp
fukui.fukui.jp
ikeda.fukui.jp
katsuyama.fukui.jp
mihama.fukui.jp
minamiechizen.fukui.jp
obama.fukui.jp
ohi.fukui.jp
ono.fukui.jp
sabae.fukui.jp
sakai.fukui.jp
takahama.fukui.jp
tsuruga.fukui.jp
wakasa.fukui.jp
ashiya.fukuoka.jp
buzen.fukuoka.jp
chikugo.fukuoka.jp
chikuho.fukuoka.jp
chikujo.fukuoka.jp
chikushino.fukuoka.jp
chikuzen.fukuoka.jp
chuo.fukuoka.jp
dazaifu.fukuoka.jp
fukuchi.fukuoka.jp
hakata.fukuoka.jp
higashi.fukuoka.jp
hirokawa.fukuoka.jp
hisayama.fukuoka.jp
iizuka.fukuoka.jp
inatsuki.fukuoka.jp
kaho.fukuoka.jp
kasuga.fukuoka.jp
kasuya.fukuoka.jp
kawara.fukuoka.jp
keisen.fukuoka.jp
koga.fukuoka.jp
kurate.fukuoka.jp
kurogi.fukuoka.jp
kurume.fukuoka.jp
minami.fukuoka.jp
miyako.fukuoka.jp
miyama.fukuoka.jp
miyawaka.fukuoka.jp
mizumaki.fukuoka.jp
munakata.fukuoka.jp
nakagawa.fukuoka.jp
nakama.fukuoka.jp
nishi.fukuoka.jp
nogata.fukuoka.jp
ogori.fukuoka.jp
okagaki.fukuoka.jp
okawa.fukuoka.jp
oki.fukuoka.jp
omuta.fukuoka.jp
onga.fukuoka.jp
onojo.fukuoka.jp
oto.fukuoka.jp
saigawa.fukuoka.jp
sasaguri.fukuoka.jp
shingu.fukuoka.jp
shinyoshitomi.fukuoka.jp
shonai.fukuoka.jp
soeda.fukuoka.jp
sue.fukuoka.jp
tachiarai.fukuoka.jp
tagawa.fukuoka.jp
takata.fukuoka.jp
toho.fukuoka.jp
toyotsu.fukuoka.jp
tsuiki.fukuoka.jp
ukiha.fukuoka.jp
umi.fukuoka.jp
usui.fukuoka.jp
yamada.fukuoka.jp
yame.fukuoka.jp
yanagawa.fukuoka.jp
yukuhashi.fukuoka.jp
aizubange.fukushima.jp
aizumisato.fukushima.jp
aizuwakamatsu.fukushima.jp
asakawa.fukushima.jp
bandai.fukushima.jp
date.fukushima.jp
fukushima.fukushima.jp
furudono.fukushima.jp
futaba.fukushima.jp
hanawa.fukushima.jp
higashi.fukushima.jp
hirata.fukushima.jp
hirono.fukushima.jp
iitate.fukushima.jp
inawashiro.fukushima.jp
ishikawa.fukushima.jp
iwaki.fukushima.jp
izumizaki.fukushima.jp
kagamiishi.fukushima.jp
kaneyama.fukushima.jp
kawamata.fukushima.jp
kitakata.fukushima.jp
kitashiobara.fukushima.jp
koori.fukushima.jp
koriyama.fukushima.jp
kunimi.fukushima.jp
miharu.fukushima.jp
mishima.fukushima.jp
namie.fukushima.jp
nango.fukushima.jp
nishiaizu.fukushima.jp
nishigo.fukushima.jp
okuma.fukushima.jp
omotego.fukushima.jp
ono.fukushima.jp
otama.fukushima.jp
samegawa.fukushima.jp
shimogo.fukushima.jp
shirakawa.fukushima.jp
showa.fukushima.jp
soma.fukushima.jp
sukagawa.fukushima.jp
taishin.fukushima.jp
tamakawa.fukushima.jp
tanagura.fukushima.jp
tenei.fukushima.jp
yabuki.fukushima.jp
yamato.fukushima.jp
yamatsuri.fukushima.jp
yanaizu.fukushima.jp
yugawa.fukushima.jp
anpachi.gifu.jp
ena.gifu.jp
gifu.gifu.jp
ginan.gifu.jp
godo.gifu.jp
gujo.gifu.jp
hashima.gifu.jp
hichiso.gifu.jp
hida.gifu.jp
higashishirakawa.gifu.jp
ibigawa.gifu.jp
ikeda.gifu.jp
kakamigahara.gifu.jp
kani.gifu.jp
kasahara.gifu.jp
kasamatsu.gifu.jp
kawaue.gifu.jp
kitagata.gifu.jp
mino.gifu.jp
minokamo.gifu.jp
mitake.gifu.jp
mizunami.gifu.jp
motosu.gifu.jp
nakatsugawa.gifu.jp
ogaki.gifu.jp
sakahogi.gifu.jp
seki.gifu.jp
sekigahara.gifu.jp
shirakawa.gifu.jp
tajimi.gifu.jp
takayama.gifu.jp
tarui.gifu.jp
toki.gifu.jp
tomika.gifu.jp
wanouchi.gifu.jp
yamagata.gifu.jp
yaotsu.gifu.jp
yoro.gifu.jp
annaka.gunma.jp
chiyoda.gunma.jp
fujioka.gunma.jp
higashiagatsuma.gunma.jp
isesaki.gunma.jp
itakura.gunma.jp
kanna.gunma.jp
kanra.gunma.jp
katashina.gunma.jp
kawaba.gunma.jp
kiryu.gunma.jp
kusatsu.gunma.jp
maebashi.gunma.jp
meiwa.gunma.jp
midori.gunma.jp
minakami.gunma.jp
naganohara.gunma.jp
nakanojo.gunma.jp
nanmoku.gunma.jp
numata.gunma.jp
oizumi.gunma.jp
ora.gunma.jp
ota.gunma.jp
shibukawa.gunma.jp
shimonita.gunma.jp
shinto.gunma.jp
showa.gunma.jp
takasaki.gunma.jp
takayama.gunma.jp
tamamura.gunma.jp
tatebayashi.gunma.jp
tomioka.gunma.jp
tsukiyono.gunma.jp
tsumagoi.gunma.jp
ueno.gunma.jp
yoshioka.gunma.jp
asaminami.hiroshima.jp
daiwa.hiroshima.jp
etajima.hiroshima.jp
fuchu.hiroshima.jp
fukuyama.hiroshima.jp
hatsukaichi.hiroshima.jp
higashihiroshima.hiroshima.jp
hongo.hiroshima.jp
jinsekikogen.hiroshima.jp
kaita.hiroshima.jp
kui.hiroshima.jp
kumano.hiroshima.jp
kure.hiroshima.jp
mihara.hiroshima.jp
miyoshi.hiroshima.jp
naka.hiroshima.jp
onomichi.hiroshima.jp
osakikamijima.hiroshima.jp
otake.hiroshima.jp
saka.hiroshima.jp
sera.hiroshima.jp
seranishi.hiroshima.jp
shinichi.hiroshima.jp
shobara.hiroshima.jp
takehara.hiroshima.jp
abashiri.hokkaido.jp
abira.hokkaido.jp
aibetsu.hokkaido.jp
akabira.hokkaido.jp
akkeshi.hokkaido.jp
asahikawa.hokkaido.jp
ashibetsu.hokkaido.jp
ashoro.hokkaido.jp
assabu.hokkaido.jp
atsuma.hokkaido.jp
bibai.hokkaido.jp
biei.hokkaido.jp
bifuka.hokkaido.jp
bihoro.hokkaido.jp
biratori.hokkaido.jp
chippubetsu.hokkaido.jp
chitose.hokkaido.jp
date.hokkaido.jp
ebetsu.hokkaido.jp
embetsu.hokkaido.jp
eniwa.hokkaido.jp
erimo.hokkaido.jp
esan.hokkaido.jp
esashi.hokkaido.jp
fukagawa.hokkaido.jp
fukushima.hokkaido.jp
furano.hokkaido.jp
furubira.hokkaido.jp
haboro.hokkaido.jp
hakodate.hokkaido.jp
hamatonbetsu.hokkaido.jp
hidaka.hokkaido.jp
higashikagura.hokkaido.jp
higashikawa.hokkaido.jp
hiroo.hokkaido.jp
hokuryu.hokkaido.jp
hokuto.hokkaido.jp
honbetsu.hokkaido.jp
horokanai.hokkaido.jp
horonobe.hokkaido.jp
ikeda.hokkaido.jp
imakane.hokkaido.jp
ishikari.hokkaido.jp
iwamizawa.hokkaido.jp
iwanai.hokkaido.jp
kamifurano.hokkaido.jp
kamikawa.hokkaido.jp
kamishihoro.hokkaido.jp
kamisunagawa.hokkaido.jp
kamoenai.hokkaido.jp
kayabe.hokkaido.jp
kembuchi.hokkaido.jp
kikonai.hokkaido.jp
kimobetsu.hokkaido.jp
kitahiroshima.hokkaido.jp
kitami.hokkaido.jp
kiyosato.hokkaido.jp
koshimizu.hokkaido.jp
kunneppu.hokkaido.jp
kuriyama.hokkaido.jp
kuromatsunai.hokkaido.jp
kushiro.hokkaido.jp
kutchan.hokkaido.jp
kyowa.hokkaido.jp
mashike.hokkaido.jp
matsumae.hokkaido.jp
mikasa.hokkaido.jp
minamifurano.hokkaido.jp
mombetsu.hokkaido.jp
moseushi.hokkaido.jp
mukawa.hokkaido.jp
muroran.hokkaido.jp
naie.hokkaido.jp
nakagawa.hokkaido.jp
nakasatsunai.hokkaido.jp
nakatombetsu.hokkaido.jp
nanae.hokkaido.jp
nanporo.hokkaido.jp
nayoro.hokkaido.jp
nemuro.hokkaido.jp
niikappu.hokkaido.jp
niki.hokkaido.jp
nishiokoppe.hokkaido.jp
noboribetsu.hokkaido.jp
numata.hokkaido.jp
obihiro.hokkaido.jp
obira.hokkaido.jp
oketo.hokkaido.jp
okoppe.hokkaido.jp
otaru.hokkaido.jp
otobe.hokkaido.jp
otofuke.hokkaido.jp
otoineppu.hokkaido.jp
oumu.hokkaido.jp
ozora.hokkaido.jp
pippu.hokkaido.jp
rankoshi.hokkaido.jp
rebun.hokkaido.jp
rikubetsu.hokkaido.jp
rishiri.hokkaido.jp
rishirifuji.hokkaido.jp
saroma.hokkaido.jp
sarufutsu.hokkaido.jp
shakotan.hokkaido.jp
shari.hokkaido.jp
shibecha.hokkaido.jp
shibetsu.hokkaido.jp
shikabe.hokkaido.jp
shikaoi.hokkaido.jp
shimamaki.hokkaido.jp
shimizu.hokkaido.jp
shimokawa.hokkaido.jp
shinshinotsu.hokkaido.jp
shintoku.hokkaido.jp
shiranuka.hokkaido.jp
shiraoi.hokkaido.jp
shiriuchi.hokkaido.jp
sobetsu.hokkaido.jp
sunagawa.hokkaido.jp
taiki.hokkaido.jp
takasu.hokkaido.jp
takikawa.hokkaido.jp
takinoue.hokkaido.jp
teshikaga.hokkaido.jp
tobetsu.hokkaido.jp
tohma.hokkaido.jp
tomakomai.hokkaido.jp
tomari.hokkaido.jp
toya.hokkaido.jp
toyako.hokkaido.jp
toyotomi.hokkaido.jp
toyoura.hokkaido.jp
tsubetsu.hokkaido.jp
tsukigata.hokkaido.jp
urakawa.hokkaido.jp
urausu.hokkaido.jp
uryu.hokkaido.jp
utashinai.hokkaido.jp
wakkanai.hokkaido.jp
wassamu.hokkaido.jp
yakumo.hokkaido.jp
yoichi.hokkaido.jp
aioi.hyogo.jp
akashi.hyogo.jp
ako.hyogo.jp
amagasaki.hyogo.jp
aogaki.hyogo.jp
asago.hyogo.jp
ashiya.hyogo.jp
awaji.hyogo.jp
fukusaki.hyogo.jp
goshiki.hyogo.jp
harima.hyogo.jp
himeji.hyogo.jp
ichikawa.hyogo.jp
inagawa.hyogo.jp
itami.hyogo.jp
kakogawa.hyogo.jp
kamigori.hyogo.jp
kamikawa.hyogo.jp
kasai.hyogo.jp
kasuga.hyogo.jp
kawanishi.hyogo.jp
miki.hyogo.jp
minamiawaji.hyogo.jp
nishinomiya.hyogo.jp
nishiwaki.hyogo.jp
ono.hyogo.jp
sanda.hyogo.jp
sannan.hyogo.jp
sasayama.hyogo.jp
sayo.hyogo.jp
shingu.hyogo.jp
shinonsen.hyogo.jp
shiso.hyogo.jp
sumoto.hyogo.jp
taishi.hyogo.jp
taka.hyogo.jp
takarazuka.hyogo.jp
takasago.hyogo.jp
takino.hyogo.jp
tamba.hyogo.jp
tatsuno.hyogo.jp
toyooka.hyogo.jp
yabu.hyogo.jp
yashiro.hyogo.jp
yoka.hyogo.jp
yokawa.hyogo.jp
ami.ibaraki.jp
asahi.ibaraki.jp
bando.ibaraki.jp
chikusei.ibaraki.jp
daigo.ibaraki.jp
fujishiro.ibaraki.jp
hitachi.ibaraki.jp
hitachinaka.ibaraki.jp
hitachiomiya.ibaraki.jp
hitachiota.ibaraki.jp
ibaraki.ibaraki.jp
ina.ibaraki.jp
inashiki.ibaraki.jp
itako.ibaraki.jp
iwama.ibaraki.jp
joso.ibaraki.jp
kamisu.ibaraki.jp
kasama.ibaraki.jp
kashima.ibaraki.jp
kasumigaura.ibaraki.jp
koga.ibaraki.jp
miho.ibaraki.jp
mito.ibaraki.jp
moriya.ibaraki.jp
naka.ibaraki.jp
namegata.ibaraki.jp
oarai.ibaraki.jp
ogawa.ibaraki.jp
omitama.ibaraki.jp
ryugasaki.ibaraki.jp
sakai.ibaraki.jp
sakuragawa.ibaraki.jp
shimodate.ibaraki.jp
shimotsuma.ibaraki.jp
shirosato.ibaraki.jp
sowa.ibaraki.jp
suifu.ibaraki.jp
takahagi.ibaraki.jp
tamatsukuri.ibaraki.jp
tokai.ibaraki.jp
tomobe.ibaraki.jp
tone.ibaraki.jp
toride.ibaraki.jp
tsuchiura.ibaraki.jp
tsukuba.ibaraki.jp
uchihara.ibaraki.jp
ushiku.ibaraki.jp
yachiyo.ibaraki.jp
yamagata.ibaraki.jp
yawara.ibaraki.jp
yuki.ibaraki.jp
anamizu.ishikawa.jp
hakui.ishikawa.jp
hakusan.ishikawa.jp
kaga.ishikawa.jp
kahoku.ishikawa.jp
kanazawa.ishikawa.jp
kawakita.ishikawa.jp
komatsu.ishikawa.jp
nakanoto.ishikawa.jp
nanao.ishikawa.jp
nomi.ishikawa.jp
nonoichi.ishikawa.jp
noto.ishikawa.jp
shika.ishikawa.jp
suzu.ishikawa.jp
tsubata.ishikawa.jp
tsurugi.ishikawa.jp
uchinada.ishikawa.jp
wajima.ishikawa.jp
fudai.iwate.jp
fujisawa.iwate.jp
hanamaki.iwate.jp
hiraizumi.iwate.jp
hirono.iwate.jp
ichinohe.iwate.jp
ichinoseki.iwate.jp
iwaizumi.iwate.jp
iwate.iwate.jp
joboji.iwate.jp
kamaishi.iwate.jp
kanegasaki.iwate.jp
karumai.iwate.jp
kawai.iwate.jp
kitakami.iwate.jp
kuji.iwate.jp
kunohe.iwate.jp
kuzumaki.iwate.jp
miyako.iwate.jp
mizusawa.iwate.jp
morioka.iwate.jp
ninohe.iwate.jp
noda.iwate.jp
ofunato.iwate.jp
oshu.iwate.jp
otsuchi.iwate.jp
rikuzentakata.iwate.jp
shiwa.iwate.jp
shizukuishi.iwate.jp
sumita.iwate.jp
tanohata.iwate.jp
tono.iwate.jp
yahaba.iwate.jp
yamada.iwate.jp
ayagawa.kagawa.jp
higashikagawa.kagawa.jp
kanonji.kagawa.jp
kotohira.kagawa.jp
manno.kagawa.jp
marugame.kagawa.jp
mitoyo.kagawa.jp
naoshima.kagawa.jp
sanuki.kagawa.jp
tadotsu.kagawa.jp
takamatsu.kagawa.jp
tonosho.kagawa.jp
uchinomi.kagawa.jp
utazu.kagawa.jp
zentsuji.kagawa.jp
akune.kagoshima.jp
amami.kagoshima.jp
hioki.kagoshima.jp
isa.kagoshima.jp
isen.kagoshima.jp
izumi.kagoshima.jp
kagoshima.kagoshima.jp
kanoya.kagoshima.jp
kawanabe.kagoshima.jp
kinko.kagoshima.jp
kouyama.kagoshima.jp
makurazaki.kagoshima.jp
matsumoto.kagoshima.jp
minamitane.kagoshima.jp
nakatane.kagoshima.jp
nishinoomote.kagoshima.jp
satsumasendai.kagoshima.jp
soo.kagoshima.jp
tarumizu.kagoshima.jp
yusui.kagoshima.jp
aikawa.kanagawa.jp
atsugi.kanagawa.jp
ayase.kanagawa.jp
chigasaki.kanagawa.jp
ebina.kanagawa.jp
fujisawa.kanagawa.jp
hadano.kanagawa.jp
hakone.kanagawa.jp
hiratsuka.kanagawa.jp
isehara.kanagawa.jp
kaisei.kanagawa.jp
kamakura.kanagawa.jp
kiyokawa.kanagawa.jp
matsuda.kanagawa.jp
minamiashigara.kanagawa.jp
miura.kanagawa.jp
nakai.kanagawa.jp
ninomiya.kanagawa.jp
odawara.kanagawa.jp
oi.kanagawa.jp
oiso.kanagawa.jp
sagamihara.kanagawa.jp
samukawa.kanagawa.jp
tsukui.kanagawa.jp
yamakita.kanagawa.jp
yamato.kanagawa.jp
yokosuka.kanagawa.jp
yugawara.kanagawa.jp
zama.kanagawa.jp
zushi.kanagawa.jp
aki.kochi.jp
geisei.kochi.jp
hidaka.kochi.jp
higashitsuno.kochi.jp
ino.kochi.jp
kagami.kochi.jp
kami.kochi.jp
kitagawa.kochi.jp
kochi.kochi.jp
mihara.kochi.jp
motoyama.kochi.jp
muroto.kochi.jp
nahari.kochi.jp
nakamura.kochi.jp
nankoku.kochi.jp
nishitosa.kochi.jp
niyodogawa.kochi.jp
ochi.kochi.jp
okawa.kochi.jp
otoyo.kochi.jp
otsuki.kochi.jp
sakawa.kochi.jp
sukumo.kochi.jp
susaki.kochi.jp
tosa.kochi.jp
tosashimizu.kochi.jp
toyo.kochi.jp
tsuno.kochi.jp
umaji.kochi.jp
yasuda.kochi.jp
yusuhara.kochi.jp
amakusa.kumamoto.jp
arao.kumamoto.jp
aso.kumamoto.jp
choyo.kumamoto.jp
gyokuto.kumamoto.jp
kamiamakusa.kumamoto.jp
kikuchi.kumamoto.jp
kumamoto.kumamoto.jp
mashiki.kumamoto.jp
mifune.kumamoto.jp
minamata.kumamoto.jp
minamioguni.kumamoto.jp
nagasu.kumamoto.jp
nishihara.kumamoto.jp
oguni.kumamoto.jp
ozu.kumamoto.jp
sumoto.kumamoto.jp
takamori.kumamoto.jp
uki.kumamoto.jp
uto.kumamoto.jp
yamaga.kumamoto.jp
yamato.kumamoto.jp
yatsushiro.kumamoto.jp
ayabe.kyoto.jp
fukuchiyama.kyoto.jp
higashiyama.kyoto.jp
ide.kyoto.jp
ine.kyoto.jp
joyo.kyoto.jp
kameoka.kyoto.jp
kamo.kyoto.jp
kita.kyoto.jp
kizu.kyoto.jp
kumiyama.kyoto.jp
kyotamba.kyoto.jp
kyotanabe.kyoto.jp
kyotango.kyoto.jp
maizuru.kyoto.jp
minami.kyoto.jp
minamiyamashiro.kyoto.jp
miyazu.kyoto.jp
muko.kyoto.jp
nagaokakyo.kyoto.jp
nakagyo.kyoto.jp
nantan.kyoto.jp
oyamazaki.kyoto.jp
sakyo.kyoto.jp
seika.kyoto.jp
tanabe.kyoto.jp
uji.kyoto.jp
ujitawara.kyoto.jp
wazuka.kyoto.jp
yamashina.kyoto.jp
yawata.kyoto.jp
asahi.mie.jp
inabe.mie.jp
ise.mie.jp
kameyama.mie.jp
kawagoe.mie.jp
kiho.mie.jp
kisosaki.mie.jp
kiwa.mie.jp
komono.mie.jp
kumano.mie.jp
kuwana.mie.jp
matsusaka.mie.jp
meiwa.mie.jp
mihama.mie.jp
minamiise.mie.jp
misugi.mie.jp
miyama.mie.jp
nabari.mie.jp
shima.mie.jp
suzuka.mie.jp
tado.mie.jp
taiki.mie.jp
taki.mie.jp
tamaki.mie.jp
toba.mie.jp
tsu.mie.jp
udono.mie.jp
ureshino.mie.jp
watarai.mie.jp
yokkaichi.mie.jp
furukawa.miyagi.jp
higashimatsushima.miyagi.jp
ishinomaki.miyagi.jp
iwanuma.miyagi.jp
kakuda.miyagi.jp
kami.miyagi.jp
kawasaki.miyagi.jp
marumori.miyagi.jp
matsushima.miyagi.jp
minamisanriku.miyagi.jp
misato.miyagi.jp
murata.miyagi.jp
natori.miyagi.jp
ogawara.miyagi.jp
ohira.miyagi.jp
onagawa.miyagi.jp
osaki.miyagi.jp
rifu.miyagi.jp
semine.miyagi.jp
shibata.miyagi.jp
shichikashuku.miyagi.jp
shikama.miyagi.jp
shiogama.miyagi.jp
shiroishi.miyagi.jp
tagajo.miyagi.jp
taiwa.miyagi.jp
tome.miyagi.jp
tomiya.miyagi.jp
wakuya.miyagi.jp
watari.miyagi.jp
yamamoto.miyagi.jp
zao.miyagi.jp
aya.miyazaki.jp
ebino.miyazaki.jp
gokase.miyazaki.jp
hyuga.miyazaki.jp
kadogawa.miyazaki.jp
kawaminami.miyazaki.jp
kijo.miyazaki.jp
kitagawa.miyazaki.jp
kitakata.miyazaki.jp
kitaura.miyazaki.jp
kobayashi.miyazaki.jp
kunitomi.miyazaki.jp
kushima.miyazaki.jp
mimata.miyazaki.jp
miyakonojo.miyazaki.jp
miyazaki.miyazaki.jp
morotsuka.miyazaki.jp
nichinan.miyazaki.jp
nishimera.miyazaki.jp
nobeoka.miyazaki.jp
saito.miyazaki.jp
shiiba.miyazaki.jp
shintomi.miyazaki.jp
takaharu.miyazaki.jp
takanabe.miyazaki.jp
takazaki.miyazaki.jp
tsuno.miyazaki.jp
achi.nagano.jp
agematsu.nagano.jp
anan.nagano.jp
aoki.nagano.jp
asahi.nagano.jp
azumino.nagano.jp
chikuhoku.nagano.jp
chikuma.nagano.jp
chino.nagano.jp
fujimi.nagano.jp
hakuba.nagano.jp
hara.nagano.jp
hiraya.nagano.jp
iida.nagano.jp
iijima.nagano.jp
iiyama.nagano.jp
iizuna.nagano.jp
ikeda.nagano.jp
ikusaka.nagano.jp
ina.nagano.jp
karuizawa.nagano.jp
kawakami.nagano.jp
kiso.nagano.jp
kisofukushima.nagano.jp
kitaaiki.nagano.jp
komagane.nagano.jp
komoro.nagano.jp
matsukawa.nagano.jp
matsumoto.nagano.jp
miasa.nagano.jp
minamiaiki.nagano.jp
minamimaki.nagano.jp
minamiminowa.nagano.jp
minowa.nagano.jp
miyada.nagano.jp
miyota.nagano.jp
mochizuki.nagano.jp
nagano.nagano.jp
nagawa.nagano.jp
nagiso.nagano.jp
nakagawa.nagano.jp
nakano.nagano.jp
nozawaonsen.nagano.jp
obuse.nagano.jp
ogawa.nagano.jp
okaya.nagano.jp
omachi.nagano.jp
omi.nagano.jp
ookuwa.nagano.jp
ooshika.nagano.jp
otaki.nagano.jp
otari.nagano.jp
sakae.nagano.jp
sakaki.nagano.jp
saku.nagano.jp
sakuho.nagano.jp
shimosuwa.nagano.jp
shinanomachi.nagano.jp
shiojiri.nagano.jp
suwa.nagano.jp
suzaka.nagano.jp
takagi.nagano.jp
takamori.nagano.jp
takayama.nagano.jp
tateshina.nagano.jp
tatsuno.nagano.jp
togakushi.nagano.jp
togura.nagano.jp
tomi.nagano.jp
ueda.nagano.jp
wada.nagano.jp
yamagata.nagano.jp
yamanouchi.nagano.jp
yasaka.nagano.jp
yasuoka.nagano.jp
chijiwa.nagasaki.jp
futsu.nagasaki.jp
goto.nagasaki.jp
hasami.nagasaki.jp
hirado.nagasaki.jp
iki.nagasaki.jp
isahaya.nagasaki.jp
kawatana.nagasaki.jp
kuchinotsu.nagasaki.jp
matsuura.nagasaki.jp
nagasaki.nagasaki.jp
obama.nagasaki.jp
omura.nagasaki.jp
oseto.nagasaki.jp
saikai.nagasaki.jp
sasebo.nagasaki.jp
seihi.nagasaki.jp
shimabara.nagasaki.jp
shinkamigoto.nagasaki.jp
togitsu.nagasaki.jp
tsushima.nagasaki.jp
unzen.nagasaki.jp
ando.nara.jp
gose.nara.jp
heguri.nara.jp
higashiyoshino.nara.jp
ikaruga.nara.jp
ikoma.nara.jp
kamikitayama.nara.jp
kanmaki.nara.jp
kashiba.nara.jp
kashihara.nara.jp
katsuragi.nara.jp
kawai.nara.jp
kawakami.nara.jp
kawanishi.nara.jp
koryo.nara.jp
kurotaki.nara.jp
mitsue.nara.jp
miyake.nara.jp
nara.nara.jp
nosegawa.nara.jp
oji.nara.jp
ouda.nara.jp
oyodo.nara.jp
sakurai.nara.jp
sango.nara.jp
shimoichi.nara.jp
shimokitayama.nara.jp
shinjo.nara.jp
soni.nara.jp
takatori.nara.jp
tawaramoto.nara.jp
tenkawa.nara.jp
tenri.nara.jp
uda.nara.jp
yamatokoriyama.nara.jp
yamatotakada.nara.jp
yamazoe.nara.jp
yoshino.nara.jp
aga.niigata.jp
agano.niigata.jp
gosen.niigata.jp
itoigawa.niigata.jp
izumozaki.niigata.jp
joetsu.niigata.jp
kamo.niigata.jp
kariwa.niigata.jp
kashiwazaki.niigata.jp
minamiuonuma.niigata.jp
mitsuke.niigata.jp
muika.niigata.jp
murakami.niigata.jp
myoko.niigata.jp
nagaoka.niigata.jp
niigata.niigata.jp
ojiya.niigata.jp
omi.niigata.jp
sado.niigata.jp
sanjo.niigata.jp
seiro.niigata.jp
seirou.niigata.jp
sekikawa.niigata.jp
shibata.niigata.jp
tagami.niigata.jp
tainai.niigata.jp
tochio.niigata.jp
tokamachi.niigata.jp
tsubame.niigata.jp
tsunan.niigata.jp
uonuma.niigata.jp
yahiko.niigata.jp
yoita.niigata.jp
yuzawa.niigata.jp
beppu.oita.jp
bungoono.oita.jp
bungotakada.oita.jp
hasama.oita.jp
hiji.oita.jp
himeshima.oita.jp
hita.oita.jp
kamitsue.oita.jp
kokonoe.oita.jp
kuju.oita.jp
kunisaki.oita.jp
kusu.oita.jp
oita.oita.jp
saiki.oita.jp
taketa.oita.jp
tsukumi.oita.jp
usa.oita.jp
usuki.oita.jp
yufu.oita.jp
akaiwa.okayama.jp
asakuchi.okayama.jp
bizen.okayama.jp
hayashima.okayama.jp
ibara.okayama.jp
kagamino.okayama.jp
kasaoka.okayama.jp
kibichuo.okayama.jp
kumenan.okayama.jp
kurashiki.okayama.jp
maniwa.okayama.jp
misaki.okayama.jp
nagi.okayama.jp
niimi.okayama.jp
nishiawakura.okayama.jp
okayama.okayama.jp
satosho.okayama.jp
setouchi.okayama.jp
shinjo.okayama.jp
shoo.okayama.jp
soja.okayama.jp
takahashi.okayama.jp
tamano.okayama.jp
tsuyama.okayama.jp
wake.okayama.jp
yakage.okayama.jp
aguni.okinawa.jp
ginowan.okinawa.jp
ginoza.okinawa.jp
gushikami.okinawa.jp
haebaru.okinawa.jp
higashi.okinawa.jp
hirara.okinawa.jp
iheya.okinawa.jp
ishigaki.okinawa.jp
ishikawa.okinawa.jp
itoman.okinawa.jp
izena.okinawa.jp
kadena.okinawa.jp
kin.okinawa.jp
kitadaito.okinawa.jp
kitanakagusuku.okinawa.jp
kumejima.okinawa.jp
kunigami.okinawa.jp
minamidaito.okinawa.jp
motobu.okinawa.jp
nago.okinawa.jp
naha.okinawa.jp
nakagusuku.okinawa.jp
nakijin.okinawa.jp
nanjo.okinawa.jp
nishihara.okinawa.jp
ogimi.okinawa.jp
okinawa.okinawa.jp
onna.okinawa.jp
shimoji.okinawa.jp
taketomi.okinawa.jp
tarama.okinawa.jp
tokashiki.okinawa.jp
tomigusuku.okinawa.jp
tonaki.okinawa.jp
urasoe.okinawa.jp
uruma.okinawa.jp
yaese.okinawa.jp
yomitan.okinawa.jp
yonabaru.okinawa.jp
yonaguni.okinawa.jp
zamami.okinawa.jp
abeno.osaka.jp
chihayaakasaka.osaka.jp
chuo.osaka.jp
daito.osaka.jp
fujiidera.osaka.jp
habikino.osaka.jp
hannan.osaka.jp
higashiosaka.osaka.jp
higashisumiyoshi.osaka.jp
higashiyodogawa.osaka.jp
hirakata.osaka.jp
ibaraki.osaka.jp
ikeda.osaka.jp
izumi.osaka.jp
izumiotsu.osaka.jp
izumisano.osaka.jp
kadoma.osaka.jp
kaizuka.osaka.jp
kanan.osaka.jp
kashiwara.osaka.jp
katano.osaka.jp
kawachinagano.osaka.jp
kishiwada.osaka.jp
kita.osaka.jp
kumatori.osaka.jp
matsubara.osaka.jp
minato.osaka.jp
minoh.osaka.jp
misaki.osaka.jp
moriguchi.osaka.jp
neyagawa.osaka.jp
nishi.osaka.jp
nose.osaka.jp
osakasayama.osaka.jp
sakai.osaka.jp
sayama.osaka.jp
sennan.osaka.jp
settsu.osaka.jp
shijonawate.osaka.jp
shimamoto.osaka.jp
suita.osaka.jp
tadaoka.osaka.jp
taishi.osaka.jp
tajiri.osaka.jp
takaishi.osaka.jp
takatsuki.osaka.jp
tondabayashi.osaka.jp
toyonaka.osaka.jp
toyono.osaka.jp
yao.osaka.jp
ariake.saga.jp
arita.saga.jp
fukudomi.saga.jp
genkai.saga.jp
hamatama.saga.jp
hizen.saga.jp
imari.saga.jp
kamimine.saga.jp
kanzaki.saga.jp
karatsu.saga.jp
kashima.saga.jp
kitagata.saga.jp
kitahata.saga.jp
kiyama.saga.jp
kouhoku.saga.jp
kyuragi.saga.jp
nishiarita.saga.jp
ogi.saga.jp
omachi.saga.jp
ouchi.saga.jp
saga.saga.jp
shiroishi.saga.jp
taku.saga.jp
tara.saga.jp
tosu.saga.jp
yoshinogari.saga.jp
arakawa.saitama.jp
asaka.saitama.jp
chichibu.saitama.jp
fujimi.saitama.jp
fujimino.saitama.jp
fukaya.saitama.jp
hanno.saitama.jp
hanyu.saitama.jp
hasuda.saitama.jp
hatogaya.saitama.jp
hatoyama.saitama.jp
hidaka.saitama.jp
higashichichibu.saitama.jp
higashimatsuyama.saitama.jp
honjo.saitama.jp
ina.saitama.jp
iruma.saitama.jp
iwatsuki.saitama.jp
kamiizumi.saitama.jp
kamikawa.saitama.jp
kamisato.saitama.jp
kasukabe.saitama.jp
kawagoe.saitama.jp
kawaguchi.saitama.jp
kawajima.saitama.jp
kazo.saitama.jp
kitamoto.saitama.jp
koshigaya.saitama.jp
kounosu.saitama.jp
kuki.saitama.jp
kumagaya.saitama.jp
matsubushi.saitama.jp
minano.saitama.jp
misato.saitama.jp
miyashiro.saitama.jp
miyoshi.saitama.jp
moroyama.saitama.jp
nagatoro.saitama.jp
namegawa.saitama.jp
niiza.saitama.jp
ogano.saitama.jp
ogawa.saitama.jp
ogose.saitama.jp
okegawa.saitama.jp
omiya.saitama.jp
otaki.saitama.jp
ranzan.saitama.jp
ryokami.saitama.jp
saitama.saitama.jp
sakado.saitama.jp
satte.saitama.jp
sayama.saitama.jp
shiki.saitama.jp
shiraoka.saitama.jp
soka.saitama.jp
sugito.saitama.jp
toda.saitama.jp
tokigawa.saitama.jp
tokorozawa.saitama.jp
tsurugashima.saitama.jp
urawa.saitama.jp
warabi.saitama.jp
yashio.saitama.jp
yokoze.saitama.jp
yono.saitama.jp
yorii.saitama.jp
yoshida.saitama.jp
yoshikawa.saitama.jp
yoshimi.saitama.jp
aisho.shiga.jp
gamo.shiga.jp
higashiomi.shiga.jp
hikone.shiga.jp
koka.shiga.jp
konan.shiga.jp
kosei.shiga.jp
koto.shiga.jp
kusatsu.shiga.jp
maibara.shiga.jp
moriyama.shiga.jp
nagahama.shiga.jp
nishiazai.shiga.jp
notogawa.shiga.jp
omihachiman.shiga.jp
otsu.shiga.jp
ritto.shiga.jp
ryuoh.shiga.jp
takashima.shiga.jp
takatsuki.shiga.jp
torahime.shiga.jp
toyosato.shiga.jp
yasu.shiga.jp
akagi.shimane.jp
ama.shimane.jp
gotsu.shimane.jp
hamada.shimane.jp
higashiizumo.shimane.jp
hikawa.shimane.jp
hikimi.shimane.jp
izumo.shimane.jp
kakinoki.shimane.jp
masuda.shimane.jp
matsue.shimane.jp
misato.shimane.jp
nishinoshima.shimane.jp
ohda.shimane.jp
okinoshima.shimane.jp
okuizumo.shimane.jp
shimane.shimane.jp
tamayu.shimane.jp
tsuwano.shimane.jp
unnan.shimane.jp
yakumo.shimane.jp
yasugi.shimane.jp
yatsuka.shimane.jp
arai.shizuoka.jp
atami.shizuoka.jp
fuji.shizuoka.jp
fujieda.shizuoka.jp
fujikawa.shizuoka.jp
fujinomiya.shizuoka.jp
fukuroi.shizuoka.jp
gotemba.shizuoka.jp
haibara.shizuoka.jp
hamamatsu.shizuoka.jp
higashiizu.shizuoka.jp
ito.shizuoka.jp
iwata.shizuoka.jp
izu.shizuoka.jp
izunokuni.shizuoka.jp
kakegawa.shizuoka.jp
kannami.shizuoka.jp
kawanehon.shizuoka.jp
kawazu.shizuoka.jp
kikugawa.shizuoka.jp
kosai.shizuoka.jp
makinohara.shizuoka.jp
matsuzaki.shizuoka.jp
minamiizu.shizuoka.jp
mishima.shizuoka.jp
morimachi.shizuoka.jp
nishiizu.shizuoka.jp
numazu.shizuoka.jp
omaezaki.shizuoka.jp
shimada.shizuoka.jp
shimizu.shizuoka.jp
shimoda.shizuoka.jp
shizuoka.shizuoka.jp
susono.shizuoka.jp
yaizu.shizuoka.jp
yoshida.shizuoka.jp
ashikaga.tochigi.jp
bato.tochigi.jp
haga.tochigi.jp
ichikai.tochigi.jp
iwafune.tochigi.jp
kaminokawa.tochigi.jp
kanuma.tochigi.jp
karasuyama.tochigi.jp
kuroiso.tochigi.jp
mashiko.tochigi.jp
mibu.tochigi.jp
moka.tochigi.jp
motegi.tochigi.jp
nasu.tochigi.jp
nasushiobara.tochigi.jp
nikko.tochigi.jp
nishikata.tochigi.jp
nogi.tochigi.jp
ohira.tochigi.jp
ohtawara.tochigi.jp
oyama.tochigi.jp
sakura.tochigi.jp
sano.tochigi.jp
shimotsuke.tochigi.jp
shioya.tochigi.jp
takanezawa.tochigi.jp
tochigi.tochigi.jp
tsuga.tochigi.jp
ujiie.tochigi.jp
utsunomiya.tochigi.jp
yaita.tochigi.jp
aizumi.tokushima.jp
anan.tokushima.jp
ichiba.tokushima.jp
itano.tokushima.jp
kainan.tokushima.jp
komatsushima.tokushima.jp
matsushige.tokushima.jp
mima.tokushima.jp
minami.tokushima.jp
miyoshi.tokushima.jp
mugi.tokushima.jp
nakagawa.tokushima.jp
naruto.tokushima.jp
sanagochi.tokushima.jp
shishikui.tokushima.jp
tokushima.tokushima.jp
wajiki.tokushima.jp
adachi.tokyo.jp
akiruno.tokyo.jp
akishima.tokyo.jp
aogashima.tokyo.jp
arakawa.tokyo.jp
bunkyo.tokyo.jp
chiyoda.tokyo.jp
chofu.tokyo.jp
chuo.tokyo.jp
edogawa.tokyo.jp
fuchu.tokyo.jp
fussa.tokyo.jp
hachijo.tokyo.jp
hachioji.tokyo.jp
hamura.tokyo.jp
higashikurume.tokyo.jp
higashimurayama.tokyo.jp
higashiyamato.tokyo.jp
hino.tokyo.jp
hinode.tokyo.jp
hinohara.tokyo.jp
inagi.tokyo.jp
itabashi.tokyo.jp
katsushika.tokyo.jp
kita.tokyo.jp
kiyose.tokyo.jp
kodaira.tokyo.jp
koganei.tokyo.jp
kokubunji.tokyo.jp
komae.tokyo.jp
koto.tokyo.jp
kouzushima.tokyo.jp
kunitachi.tokyo.jp
machida.tokyo.jp
meguro.tokyo.jp
minato.tokyo.jp
mitaka.tokyo.jp
mizuho.tokyo.jp
musashimurayama.tokyo.jp
musashino.tokyo.jp
nakano.tokyo.jp
nerima.tokyo.jp
ogasawara.tokyo.jp
okutama.tokyo.jp
ome.tokyo.jp
oshima.tokyo.jp
ota.tokyo.jp
setagaya.tokyo.jp
shibuya.tokyo.jp
shinagawa.tokyo.jp
shinjuku.tokyo.jp
suginami.tokyo.jp
sumida.tokyo.jp
tachikawa.tokyo.jp
taito.tokyo.jp
tama.tokyo.jp
toshima.tokyo.jp
chizu.tottori.jp
hino.tottori.jp
kawahara.tottori.jp
koge.tottori.jp
kotoura.tottori.jp
misasa.tottori.jp
nanbu.tottori.jp
nichinan.tottori.jp
sakaiminato.tottori.jp
tottori.tottori.jp
wakasa.tottori.jp
yazu.tottori.jp
yonago.tottori.jp
asahi.toyama.jp
fuchu.toyama.jp
fukumitsu.toyama.jp
funahashi.toyama.jp
himi.toyama.jp
imizu.toyama.jp
inami.toyama.jp
johana.toyama.jp
kamiichi.toyama.jp
kurobe.toyama.jp
nakaniikawa.toyama.jp
namerikawa.toyama.jp
nanto.toyama.jp
nyuzen.toyama.jp
oyabe.toyama.jp
taira.toyama.jp
takaoka.toyama.jp
tateyama.toyama.jp
toga.toyama.jp
tonami.toyama.jp
toyama.toyama.jp
unazuki.toyama.jp
uozu.toyama.jp
yamada.toyama.jp
arida.wakayama.jp
aridagawa.wakayama.jp
gobo.wakayama.jp
hashimoto.wakayama.jp
hidaka.wakayama.jp
hirogawa.wakayama.jp
inami.wakayama.jp
iwade.wakayama.jp
kainan.wakayama.jp
kamitonda.wakayama.jp
katsuragi.wakayama.jp
kimino.wakayama.jp
kinokawa.wakayama.jp
kitayama.wakayama.jp
koya.wakayama.jp
koza.wakayama.jp
kozagawa.wakayama.jp
kudoyama.wakayama.jp
kushimoto.wakayama.jp
mihama.wakayama.jp
misato.wakayama.jp
nachikatsuura.wakayama.jp
shingu.wakayama.jp
shirahama.wakayama.jp
taiji.wakayama.jp
tanabe.wakayama.jp
wakayama.wakayama.jp
yuasa.wakayama.jp
yura.wakayama.jp
asahi.yamagata.jp
funagata.yamagata.jp
higashine.yamagata.jp
iide.yamagata.jp
kahoku.yamagata.jp
kaminoyama.yamagata.jp
kaneyama.yamagata.jp
kawanishi.yamagata.jp
mamurogawa.yamagata.jp
mikawa.yamagata.jp
murayama.yamagata.jp
nagai.yamagata.jp
nakayama.yamagata.jp
nanyo.yamagata.jp
nishikawa.yamagata.jp
obanazawa.yamagata.jp
oe.yamagata.jp
oguni.yamagata.jp
ohkura.yamagata.jp
oishida.yamagata.jp
sagae.yamagata.jp
sakata.yamagata.jp
sakegawa.yamagata.jp
shinjo.yamagata.jp
shirataka.yamagata.jp
shonai.yamagata.jp
takahata.yamagata.jp
tendo.yamagata.jp
tozawa.yamagata.jp
tsuruoka.yamagata.jp
yamagata.yamagata.jp
yamanobe.yamagata.jp
yonezawa.yamagata.jp
yuza.yamagata.jp
abu.yamaguchi.jp
hagi.yamaguchi.jp
hikari.yamaguchi.jp
hofu.yamaguchi.jp
iwakuni.yamaguchi.jp
kudamatsu.yamaguchi.jp
mitou.yamaguchi.jp
nagato.yamaguchi.jp
oshima.yamaguchi.jp
shimonoseki.yamaguchi.jp
shunan.yamaguchi.jp
tabuse.yamaguchi.jp
tokuyama.yamaguchi.jp
toyota.yamaguchi.jp
ube.yamaguchi.jp
yuu.yamaguchi.jp
chuo.yamanashi.jp
doshi.yamanashi.jp
fuefuki.yamanashi.jp
fujikawa.yamanashi.jp
fujikawaguchiko.yamanashi.jp
fujiyoshida.yamanashi.jp
hayakawa.yamanashi.jp
hokuto.yamanashi.jp
ichikawamisato.yamanashi.jp
kai.yamanashi.jp
kofu.yamanashi.jp
koshu.yamanashi.jp
kosuge.yamanashi.jp
minami-alps.yamanashi.jp
minobu.yamanashi.jp
nakamichi.yamanashi.jp
nanbu.yamanashi.jp
narusawa.yamanashi.jp
nirasaki.yamanashi.jp
nishikatsura.yamanashi.jp
oshino.yamanashi.jp
otsuki.yamanashi.jp
showa.yamanashi.jp
tabayama.yamanashi.jp
tsuru.yamanashi.jp
uenohara.yamanashi.jp
yamanakako.yamanashi.jp
yamanashi.yamanashi.jp
// ke : http://www.kenic.or.ke/index.php/en/ke-domains/ke-domains
ke
ac.ke
co.ke
go.ke
info.ke
me.ke
mobi.ke
ne.ke
or.ke
sc.ke
// kg : http://www.domain.kg/dmn_n.html
kg
org.kg
net.kg
com.kg
edu.kg
gov.kg
mil.kg
// kh : http://www.mptc.gov.kh/dns_registration.htm
*.kh
// ki : http://www.ki/dns/index.html
ki
edu.ki
biz.ki
net.ki
org.ki
gov.ki
info.ki
com.ki
// km : https://en.wikipedia.org/wiki/.km
// http://www.domaine.km/documents/charte.doc
km
org.km
nom.km
gov.km
prd.km
tm.km
edu.km
mil.km
ass.km
com.km
// These are only mentioned as proposed suggestions at domaine.km, but
// https://en.wikipedia.org/wiki/.km says they're available for registration:
coop.km
asso.km
presse.km
medecin.km
notaires.km
pharmaciens.km
veterinaire.km
gouv.km
// kn : https://en.wikipedia.org/wiki/.kn
// http://www.dot.kn/domainRules.html
kn
net.kn
org.kn
edu.kn
gov.kn
// kp : http://www.kcce.kp/en_index.php
kp
com.kp
edu.kp
gov.kp
org.kp
rep.kp
tra.kp
// kr : https://en.wikipedia.org/wiki/.kr
// see also: http://domain.nida.or.kr/eng/registration.jsp
kr
ac.kr
co.kr
es.kr
go.kr
hs.kr
kg.kr
mil.kr
ms.kr
ne.kr
or.kr
pe.kr
re.kr
sc.kr
// kr geographical names
busan.kr
chungbuk.kr
chungnam.kr
daegu.kr
daejeon.kr
gangwon.kr
gwangju.kr
gyeongbuk.kr
gyeonggi.kr
gyeongnam.kr
incheon.kr
jeju.kr
jeonbuk.kr
jeonnam.kr
seoul.kr
ulsan.kr
// kw : https://www.nic.kw/policies/
// Confirmed by registry
kw
com.kw
edu.kw
emb.kw
gov.kw
ind.kw
net.kw
org.kw
// ky : http://www.icta.ky/da_ky_reg_dom.php
// Confirmed by registry 2008-06-17
ky
edu.ky
gov.ky
com.ky
org.ky
net.ky
// kz : https://en.wikipedia.org/wiki/.kz
// see also: http://www.nic.kz/rules/index.jsp
kz
org.kz
edu.kz
net.kz
gov.kz
mil.kz
com.kz
// la : https://en.wikipedia.org/wiki/.la
// Submitted by registry
la
int.la
net.la
info.la
edu.la
gov.la
per.la
com.la
org.la
// lb : https://en.wikipedia.org/wiki/.lb
// Submitted by registry
lb
com.lb
edu.lb
gov.lb
net.lb
org.lb
// lc : https://en.wikipedia.org/wiki/.lc
// see also: http://www.nic.lc/rules.htm
lc
com.lc
net.lc
co.lc
org.lc
edu.lc
gov.lc
// li : https://en.wikipedia.org/wiki/.li
li
// lk : http://www.nic.lk/seclevpr.html
lk
gov.lk
sch.lk
net.lk
int.lk
com.lk
org.lk
edu.lk
ngo.lk
soc.lk
web.lk
ltd.lk
assn.lk
grp.lk
hotel.lk
ac.lk
// lr : http://psg.com/dns/lr/lr.txt
// Submitted by registry
lr
com.lr
edu.lr
gov.lr
org.lr
net.lr
// ls : http://www.nic.ls/
// Confirmed by registry
ls
ac.ls
biz.ls
co.ls
edu.ls
gov.ls
info.ls
net.ls
org.ls
sc.ls
// lt : https://en.wikipedia.org/wiki/.lt
lt
// gov.lt : http://www.gov.lt/index_en.php
gov.lt
// lu : http://www.dns.lu/en/
lu
// lv : http://www.nic.lv/DNS/En/generic.php
lv
com.lv
edu.lv
gov.lv
org.lv
mil.lv
id.lv
net.lv
asn.lv
conf.lv
// ly : http://www.nic.ly/regulations.php
ly
com.ly
net.ly
gov.ly
plc.ly
edu.ly
sch.ly
med.ly
org.ly
id.ly
// ma : https://en.wikipedia.org/wiki/.ma
// http://www.anrt.ma/fr/admin/download/upload/file_fr782.pdf
ma
co.ma
net.ma
gov.ma
org.ma
ac.ma
press.ma
// mc : http://www.nic.mc/
mc
tm.mc
asso.mc
// md : https://en.wikipedia.org/wiki/.md
md
// me : https://en.wikipedia.org/wiki/.me
me
co.me
net.me
org.me
edu.me
ac.me
gov.me
its.me
priv.me
// mg : http://nic.mg/nicmg/?page_id=39
mg
org.mg
nom.mg
gov.mg
prd.mg
tm.mg
edu.mg
mil.mg
com.mg
co.mg
// mh : https://en.wikipedia.org/wiki/.mh
mh
// mil : https://en.wikipedia.org/wiki/.mil
mil
// mk : https://en.wikipedia.org/wiki/.mk
// see also: http://dns.marnet.net.mk/postapka.php
mk
com.mk
org.mk
net.mk
edu.mk
gov.mk
inf.mk
name.mk
// ml : http://www.gobin.info/domainname/ml-template.doc
// see also: https://en.wikipedia.org/wiki/.ml
ml
com.ml
edu.ml
gouv.ml
gov.ml
net.ml
org.ml
presse.ml
// mm : https://en.wikipedia.org/wiki/.mm
*.mm
// mn : https://en.wikipedia.org/wiki/.mn
mn
gov.mn
edu.mn
org.mn
// mo : http://www.monic.net.mo/
mo
com.mo
net.mo
org.mo
edu.mo
gov.mo
// mobi : https://en.wikipedia.org/wiki/.mobi
mobi
// mp : http://www.dot.mp/
// Confirmed by registry 2008-06-17
mp
// mq : https://en.wikipedia.org/wiki/.mq
mq
// mr : https://en.wikipedia.org/wiki/.mr
mr
gov.mr
// ms : http://www.nic.ms/pdf/MS_Domain_Name_Rules.pdf
ms
com.ms
edu.ms
gov.ms
net.ms
org.ms
// mt : https://www.nic.org.mt/go/policy
// Submitted by registry
mt
com.mt
edu.mt
net.mt
org.mt
// mu : https://en.wikipedia.org/wiki/.mu
mu
com.mu
net.mu
org.mu
gov.mu
ac.mu
co.mu
or.mu
// museum : http://about.museum/naming/
// http://index.museum/
museum
academy.museum
agriculture.museum
air.museum
airguard.museum
alabama.museum
alaska.museum
amber.museum
ambulance.museum
american.museum
americana.museum
americanantiques.museum
americanart.museum
amsterdam.museum
and.museum
annefrank.museum
anthro.museum
anthropology.museum
antiques.museum
aquarium.museum
arboretum.museum
archaeological.museum
archaeology.museum
architecture.museum
art.museum
artanddesign.museum
artcenter.museum
artdeco.museum
arteducation.museum
artgallery.museum
arts.museum
artsandcrafts.museum
asmatart.museum
assassination.museum
assisi.museum
association.museum
astronomy.museum
atlanta.museum
austin.museum
australia.museum
automotive.museum
aviation.museum
axis.museum
badajoz.museum
baghdad.museum
bahn.museum
bale.museum
baltimore.museum
barcelona.museum
baseball.museum
basel.museum
baths.museum
bauern.museum
beauxarts.museum
beeldengeluid.museum
bellevue.museum
bergbau.museum
berkeley.museum
berlin.museum
bern.museum
bible.museum
bilbao.museum
bill.museum
birdart.museum
birthplace.museum
bonn.museum
boston.museum
botanical.museum
botanicalgarden.museum
botanicgarden.museum
botany.museum
brandywinevalley.museum
brasil.museum
bristol.museum
british.museum
britishcolumbia.museum
broadcast.museum
brunel.museum
brussel.museum
brussels.museum
bruxelles.museum
building.museum
burghof.museum
bus.museum
bushey.museum
cadaques.museum
california.museum
cambridge.museum
can.museum
canada.museum
capebreton.museum
carrier.museum
cartoonart.museum
casadelamoneda.museum
castle.museum
castres.museum
celtic.museum
center.museum
chattanooga.museum
cheltenham.museum
chesapeakebay.museum
chicago.museum
children.museum
childrens.museum
childrensgarden.museum
chiropractic.museum
chocolate.museum
christiansburg.museum
cincinnati.museum
cinema.museum
circus.museum
civilisation.museum
civilization.museum
civilwar.museum
clinton.museum
clock.museum
coal.museum
coastaldefence.museum
cody.museum
coldwar.museum
collection.museum
colonialwilliamsburg.museum
coloradoplateau.museum
columbia.museum
columbus.museum
communication.museum
communications.museum
community.museum
computer.museum
computerhistory.museum
comunicações.museum
contemporary.museum
contemporaryart.museum
convent.museum
copenhagen.museum
corporation.museum
correios-e-telecomunicações.museum
corvette.museum
costume.museum
countryestate.museum
county.museum
crafts.museum
cranbrook.museum
creation.museum
cultural.museum
culturalcenter.museum
culture.museum
cyber.museum
cymru.museum
dali.museum
dallas.museum
database.museum
ddr.museum
decorativearts.museum
delaware.museum
delmenhorst.museum
denmark.museum
depot.museum
design.museum
detroit.museum
dinosaur.museum
discovery.museum
dolls.museum
donostia.museum
durham.museum
eastafrica.museum
eastcoast.museum
education.museum
educational.museum
egyptian.museum
eisenbahn.museum
elburg.museum
elvendrell.museum
embroidery.museum
encyclopedic.museum
england.museum
entomology.museum
environment.museum
environmentalconservation.museum
epilepsy.museum
essex.museum
estate.museum
ethnology.museum
exeter.museum
exhibition.museum
family.museum
farm.museum
farmequipment.museum
farmers.museum
farmstead.museum
field.museum
figueres.museum
filatelia.museum
film.museum
fineart.museum
finearts.museum
finland.museum
flanders.museum
florida.museum
force.museum
fortmissoula.museum
fortworth.museum
foundation.museum
francaise.museum
frankfurt.museum
franziskaner.museum
freemasonry.museum
freiburg.museum
fribourg.museum
frog.museum
fundacio.museum
furniture.museum
gallery.museum
garden.museum
gateway.museum
geelvinck.museum
gemological.museum
geology.museum
georgia.museum
giessen.museum
glas.museum
glass.museum
gorge.museum
grandrapids.museum
graz.museum
guernsey.museum
halloffame.museum
hamburg.museum
handson.museum
harvestcelebration.museum
hawaii.museum
health.museum
heimatunduhren.museum
hellas.museum
helsinki.museum
hembygdsforbund.museum
heritage.museum
histoire.museum
historical.museum
historicalsociety.museum
historichouses.museum
historisch.museum
historisches.museum
history.museum
historyofscience.museum
horology.museum
house.museum
humanities.museum
illustration.museum
imageandsound.museum
indian.museum
indiana.museum
indianapolis.museum
indianmarket.museum
intelligence.museum
interactive.museum
iraq.museum
iron.museum
isleofman.museum
jamison.museum
jefferson.museum
jerusalem.museum
jewelry.museum
jewish.museum
jewishart.museum
jfk.museum
journalism.museum
judaica.museum
judygarland.museum
juedisches.museum
juif.museum
karate.museum
karikatur.museum
kids.museum
koebenhavn.museum
koeln.museum
kunst.museum
kunstsammlung.museum
kunstunddesign.museum
labor.museum
labour.museum
lajolla.museum
lancashire.museum
landes.museum
lans.museum
läns.museum
larsson.museum
lewismiller.museum
lincoln.museum
linz.museum
living.museum
livinghistory.museum
localhistory.museum
london.museum
losangeles.museum
louvre.museum
loyalist.museum
lucerne.museum
luxembourg.museum
luzern.museum
mad.museum
madrid.museum
mallorca.museum
manchester.museum
mansion.museum
mansions.museum
manx.museum
marburg.museum
maritime.museum
maritimo.museum
maryland.museum
marylhurst.museum
media.museum
medical.museum
medizinhistorisches.museum
meeres.museum
memorial.museum
mesaverde.museum
michigan.museum
midatlantic.museum
military.museum
mill.museum
miners.museum
mining.museum
minnesota.museum
missile.museum
missoula.museum
modern.museum
moma.museum
money.museum
monmouth.museum
monticello.museum
montreal.museum
moscow.museum
motorcycle.museum
muenchen.museum
muenster.museum
mulhouse.museum
muncie.museum
museet.museum
museumcenter.museum
museumvereniging.museum
music.museum
national.museum
nationalfirearms.museum
nationalheritage.museum
nativeamerican.museum
naturalhistory.museum
naturalhistorymuseum.museum
naturalsciences.museum
nature.museum
naturhistorisches.museum
natuurwetenschappen.museum
naumburg.museum
naval.museum
nebraska.museum
neues.museum
newhampshire.museum
newjersey.museum
newmexico.museum
newport.museum
newspaper.museum
newyork.museum
niepce.museum
norfolk.museum
north.museum
nrw.museum
nyc.museum
nyny.museum
oceanographic.museum
oceanographique.museum
omaha.museum
online.museum
ontario.museum
openair.museum
oregon.museum
oregontrail.museum
otago.museum
oxford.museum
pacific.museum
paderborn.museum
palace.museum
paleo.museum
palmsprings.museum
panama.museum
paris.museum
pasadena.museum
pharmacy.museum
philadelphia.museum
philadelphiaarea.museum
philately.museum
phoenix.museum
photography.museum
pilots.museum
pittsburgh.museum
planetarium.museum
plantation.museum
plants.museum
plaza.museum
portal.museum
portland.museum
portlligat.museum
posts-and-telecommunications.museum
preservation.museum
presidio.museum
press.museum
project.museum
public.museum
pubol.museum
quebec.museum
railroad.museum
railway.museum
research.museum
resistance.museum
riodejaneiro.museum
rochester.museum
rockart.museum
roma.museum
russia.museum
saintlouis.museum
salem.museum
salvadordali.museum
salzburg.museum
sandiego.museum
sanfrancisco.museum
santabarbara.museum
santacruz.museum
santafe.museum
saskatchewan.museum
satx.museum
savannahga.museum
schlesisches.museum
schoenbrunn.museum
schokoladen.museum
school.museum
schweiz.museum
science.museum
scienceandhistory.museum
scienceandindustry.museum
sciencecenter.museum
sciencecenters.museum
science-fiction.museum
sciencehistory.museum
sciences.museum
sciencesnaturelles.museum
scotland.museum
seaport.museum
settlement.museum
settlers.museum
shell.museum
sherbrooke.museum
sibenik.museum
silk.museum
ski.museum
skole.museum
society.museum
sologne.museum
soundandvision.museum
southcarolina.museum
southwest.museum
space.museum
spy.museum
square.museum
stadt.museum
stalbans.museum
starnberg.museum
state.museum
stateofdelaware.museum
station.museum
steam.museum
steiermark.museum
stjohn.museum
stockholm.museum
stpetersburg.museum
stuttgart.museum
suisse.museum
surgeonshall.museum
surrey.museum
svizzera.museum
sweden.museum
sydney.museum
tank.museum
tcm.museum
technology.museum
telekommunikation.museum
television.museum
texas.museum
textile.museum
theater.museum
time.museum
timekeeping.museum
topology.museum
torino.museum
touch.museum
town.museum
transport.museum
tree.museum
trolley.museum
trust.museum
trustee.museum
uhren.museum
ulm.museum
undersea.museum
university.museum
usa.museum
usantiques.museum
usarts.museum
uscountryestate.museum
usculture.museum
usdecorativearts.museum
usgarden.museum
ushistory.museum
ushuaia.museum
uslivinghistory.museum
utah.museum
uvic.museum
valley.museum
vantaa.museum
versailles.museum
viking.museum
village.museum
virginia.museum
virtual.museum
virtuel.museum
vlaanderen.museum
volkenkunde.museum
wales.museum
wallonie.museum
war.museum
washingtondc.museum
watchandclock.museum
watch-and-clock.museum
western.museum
westfalen.museum
whaling.museum
wildlife.museum
williamsburg.museum
windmill.museum
workshop.museum
york.museum
yorkshire.museum
yosemite.museum
youth.museum
zoological.museum
zoology.museum
ירושלים.museum
иком.museum
// mv : https://en.wikipedia.org/wiki/.mv
// "mv" included because, contra Wikipedia, google.mv exists.
mv
aero.mv
biz.mv
com.mv
coop.mv
edu.mv
gov.mv
info.mv
int.mv
mil.mv
museum.mv
name.mv
net.mv
org.mv
pro.mv
// mw : http://www.registrar.mw/
mw
ac.mw
biz.mw
co.mw
com.mw
coop.mw
edu.mw
gov.mw
int.mw
museum.mw
net.mw
org.mw
// mx : http://www.nic.mx/
// Submitted by registry
mx
com.mx
org.mx
gob.mx
edu.mx
net.mx
// my : http://www.mynic.net.my/
my
com.my
net.my
org.my
gov.my
edu.my
mil.my
name.my
// mz : http://www.uem.mz/
// Submitted by registry
mz
ac.mz
adv.mz
co.mz
edu.mz
gov.mz
mil.mz
net.mz
org.mz
// na : http://www.na-nic.com.na/
// http://www.info.na/domain/
na
info.na
pro.na
name.na
school.na
or.na
dr.na
us.na
mx.na
ca.na
in.na
cc.na
tv.na
ws.na
mobi.na
co.na
com.na
org.na
// name : has 2nd-level tlds, but there's no list of them
name
// nc : http://www.cctld.nc/
nc
asso.nc
nom.nc
// ne : https://en.wikipedia.org/wiki/.ne
ne
// net : https://en.wikipedia.org/wiki/.net
net
// nf : https://en.wikipedia.org/wiki/.nf
nf
com.nf
net.nf
per.nf
rec.nf
web.nf
arts.nf
firm.nf
info.nf
other.nf
store.nf
// ng : http://www.nira.org.ng/index.php/join-us/register-ng-domain/189-nira-slds
ng
com.ng
edu.ng
gov.ng
i.ng
mil.ng
mobi.ng
name.ng
net.ng
org.ng
sch.ng
// ni : http://www.nic.ni/
ni
ac.ni
biz.ni
co.ni
com.ni
edu.ni
gob.ni
in.ni
info.ni
int.ni
mil.ni
net.ni
nom.ni
org.ni
web.ni
// nl : https://en.wikipedia.org/wiki/.nl
// https://www.sidn.nl/
// ccTLD for the Netherlands
nl
// no : http://www.norid.no/regelverk/index.en.html
// The Norwegian registry has declined to notify us of updates. The web pages
// referenced below are the official source of the data. There is also an
// announce mailing list:
// https://postlister.uninett.no/sympa/info/norid-diskusjon
no
// Norid generic domains : http://www.norid.no/regelverk/vedlegg-c.en.html
fhs.no
vgs.no
fylkesbibl.no
folkebibl.no
museum.no
idrett.no
priv.no
// Non-Norid generic domains : http://www.norid.no/regelverk/vedlegg-d.en.html
mil.no
stat.no
dep.no
kommune.no
herad.no
// no geographical names : http://www.norid.no/regelverk/vedlegg-b.en.html
// counties
aa.no
ah.no
bu.no
fm.no
hl.no
hm.no
jan-mayen.no
mr.no
nl.no
nt.no
of.no
ol.no
oslo.no
rl.no
sf.no
st.no
svalbard.no
tm.no
tr.no
va.no
vf.no
// primary and lower secondary schools per county
gs.aa.no
gs.ah.no
gs.bu.no
gs.fm.no
gs.hl.no
gs.hm.no
gs.jan-mayen.no
gs.mr.no
gs.nl.no
gs.nt.no
gs.of.no
gs.ol.no
gs.oslo.no
gs.rl.no
gs.sf.no
gs.st.no
gs.svalbard.no
gs.tm.no
gs.tr.no
gs.va.no
gs.vf.no
// cities
akrehamn.no
åkrehamn.no
algard.no
ålgård.no
arna.no
brumunddal.no
bryne.no
bronnoysund.no
brønnøysund.no
drobak.no
drøbak.no
egersund.no
fetsund.no
floro.no
florø.no
fredrikstad.no
hokksund.no
honefoss.no
hønefoss.no
jessheim.no
jorpeland.no
jørpeland.no
kirkenes.no
kopervik.no
krokstadelva.no
langevag.no
langevåg.no
leirvik.no
mjondalen.no
mjøndalen.no
mo-i-rana.no
mosjoen.no
mosjøen.no
nesoddtangen.no
orkanger.no
osoyro.no
osøyro.no
raholt.no
råholt.no
sandnessjoen.no
sandnessjøen.no
skedsmokorset.no
slattum.no
spjelkavik.no
stathelle.no
stavern.no
stjordalshalsen.no
stjørdalshalsen.no
tananger.no
tranby.no
vossevangen.no
// communities
afjord.no
åfjord.no
agdenes.no
al.no
ål.no
alesund.no
ålesund.no
alstahaug.no
alta.no
áltá.no
alaheadju.no
álaheadju.no
alvdal.no
amli.no
åmli.no
amot.no
åmot.no
andebu.no
andoy.no
andøy.no
andasuolo.no
ardal.no
årdal.no
aremark.no
arendal.no
ås.no
aseral.no
åseral.no
asker.no
askim.no
askvoll.no
askoy.no
askøy.no
asnes.no
åsnes.no
audnedaln.no
aukra.no
aure.no
aurland.no
aurskog-holand.no
aurskog-høland.no
austevoll.no
austrheim.no
averoy.no
averøy.no
balestrand.no
ballangen.no
balat.no
bálát.no
balsfjord.no
bahccavuotna.no
báhccavuotna.no
bamble.no
bardu.no
beardu.no
beiarn.no
bajddar.no
bájddar.no
baidar.no
báidár.no
berg.no
bergen.no
berlevag.no
berlevåg.no
bearalvahki.no
bearalváhki.no
bindal.no
birkenes.no
bjarkoy.no
bjarkøy.no
bjerkreim.no
bjugn.no
bodo.no
bodø.no
badaddja.no
bådåddjå.no
budejju.no
bokn.no
bremanger.no
bronnoy.no
brønnøy.no
bygland.no
bykle.no
barum.no
bærum.no
bo.telemark.no
bø.telemark.no
bo.nordland.no
bø.nordland.no
bievat.no
bievát.no
bomlo.no
bømlo.no
batsfjord.no
båtsfjord.no
bahcavuotna.no
báhcavuotna.no
dovre.no
drammen.no
drangedal.no
dyroy.no
dyrøy.no
donna.no
dønna.no
eid.no
eidfjord.no
eidsberg.no
eidskog.no
eidsvoll.no
eigersund.no
elverum.no
enebakk.no
engerdal.no
etne.no
etnedal.no
evenes.no
evenassi.no
evenášši.no
evje-og-hornnes.no
farsund.no
fauske.no
fuossko.no
fuoisku.no
fedje.no
fet.no
finnoy.no
finnøy.no
fitjar.no
fjaler.no
fjell.no
flakstad.no
flatanger.no
flekkefjord.no
flesberg.no
flora.no
fla.no
flå.no
folldal.no
forsand.no
fosnes.no
frei.no
frogn.no
froland.no
frosta.no
frana.no
fræna.no
froya.no
frøya.no
fusa.no
fyresdal.no
forde.no
førde.no
gamvik.no
gangaviika.no
gáŋgaviika.no
gaular.no
gausdal.no
gildeskal.no
gildeskål.no
giske.no
gjemnes.no
gjerdrum.no
gjerstad.no
gjesdal.no
gjovik.no
gjøvik.no
gloppen.no
gol.no
gran.no
grane.no
granvin.no
gratangen.no
grimstad.no
grong.no
kraanghke.no
kråanghke.no
grue.no
gulen.no
hadsel.no
halden.no
halsa.no
hamar.no
hamaroy.no
habmer.no
hábmer.no
hapmir.no
hápmir.no
hammerfest.no
hammarfeasta.no
hámmárfeasta.no
haram.no
hareid.no
harstad.no
hasvik.no
aknoluokta.no
ákŋoluokta.no
hattfjelldal.no
aarborte.no
haugesund.no
hemne.no
hemnes.no
hemsedal.no
heroy.more-og-romsdal.no
herøy.møre-og-romsdal.no
heroy.nordland.no
herøy.nordland.no
hitra.no
hjartdal.no
hjelmeland.no
hobol.no
hobøl.no
hof.no
hol.no
hole.no
holmestrand.no
holtalen.no
holtålen.no
hornindal.no
horten.no
hurdal.no
hurum.no
hvaler.no
hyllestad.no
hagebostad.no
hægebostad.no
hoyanger.no
høyanger.no
hoylandet.no
høylandet.no
ha.no
hå.no
ibestad.no
inderoy.no
inderøy.no
iveland.no
jevnaker.no
jondal.no
jolster.no
jølster.no
karasjok.no
karasjohka.no
kárášjohka.no
karlsoy.no
galsa.no
gálsá.no
karmoy.no
karmøy.no
kautokeino.no
guovdageaidnu.no
klepp.no
klabu.no
klæbu.no
kongsberg.no
kongsvinger.no
kragero.no
kragerø.no
kristiansand.no
kristiansund.no
krodsherad.no
krødsherad.no
kvalsund.no
rahkkeravju.no
ráhkkerávju.no
kvam.no
kvinesdal.no
kvinnherad.no
kviteseid.no
kvitsoy.no
kvitsøy.no
kvafjord.no
kvæfjord.no
giehtavuoatna.no
kvanangen.no
kvænangen.no
navuotna.no
návuotna.no
kafjord.no
kåfjord.no
gaivuotna.no
gáivuotna.no
larvik.no
lavangen.no
lavagis.no
loabat.no
loabát.no
lebesby.no
davvesiida.no
leikanger.no
leirfjord.no
leka.no
leksvik.no
lenvik.no
leangaviika.no
leaŋgaviika.no
lesja.no
levanger.no
lier.no
lierne.no
lillehammer.no
lillesand.no
lindesnes.no
lindas.no
lindås.no
lom.no
loppa.no
lahppi.no
láhppi.no
lund.no
lunner.no
luroy.no
lurøy.no
luster.no
lyngdal.no
lyngen.no
ivgu.no
lardal.no
lerdal.no
lærdal.no
lodingen.no
lødingen.no
lorenskog.no
lørenskog.no
loten.no
løten.no
malvik.no
masoy.no
måsøy.no
muosat.no
muosát.no
mandal.no
marker.no
marnardal.no
masfjorden.no
meland.no
meldal.no
melhus.no
meloy.no
meløy.no
meraker.no
meråker.no
moareke.no
moåreke.no
midsund.no
midtre-gauldal.no
modalen.no
modum.no
molde.no
moskenes.no
moss.no
mosvik.no
malselv.no
målselv.no
malatvuopmi.no
málatvuopmi.no
namdalseid.no
aejrie.no
namsos.no
namsskogan.no
naamesjevuemie.no
nååmesjevuemie.no
laakesvuemie.no
nannestad.no
narvik.no
narviika.no
naustdal.no
nedre-eiker.no
nes.akershus.no
nes.buskerud.no
nesna.no
nesodden.no
nesseby.no
unjarga.no
unjárga.no
nesset.no
nissedal.no
nittedal.no
nord-aurdal.no
nord-fron.no
nord-odal.no
norddal.no
nordkapp.no
davvenjarga.no
davvenjárga.no
nordre-land.no
nordreisa.no
raisa.no
ráisa.no
nore-og-uvdal.no
notodden.no
naroy.no
nærøy.no
notteroy.no
nøtterøy.no
odda.no
oksnes.no
øksnes.no
oppdal.no
oppegard.no
oppegård.no
orkdal.no
orland.no
ørland.no
orskog.no
ørskog.no
orsta.no
ørsta.no
os.hedmark.no
os.hordaland.no
osen.no
osteroy.no
osterøy.no
ostre-toten.no
østre-toten.no
overhalla.no
ovre-eiker.no
øvre-eiker.no
oyer.no
øyer.no
oygarden.no
øygarden.no
oystre-slidre.no
øystre-slidre.no
porsanger.no
porsangu.no
porsáŋgu.no
porsgrunn.no
radoy.no
radøy.no
rakkestad.no
rana.no
ruovat.no
randaberg.no
rauma.no
rendalen.no
rennebu.no
rennesoy.no
rennesøy.no
rindal.no
ringebu.no
ringerike.no
ringsaker.no
rissa.no
risor.no
risør.no
roan.no
rollag.no
rygge.no
ralingen.no
rælingen.no
rodoy.no
rødøy.no
romskog.no
rømskog.no
roros.no
røros.no
rost.no
røst.no
royken.no
røyken.no
royrvik.no
røyrvik.no
rade.no
råde.no
salangen.no
siellak.no
saltdal.no
salat.no
sálát.no
sálat.no
samnanger.no
sande.more-og-romsdal.no
sande.møre-og-romsdal.no
sande.vestfold.no
sandefjord.no
sandnes.no
sandoy.no
sandøy.no
sarpsborg.no
sauda.no
sauherad.no
sel.no
selbu.no
selje.no
seljord.no
sigdal.no
siljan.no
sirdal.no
skaun.no
skedsmo.no
ski.no
skien.no
skiptvet.no
skjervoy.no
skjervøy.no
skierva.no
skiervá.no
skjak.no
skjåk.no
skodje.no
skanland.no
skånland.no
skanit.no
skánit.no
smola.no
smøla.no
snillfjord.no
snasa.no
snåsa.no
snoasa.no
snaase.no
snåase.no
sogndal.no
sokndal.no
sola.no
solund.no
songdalen.no
sortland.no
spydeberg.no
stange.no
stavanger.no
steigen.no
steinkjer.no
stjordal.no
stjørdal.no
stokke.no
stor-elvdal.no
stord.no
stordal.no
storfjord.no
omasvuotna.no
strand.no
stranda.no
stryn.no
sula.no
suldal.no
sund.no
sunndal.no
surnadal.no
sveio.no
svelvik.no
sykkylven.no
sogne.no
søgne.no
somna.no
sømna.no
sondre-land.no
søndre-land.no
sor-aurdal.no
sør-aurdal.no
sor-fron.no
sør-fron.no
sor-odal.no
sør-odal.no
sor-varanger.no
sør-varanger.no
matta-varjjat.no
mátta-várjjat.no
sorfold.no
sørfold.no
sorreisa.no
sørreisa.no
sorum.no
sørum.no
tana.no
deatnu.no
time.no
tingvoll.no
tinn.no
tjeldsund.no
dielddanuorri.no
tjome.no
tjøme.no
tokke.no
tolga.no
torsken.no
tranoy.no
tranøy.no
tromso.no
tromsø.no
tromsa.no
romsa.no
trondheim.no
troandin.no
trysil.no
trana.no
træna.no
trogstad.no
trøgstad.no
tvedestrand.no
tydal.no
tynset.no
tysfjord.no
divtasvuodna.no
divttasvuotna.no
tysnes.no
tysvar.no
tysvær.no
tonsberg.no
tønsberg.no
ullensaker.no
ullensvang.no
ulvik.no
utsira.no
vadso.no
vadsø.no
cahcesuolo.no
čáhcesuolo.no
vaksdal.no
valle.no
vang.no
vanylven.no
vardo.no
vardø.no
varggat.no
várggát.no
vefsn.no
vaapste.no
vega.no
vegarshei.no
vegårshei.no
vennesla.no
verdal.no
verran.no
vestby.no
vestnes.no
vestre-slidre.no
vestre-toten.no
vestvagoy.no
vestvågøy.no
vevelstad.no
vik.no
vikna.no
vindafjord.no
volda.no
voss.no
varoy.no
værøy.no
vagan.no
vågan.no
voagat.no
vagsoy.no
vågsøy.no
vaga.no
vågå.no
valer.ostfold.no
våler.østfold.no
valer.hedmark.no
våler.hedmark.no
// np : http://www.mos.com.np/register.html
*.np
// nr : http://cenpac.net.nr/dns/index.html
// Submitted by registry
nr
biz.nr
info.nr
gov.nr
edu.nr
org.nr
net.nr
com.nr
// nu : https://en.wikipedia.org/wiki/.nu
nu
// nz : https://en.wikipedia.org/wiki/.nz
// Submitted by registry
nz
ac.nz
co.nz
cri.nz
geek.nz
gen.nz
govt.nz
health.nz
iwi.nz
kiwi.nz
maori.nz
mil.nz
māori.nz
net.nz
org.nz
parliament.nz
school.nz
// om : https://en.wikipedia.org/wiki/.om
om
co.om
com.om
edu.om
gov.om
med.om
museum.om
net.om
org.om
pro.om
// onion : https://tools.ietf.org/html/rfc7686
onion
// org : https://en.wikipedia.org/wiki/.org
org
// pa : http://www.nic.pa/
// Some additional second level "domains" resolve directly as hostnames, such as
// pannet.pa, so we add a rule for "pa".
pa
ac.pa
gob.pa
com.pa
org.pa
sld.pa
edu.pa
net.pa
ing.pa
abo.pa
med.pa
nom.pa
// pe : https://www.nic.pe/InformeFinalComision.pdf
pe
edu.pe
gob.pe
nom.pe
mil.pe
org.pe
com.pe
net.pe
// pf : http://www.gobin.info/domainname/formulaire-pf.pdf
pf
com.pf
org.pf
edu.pf
// pg : https://en.wikipedia.org/wiki/.pg
*.pg
// ph : http://www.domains.ph/FAQ2.asp
// Submitted by registry
ph
com.ph
net.ph
org.ph
gov.ph
edu.ph
ngo.ph
mil.ph
i.ph
// pk : http://pk5.pknic.net.pk/pk5/msgNamepk.PK
pk
com.pk
net.pk
edu.pk
org.pk
fam.pk
biz.pk
web.pk
gov.pk
gob.pk
gok.pk
gon.pk
gop.pk
gos.pk
info.pk
// pl http://www.dns.pl/english/index.html
// Submitted by registry
pl
com.pl
net.pl
org.pl
// pl functional domains (http://www.dns.pl/english/index.html)
aid.pl
agro.pl
atm.pl
auto.pl
biz.pl
edu.pl
gmina.pl
gsm.pl
info.pl
mail.pl
miasta.pl
media.pl
mil.pl
nieruchomosci.pl
nom.pl
pc.pl
powiat.pl
priv.pl
realestate.pl
rel.pl
sex.pl
shop.pl
sklep.pl
sos.pl
szkola.pl
targi.pl
tm.pl
tourism.pl
travel.pl
turystyka.pl
// Government domains
gov.pl
ap.gov.pl
ic.gov.pl
is.gov.pl
us.gov.pl
kmpsp.gov.pl
kppsp.gov.pl
kwpsp.gov.pl
psp.gov.pl
wskr.gov.pl
kwp.gov.pl
mw.gov.pl
ug.gov.pl
um.gov.pl
umig.gov.pl
ugim.gov.pl
upow.gov.pl
uw.gov.pl
starostwo.gov.pl
pa.gov.pl
po.gov.pl
psse.gov.pl
pup.gov.pl
rzgw.gov.pl
sa.gov.pl
so.gov.pl
sr.gov.pl
wsa.gov.pl
sko.gov.pl
uzs.gov.pl
wiih.gov.pl
winb.gov.pl
pinb.gov.pl
wios.gov.pl
witd.gov.pl
wzmiuw.gov.pl
piw.gov.pl
wiw.gov.pl
griw.gov.pl
wif.gov.pl
oum.gov.pl
sdn.gov.pl
zp.gov.pl
uppo.gov.pl
mup.gov.pl
wuoz.gov.pl
konsulat.gov.pl
oirm.gov.pl
// pl regional domains (http://www.dns.pl/english/index.html)
augustow.pl
babia-gora.pl
bedzin.pl
beskidy.pl
bialowieza.pl
bialystok.pl
bielawa.pl
bieszczady.pl
boleslawiec.pl
bydgoszcz.pl
bytom.pl
cieszyn.pl
czeladz.pl
czest.pl
dlugoleka.pl
elblag.pl
elk.pl
glogow.pl
gniezno.pl
gorlice.pl
grajewo.pl
ilawa.pl
jaworzno.pl
jelenia-gora.pl
jgora.pl
kalisz.pl
kazimierz-dolny.pl
karpacz.pl
kartuzy.pl
kaszuby.pl
katowice.pl
kepno.pl
ketrzyn.pl
klodzko.pl
kobierzyce.pl
kolobrzeg.pl
konin.pl
konskowola.pl
kutno.pl
lapy.pl
lebork.pl
legnica.pl
lezajsk.pl
limanowa.pl
lomza.pl
lowicz.pl
lubin.pl
lukow.pl
malbork.pl
malopolska.pl
mazowsze.pl
mazury.pl
mielec.pl
mielno.pl
mragowo.pl
naklo.pl
nowaruda.pl
nysa.pl
olawa.pl
olecko.pl
olkusz.pl
olsztyn.pl
opoczno.pl
opole.pl
ostroda.pl
ostroleka.pl
ostrowiec.pl
ostrowwlkp.pl
pila.pl
pisz.pl
podhale.pl
podlasie.pl
polkowice.pl
pomorze.pl
pomorskie.pl
prochowice.pl
pruszkow.pl
przeworsk.pl
pulawy.pl
radom.pl
rawa-maz.pl
rybnik.pl
rzeszow.pl
sanok.pl
sejny.pl
slask.pl
slupsk.pl
sosnowiec.pl
stalowa-wola.pl
skoczow.pl
starachowice.pl
stargard.pl
suwalki.pl
swidnica.pl
swiebodzin.pl
swinoujscie.pl
szczecin.pl
szczytno.pl
tarnobrzeg.pl
tgory.pl
turek.pl
tychy.pl
ustka.pl
walbrzych.pl
warmia.pl
warszawa.pl
waw.pl
wegrow.pl
wielun.pl
wlocl.pl
wloclawek.pl
wodzislaw.pl
wolomin.pl
wroclaw.pl
zachpomor.pl
zagan.pl
zarow.pl
zgora.pl
zgorzelec.pl
// pm : http://www.afnic.fr/medias/documents/AFNIC-naming-policy2012.pdf
pm
// pn : http://www.government.pn/PnRegistry/policies.htm
pn
gov.pn
co.pn
org.pn
edu.pn
net.pn
// post : https://en.wikipedia.org/wiki/.post
post
// pr : http://www.nic.pr/index.asp?f=1
pr
com.pr
net.pr
org.pr
gov.pr
edu.pr
isla.pr
pro.pr
biz.pr
info.pr
name.pr
// these aren't mentioned on nic.pr, but on https://en.wikipedia.org/wiki/.pr
est.pr
prof.pr
ac.pr
// pro : http://registry.pro/get-pro
pro
aaa.pro
aca.pro
acct.pro
avocat.pro
bar.pro
cpa.pro
eng.pro
jur.pro
law.pro
med.pro
recht.pro
// ps : https://en.wikipedia.org/wiki/.ps
// http://www.nic.ps/registration/policy.html#reg
ps
edu.ps
gov.ps
sec.ps
plo.ps
com.ps
org.ps
net.ps
// pt : http://online.dns.pt/dns/start_dns
pt
net.pt
gov.pt
org.pt
edu.pt
int.pt
publ.pt
com.pt
nome.pt
// pw : https://en.wikipedia.org/wiki/.pw
pw
co.pw
ne.pw
or.pw
ed.pw
go.pw
belau.pw
// py : http://www.nic.py/pautas.html#seccion_9
// Submitted by registry
py
com.py
coop.py
edu.py
gov.py
mil.py
net.py
org.py
// qa : http://domains.qa/en/
qa
com.qa
edu.qa
gov.qa
mil.qa
name.qa
net.qa
org.qa
sch.qa
// re : http://www.afnic.re/obtenir/chartes/nommage-re/annexe-descriptifs
re
asso.re
com.re
nom.re
// ro : http://www.rotld.ro/
ro
arts.ro
com.ro
firm.ro
info.ro
nom.ro
nt.ro
org.ro
rec.ro
store.ro
tm.ro
www.ro
// rs : https://www.rnids.rs/en/domains/national-domains
rs
ac.rs
co.rs
edu.rs
gov.rs
in.rs
org.rs
// ru : https://cctld.ru/en/domains/domens_ru/reserved/
ru
ac.ru
edu.ru
gov.ru
int.ru
mil.ru
test.ru
// rw : https://www.ricta.org.rw/sites/default/files/resources/registry_registrar_contract_0.pdf
rw
ac.rw
co.rw
coop.rw
gov.rw
mil.rw
net.rw
org.rw
// sa : http://www.nic.net.sa/
sa
com.sa
net.sa
org.sa
gov.sa
med.sa
pub.sa
edu.sa
sch.sa
// sb : http://www.sbnic.net.sb/
// Submitted by registry
sb
com.sb
edu.sb
gov.sb
net.sb
org.sb
// sc : http://www.nic.sc/
sc
com.sc
gov.sc
net.sc
org.sc
edu.sc
// sd : http://www.isoc.sd/sudanic.isoc.sd/billing_pricing.htm
// Submitted by registry
sd
com.sd
net.sd
org.sd
edu.sd
med.sd
tv.sd
gov.sd
info.sd
// se : https://en.wikipedia.org/wiki/.se
// Submitted by registry
se
a.se
ac.se
b.se
bd.se
brand.se
c.se
d.se
e.se
f.se
fh.se
fhsk.se
fhv.se
g.se
h.se
i.se
k.se
komforb.se
kommunalforbund.se
komvux.se
l.se
lanbib.se
m.se
n.se
naturbruksgymn.se
o.se
org.se
p.se
parti.se
pp.se
press.se
r.se
s.se
t.se
tm.se
u.se
w.se
x.se
y.se
z.se
// sg : http://www.nic.net.sg/page/registration-policies-procedures-and-guidelines
sg
com.sg
net.sg
org.sg
gov.sg
edu.sg
per.sg
// sh : http://www.nic.sh/registrar.html
sh
com.sh
net.sh
gov.sh
org.sh
mil.sh
// si : https://en.wikipedia.org/wiki/.si
si
// sj : No registrations at this time.
// Submitted by registry
sj
// sk : https://en.wikipedia.org/wiki/.sk
// list of 2nd level domains ?
sk
// sl : http://www.nic.sl
// Submitted by registry
sl
com.sl
net.sl
edu.sl
gov.sl
org.sl
// sm : https://en.wikipedia.org/wiki/.sm
sm
// sn : https://en.wikipedia.org/wiki/.sn
sn
art.sn
com.sn
edu.sn
gouv.sn
org.sn
perso.sn
univ.sn
// so : http://sonic.so/policies/
so
com.so
edu.so
gov.so
me.so
net.so
org.so
// sr : https://en.wikipedia.org/wiki/.sr
sr
// ss : https://registry.nic.ss/
// Submitted by registry
ss
biz.ss
com.ss
edu.ss
gov.ss
net.ss
org.ss
// st : http://www.nic.st/html/policyrules/
st
co.st
com.st
consulado.st
edu.st
embaixada.st
gov.st
mil.st
net.st
org.st
principe.st
saotome.st
store.st
// su : https://en.wikipedia.org/wiki/.su
su
// sv : http://www.svnet.org.sv/niveldos.pdf
sv
com.sv
edu.sv
gob.sv
org.sv
red.sv
// sx : https://en.wikipedia.org/wiki/.sx
// Submitted by registry
sx
gov.sx
// sy : https://en.wikipedia.org/wiki/.sy
// see also: http://www.gobin.info/domainname/sy.doc
sy
edu.sy
gov.sy
net.sy
mil.sy
com.sy
org.sy
// sz : https://en.wikipedia.org/wiki/.sz
// http://www.sispa.org.sz/
sz
co.sz
ac.sz
org.sz
// tc : https://en.wikipedia.org/wiki/.tc
tc
// td : https://en.wikipedia.org/wiki/.td
td
// tel: https://en.wikipedia.org/wiki/.tel
// http://www.telnic.org/
tel
// tf : https://en.wikipedia.org/wiki/.tf
tf
// tg : https://en.wikipedia.org/wiki/.tg
// http://www.nic.tg/
tg
// th : https://en.wikipedia.org/wiki/.th
// Submitted by registry
th
ac.th
co.th
go.th
in.th
mi.th
net.th
or.th
// tj : http://www.nic.tj/policy.html
tj
ac.tj
biz.tj
co.tj
com.tj
edu.tj
go.tj
gov.tj
int.tj
mil.tj
name.tj
net.tj
nic.tj
org.tj
test.tj
web.tj
// tk : https://en.wikipedia.org/wiki/.tk
tk
// tl : https://en.wikipedia.org/wiki/.tl
tl
gov.tl
// tm : http://www.nic.tm/local.html
tm
com.tm
co.tm
org.tm
net.tm
nom.tm
gov.tm
mil.tm
edu.tm
// tn : https://en.wikipedia.org/wiki/.tn
// http://whois.ati.tn/
tn
com.tn
ens.tn
fin.tn
gov.tn
ind.tn
intl.tn
nat.tn
net.tn
org.tn
info.tn
perso.tn
tourism.tn
edunet.tn
rnrt.tn
rns.tn
rnu.tn
mincom.tn
agrinet.tn
defense.tn
turen.tn
// to : https://en.wikipedia.org/wiki/.to
// Submitted by registry
to
com.to
gov.to
net.to
org.to
edu.to
mil.to
// tr : https://nic.tr/
// https://nic.tr/forms/eng/policies.pdf
// https://nic.tr/index.php?USRACTN=PRICELST
tr
av.tr
bbs.tr
bel.tr
biz.tr
com.tr
dr.tr
edu.tr
gen.tr
gov.tr
info.tr
mil.tr
k12.tr
kep.tr
name.tr
net.tr
org.tr
pol.tr
tel.tr
tsk.tr
tv.tr
web.tr
// Used by Northern Cyprus
nc.tr
// Used by government agencies of Northern Cyprus
gov.nc.tr
// tt : http://www.nic.tt/
tt
co.tt
com.tt
org.tt
net.tt
biz.tt
info.tt
pro.tt
int.tt
coop.tt
jobs.tt
mobi.tt
travel.tt
museum.tt
aero.tt
name.tt
gov.tt
edu.tt
// tv : https://en.wikipedia.org/wiki/.tv
// Not listing any 2LDs as reserved since none seem to exist in practice,
// Wikipedia notwithstanding.
tv
// tw : https://en.wikipedia.org/wiki/.tw
tw
edu.tw
gov.tw
mil.tw
com.tw
net.tw
org.tw
idv.tw
game.tw
ebiz.tw
club.tw
網路.tw
組織.tw
商業.tw
// tz : http://www.tznic.or.tz/index.php/domains
// Submitted by registry
tz
ac.tz
co.tz
go.tz
hotel.tz
info.tz
me.tz
mil.tz
mobi.tz
ne.tz
or.tz
sc.tz
tv.tz
// ua : https://hostmaster.ua/policy/?ua
// Submitted by registry
ua
// ua 2LD
com.ua
edu.ua
gov.ua
in.ua
net.ua
org.ua
// ua geographic names
// https://hostmaster.ua/2ld/
cherkassy.ua
cherkasy.ua
chernigov.ua
chernihiv.ua
chernivtsi.ua
chernovtsy.ua
ck.ua
cn.ua
cr.ua
crimea.ua
cv.ua
dn.ua
dnepropetrovsk.ua
dnipropetrovsk.ua
dominic.ua
donetsk.ua
dp.ua
if.ua
ivano-frankivsk.ua
kh.ua
kharkiv.ua
kharkov.ua
kherson.ua
khmelnitskiy.ua
khmelnytskyi.ua
kiev.ua
kirovograd.ua
km.ua
kr.ua
krym.ua
ks.ua
kv.ua
kyiv.ua
lg.ua
lt.ua
lugansk.ua
lutsk.ua
lv.ua
lviv.ua
mk.ua
mykolaiv.ua
nikolaev.ua
od.ua
odesa.ua
odessa.ua
pl.ua
poltava.ua
rivne.ua
rovno.ua
rv.ua
sb.ua
sebastopol.ua
sevastopol.ua
sm.ua
sumy.ua
te.ua
ternopil.ua
uz.ua
uzhgorod.ua
vinnica.ua
vinnytsia.ua
vn.ua
volyn.ua
yalta.ua
zaporizhzhe.ua
zaporizhzhia.ua
zhitomir.ua
zhytomyr.ua
zp.ua
zt.ua
// ug : https://www.registry.co.ug/
ug
co.ug
or.ug
ac.ug
sc.ug
go.ug
ne.ug
com.ug
org.ug
// uk : https://en.wikipedia.org/wiki/.uk
// Submitted by registry
uk
ac.uk
co.uk
gov.uk
ltd.uk
me.uk
net.uk
nhs.uk
org.uk
plc.uk
police.uk
*.sch.uk
// us : https://en.wikipedia.org/wiki/.us
us
dni.us
fed.us
isa.us
kids.us
nsn.us
// us geographic names
ak.us
al.us
ar.us
as.us
az.us
ca.us
co.us
ct.us
dc.us
de.us
fl.us
ga.us
gu.us
hi.us
ia.us
id.us
il.us
in.us
ks.us
ky.us
la.us
ma.us
md.us
me.us
mi.us
mn.us
mo.us
ms.us
mt.us
nc.us
nd.us
ne.us
nh.us
nj.us
nm.us
nv.us
ny.us
oh.us
ok.us
or.us
pa.us
pr.us
ri.us
sc.us
sd.us
tn.us
tx.us
ut.us
vi.us
vt.us
va.us
wa.us
wi.us
wv.us
wy.us
// The registrar notes several more specific domains available in each state,
// such as state.*.us, dst.*.us, etc., but resolution of these is somewhat
// haphazard; in some states these domains resolve as addresses, while in others
// only subdomains are available, or even nothing at all. We include the
// most common ones where it's clear that different sites are different
// entities.
k12.ak.us
k12.al.us
k12.ar.us
k12.as.us
k12.az.us
k12.ca.us
k12.co.us
k12.ct.us
k12.dc.us
k12.de.us
k12.fl.us
k12.ga.us
k12.gu.us
// k12.hi.us Bug 614565 - Hawaii has a state-wide DOE login
k12.ia.us
k12.id.us
k12.il.us
k12.in.us
k12.ks.us
k12.ky.us
k12.la.us
k12.ma.us
k12.md.us
k12.me.us
k12.mi.us
k12.mn.us
k12.mo.us
k12.ms.us
k12.mt.us
k12.nc.us
// k12.nd.us Bug 1028347 - Removed at request of Travis Rosso
k12.ne.us
k12.nh.us
k12.nj.us
k12.nm.us
k12.nv.us
k12.ny.us
k12.oh.us
k12.ok.us
k12.or.us
k12.pa.us
k12.pr.us
k12.ri.us
k12.sc.us
// k12.sd.us Bug 934131 - Removed at request of James Booze
k12.tn.us
k12.tx.us
k12.ut.us
k12.vi.us
k12.vt.us
k12.va.us
k12.wa.us
k12.wi.us
// k12.wv.us Bug 947705 - Removed at request of Verne Britton
k12.wy.us
cc.ak.us
cc.al.us
cc.ar.us
cc.as.us
cc.az.us
cc.ca.us
cc.co.us
cc.ct.us
cc.dc.us
cc.de.us
cc.fl.us
cc.ga.us
cc.gu.us
cc.hi.us
cc.ia.us
cc.id.us
cc.il.us
cc.in.us
cc.ks.us
cc.ky.us
cc.la.us
cc.ma.us
cc.md.us
cc.me.us
cc.mi.us
cc.mn.us
cc.mo.us
cc.ms.us
cc.mt.us
cc.nc.us
cc.nd.us
cc.ne.us
cc.nh.us
cc.nj.us
cc.nm.us
cc.nv.us
cc.ny.us
cc.oh.us
cc.ok.us
cc.or.us
cc.pa.us
cc.pr.us
cc.ri.us
cc.sc.us
cc.sd.us
cc.tn.us
cc.tx.us
cc.ut.us
cc.vi.us
cc.vt.us
cc.va.us
cc.wa.us
cc.wi.us
cc.wv.us
cc.wy.us
lib.ak.us
lib.al.us
lib.ar.us
lib.as.us
lib.az.us
lib.ca.us
lib.co.us
lib.ct.us
lib.dc.us
// lib.de.us Issue #243 - Moved to Private section at request of Ed Moore
lib.fl.us
lib.ga.us
lib.gu.us
lib.hi.us
lib.ia.us
lib.id.us
lib.il.us
lib.in.us
lib.ks.us
lib.ky.us
lib.la.us
lib.ma.us
lib.md.us
lib.me.us
lib.mi.us
lib.mn.us
lib.mo.us
lib.ms.us
lib.mt.us
lib.nc.us
lib.nd.us
lib.ne.us
lib.nh.us
lib.nj.us
lib.nm.us
lib.nv.us
lib.ny.us
lib.oh.us
lib.ok.us
lib.or.us
lib.pa.us
lib.pr.us
lib.ri.us
lib.sc.us
lib.sd.us
lib.tn.us
lib.tx.us
lib.ut.us
lib.vi.us
lib.vt.us
lib.va.us
lib.wa.us
lib.wi.us
// lib.wv.us Bug 941670 - Removed at request of Larry W Arnold
lib.wy.us
// k12.ma.us contains school districts in Massachusetts. The 4LDs are
// managed independently except for private (PVT), charter (CHTR) and
// parochial (PAROCH) schools. Those are delegated directly to the
// 5LD operators.
pvt.k12.ma.us
chtr.k12.ma.us
paroch.k12.ma.us
// Merit Network, Inc. maintains the registry for =~ /(k12|cc|lib).mi.us/ and the following
// see also: http://domreg.merit.edu
// see also: whois -h whois.domreg.merit.edu help
ann-arbor.mi.us
cog.mi.us
dst.mi.us
eaton.mi.us
gen.mi.us
mus.mi.us
tec.mi.us
washtenaw.mi.us
// uy : http://www.nic.org.uy/
uy
com.uy
edu.uy
gub.uy
mil.uy
net.uy
org.uy
// uz : http://www.reg.uz/
uz
co.uz
com.uz
net.uz
org.uz
// va : https://en.wikipedia.org/wiki/.va
va
// vc : https://en.wikipedia.org/wiki/.vc
// Submitted by registry
vc
com.vc
net.vc
org.vc
gov.vc
mil.vc
edu.vc
// ve : https://registro.nic.ve/
// Submitted by registry
ve
arts.ve
co.ve
com.ve
e12.ve
edu.ve
firm.ve
gob.ve
gov.ve
info.ve
int.ve
mil.ve
net.ve
org.ve
rec.ve
store.ve
tec.ve
web.ve
// vg : https://en.wikipedia.org/wiki/.vg
vg
// vi : http://www.nic.vi/newdomainform.htm
// http://www.nic.vi/Domain_Rules/body_domain_rules.html indicates some other
// TLDs are "reserved", such as edu.vi and gov.vi, but doesn't actually say they
// are available for registration (which they do not seem to be).
vi
co.vi
com.vi
k12.vi
net.vi
org.vi
// vn : https://www.dot.vn/vnnic/vnnic/domainregistration.jsp
vn
com.vn
net.vn
org.vn
edu.vn
gov.vn
int.vn
ac.vn
biz.vn
info.vn
name.vn
pro.vn
health.vn
// vu : https://en.wikipedia.org/wiki/.vu
// http://www.vunic.vu/
vu
com.vu
edu.vu
net.vu
org.vu
// wf : http://www.afnic.fr/medias/documents/AFNIC-naming-policy2012.pdf
wf
// ws : https://en.wikipedia.org/wiki/.ws
// http://samoanic.ws/index.dhtml
ws
com.ws
net.ws
org.ws
gov.ws
edu.ws
// yt : http://www.afnic.fr/medias/documents/AFNIC-naming-policy2012.pdf
yt
// IDN ccTLDs
// When submitting patches, please maintain a sort by ISO 3166 ccTLD, then
// U-label, and follow this format:
// // A-Label ("", [, variant info]) :
// // [sponsoring org]
// U-Label
// xn--mgbaam7a8h ("Emerat", Arabic) : AE
// http://nic.ae/english/arabicdomain/rules.jsp
امارات
// xn--y9a3aq ("hye", Armenian) : AM
// ISOC AM (operated by .am Registry)
հայ
// xn--54b7fta0cc ("Bangla", Bangla) : BD
বাংলা
// xn--90ae ("bg", Bulgarian) : BG
бг
// xn--90ais ("bel", Belarusian/Russian Cyrillic) : BY
// Operated by .by registry
бел
// xn--fiqs8s ("Zhongguo/China", Chinese, Simplified) : CN
// CNNIC
// http://cnnic.cn/html/Dir/2005/10/11/3218.htm
中国
// xn--fiqz9s ("Zhongguo/China", Chinese, Traditional) : CN
// CNNIC
// http://cnnic.cn/html/Dir/2005/10/11/3218.htm
中國
// xn--lgbbat1ad8j ("Algeria/Al Jazair", Arabic) : DZ
الجزائر
// xn--wgbh1c ("Egypt/Masr", Arabic) : EG
// http://www.dotmasr.eg/
مصر
// xn--e1a4c ("eu", Cyrillic) : EU
ею
// xn--mgbah1a3hjkrd ("Mauritania", Arabic) : MR
موريتانيا
// xn--node ("ge", Georgian Mkhedruli) : GE
გე
// xn--qxam ("el", Greek) : GR
// Hellenic Ministry of Infrastructure, Transport, and Networks
ελ
// xn--j6w193g ("Hong Kong", Chinese) : HK
// https://www.hkirc.hk
// Submitted by registry
// https://www.hkirc.hk/content.jsp?id=30#!/34
香港
公司.香港
教育.香港
政府.香港
個人.香港
網絡.香港
組織.香港
// xn--2scrj9c ("Bharat", Kannada) : IN
// India
ಭಾರತ
// xn--3hcrj9c ("Bharat", Oriya) : IN
// India
ଭାରତ
// xn--45br5cyl ("Bharatam", Assamese) : IN
// India
ভাৰত
// xn--h2breg3eve ("Bharatam", Sanskrit) : IN
// India
भारतम्
// xn--h2brj9c8c ("Bharot", Santali) : IN
// India
भारोत
// xn--mgbgu82a ("Bharat", Sindhi) : IN
// India
ڀارت
// xn--rvc1e0am3e ("Bharatam", Malayalam) : IN
// India
ഭാരതം
// xn--h2brj9c ("Bharat", Devanagari) : IN
// India
भारत
// xn--mgbbh1a ("Bharat", Kashmiri) : IN
// India
بارت
// xn--mgbbh1a71e ("Bharat", Arabic) : IN
// India
بھارت
// xn--fpcrj9c3d ("Bharat", Telugu) : IN
// India
భారత్
// xn--gecrj9c ("Bharat", Gujarati) : IN
// India
ભારત
// xn--s9brj9c ("Bharat", Gurmukhi) : IN
// India
ਭਾਰਤ
// xn--45brj9c ("Bharat", Bengali) : IN
// India
ভারত
// xn--xkc2dl3a5ee0h ("India", Tamil) : IN
// India
இந்தியா
// xn--mgba3a4f16a ("Iran", Persian) : IR
ایران
// xn--mgba3a4fra ("Iran", Arabic) : IR
ايران
// xn--mgbtx2b ("Iraq", Arabic) : IQ
// Communications and Media Commission
عراق
// xn--mgbayh7gpa ("al-Ordon", Arabic) : JO
// National Information Technology Center (NITC)
// Royal Scientific Society, Al-Jubeiha
الاردن
// xn--3e0b707e ("Republic of Korea", Hangul) : KR
한국
// xn--80ao21a ("Kaz", Kazakh) : KZ
қаз
// xn--fzc2c9e2c ("Lanka", Sinhalese-Sinhala) : LK
// http://nic.lk
ලංකා
// xn--xkc2al3hye2a ("Ilangai", Tamil) : LK
// http://nic.lk
இலங்கை
// xn--mgbc0a9azcg ("Morocco/al-Maghrib", Arabic) : MA
المغرب
// xn--d1alf ("mkd", Macedonian) : MK
// MARnet
мкд
// xn--l1acc ("mon", Mongolian) : MN
мон
// xn--mix891f ("Macao", Chinese, Traditional) : MO
// MONIC / HNET Asia (Registry Operator for .mo)
澳門
// xn--mix082f ("Macao", Chinese, Simplified) : MO
澳门
// xn--mgbx4cd0ab ("Malaysia", Malay) : MY
مليسيا
// xn--mgb9awbf ("Oman", Arabic) : OM
عمان
// xn--mgbai9azgqp6j ("Pakistan", Urdu/Arabic) : PK
پاکستان
// xn--mgbai9a5eva00b ("Pakistan", Urdu/Arabic, variant) : PK
پاكستان
// xn--ygbi2ammx ("Falasteen", Arabic) : PS
// The Palestinian National Internet Naming Authority (PNINA)
// http://www.pnina.ps
فلسطين
// xn--90a3ac ("srb", Cyrillic) : RS
// https://www.rnids.rs/en/domains/national-domains
срб
пр.срб
орг.срб
обр.срб
од.срб
упр.срб
ак.срб
// xn--p1ai ("rf", Russian-Cyrillic) : RU
// http://www.cctld.ru/en/docs/rulesrf.php
рф
// xn--wgbl6a ("Qatar", Arabic) : QA
// http://www.ict.gov.qa/
قطر
// xn--mgberp4a5d4ar ("AlSaudiah", Arabic) : SA
// http://www.nic.net.sa/
السعودية
// xn--mgberp4a5d4a87g ("AlSaudiah", Arabic, variant) : SA
السعودیة
// xn--mgbqly7c0a67fbc ("AlSaudiah", Arabic, variant) : SA
السعودیۃ
// xn--mgbqly7cvafr ("AlSaudiah", Arabic, variant) : SA
السعوديه
// xn--mgbpl2fh ("sudan", Arabic) : SD
// Operated by .sd registry
سودان
// xn--yfro4i67o Singapore ("Singapore", Chinese) : SG
新加坡
// xn--clchc0ea0b2g2a9gcd ("Singapore", Tamil) : SG
சிங்கப்பூர்
// xn--ogbpf8fl ("Syria", Arabic) : SY
سورية
// xn--mgbtf8fl ("Syria", Arabic, variant) : SY
سوريا
// xn--o3cw4h ("Thai", Thai) : TH
// http://www.thnic.co.th
ไทย
ศึกษา.ไทย
ธุรกิจ.ไทย
รัฐบาล.ไทย
ทหาร.ไทย
เน็ต.ไทย
องค์กร.ไทย
// xn--pgbs0dh ("Tunisia", Arabic) : TN
// http://nic.tn
تونس
// xn--kpry57d ("Taiwan", Chinese, Traditional) : TW
// http://www.twnic.net/english/dn/dn_07a.htm
台灣
// xn--kprw13d ("Taiwan", Chinese, Simplified) : TW
// http://www.twnic.net/english/dn/dn_07a.htm
台湾
// xn--nnx388a ("Taiwan", Chinese, variant) : TW
臺灣
// xn--j1amh ("ukr", Cyrillic) : UA
укр
// xn--mgb2ddes ("AlYemen", Arabic) : YE
اليمن
// xxx : http://icmregistry.com
xxx
// ye : http://www.y.net.ye/services/domain_name.htm
*.ye
// za : https://www.zadna.org.za/content/page/domain-information/
ac.za
agric.za
alt.za
co.za
edu.za
gov.za
grondar.za
law.za
mil.za
net.za
ngo.za
nic.za
nis.za
nom.za
org.za
school.za
tm.za
web.za
// zm : https://zicta.zm/
// Submitted by registry
zm
ac.zm
biz.zm
co.zm
com.zm
edu.zm
gov.zm
info.zm
mil.zm
net.zm
org.zm
sch.zm
// zw : https://www.potraz.gov.zw/
// Confirmed by registry 2017-01-25
zw
ac.zw
co.zw
gov.zw
mil.zw
org.zw
// newGTLDs
// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2019-11-20T17:10:44Z
// This list is auto-generated, don't edit it manually.
// aaa : 2015-02-26 American Automobile Association, Inc.
aaa
// aarp : 2015-05-21 AARP
aarp
// abarth : 2015-07-30 Fiat Chrysler Automobiles N.V.
abarth
// abb : 2014-10-24 ABB Ltd
abb
// abbott : 2014-07-24 Abbott Laboratories, Inc.
abbott
// abbvie : 2015-07-30 AbbVie Inc.
abbvie
// abc : 2015-07-30 Disney Enterprises, Inc.
abc
// able : 2015-06-25 Able Inc.
able
// abogado : 2014-04-24 Minds + Machines Group Limited
abogado
// abudhabi : 2015-07-30 Abu Dhabi Systems and Information Centre
abudhabi
// academy : 2013-11-07 Binky Moon, LLC
academy
// accenture : 2014-08-15 Accenture plc
accenture
// accountant : 2014-11-20 dot Accountant Limited
accountant
// accountants : 2014-03-20 Binky Moon, LLC
accountants
// aco : 2015-01-08 ACO Severin Ahlmann GmbH & Co. KG
aco
// actor : 2013-12-12 Dog Beach, LLC
actor
// adac : 2015-07-16 Allgemeiner Deutscher Automobil-Club e.V. (ADAC)
adac
// ads : 2014-12-04 Charleston Road Registry Inc.
ads
// adult : 2014-10-16 ICM Registry AD LLC
adult
// aeg : 2015-03-19 Aktiebolaget Electrolux
aeg
// aetna : 2015-05-21 Aetna Life Insurance Company
aetna
// afamilycompany : 2015-07-23 Johnson Shareholdings, Inc.
afamilycompany
// afl : 2014-10-02 Australian Football League
afl
// africa : 2014-03-24 ZA Central Registry NPC trading as Registry.Africa
africa
// agakhan : 2015-04-23 Fondation Aga Khan (Aga Khan Foundation)
agakhan
// agency : 2013-11-14 Binky Moon, LLC
agency
// aig : 2014-12-18 American International Group, Inc.
aig
// aigo : 2015-08-06 aigo Digital Technology Co,Ltd.
aigo
// airbus : 2015-07-30 Airbus S.A.S.
airbus
// airforce : 2014-03-06 Dog Beach, LLC
airforce
// airtel : 2014-10-24 Bharti Airtel Limited
airtel
// akdn : 2015-04-23 Fondation Aga Khan (Aga Khan Foundation)
akdn
// alfaromeo : 2015-07-31 Fiat Chrysler Automobiles N.V.
alfaromeo
// alibaba : 2015-01-15 Alibaba Group Holding Limited
alibaba
// alipay : 2015-01-15 Alibaba Group Holding Limited
alipay
// allfinanz : 2014-07-03 Allfinanz Deutsche Vermögensberatung Aktiengesellschaft
allfinanz
// allstate : 2015-07-31 Allstate Fire and Casualty Insurance Company
allstate
// ally : 2015-06-18 Ally Financial Inc.
ally
// alsace : 2014-07-02 Region Grand Est
alsace
// alstom : 2015-07-30 ALSTOM
alstom
// americanexpress : 2015-07-31 American Express Travel Related Services Company, Inc.
americanexpress
// americanfamily : 2015-07-23 AmFam, Inc.
americanfamily
// amex : 2015-07-31 American Express Travel Related Services Company, Inc.
amex
// amfam : 2015-07-23 AmFam, Inc.
amfam
// amica : 2015-05-28 Amica Mutual Insurance Company
amica
// amsterdam : 2014-07-24 Gemeente Amsterdam
amsterdam
// analytics : 2014-12-18 Campus IP LLC
analytics
// android : 2014-08-07 Charleston Road Registry Inc.
android
// anquan : 2015-01-08 QIHOO 360 TECHNOLOGY CO. LTD.
anquan
// anz : 2015-07-31 Australia and New Zealand Banking Group Limited
anz
// aol : 2015-09-17 Oath Inc.
aol
// apartments : 2014-12-11 Binky Moon, LLC
apartments
// app : 2015-05-14 Charleston Road Registry Inc.
app
// apple : 2015-05-14 Apple Inc.
apple
// aquarelle : 2014-07-24 Aquarelle.com
aquarelle
// arab : 2015-11-12 League of Arab States
arab
// aramco : 2014-11-20 Aramco Services Company
aramco
// archi : 2014-02-06 Afilias Limited
archi
// army : 2014-03-06 Dog Beach, LLC
army
// art : 2016-03-24 UK Creative Ideas Limited
art
// arte : 2014-12-11 Association Relative à la Télévision Européenne G.E.I.E.
arte
// asda : 2015-07-31 Wal-Mart Stores, Inc.
asda
// associates : 2014-03-06 Binky Moon, LLC
associates
// athleta : 2015-07-30 The Gap, Inc.
athleta
// attorney : 2014-03-20 Dog Beach, LLC
attorney
// auction : 2014-03-20 Dog Beach, LLC
auction
// audi : 2015-05-21 AUDI Aktiengesellschaft
audi
// audible : 2015-06-25 Amazon Registry Services, Inc.
audible
// audio : 2014-03-20 Uniregistry, Corp.
audio
// auspost : 2015-08-13 Australian Postal Corporation
auspost
// author : 2014-12-18 Amazon Registry Services, Inc.
author
// auto : 2014-11-13 Cars Registry Limited
auto
// autos : 2014-01-09 DERAutos, LLC
autos
// avianca : 2015-01-08 Aerovias del Continente Americano S.A. Avianca
avianca
// aws : 2015-06-25 Amazon Registry Services, Inc.
aws
// axa : 2013-12-19 AXA SA
axa
// azure : 2014-12-18 Microsoft Corporation
azure
// baby : 2015-04-09 XYZ.COM LLC
baby
// baidu : 2015-01-08 Baidu, Inc.
baidu
// banamex : 2015-07-30 Citigroup Inc.
banamex
// bananarepublic : 2015-07-31 The Gap, Inc.
bananarepublic
// band : 2014-06-12 Dog Beach, LLC
band
// bank : 2014-09-25 fTLD Registry Services LLC
bank
// bar : 2013-12-12 Punto 2012 Sociedad Anonima Promotora de Inversion de Capital Variable
bar
// barcelona : 2014-07-24 Municipi de Barcelona
barcelona
// barclaycard : 2014-11-20 Barclays Bank PLC
barclaycard
// barclays : 2014-11-20 Barclays Bank PLC
barclays
// barefoot : 2015-06-11 Gallo Vineyards, Inc.
barefoot
// bargains : 2013-11-14 Binky Moon, LLC
bargains
// baseball : 2015-10-29 MLB Advanced Media DH, LLC
baseball
// basketball : 2015-08-20 Fédération Internationale de Basketball (FIBA)
basketball
// bauhaus : 2014-04-17 Werkhaus GmbH
bauhaus
// bayern : 2014-01-23 Bayern Connect GmbH
bayern
// bbc : 2014-12-18 British Broadcasting Corporation
bbc
// bbt : 2015-07-23 BB&T Corporation
bbt
// bbva : 2014-10-02 BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
bbva
// bcg : 2015-04-02 The Boston Consulting Group, Inc.
bcg
// bcn : 2014-07-24 Municipi de Barcelona
bcn
// beats : 2015-05-14 Beats Electronics, LLC
beats
// beauty : 2015-12-03 L'Oréal
beauty
// beer : 2014-01-09 Minds + Machines Group Limited
beer
// bentley : 2014-12-18 Bentley Motors Limited
bentley
// berlin : 2013-10-31 dotBERLIN GmbH & Co. KG
berlin
// best : 2013-12-19 BestTLD Pty Ltd
best
// bestbuy : 2015-07-31 BBY Solutions, Inc.
bestbuy
// bet : 2015-05-07 Afilias Limited
bet
// bharti : 2014-01-09 Bharti Enterprises (Holding) Private Limited
bharti
// bible : 2014-06-19 American Bible Society
bible
// bid : 2013-12-19 dot Bid Limited
bid
// bike : 2013-08-27 Binky Moon, LLC
bike
// bing : 2014-12-18 Microsoft Corporation
bing
// bingo : 2014-12-04 Binky Moon, LLC
bingo
// bio : 2014-03-06 Afilias Limited
bio
// black : 2014-01-16 Afilias Limited
black
// blackfriday : 2014-01-16 Uniregistry, Corp.
blackfriday
// blockbuster : 2015-07-30 Dish DBS Corporation
blockbuster
// blog : 2015-05-14 Knock Knock WHOIS There, LLC
blog
// bloomberg : 2014-07-17 Bloomberg IP Holdings LLC
bloomberg
// blue : 2013-11-07 Afilias Limited
blue
// bms : 2014-10-30 Bristol-Myers Squibb Company
bms
// bmw : 2014-01-09 Bayerische Motoren Werke Aktiengesellschaft
bmw
// bnpparibas : 2014-05-29 BNP Paribas
bnpparibas
// boats : 2014-12-04 DERBoats, LLC
boats
// boehringer : 2015-07-09 Boehringer Ingelheim International GmbH
boehringer
// bofa : 2015-07-31 Bank of America Corporation
bofa
// bom : 2014-10-16 Núcleo de Informação e Coordenação do Ponto BR - NIC.br
bom
// bond : 2014-06-05 ShortDot SA
bond
// boo : 2014-01-30 Charleston Road Registry Inc.
boo
// book : 2015-08-27 Amazon Registry Services, Inc.
book
// booking : 2015-07-16 Booking.com B.V.
booking
// bosch : 2015-06-18 Robert Bosch GMBH
bosch
// bostik : 2015-05-28 Bostik SA
bostik
// boston : 2015-12-10 Boston TLD Management, LLC
boston
// bot : 2014-12-18 Amazon Registry Services, Inc.
bot
// boutique : 2013-11-14 Binky Moon, LLC
boutique
// box : 2015-11-12 .BOX INC.
box
// bradesco : 2014-12-18 Banco Bradesco S.A.
bradesco
// bridgestone : 2014-12-18 Bridgestone Corporation
bridgestone
// broadway : 2014-12-22 Celebrate Broadway, Inc.
broadway
// broker : 2014-12-11 Dotbroker Registry Limited
broker
// brother : 2015-01-29 Brother Industries, Ltd.
brother
// brussels : 2014-02-06 DNS.be vzw
brussels
// budapest : 2013-11-21 Minds + Machines Group Limited
budapest
// bugatti : 2015-07-23 Bugatti International SA
bugatti
// build : 2013-11-07 Plan Bee LLC
build
// builders : 2013-11-07 Binky Moon, LLC
builders
// business : 2013-11-07 Binky Moon, LLC
business
// buy : 2014-12-18 Amazon Registry Services, Inc.
buy
// buzz : 2013-10-02 DOTSTRATEGY CO.
buzz
// bzh : 2014-02-27 Association www.bzh
bzh
// cab : 2013-10-24 Binky Moon, LLC
cab
// cafe : 2015-02-11 Binky Moon, LLC
cafe
// cal : 2014-07-24 Charleston Road Registry Inc.
cal
// call : 2014-12-18 Amazon Registry Services, Inc.
call
// calvinklein : 2015-07-30 PVH gTLD Holdings LLC
calvinklein
// cam : 2016-04-21 AC Webconnecting Holding B.V.
cam
// camera : 2013-08-27 Binky Moon, LLC
camera
// camp : 2013-11-07 Binky Moon, LLC
camp
// cancerresearch : 2014-05-15 Australian Cancer Research Foundation
cancerresearch
// canon : 2014-09-12 Canon Inc.
canon
// capetown : 2014-03-24 ZA Central Registry NPC trading as ZA Central Registry
capetown
// capital : 2014-03-06 Binky Moon, LLC
capital
// capitalone : 2015-08-06 Capital One Financial Corporation
capitalone
// car : 2015-01-22 Cars Registry Limited
car
// caravan : 2013-12-12 Caravan International, Inc.
caravan
// cards : 2013-12-05 Binky Moon, LLC
cards
// care : 2014-03-06 Binky Moon, LLC
care
// career : 2013-10-09 dotCareer LLC
career
// careers : 2013-10-02 Binky Moon, LLC
careers
// cars : 2014-11-13 Cars Registry Limited
cars
// casa : 2013-11-21 Minds + Machines Group Limited
casa
// case : 2015-09-03 CNH Industrial N.V.
case
// caseih : 2015-09-03 CNH Industrial N.V.
caseih
// cash : 2014-03-06 Binky Moon, LLC
cash
// casino : 2014-12-18 Binky Moon, LLC
casino
// catering : 2013-12-05 Binky Moon, LLC
catering
// catholic : 2015-10-21 Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
catholic
// cba : 2014-06-26 COMMONWEALTH BANK OF AUSTRALIA
cba
// cbn : 2014-08-22 The Christian Broadcasting Network, Inc.
cbn
// cbre : 2015-07-02 CBRE, Inc.
cbre
// cbs : 2015-08-06 CBS Domains Inc.
cbs
// ceb : 2015-04-09 The Corporate Executive Board Company
ceb
// center : 2013-11-07 Binky Moon, LLC
center
// ceo : 2013-11-07 CEOTLD Pty Ltd
ceo
// cern : 2014-06-05 European Organization for Nuclear Research ("CERN")
cern
// cfa : 2014-08-28 CFA Institute
cfa
// cfd : 2014-12-11 DotCFD Registry Limited
cfd
// chanel : 2015-04-09 Chanel International B.V.
chanel
// channel : 2014-05-08 Charleston Road Registry Inc.
channel
// charity : 2018-04-11 Binky Moon, LLC
charity
// chase : 2015-04-30 JPMorgan Chase Bank, National Association
chase
// chat : 2014-12-04 Binky Moon, LLC
chat
// cheap : 2013-11-14 Binky Moon, LLC
cheap
// chintai : 2015-06-11 CHINTAI Corporation
chintai
// christmas : 2013-11-21 Uniregistry, Corp.
christmas
// chrome : 2014-07-24 Charleston Road Registry Inc.
chrome
// church : 2014-02-06 Binky Moon, LLC
church
// cipriani : 2015-02-19 Hotel Cipriani Srl
cipriani
// circle : 2014-12-18 Amazon Registry Services, Inc.
circle
// cisco : 2014-12-22 Cisco Technology, Inc.
cisco
// citadel : 2015-07-23 Citadel Domain LLC
citadel
// citi : 2015-07-30 Citigroup Inc.
citi
// citic : 2014-01-09 CITIC Group Corporation
citic
// city : 2014-05-29 Binky Moon, LLC
city
// cityeats : 2014-12-11 Lifestyle Domain Holdings, Inc.
cityeats
// claims : 2014-03-20 Binky Moon, LLC
claims
// cleaning : 2013-12-05 Binky Moon, LLC
cleaning
// click : 2014-06-05 Uniregistry, Corp.
click
// clinic : 2014-03-20 Binky Moon, LLC
clinic
// clinique : 2015-10-01 The Estée Lauder Companies Inc.
clinique
// clothing : 2013-08-27 Binky Moon, LLC
clothing
// cloud : 2015-04-16 Aruba PEC S.p.A.
cloud
// club : 2013-11-08 .CLUB DOMAINS, LLC
club
// clubmed : 2015-06-25 Club Méditerranée S.A.
clubmed
// coach : 2014-10-09 Binky Moon, LLC
coach
// codes : 2013-10-31 Binky Moon, LLC
codes
// coffee : 2013-10-17 Binky Moon, LLC
coffee
// college : 2014-01-16 XYZ.COM LLC
college
// cologne : 2014-02-05 dotKoeln GmbH
cologne
// comcast : 2015-07-23 Comcast IP Holdings I, LLC
comcast
// commbank : 2014-06-26 COMMONWEALTH BANK OF AUSTRALIA
commbank
// community : 2013-12-05 Binky Moon, LLC
community
// company : 2013-11-07 Binky Moon, LLC
company
// compare : 2015-10-08 Registry Services, LLC
compare
// computer : 2013-10-24 Binky Moon, LLC
computer
// comsec : 2015-01-08 VeriSign, Inc.
comsec
// condos : 2013-12-05 Binky Moon, LLC
condos
// construction : 2013-09-16 Binky Moon, LLC
construction
// consulting : 2013-12-05 Dog Beach, LLC
consulting
// contact : 2015-01-08 Dog Beach, LLC
contact
// contractors : 2013-09-10 Binky Moon, LLC
contractors
// cooking : 2013-11-21 Minds + Machines Group Limited
cooking
// cookingchannel : 2015-07-02 Lifestyle Domain Holdings, Inc.
cookingchannel
// cool : 2013-11-14 Binky Moon, LLC
cool
// corsica : 2014-09-25 Collectivité de Corse
corsica
// country : 2013-12-19 DotCountry LLC
country
// coupon : 2015-02-26 Amazon Registry Services, Inc.
coupon
// coupons : 2015-03-26 Binky Moon, LLC
coupons
// courses : 2014-12-04 OPEN UNIVERSITIES AUSTRALIA PTY LTD
courses
// cpa : 2019-06-10 American Institute of Certified Public Accountants
cpa
// credit : 2014-03-20 Binky Moon, LLC
credit
// creditcard : 2014-03-20 Binky Moon, LLC
creditcard
// creditunion : 2015-01-22 CUNA Performance Resources, LLC
creditunion
// cricket : 2014-10-09 dot Cricket Limited
cricket
// crown : 2014-10-24 Crown Equipment Corporation
crown
// crs : 2014-04-03 Federated Co-operatives Limited
crs
// cruise : 2015-12-10 Viking River Cruises (Bermuda) Ltd.
cruise
// cruises : 2013-12-05 Binky Moon, LLC
cruises
// csc : 2014-09-25 Alliance-One Services, Inc.
csc
// cuisinella : 2014-04-03 SCHMIDT GROUPE S.A.S.
cuisinella
// cymru : 2014-05-08 Nominet UK
cymru
// cyou : 2015-01-22 Beijing Gamease Age Digital Technology Co., Ltd.
cyou
// dabur : 2014-02-06 Dabur India Limited
dabur
// dad : 2014-01-23 Charleston Road Registry Inc.
dad
// dance : 2013-10-24 Dog Beach, LLC
dance
// data : 2016-06-02 Dish DBS Corporation
data
// date : 2014-11-20 dot Date Limited
date
// dating : 2013-12-05 Binky Moon, LLC
dating
// datsun : 2014-03-27 NISSAN MOTOR CO., LTD.
datsun
// day : 2014-01-30 Charleston Road Registry Inc.
day
// dclk : 2014-11-20 Charleston Road Registry Inc.
dclk
// dds : 2015-05-07 Minds + Machines Group Limited
dds
// deal : 2015-06-25 Amazon Registry Services, Inc.
deal
// dealer : 2014-12-22 Intercap Registry Inc.
dealer
// deals : 2014-05-22 Binky Moon, LLC
deals
// degree : 2014-03-06 Dog Beach, LLC
degree
// delivery : 2014-09-11 Binky Moon, LLC
delivery
// dell : 2014-10-24 Dell Inc.
dell
// deloitte : 2015-07-31 Deloitte Touche Tohmatsu
deloitte
// delta : 2015-02-19 Delta Air Lines, Inc.
delta
// democrat : 2013-10-24 Dog Beach, LLC
democrat
// dental : 2014-03-20 Binky Moon, LLC
dental
// dentist : 2014-03-20 Dog Beach, LLC
dentist
// desi : 2013-11-14 Desi Networks LLC
desi
// design : 2014-11-07 Top Level Design, LLC
design
// dev : 2014-10-16 Charleston Road Registry Inc.
dev
// dhl : 2015-07-23 Deutsche Post AG
dhl
// diamonds : 2013-09-22 Binky Moon, LLC
diamonds
// diet : 2014-06-26 Uniregistry, Corp.
diet
// digital : 2014-03-06 Binky Moon, LLC
digital
// direct : 2014-04-10 Binky Moon, LLC
direct
// directory : 2013-09-20 Binky Moon, LLC
directory
// discount : 2014-03-06 Binky Moon, LLC
discount
// discover : 2015-07-23 Discover Financial Services
discover
// dish : 2015-07-30 Dish DBS Corporation
dish
// diy : 2015-11-05 Lifestyle Domain Holdings, Inc.
diy
// dnp : 2013-12-13 Dai Nippon Printing Co., Ltd.
dnp
// docs : 2014-10-16 Charleston Road Registry Inc.
docs
// doctor : 2016-06-02 Binky Moon, LLC
doctor
// dog : 2014-12-04 Binky Moon, LLC
dog
// domains : 2013-10-17 Binky Moon, LLC
domains
// dot : 2015-05-21 Dish DBS Corporation
dot
// download : 2014-11-20 dot Support Limited
download
// drive : 2015-03-05 Charleston Road Registry Inc.
drive
// dtv : 2015-06-04 Dish DBS Corporation
dtv
// dubai : 2015-01-01 Dubai Smart Government Department
dubai
// duck : 2015-07-23 Johnson Shareholdings, Inc.
duck
// dunlop : 2015-07-02 The Goodyear Tire & Rubber Company
dunlop
// dupont : 2015-06-25 E. I. du Pont de Nemours and Company
dupont
// durban : 2014-03-24 ZA Central Registry NPC trading as ZA Central Registry
durban
// dvag : 2014-06-23 Deutsche Vermögensberatung Aktiengesellschaft DVAG
dvag
// dvr : 2016-05-26 DISH Technologies L.L.C.
dvr
// earth : 2014-12-04 Interlink Co., Ltd.
earth
// eat : 2014-01-23 Charleston Road Registry Inc.
eat
// eco : 2016-07-08 Big Room Inc.
eco
// edeka : 2014-12-18 EDEKA Verband kaufmännischer Genossenschaften e.V.
edeka
// education : 2013-11-07 Binky Moon, LLC
education
// email : 2013-10-31 Binky Moon, LLC
email
// emerck : 2014-04-03 Merck KGaA
emerck
// energy : 2014-09-11 Binky Moon, LLC
energy
// engineer : 2014-03-06 Dog Beach, LLC
engineer
// engineering : 2014-03-06 Binky Moon, LLC
engineering
// enterprises : 2013-09-20 Binky Moon, LLC
enterprises
// epson : 2014-12-04 Seiko Epson Corporation
epson
// equipment : 2013-08-27 Binky Moon, LLC
equipment
// ericsson : 2015-07-09 Telefonaktiebolaget L M Ericsson
ericsson
// erni : 2014-04-03 ERNI Group Holding AG
erni
// esq : 2014-05-08 Charleston Road Registry Inc.
esq
// estate : 2013-08-27 Binky Moon, LLC
estate
// esurance : 2015-07-23 Esurance Insurance Company
esurance
// etisalat : 2015-09-03 Emirates Telecommunications Corporation (trading as Etisalat)
etisalat
// eurovision : 2014-04-24 European Broadcasting Union (EBU)
eurovision
// eus : 2013-12-12 Puntueus Fundazioa
eus
// events : 2013-12-05 Binky Moon, LLC
events
// exchange : 2014-03-06 Binky Moon, LLC
exchange
// expert : 2013-11-21 Binky Moon, LLC
expert
// exposed : 2013-12-05 Binky Moon, LLC
exposed
// express : 2015-02-11 Binky Moon, LLC
express
// extraspace : 2015-05-14 Extra Space Storage LLC
extraspace
// fage : 2014-12-18 Fage International S.A.
fage
// fail : 2014-03-06 Binky Moon, LLC
fail
// fairwinds : 2014-11-13 FairWinds Partners, LLC
fairwinds
// faith : 2014-11-20 dot Faith Limited
faith
// family : 2015-04-02 Dog Beach, LLC
family
// fan : 2014-03-06 Dog Beach, LLC
fan
// fans : 2014-11-07 ZDNS International Limited
fans
// farm : 2013-11-07 Binky Moon, LLC
farm
// farmers : 2015-07-09 Farmers Insurance Exchange
farmers
// fashion : 2014-07-03 Minds + Machines Group Limited
fashion
// fast : 2014-12-18 Amazon Registry Services, Inc.
fast
// fedex : 2015-08-06 Federal Express Corporation
fedex
// feedback : 2013-12-19 Top Level Spectrum, Inc.
feedback
// ferrari : 2015-07-31 Fiat Chrysler Automobiles N.V.
ferrari
// ferrero : 2014-12-18 Ferrero Trading Lux S.A.
ferrero
// fiat : 2015-07-31 Fiat Chrysler Automobiles N.V.
fiat
// fidelity : 2015-07-30 Fidelity Brokerage Services LLC
fidelity
// fido : 2015-08-06 Rogers Communications Canada Inc.
fido
// film : 2015-01-08 Motion Picture Domain Registry Pty Ltd
film
// final : 2014-10-16 Núcleo de Informação e Coordenação do Ponto BR - NIC.br
final
// finance : 2014-03-20 Binky Moon, LLC
finance
// financial : 2014-03-06 Binky Moon, LLC
financial
// fire : 2015-06-25 Amazon Registry Services, Inc.
fire
// firestone : 2014-12-18 Bridgestone Licensing Services, Inc
firestone
// firmdale : 2014-03-27 Firmdale Holdings Limited
firmdale
// fish : 2013-12-12 Binky Moon, LLC
fish
// fishing : 2013-11-21 Minds + Machines Group Limited
fishing
// fit : 2014-11-07 Minds + Machines Group Limited
fit
// fitness : 2014-03-06 Binky Moon, LLC
fitness
// flickr : 2015-04-02 Yahoo! Domain Services Inc.
flickr
// flights : 2013-12-05 Binky Moon, LLC
flights
// flir : 2015-07-23 FLIR Systems, Inc.
flir
// florist : 2013-11-07 Binky Moon, LLC
florist
// flowers : 2014-10-09 Uniregistry, Corp.
flowers
// fly : 2014-05-08 Charleston Road Registry Inc.
fly
// foo : 2014-01-23 Charleston Road Registry Inc.
foo
// food : 2016-04-21 Lifestyle Domain Holdings, Inc.
food
// foodnetwork : 2015-07-02 Lifestyle Domain Holdings, Inc.
foodnetwork
// football : 2014-12-18 Binky Moon, LLC
football
// ford : 2014-11-13 Ford Motor Company
ford
// forex : 2014-12-11 Dotforex Registry Limited
forex
// forsale : 2014-05-22 Dog Beach, LLC
forsale
// forum : 2015-04-02 Fegistry, LLC
forum
// foundation : 2013-12-05 Binky Moon, LLC
foundation
// fox : 2015-09-11 FOX Registry, LLC
fox
// free : 2015-12-10 Amazon Registry Services, Inc.
free
// fresenius : 2015-07-30 Fresenius Immobilien-Verwaltungs-GmbH
fresenius
// frl : 2014-05-15 FRLregistry B.V.
frl
// frogans : 2013-12-19 OP3FT
frogans
// frontdoor : 2015-07-02 Lifestyle Domain Holdings, Inc.
frontdoor
// frontier : 2015-02-05 Frontier Communications Corporation
frontier
// ftr : 2015-07-16 Frontier Communications Corporation
ftr
// fujitsu : 2015-07-30 Fujitsu Limited
fujitsu
// fujixerox : 2015-07-23 Xerox DNHC LLC
fujixerox
// fun : 2016-01-14 DotSpace Inc.
fun
// fund : 2014-03-20 Binky Moon, LLC
fund
// furniture : 2014-03-20 Binky Moon, LLC
furniture
// futbol : 2013-09-20 Dog Beach, LLC
futbol
// fyi : 2015-04-02 Binky Moon, LLC
fyi
// gal : 2013-11-07 Asociación puntoGAL
gal
// gallery : 2013-09-13 Binky Moon, LLC
gallery
// gallo : 2015-06-11 Gallo Vineyards, Inc.
gallo
// gallup : 2015-02-19 Gallup, Inc.
gallup
// game : 2015-05-28 Uniregistry, Corp.
game
// games : 2015-05-28 Dog Beach, LLC
games
// gap : 2015-07-31 The Gap, Inc.
gap
// garden : 2014-06-26 Minds + Machines Group Limited
garden
// gay : 2019-05-23 Top Level Design, LLC
gay
// gbiz : 2014-07-17 Charleston Road Registry Inc.
gbiz
// gdn : 2014-07-31 Joint Stock Company "Navigation-information systems"
gdn
// gea : 2014-12-04 GEA Group Aktiengesellschaft
gea
// gent : 2014-01-23 COMBELL NV
gent
// genting : 2015-03-12 Resorts World Inc Pte. Ltd.
genting
// george : 2015-07-31 Wal-Mart Stores, Inc.
george
// ggee : 2014-01-09 GMO Internet, Inc.
ggee
// gift : 2013-10-17 DotGift, LLC
gift
// gifts : 2014-07-03 Binky Moon, LLC
gifts
// gives : 2014-03-06 Dog Beach, LLC
gives
// giving : 2014-11-13 Giving Limited
giving
// glade : 2015-07-23 Johnson Shareholdings, Inc.
glade
// glass : 2013-11-07 Binky Moon, LLC
glass
// gle : 2014-07-24 Charleston Road Registry Inc.
gle
// global : 2014-04-17 Dot Global Domain Registry Limited
global
// globo : 2013-12-19 Globo Comunicação e Participações S.A
globo
// gmail : 2014-05-01 Charleston Road Registry Inc.
gmail
// gmbh : 2016-01-29 Binky Moon, LLC
gmbh
// gmo : 2014-01-09 GMO Internet, Inc.
gmo
// gmx : 2014-04-24 1&1 Mail & Media GmbH
gmx
// godaddy : 2015-07-23 Go Daddy East, LLC
godaddy
// gold : 2015-01-22 Binky Moon, LLC
gold
// goldpoint : 2014-11-20 YODOBASHI CAMERA CO.,LTD.
goldpoint
// golf : 2014-12-18 Binky Moon, LLC
golf
// goo : 2014-12-18 NTT Resonant Inc.
goo
// goodyear : 2015-07-02 The Goodyear Tire & Rubber Company
goodyear
// goog : 2014-11-20 Charleston Road Registry Inc.
goog
// google : 2014-07-24 Charleston Road Registry Inc.
google
// gop : 2014-01-16 Republican State Leadership Committee, Inc.
gop
// got : 2014-12-18 Amazon Registry Services, Inc.
got
// grainger : 2015-05-07 Grainger Registry Services, LLC
grainger
// graphics : 2013-09-13 Binky Moon, LLC
graphics
// gratis : 2014-03-20 Binky Moon, LLC
gratis
// green : 2014-05-08 Afilias Limited
green
// gripe : 2014-03-06 Binky Moon, LLC
gripe
// grocery : 2016-06-16 Wal-Mart Stores, Inc.
grocery
// group : 2014-08-15 Binky Moon, LLC
group
// guardian : 2015-07-30 The Guardian Life Insurance Company of America
guardian
// gucci : 2014-11-13 Guccio Gucci S.p.a.
gucci
// guge : 2014-08-28 Charleston Road Registry Inc.
guge
// guide : 2013-09-13 Binky Moon, LLC
guide
// guitars : 2013-11-14 Uniregistry, Corp.
guitars
// guru : 2013-08-27 Binky Moon, LLC
guru
// hair : 2015-12-03 L'Oréal
hair
// hamburg : 2014-02-20 Hamburg Top-Level-Domain GmbH
hamburg
// hangout : 2014-11-13 Charleston Road Registry Inc.
hangout
// haus : 2013-12-05 Dog Beach, LLC
haus
// hbo : 2015-07-30 HBO Registry Services, Inc.
hbo
// hdfc : 2015-07-30 HOUSING DEVELOPMENT FINANCE CORPORATION LIMITED
hdfc
// hdfcbank : 2015-02-12 HDFC Bank Limited
hdfcbank
// health : 2015-02-11 DotHealth, LLC
health
// healthcare : 2014-06-12 Binky Moon, LLC
healthcare
// help : 2014-06-26 Uniregistry, Corp.
help
// helsinki : 2015-02-05 City of Helsinki
helsinki
// here : 2014-02-06 Charleston Road Registry Inc.
here
// hermes : 2014-07-10 HERMES INTERNATIONAL
hermes
// hgtv : 2015-07-02 Lifestyle Domain Holdings, Inc.
hgtv
// hiphop : 2014-03-06 Uniregistry, Corp.
hiphop
// hisamitsu : 2015-07-16 Hisamitsu Pharmaceutical Co.,Inc.
hisamitsu
// hitachi : 2014-10-31 Hitachi, Ltd.
hitachi
// hiv : 2014-03-13 Uniregistry, Corp.
hiv
// hkt : 2015-05-14 PCCW-HKT DataCom Services Limited
hkt
// hockey : 2015-03-19 Binky Moon, LLC
hockey
// holdings : 2013-08-27 Binky Moon, LLC
holdings
// holiday : 2013-11-07 Binky Moon, LLC
holiday
// homedepot : 2015-04-02 Home Depot Product Authority, LLC
homedepot
// homegoods : 2015-07-16 The TJX Companies, Inc.
homegoods
// homes : 2014-01-09 DERHomes, LLC
homes
// homesense : 2015-07-16 The TJX Companies, Inc.
homesense
// honda : 2014-12-18 Honda Motor Co., Ltd.
honda
// horse : 2013-11-21 Minds + Machines Group Limited
horse
// hospital : 2016-10-20 Binky Moon, LLC
hospital
// host : 2014-04-17 DotHost Inc.
host
// hosting : 2014-05-29 Uniregistry, Corp.
hosting
// hot : 2015-08-27 Amazon Registry Services, Inc.
hot
// hoteles : 2015-03-05 Travel Reservations SRL
hoteles
// hotels : 2016-04-07 Booking.com B.V.
hotels
// hotmail : 2014-12-18 Microsoft Corporation
hotmail
// house : 2013-11-07 Binky Moon, LLC
house
// how : 2014-01-23 Charleston Road Registry Inc.
how
// hsbc : 2014-10-24 HSBC Global Services (UK) Limited
hsbc
// hughes : 2015-07-30 Hughes Satellite Systems Corporation
hughes
// hyatt : 2015-07-30 Hyatt GTLD, L.L.C.
hyatt
// hyundai : 2015-07-09 Hyundai Motor Company
hyundai
// ibm : 2014-07-31 International Business Machines Corporation
ibm
// icbc : 2015-02-19 Industrial and Commercial Bank of China Limited
icbc
// ice : 2014-10-30 IntercontinentalExchange, Inc.
ice
// icu : 2015-01-08 ShortDot SA
icu
// ieee : 2015-07-23 IEEE Global LLC
ieee
// ifm : 2014-01-30 ifm electronic gmbh
ifm
// ikano : 2015-07-09 Ikano S.A.
ikano
// imamat : 2015-08-06 Fondation Aga Khan (Aga Khan Foundation)
imamat
// imdb : 2015-06-25 Amazon Registry Services, Inc.
imdb
// immo : 2014-07-10 Binky Moon, LLC
immo
// immobilien : 2013-11-07 Dog Beach, LLC
immobilien
// inc : 2018-03-10 Intercap Registry Inc.
inc
// industries : 2013-12-05 Binky Moon, LLC
industries
// infiniti : 2014-03-27 NISSAN MOTOR CO., LTD.
infiniti
// ing : 2014-01-23 Charleston Road Registry Inc.
ing
// ink : 2013-12-05 Top Level Design, LLC
ink
// institute : 2013-11-07 Binky Moon, LLC
institute
// insurance : 2015-02-19 fTLD Registry Services LLC
insurance
// insure : 2014-03-20 Binky Moon, LLC
insure
// intel : 2015-08-06 Intel Corporation
intel
// international : 2013-11-07 Binky Moon, LLC
international
// intuit : 2015-07-30 Intuit Administrative Services, Inc.
intuit
// investments : 2014-03-20 Binky Moon, LLC
investments
// ipiranga : 2014-08-28 Ipiranga Produtos de Petroleo S.A.
ipiranga
// irish : 2014-08-07 Binky Moon, LLC
irish
// ismaili : 2015-08-06 Fondation Aga Khan (Aga Khan Foundation)
ismaili
// ist : 2014-08-28 Istanbul Metropolitan Municipality
ist
// istanbul : 2014-08-28 Istanbul Metropolitan Municipality
istanbul
// itau : 2014-10-02 Itau Unibanco Holding S.A.
itau
// itv : 2015-07-09 ITV Services Limited
itv
// iveco : 2015-09-03 CNH Industrial N.V.
iveco
// jaguar : 2014-11-13 Jaguar Land Rover Ltd
jaguar
// java : 2014-06-19 Oracle Corporation
java
// jcb : 2014-11-20 JCB Co., Ltd.
jcb
// jcp : 2015-04-23 JCP Media, Inc.
jcp
// jeep : 2015-07-30 FCA US LLC.
jeep
// jetzt : 2014-01-09 Binky Moon, LLC
jetzt
// jewelry : 2015-03-05 Binky Moon, LLC
jewelry
// jio : 2015-04-02 Reliance Industries Limited
jio
// jll : 2015-04-02 Jones Lang LaSalle Incorporated
jll
// jmp : 2015-03-26 Matrix IP LLC
jmp
// jnj : 2015-06-18 Johnson & Johnson Services, Inc.
jnj
// joburg : 2014-03-24 ZA Central Registry NPC trading as ZA Central Registry
joburg
// jot : 2014-12-18 Amazon Registry Services, Inc.
jot
// joy : 2014-12-18 Amazon Registry Services, Inc.
joy
// jpmorgan : 2015-04-30 JPMorgan Chase Bank, National Association
jpmorgan
// jprs : 2014-09-18 Japan Registry Services Co., Ltd.
jprs
// juegos : 2014-03-20 Uniregistry, Corp.
juegos
// juniper : 2015-07-30 JUNIPER NETWORKS, INC.
juniper
// kaufen : 2013-11-07 Dog Beach, LLC
kaufen
// kddi : 2014-09-12 KDDI CORPORATION
kddi
// kerryhotels : 2015-04-30 Kerry Trading Co. Limited
kerryhotels
// kerrylogistics : 2015-04-09 Kerry Trading Co. Limited
kerrylogistics
// kerryproperties : 2015-04-09 Kerry Trading Co. Limited
kerryproperties
// kfh : 2014-12-04 Kuwait Finance House
kfh
// kia : 2015-07-09 KIA MOTORS CORPORATION
kia
// kim : 2013-09-23 Afilias Limited
kim
// kinder : 2014-11-07 Ferrero Trading Lux S.A.
kinder
// kindle : 2015-06-25 Amazon Registry Services, Inc.
kindle
// kitchen : 2013-09-20 Binky Moon, LLC
kitchen
// kiwi : 2013-09-20 DOT KIWI LIMITED
kiwi
// koeln : 2014-01-09 dotKoeln GmbH
koeln
// komatsu : 2015-01-08 Komatsu Ltd.
komatsu
// kosher : 2015-08-20 Kosher Marketing Assets LLC
kosher
// kpmg : 2015-04-23 KPMG International Cooperative (KPMG International Genossenschaft)
kpmg
// kpn : 2015-01-08 Koninklijke KPN N.V.
kpn
// krd : 2013-12-05 KRG Department of Information Technology
krd
// kred : 2013-12-19 KredTLD Pty Ltd
kred
// kuokgroup : 2015-04-09 Kerry Trading Co. Limited
kuokgroup
// kyoto : 2014-11-07 Academic Institution: Kyoto Jyoho Gakuen
kyoto
// lacaixa : 2014-01-09 Fundación Bancaria Caixa d’Estalvis i Pensions de Barcelona, “la Caixa”
lacaixa
// lamborghini : 2015-06-04 Automobili Lamborghini S.p.A.
lamborghini
// lamer : 2015-10-01 The Estée Lauder Companies Inc.
lamer
// lancaster : 2015-02-12 LANCASTER
lancaster
// lancia : 2015-07-31 Fiat Chrysler Automobiles N.V.
lancia
// lancome : 2015-07-23 L'Oréal
lancome
// land : 2013-09-10 Binky Moon, LLC
land
// landrover : 2014-11-13 Jaguar Land Rover Ltd
landrover
// lanxess : 2015-07-30 LANXESS Corporation
lanxess
// lasalle : 2015-04-02 Jones Lang LaSalle Incorporated
lasalle
// lat : 2014-10-16 ECOM-LAC Federaciòn de Latinoamèrica y el Caribe para Internet y el Comercio Electrònico
lat
// latino : 2015-07-30 Dish DBS Corporation
latino
// latrobe : 2014-06-16 La Trobe University
latrobe
// law : 2015-01-22 LW TLD Limited
law
// lawyer : 2014-03-20 Dog Beach, LLC
lawyer
// lds : 2014-03-20 IRI Domain Management, LLC ("Applicant")
lds
// lease : 2014-03-06 Binky Moon, LLC
lease
// leclerc : 2014-08-07 A.C.D. LEC Association des Centres Distributeurs Edouard Leclerc
leclerc
// lefrak : 2015-07-16 LeFrak Organization, Inc.
lefrak
// legal : 2014-10-16 Binky Moon, LLC
legal
// lego : 2015-07-16 LEGO Juris A/S
lego
// lexus : 2015-04-23 TOYOTA MOTOR CORPORATION
lexus
// lgbt : 2014-05-08 Afilias Limited
lgbt
// liaison : 2014-10-02 Liaison Technologies, Incorporated
liaison
// lidl : 2014-09-18 Schwarz Domains und Services GmbH & Co. KG
lidl
// life : 2014-02-06 Binky Moon, LLC
life
// lifeinsurance : 2015-01-15 American Council of Life Insurers
lifeinsurance
// lifestyle : 2014-12-11 Lifestyle Domain Holdings, Inc.
lifestyle
// lighting : 2013-08-27 Binky Moon, LLC
lighting
// like : 2014-12-18 Amazon Registry Services, Inc.
like
// lilly : 2015-07-31 Eli Lilly and Company
lilly
// limited : 2014-03-06 Binky Moon, LLC
limited
// limo : 2013-10-17 Binky Moon, LLC
limo
// lincoln : 2014-11-13 Ford Motor Company
lincoln
// linde : 2014-12-04 Linde Aktiengesellschaft
linde
// link : 2013-11-14 Uniregistry, Corp.
link
// lipsy : 2015-06-25 Lipsy Ltd
lipsy
// live : 2014-12-04 Dog Beach, LLC
live
// living : 2015-07-30 Lifestyle Domain Holdings, Inc.
living
// lixil : 2015-03-19 LIXIL Group Corporation
lixil
// llc : 2017-12-14 Afilias Limited
llc
// llp : 2019-08-26 Dot Registry LLC
llp
// loan : 2014-11-20 dot Loan Limited
loan
// loans : 2014-03-20 Binky Moon, LLC
loans
// locker : 2015-06-04 Dish DBS Corporation
locker
// locus : 2015-06-25 Locus Analytics LLC
locus
// loft : 2015-07-30 Annco, Inc.
loft
// lol : 2015-01-30 Uniregistry, Corp.
lol
// london : 2013-11-14 Dot London Domains Limited
london
// lotte : 2014-11-07 Lotte Holdings Co., Ltd.
lotte
// lotto : 2014-04-10 Afilias Limited
lotto
// love : 2014-12-22 Merchant Law Group LLP
love
// lpl : 2015-07-30 LPL Holdings, Inc.
lpl
// lplfinancial : 2015-07-30 LPL Holdings, Inc.
lplfinancial
// ltd : 2014-09-25 Binky Moon, LLC
ltd
// ltda : 2014-04-17 InterNetX, Corp
ltda
// lundbeck : 2015-08-06 H. Lundbeck A/S
lundbeck
// lupin : 2014-11-07 LUPIN LIMITED
lupin
// luxe : 2014-01-09 Minds + Machines Group Limited
luxe
// luxury : 2013-10-17 Luxury Partners, LLC
luxury
// macys : 2015-07-31 Macys, Inc.
macys
// madrid : 2014-05-01 Comunidad de Madrid
madrid
// maif : 2014-10-02 Mutuelle Assurance Instituteur France (MAIF)
maif
// maison : 2013-12-05 Binky Moon, LLC
maison
// makeup : 2015-01-15 L'Oréal
makeup
// man : 2014-12-04 MAN SE
man
// management : 2013-11-07 Binky Moon, LLC
management
// mango : 2013-10-24 PUNTO FA S.L.
mango
// map : 2016-06-09 Charleston Road Registry Inc.
map
// market : 2014-03-06 Dog Beach, LLC
market
// marketing : 2013-11-07 Binky Moon, LLC
marketing
// markets : 2014-12-11 Dotmarkets Registry Limited
markets
// marriott : 2014-10-09 Marriott Worldwide Corporation
marriott
// marshalls : 2015-07-16 The TJX Companies, Inc.
marshalls
// maserati : 2015-07-31 Fiat Chrysler Automobiles N.V.
maserati
// mattel : 2015-08-06 Mattel Sites, Inc.
mattel
// mba : 2015-04-02 Binky Moon, LLC
mba
// mckinsey : 2015-07-31 McKinsey Holdings, Inc.
mckinsey
// med : 2015-08-06 Medistry LLC
med
// media : 2014-03-06 Binky Moon, LLC
media
// meet : 2014-01-16 Charleston Road Registry Inc.
meet
// melbourne : 2014-05-29 The Crown in right of the State of Victoria, represented by its Department of State Development, Business and Innovation
melbourne
// meme : 2014-01-30 Charleston Road Registry Inc.
meme
// memorial : 2014-10-16 Dog Beach, LLC
memorial
// men : 2015-02-26 Exclusive Registry Limited
men
// menu : 2013-09-11 Dot Menu Registry, LLC
menu
// merckmsd : 2016-07-14 MSD Registry Holdings, Inc.
merckmsd
// metlife : 2015-05-07 MetLife Services and Solutions, LLC
metlife
// miami : 2013-12-19 Minds + Machines Group Limited
miami
// microsoft : 2014-12-18 Microsoft Corporation
microsoft
// mini : 2014-01-09 Bayerische Motoren Werke Aktiengesellschaft
mini
// mint : 2015-07-30 Intuit Administrative Services, Inc.
mint
// mit : 2015-07-02 Massachusetts Institute of Technology
mit
// mitsubishi : 2015-07-23 Mitsubishi Corporation
mitsubishi
// mlb : 2015-05-21 MLB Advanced Media DH, LLC
mlb
// mls : 2015-04-23 The Canadian Real Estate Association
mls
// mma : 2014-11-07 MMA IARD
mma
// mobile : 2016-06-02 Dish DBS Corporation
mobile
// moda : 2013-11-07 Dog Beach, LLC
moda
// moe : 2013-11-13 Interlink Co., Ltd.
moe
// moi : 2014-12-18 Amazon Registry Services, Inc.
moi
// mom : 2015-04-16 Uniregistry, Corp.
mom
// monash : 2013-09-30 Monash University
monash
// money : 2014-10-16 Binky Moon, LLC
money
// monster : 2015-09-11 XYZ.COM LLC
monster
// mormon : 2013-12-05 IRI Domain Management, LLC ("Applicant")
mormon
// mortgage : 2014-03-20 Dog Beach, LLC
mortgage
// moscow : 2013-12-19 Foundation for Assistance for Internet Technologies and Infrastructure Development (FAITID)
moscow
// moto : 2015-06-04 Motorola Trademark Holdings, LLC
moto
// motorcycles : 2014-01-09 DERMotorcycles, LLC
motorcycles
// mov : 2014-01-30 Charleston Road Registry Inc.
mov
// movie : 2015-02-05 Binky Moon, LLC
movie
// movistar : 2014-10-16 Telefónica S.A.
movistar
// msd : 2015-07-23 MSD Registry Holdings, Inc.
msd
// mtn : 2014-12-04 MTN Dubai Limited
mtn
// mtr : 2015-03-12 MTR Corporation Limited
mtr
// mutual : 2015-04-02 Northwestern Mutual MU TLD Registry, LLC
mutual
// nab : 2015-08-20 National Australia Bank Limited
nab
// nadex : 2014-12-11 Nadex Domains, Inc.
nadex
// nagoya : 2013-10-24 GMO Registry, Inc.
nagoya
// nationwide : 2015-07-23 Nationwide Mutual Insurance Company
nationwide
// natura : 2015-03-12 NATURA COSMÉTICOS S.A.
natura
// navy : 2014-03-06 Dog Beach, LLC
navy
// nba : 2015-07-31 NBA REGISTRY, LLC
nba
// nec : 2015-01-08 NEC Corporation
nec
// netbank : 2014-06-26 COMMONWEALTH BANK OF AUSTRALIA
netbank
// netflix : 2015-06-18 Netflix, Inc.
netflix
// network : 2013-11-14 Binky Moon, LLC
network
// neustar : 2013-12-05 Registry Services, LLC
neustar
// new : 2014-01-30 Charleston Road Registry Inc.
new
// newholland : 2015-09-03 CNH Industrial N.V.
newholland
// news : 2014-12-18 Dog Beach, LLC
news
// next : 2015-06-18 Next plc
next
// nextdirect : 2015-06-18 Next plc
nextdirect
// nexus : 2014-07-24 Charleston Road Registry Inc.
nexus
// nfl : 2015-07-23 NFL Reg Ops LLC
nfl
// ngo : 2014-03-06 Public Interest Registry
ngo
// nhk : 2014-02-13 Japan Broadcasting Corporation (NHK)
nhk
// nico : 2014-12-04 DWANGO Co., Ltd.
nico
// nike : 2015-07-23 NIKE, Inc.
nike
// nikon : 2015-05-21 NIKON CORPORATION
nikon
// ninja : 2013-11-07 Dog Beach, LLC
ninja
// nissan : 2014-03-27 NISSAN MOTOR CO., LTD.
nissan
// nissay : 2015-10-29 Nippon Life Insurance Company
nissay
// nokia : 2015-01-08 Nokia Corporation
nokia
// northwesternmutual : 2015-06-18 Northwestern Mutual Registry, LLC
northwesternmutual
// norton : 2014-12-04 Symantec Corporation
norton
// now : 2015-06-25 Amazon Registry Services, Inc.
now
// nowruz : 2014-09-04 Asia Green IT System Bilgisayar San. ve Tic. Ltd. Sti.
nowruz
// nowtv : 2015-05-14 Starbucks (HK) Limited
nowtv
// nra : 2014-05-22 NRA Holdings Company, INC.
nra
// nrw : 2013-11-21 Minds + Machines GmbH
nrw
// ntt : 2014-10-31 NIPPON TELEGRAPH AND TELEPHONE CORPORATION
ntt
// nyc : 2014-01-23 The City of New York by and through the New York City Department of Information Technology & Telecommunications
nyc
// obi : 2014-09-25 OBI Group Holding SE & Co. KGaA
obi
// observer : 2015-04-30 Top Level Spectrum, Inc.
observer
// off : 2015-07-23 Johnson Shareholdings, Inc.
off
// office : 2015-03-12 Microsoft Corporation
office
// okinawa : 2013-12-05 BRregistry, Inc.
okinawa
// olayan : 2015-05-14 Crescent Holding GmbH
olayan
// olayangroup : 2015-05-14 Crescent Holding GmbH
olayangroup
// oldnavy : 2015-07-31 The Gap, Inc.
oldnavy
// ollo : 2015-06-04 Dish DBS Corporation
ollo
// omega : 2015-01-08 The Swatch Group Ltd
omega
// one : 2014-11-07 One.com A/S
one
// ong : 2014-03-06 Public Interest Registry
ong
// onl : 2013-09-16 I-Registry Ltd.
onl
// online : 2015-01-15 DotOnline Inc.
online
// onyourside : 2015-07-23 Nationwide Mutual Insurance Company
onyourside
// ooo : 2014-01-09 INFIBEAM AVENUES LIMITED
ooo
// open : 2015-07-31 American Express Travel Related Services Company, Inc.
open
// oracle : 2014-06-19 Oracle Corporation
oracle
// orange : 2015-03-12 Orange Brand Services Limited
orange
// organic : 2014-03-27 Afilias Limited
organic
// origins : 2015-10-01 The Estée Lauder Companies Inc.
origins
// osaka : 2014-09-04 Osaka Registry Co., Ltd.
osaka
// otsuka : 2013-10-11 Otsuka Holdings Co., Ltd.
otsuka
// ott : 2015-06-04 Dish DBS Corporation
ott
// ovh : 2014-01-16 MédiaBC
ovh
// page : 2014-12-04 Charleston Road Registry Inc.
page
// panasonic : 2015-07-30 Panasonic Corporation
panasonic
// paris : 2014-01-30 City of Paris
paris
// pars : 2014-09-04 Asia Green IT System Bilgisayar San. ve Tic. Ltd. Sti.
pars
// partners : 2013-12-05 Binky Moon, LLC
partners
// parts : 2013-12-05 Binky Moon, LLC
parts
// party : 2014-09-11 Blue Sky Registry Limited
party
// passagens : 2015-03-05 Travel Reservations SRL
passagens
// pay : 2015-08-27 Amazon Registry Services, Inc.
pay
// pccw : 2015-05-14 PCCW Enterprises Limited
pccw
// pet : 2015-05-07 Afilias Limited
pet
// pfizer : 2015-09-11 Pfizer Inc.
pfizer
// pharmacy : 2014-06-19 National Association of Boards of Pharmacy
pharmacy
// phd : 2016-07-28 Charleston Road Registry Inc.
phd
// philips : 2014-11-07 Koninklijke Philips N.V.
philips
// phone : 2016-06-02 Dish DBS Corporation
phone
// photo : 2013-11-14 Uniregistry, Corp.
photo
// photography : 2013-09-20 Binky Moon, LLC
photography
// photos : 2013-10-17 Binky Moon, LLC
photos
// physio : 2014-05-01 PhysBiz Pty Ltd
physio
// pics : 2013-11-14 Uniregistry, Corp.
pics
// pictet : 2014-06-26 Pictet Europe S.A.
pictet
// pictures : 2014-03-06 Binky Moon, LLC
pictures
// pid : 2015-01-08 Top Level Spectrum, Inc.
pid
// pin : 2014-12-18 Amazon Registry Services, Inc.
pin
// ping : 2015-06-11 Ping Registry Provider, Inc.
ping
// pink : 2013-10-01 Afilias Limited
pink
// pioneer : 2015-07-16 Pioneer Corporation
pioneer
// pizza : 2014-06-26 Binky Moon, LLC
pizza
// place : 2014-04-24 Binky Moon, LLC
place
// play : 2015-03-05 Charleston Road Registry Inc.
play
// playstation : 2015-07-02 Sony Interactive Entertainment Inc.
playstation
// plumbing : 2013-09-10 Binky Moon, LLC
plumbing
// plus : 2015-02-05 Binky Moon, LLC
plus
// pnc : 2015-07-02 PNC Domain Co., LLC
pnc
// pohl : 2014-06-23 Deutsche Vermögensberatung Aktiengesellschaft DVAG
pohl
// poker : 2014-07-03 Afilias Limited
poker
// politie : 2015-08-20 Politie Nederland
politie
// porn : 2014-10-16 ICM Registry PN LLC
porn
// pramerica : 2015-07-30 Prudential Financial, Inc.
pramerica
// praxi : 2013-12-05 Praxi S.p.A.
praxi
// press : 2014-04-03 DotPress Inc.
press
// prime : 2015-06-25 Amazon Registry Services, Inc.
prime
// prod : 2014-01-23 Charleston Road Registry Inc.
prod
// productions : 2013-12-05 Binky Moon, LLC
productions
// prof : 2014-07-24 Charleston Road Registry Inc.
prof
// progressive : 2015-07-23 Progressive Casualty Insurance Company
progressive
// promo : 2014-12-18 Afilias Limited
promo
// properties : 2013-12-05 Binky Moon, LLC
properties
// property : 2014-05-22 Uniregistry, Corp.
property
// protection : 2015-04-23 XYZ.COM LLC
protection
// pru : 2015-07-30 Prudential Financial, Inc.
pru
// prudential : 2015-07-30 Prudential Financial, Inc.
prudential
// pub : 2013-12-12 Dog Beach, LLC
pub
// pwc : 2015-10-29 PricewaterhouseCoopers LLP
pwc
// qpon : 2013-11-14 dotCOOL, Inc.
qpon
// quebec : 2013-12-19 PointQuébec Inc
quebec
// quest : 2015-03-26 XYZ.COM LLC
quest
// qvc : 2015-07-30 QVC, Inc.
qvc
// racing : 2014-12-04 Premier Registry Limited
racing
// radio : 2016-07-21 European Broadcasting Union (EBU)
radio
// raid : 2015-07-23 Johnson Shareholdings, Inc.
raid
// read : 2014-12-18 Amazon Registry Services, Inc.
read
// realestate : 2015-09-11 dotRealEstate LLC
realestate
// realtor : 2014-05-29 Real Estate Domains LLC
realtor
// realty : 2015-03-19 Fegistry, LLC
realty
// recipes : 2013-10-17 Binky Moon, LLC
recipes
// red : 2013-11-07 Afilias Limited
red
// redstone : 2014-10-31 Redstone Haute Couture Co., Ltd.
redstone
// redumbrella : 2015-03-26 Travelers TLD, LLC
redumbrella
// rehab : 2014-03-06 Dog Beach, LLC
rehab
// reise : 2014-03-13 Binky Moon, LLC
reise
// reisen : 2014-03-06 Binky Moon, LLC
reisen
// reit : 2014-09-04 National Association of Real Estate Investment Trusts, Inc.
reit
// reliance : 2015-04-02 Reliance Industries Limited
reliance
// ren : 2013-12-12 ZDNS International Limited
ren
// rent : 2014-12-04 XYZ.COM LLC
rent
// rentals : 2013-12-05 Binky Moon, LLC
rentals
// repair : 2013-11-07 Binky Moon, LLC
repair
// report : 2013-12-05 Binky Moon, LLC
report
// republican : 2014-03-20 Dog Beach, LLC
republican
// rest : 2013-12-19 Punto 2012 Sociedad Anonima Promotora de Inversion de Capital Variable
rest
// restaurant : 2014-07-03 Binky Moon, LLC
restaurant
// review : 2014-11-20 dot Review Limited
review
// reviews : 2013-09-13 Dog Beach, LLC
reviews
// rexroth : 2015-06-18 Robert Bosch GMBH
rexroth
// rich : 2013-11-21 I-Registry Ltd.
rich
// richardli : 2015-05-14 Pacific Century Asset Management (HK) Limited
richardli
// ricoh : 2014-11-20 Ricoh Company, Ltd.
ricoh
// rightathome : 2015-07-23 Johnson Shareholdings, Inc.
rightathome
// ril : 2015-04-02 Reliance Industries Limited
ril
// rio : 2014-02-27 Empresa Municipal de Informática SA - IPLANRIO
rio
// rip : 2014-07-10 Dog Beach, LLC
rip
// rmit : 2015-11-19 Royal Melbourne Institute of Technology
rmit
// rocher : 2014-12-18 Ferrero Trading Lux S.A.
rocher
// rocks : 2013-11-14 Dog Beach, LLC
rocks
// rodeo : 2013-12-19 Minds + Machines Group Limited
rodeo
// rogers : 2015-08-06 Rogers Communications Canada Inc.
rogers
// room : 2014-12-18 Amazon Registry Services, Inc.
room
// rsvp : 2014-05-08 Charleston Road Registry Inc.
rsvp
// rugby : 2016-12-15 World Rugby Strategic Developments Limited
rugby
// ruhr : 2013-10-02 regiodot GmbH & Co. KG
ruhr
// run : 2015-03-19 Binky Moon, LLC
run
// rwe : 2015-04-02 RWE AG
rwe
// ryukyu : 2014-01-09 BRregistry, Inc.
ryukyu
// saarland : 2013-12-12 dotSaarland GmbH
saarland
// safe : 2014-12-18 Amazon Registry Services, Inc.
safe
// safety : 2015-01-08 Safety Registry Services, LLC.
safety
// sakura : 2014-12-18 SAKURA Internet Inc.
sakura
// sale : 2014-10-16 Dog Beach, LLC
sale
// salon : 2014-12-11 Binky Moon, LLC
salon
// samsclub : 2015-07-31 Wal-Mart Stores, Inc.
samsclub
// samsung : 2014-04-03 SAMSUNG SDS CO., LTD
samsung
// sandvik : 2014-11-13 Sandvik AB
sandvik
// sandvikcoromant : 2014-11-07 Sandvik AB
sandvikcoromant
// sanofi : 2014-10-09 Sanofi
sanofi
// sap : 2014-03-27 SAP AG
sap
// sarl : 2014-07-03 Binky Moon, LLC
sarl
// sas : 2015-04-02 Research IP LLC
sas
// save : 2015-06-25 Amazon Registry Services, Inc.
save
// saxo : 2014-10-31 Saxo Bank A/S
saxo
// sbi : 2015-03-12 STATE BANK OF INDIA
sbi
// sbs : 2014-11-07 SPECIAL BROADCASTING SERVICE CORPORATION
sbs
// sca : 2014-03-13 SVENSKA CELLULOSA AKTIEBOLAGET SCA (publ)
sca
// scb : 2014-02-20 The Siam Commercial Bank Public Company Limited ("SCB")
scb
// schaeffler : 2015-08-06 Schaeffler Technologies AG & Co. KG
schaeffler
// schmidt : 2014-04-03 SCHMIDT GROUPE S.A.S.
schmidt
// scholarships : 2014-04-24 Scholarships.com, LLC
scholarships
// school : 2014-12-18 Binky Moon, LLC
school
// schule : 2014-03-06 Binky Moon, LLC
schule
// schwarz : 2014-09-18 Schwarz Domains und Services GmbH & Co. KG
schwarz
// science : 2014-09-11 dot Science Limited
science
// scjohnson : 2015-07-23 Johnson Shareholdings, Inc.
scjohnson
// scor : 2014-10-31 SCOR SE
scor
// scot : 2014-01-23 Dot Scot Registry Limited
scot
// search : 2016-06-09 Charleston Road Registry Inc.
search
// seat : 2014-05-22 SEAT, S.A. (Sociedad Unipersonal)
seat
// secure : 2015-08-27 Amazon Registry Services, Inc.
secure
// security : 2015-05-14 XYZ.COM LLC
security
// seek : 2014-12-04 Seek Limited
seek
// select : 2015-10-08 Registry Services, LLC
select
// sener : 2014-10-24 Sener Ingeniería y Sistemas, S.A.
sener
// services : 2014-02-27 Binky Moon, LLC
services
// ses : 2015-07-23 SES
ses
// seven : 2015-08-06 Seven West Media Ltd
seven
// sew : 2014-07-17 SEW-EURODRIVE GmbH & Co KG
sew
// sex : 2014-11-13 ICM Registry SX LLC
sex
// sexy : 2013-09-11 Uniregistry, Corp.
sexy
// sfr : 2015-08-13 Societe Francaise du Radiotelephone - SFR
sfr
// shangrila : 2015-09-03 Shangri‐La International Hotel Management Limited
shangrila
// sharp : 2014-05-01 Sharp Corporation
sharp
// shaw : 2015-04-23 Shaw Cablesystems G.P.
shaw
// shell : 2015-07-30 Shell Information Technology International Inc
shell
// shia : 2014-09-04 Asia Green IT System Bilgisayar San. ve Tic. Ltd. Sti.
shia
// shiksha : 2013-11-14 Afilias Limited
shiksha
// shoes : 2013-10-02 Binky Moon, LLC
shoes
// shop : 2016-04-08 GMO Registry, Inc.
shop
// shopping : 2016-03-31 Binky Moon, LLC
shopping
// shouji : 2015-01-08 QIHOO 360 TECHNOLOGY CO. LTD.
shouji
// show : 2015-03-05 Binky Moon, LLC
show
// showtime : 2015-08-06 CBS Domains Inc.
showtime
// shriram : 2014-01-23 Shriram Capital Ltd.
shriram
// silk : 2015-06-25 Amazon Registry Services, Inc.
silk
// sina : 2015-03-12 Sina Corporation
sina
// singles : 2013-08-27 Binky Moon, LLC
singles
// site : 2015-01-15 DotSite Inc.
site
// ski : 2015-04-09 Afilias Limited
ski
// skin : 2015-01-15 L'Oréal
skin
// sky : 2014-06-19 Sky International AG
sky
// skype : 2014-12-18 Microsoft Corporation
skype
// sling : 2015-07-30 DISH Technologies L.L.C.
sling
// smart : 2015-07-09 Smart Communications, Inc. (SMART)
smart
// smile : 2014-12-18 Amazon Registry Services, Inc.
smile
// sncf : 2015-02-19 Société Nationale des Chemins de fer Francais S N C F
sncf
// soccer : 2015-03-26 Binky Moon, LLC
soccer
// social : 2013-11-07 Dog Beach, LLC
social
// softbank : 2015-07-02 SoftBank Group Corp.
softbank
// software : 2014-03-20 Dog Beach, LLC
software
// sohu : 2013-12-19 Sohu.com Limited
sohu
// solar : 2013-11-07 Binky Moon, LLC
solar
// solutions : 2013-11-07 Binky Moon, LLC
solutions
// song : 2015-02-26 Amazon Registry Services, Inc.
song
// sony : 2015-01-08 Sony Corporation
sony
// soy : 2014-01-23 Charleston Road Registry Inc.
soy
// spa : 2019-09-19 Asia Spa and Wellness Promotion Council Limited
spa
// space : 2014-04-03 DotSpace Inc.
space
// sport : 2017-11-16 Global Association of International Sports Federations (GAISF)
sport
// spot : 2015-02-26 Amazon Registry Services, Inc.
spot
// spreadbetting : 2014-12-11 Dotspreadbetting Registry Limited
spreadbetting
// srl : 2015-05-07 InterNetX, Corp
srl
// stada : 2014-11-13 STADA Arzneimittel AG
stada
// staples : 2015-07-30 Staples, Inc.
staples
// star : 2015-01-08 Star India Private Limited
star
// statebank : 2015-03-12 STATE BANK OF INDIA
statebank
// statefarm : 2015-07-30 State Farm Mutual Automobile Insurance Company
statefarm
// stc : 2014-10-09 Saudi Telecom Company
stc
// stcgroup : 2014-10-09 Saudi Telecom Company
stcgroup
// stockholm : 2014-12-18 Stockholms kommun
stockholm
// storage : 2014-12-22 XYZ.COM LLC
storage
// store : 2015-04-09 DotStore Inc.
store
// stream : 2016-01-08 dot Stream Limited
stream
// studio : 2015-02-11 Dog Beach, LLC
studio
// study : 2014-12-11 OPEN UNIVERSITIES AUSTRALIA PTY LTD
study
// style : 2014-12-04 Binky Moon, LLC
style
// sucks : 2014-12-22 Vox Populi Registry Ltd.
sucks
// supplies : 2013-12-19 Binky Moon, LLC
supplies
// supply : 2013-12-19 Binky Moon, LLC
supply
// support : 2013-10-24 Binky Moon, LLC
support
// surf : 2014-01-09 Minds + Machines Group Limited
surf
// surgery : 2014-03-20 Binky Moon, LLC
surgery
// suzuki : 2014-02-20 SUZUKI MOTOR CORPORATION
suzuki
// swatch : 2015-01-08 The Swatch Group Ltd
swatch
// swiftcover : 2015-07-23 Swiftcover Insurance Services Limited
swiftcover
// swiss : 2014-10-16 Swiss Confederation
swiss
// sydney : 2014-09-18 State of New South Wales, Department of Premier and Cabinet
sydney
// symantec : 2014-12-04 Symantec Corporation
symantec
// systems : 2013-11-07 Binky Moon, LLC
systems
// tab : 2014-12-04 Tabcorp Holdings Limited
tab
// taipei : 2014-07-10 Taipei City Government
taipei
// talk : 2015-04-09 Amazon Registry Services, Inc.
talk
// taobao : 2015-01-15 Alibaba Group Holding Limited
taobao
// target : 2015-07-31 Target Domain Holdings, LLC
target
// tatamotors : 2015-03-12 Tata Motors Ltd
tatamotors
// tatar : 2014-04-24 Limited Liability Company "Coordination Center of Regional Domain of Tatarstan Republic"
tatar
// tattoo : 2013-08-30 Uniregistry, Corp.
tattoo
// tax : 2014-03-20 Binky Moon, LLC
tax
// taxi : 2015-03-19 Binky Moon, LLC
taxi
// tci : 2014-09-12 Asia Green IT System Bilgisayar San. ve Tic. Ltd. Sti.
tci
// tdk : 2015-06-11 TDK Corporation
tdk
// team : 2015-03-05 Binky Moon, LLC
team
// tech : 2015-01-30 Personals TLD Inc.
tech
// technology : 2013-09-13 Binky Moon, LLC
technology
// telefonica : 2014-10-16 Telefónica S.A.
telefonica
// temasek : 2014-08-07 Temasek Holdings (Private) Limited
temasek
// tennis : 2014-12-04 Binky Moon, LLC
tennis
// teva : 2015-07-02 Teva Pharmaceutical Industries Limited
teva
// thd : 2015-04-02 Home Depot Product Authority, LLC
thd
// theater : 2015-03-19 Binky Moon, LLC
theater
// theatre : 2015-05-07 XYZ.COM LLC
theatre
// tiaa : 2015-07-23 Teachers Insurance and Annuity Association of America
tiaa
// tickets : 2015-02-05 Accent Media Limited
tickets
// tienda : 2013-11-14 Binky Moon, LLC
tienda
// tiffany : 2015-01-30 Tiffany and Company
tiffany
// tips : 2013-09-20 Binky Moon, LLC
tips
// tires : 2014-11-07 Binky Moon, LLC
tires
// tirol : 2014-04-24 punkt Tirol GmbH
tirol
// tjmaxx : 2015-07-16 The TJX Companies, Inc.
tjmaxx
// tjx : 2015-07-16 The TJX Companies, Inc.
tjx
// tkmaxx : 2015-07-16 The TJX Companies, Inc.
tkmaxx
// tmall : 2015-01-15 Alibaba Group Holding Limited
tmall
// today : 2013-09-20 Binky Moon, LLC
today
// tokyo : 2013-11-13 GMO Registry, Inc.
tokyo
// tools : 2013-11-21 Binky Moon, LLC
tools
// top : 2014-03-20 .TOP Registry
top
// toray : 2014-12-18 Toray Industries, Inc.
toray
// toshiba : 2014-04-10 TOSHIBA Corporation
toshiba
// total : 2015-08-06 Total SA
total
// tours : 2015-01-22 Binky Moon, LLC
tours
// town : 2014-03-06 Binky Moon, LLC
town
// toyota : 2015-04-23 TOYOTA MOTOR CORPORATION
toyota
// toys : 2014-03-06 Binky Moon, LLC
toys
// trade : 2014-01-23 Elite Registry Limited
trade
// trading : 2014-12-11 Dottrading Registry Limited
trading
// training : 2013-11-07 Binky Moon, LLC
training
// travel : Dog Beach, LLC
travel
// travelchannel : 2015-07-02 Lifestyle Domain Holdings, Inc.
travelchannel
// travelers : 2015-03-26 Travelers TLD, LLC
travelers
// travelersinsurance : 2015-03-26 Travelers TLD, LLC
travelersinsurance
// trust : 2014-10-16 NCC Group Inc.
trust
// trv : 2015-03-26 Travelers TLD, LLC
trv
// tube : 2015-06-11 Latin American Telecom LLC
tube
// tui : 2014-07-03 TUI AG
tui
// tunes : 2015-02-26 Amazon Registry Services, Inc.
tunes
// tushu : 2014-12-18 Amazon Registry Services, Inc.
tushu
// tvs : 2015-02-19 T V SUNDRAM IYENGAR & SONS LIMITED
tvs
// ubank : 2015-08-20 National Australia Bank Limited
ubank
// ubs : 2014-12-11 UBS AG
ubs
// unicom : 2015-10-15 China United Network Communications Corporation Limited
unicom
// university : 2014-03-06 Binky Moon, LLC
university
// uno : 2013-09-11 DotSite Inc.
uno
// uol : 2014-05-01 UBN INTERNET LTDA.
uol
// ups : 2015-06-25 UPS Market Driver, Inc.
ups
// vacations : 2013-12-05 Binky Moon, LLC
vacations
// vana : 2014-12-11 Lifestyle Domain Holdings, Inc.
vana
// vanguard : 2015-09-03 The Vanguard Group, Inc.
vanguard
// vegas : 2014-01-16 Dot Vegas, Inc.
vegas
// ventures : 2013-08-27 Binky Moon, LLC
ventures
// verisign : 2015-08-13 VeriSign, Inc.
verisign
// versicherung : 2014-03-20 tldbox GmbH
versicherung
// vet : 2014-03-06 Dog Beach, LLC
vet
// viajes : 2013-10-17 Binky Moon, LLC
viajes
// video : 2014-10-16 Dog Beach, LLC
video
// vig : 2015-05-14 VIENNA INSURANCE GROUP AG Wiener Versicherung Gruppe
vig
// viking : 2015-04-02 Viking River Cruises (Bermuda) Ltd.
viking
// villas : 2013-12-05 Binky Moon, LLC
villas
// vin : 2015-06-18 Binky Moon, LLC
vin
// vip : 2015-01-22 Minds + Machines Group Limited
vip
// virgin : 2014-09-25 Virgin Enterprises Limited
virgin
// visa : 2015-07-30 Visa Worldwide Pte. Limited
visa
// vision : 2013-12-05 Binky Moon, LLC
vision
// vistaprint : 2014-09-18 Vistaprint Limited
vistaprint
// viva : 2014-11-07 Saudi Telecom Company
viva
// vivo : 2015-07-31 Telefonica Brasil S.A.
vivo
// vlaanderen : 2014-02-06 DNS.be vzw
vlaanderen
// vodka : 2013-12-19 Minds + Machines Group Limited
vodka
// volkswagen : 2015-05-14 Volkswagen Group of America Inc.
volkswagen
// volvo : 2015-11-12 Volvo Holding Sverige Aktiebolag
volvo
// vote : 2013-11-21 Monolith Registry LLC
vote
// voting : 2013-11-13 Valuetainment Corp.
voting
// voto : 2013-11-21 Monolith Registry LLC
voto
// voyage : 2013-08-27 Binky Moon, LLC
voyage
// vuelos : 2015-03-05 Travel Reservations SRL
vuelos
// wales : 2014-05-08 Nominet UK
wales
// walmart : 2015-07-31 Wal-Mart Stores, Inc.
walmart
// walter : 2014-11-13 Sandvik AB
walter
// wang : 2013-10-24 Zodiac Wang Limited
wang
// wanggou : 2014-12-18 Amazon Registry Services, Inc.
wanggou
// watch : 2013-11-14 Binky Moon, LLC
watch
// watches : 2014-12-22 Richemont DNS Inc.
watches
// weather : 2015-01-08 International Business Machines Corporation
weather
// weatherchannel : 2015-03-12 International Business Machines Corporation
weatherchannel
// webcam : 2014-01-23 dot Webcam Limited
webcam
// weber : 2015-06-04 Saint-Gobain Weber SA
weber
// website : 2014-04-03 DotWebsite Inc.
website
// wed : 2013-10-01 Atgron, Inc.
wed
// wedding : 2014-04-24 Minds + Machines Group Limited
wedding
// weibo : 2015-03-05 Sina Corporation
weibo
// weir : 2015-01-29 Weir Group IP Limited
weir
// whoswho : 2014-02-20 Who's Who Registry
whoswho
// wien : 2013-10-28 punkt.wien GmbH
wien
// wiki : 2013-11-07 Top Level Design, LLC
wiki
// williamhill : 2014-03-13 William Hill Organization Limited
williamhill
// win : 2014-11-20 First Registry Limited
win
// windows : 2014-12-18 Microsoft Corporation
windows
// wine : 2015-06-18 Binky Moon, LLC
wine
// winners : 2015-07-16 The TJX Companies, Inc.
winners
// wme : 2014-02-13 William Morris Endeavor Entertainment, LLC
wme
// wolterskluwer : 2015-08-06 Wolters Kluwer N.V.
wolterskluwer
// woodside : 2015-07-09 Woodside Petroleum Limited
woodside
// work : 2013-12-19 Minds + Machines Group Limited
work
// works : 2013-11-14 Binky Moon, LLC
works
// world : 2014-06-12 Binky Moon, LLC
world
// wow : 2015-10-08 Amazon Registry Services, Inc.
wow
// wtc : 2013-12-19 World Trade Centers Association, Inc.
wtc
// wtf : 2014-03-06 Binky Moon, LLC
wtf
// xbox : 2014-12-18 Microsoft Corporation
xbox
// xerox : 2014-10-24 Xerox DNHC LLC
xerox
// xfinity : 2015-07-09 Comcast IP Holdings I, LLC
xfinity
// xihuan : 2015-01-08 QIHOO 360 TECHNOLOGY CO. LTD.
xihuan
// xin : 2014-12-11 Elegant Leader Limited
xin
// xn--11b4c3d : 2015-01-15 VeriSign Sarl
कॉम
// xn--1ck2e1b : 2015-02-26 Amazon Registry Services, Inc.
セール
// xn--1qqw23a : 2014-01-09 Guangzhou YU Wei Information Technology Co., Ltd.
佛山
// xn--30rr7y : 2014-06-12 Excellent First Limited
慈善
// xn--3bst00m : 2013-09-13 Eagle Horizon Limited
集团
// xn--3ds443g : 2013-09-08 TLD REGISTRY LIMITED OY
在线
// xn--3oq18vl8pn36a : 2015-07-02 Volkswagen (China) Investment Co., Ltd.
大众汽车
// xn--3pxu8k : 2015-01-15 VeriSign Sarl
点看
// xn--42c2d9a : 2015-01-15 VeriSign Sarl
คอม
// xn--45q11c : 2013-11-21 Zodiac Gemini Ltd
八卦
// xn--4gbrim : 2013-10-04 Suhub Electronic Establishment
موقع
// xn--55qw42g : 2013-11-08 China Organizational Name Administration Center
公益
// xn--55qx5d : 2013-11-14 China Internet Network Information Center (CNNIC)
公司
// xn--5su34j936bgsg : 2015-09-03 Shangri‐La International Hotel Management Limited
香格里拉
// xn--5tzm5g : 2014-12-22 Global Website TLD Asia Limited
网站
// xn--6frz82g : 2013-09-23 Afilias Limited
移动
// xn--6qq986b3xl : 2013-09-13 Tycoon Treasure Limited
我爱你
// xn--80adxhks : 2013-12-19 Foundation for Assistance for Internet Technologies and Infrastructure Development (FAITID)
москва
// xn--80aqecdr1a : 2015-10-21 Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
католик
// xn--80asehdb : 2013-07-14 CORE Association
онлайн
// xn--80aswg : 2013-07-14 CORE Association
сайт
// xn--8y0a063a : 2015-03-26 China United Network Communications Corporation Limited
联通
// xn--9dbq2a : 2015-01-15 VeriSign Sarl
קום
// xn--9et52u : 2014-06-12 RISE VICTORY LIMITED
时尚
// xn--9krt00a : 2015-03-12 Sina Corporation
微博
// xn--b4w605ferd : 2014-08-07 Temasek Holdings (Private) Limited
淡马锡
// xn--bck1b9a5dre4c : 2015-02-26 Amazon Registry Services, Inc.
ファッション
// xn--c1avg : 2013-11-14 Public Interest Registry
орг
// xn--c2br7g : 2015-01-15 VeriSign Sarl
नेट
// xn--cck2b3b : 2015-02-26 Amazon Registry Services, Inc.
ストア
// xn--cg4bki : 2013-09-27 SAMSUNG SDS CO., LTD
삼성
// xn--czr694b : 2014-01-16 Internet DotTrademark Organisation Limited
商标
// xn--czrs0t : 2013-12-19 Binky Moon, LLC
商店
// xn--czru2d : 2013-11-21 Zodiac Aquarius Limited
商城
// xn--d1acj3b : 2013-11-20 The Foundation for Network Initiatives “The Smart Internet”
дети
// xn--eckvdtc9d : 2014-12-18 Amazon Registry Services, Inc.
ポイント
// xn--efvy88h : 2014-08-22 Guangzhou YU Wei Information Technology Co., Ltd.
新闻
// xn--estv75g : 2015-02-19 Industrial and Commercial Bank of China Limited
工行
// xn--fct429k : 2015-04-09 Amazon Registry Services, Inc.
家電
// xn--fhbei : 2015-01-15 VeriSign Sarl
كوم
// xn--fiq228c5hs : 2013-09-08 TLD REGISTRY LIMITED OY
中文网
// xn--fiq64b : 2013-10-14 CITIC Group Corporation
中信
// xn--fjq720a : 2014-05-22 Binky Moon, LLC
娱乐
// xn--flw351e : 2014-07-31 Charleston Road Registry Inc.
谷歌
// xn--fzys8d69uvgm : 2015-05-14 PCCW Enterprises Limited
電訊盈科
// xn--g2xx48c : 2015-01-30 Minds + Machines Group Limited
购物
// xn--gckr3f0f : 2015-02-26 Amazon Registry Services, Inc.
クラウド
// xn--gk3at1e : 2015-10-08 Amazon Registry Services, Inc.
通販
// xn--hxt814e : 2014-05-15 Zodiac Taurus Limited
网店
// xn--i1b6b1a6a2e : 2013-11-14 Public Interest Registry
संगठन
// xn--imr513n : 2014-12-11 Internet DotTrademark Organisation Limited
餐厅
// xn--io0a7i : 2013-11-14 China Internet Network Information Center (CNNIC)
网络
// xn--j1aef : 2015-01-15 VeriSign Sarl
ком
// xn--jlq61u9w7b : 2015-01-08 Nokia Corporation
诺基亚
// xn--jvr189m : 2015-02-26 Amazon Registry Services, Inc.
食品
// xn--kcrx77d1x4a : 2014-11-07 Koninklijke Philips N.V.
飞利浦
// xn--kpu716f : 2014-12-22 Richemont DNS Inc.
手表
// xn--kput3i : 2014-02-13 Beijing RITT-Net Technology Development Co., Ltd
手机
// xn--mgba3a3ejt : 2014-11-20 Aramco Services Company
ارامكو
// xn--mgba7c0bbn0a : 2015-05-14 Crescent Holding GmbH
العليان
// xn--mgbaakc7dvf : 2015-09-03 Emirates Telecommunications Corporation (trading as Etisalat)
اتصالات
// xn--mgbab2bd : 2013-10-31 CORE Association
بازار
// xn--mgbca7dzdo : 2015-07-30 Abu Dhabi Systems and Information Centre
ابوظبي
// xn--mgbi4ecexp : 2015-10-21 Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
كاثوليك
// xn--mgbt3dhd : 2014-09-04 Asia Green IT System Bilgisayar San. ve Tic. Ltd. Sti.
همراه
// xn--mk1bu44c : 2015-01-15 VeriSign Sarl
닷컴
// xn--mxtq1m : 2014-03-06 Net-Chinese Co., Ltd.
政府
// xn--ngbc5azd : 2013-07-13 International Domain Registry Pty. Ltd.
شبكة
// xn--ngbe9e0a : 2014-12-04 Kuwait Finance House
بيتك
// xn--ngbrx : 2015-11-12 League of Arab States
عرب
// xn--nqv7f : 2013-11-14 Public Interest Registry
机构
// xn--nqv7fs00ema : 2013-11-14 Public Interest Registry
组织机构
// xn--nyqy26a : 2014-11-07 Stable Tone Limited
健康
// xn--otu796d : 2017-08-06 Internet DotTrademark Organisation Limited
招聘
// xn--p1acf : 2013-12-12 Rusnames Limited
рус
// xn--pbt977c : 2014-12-22 Richemont DNS Inc.
珠宝
// xn--pssy2u : 2015-01-15 VeriSign Sarl
大拿
// xn--q9jyb4c : 2013-09-17 Charleston Road Registry Inc.
みんな
// xn--qcka1pmc : 2014-07-31 Charleston Road Registry Inc.
グーグル
// xn--rhqv96g : 2013-09-11 Stable Tone Limited
世界
// xn--rovu88b : 2015-02-26 Amazon Registry Services, Inc.
書籍
// xn--ses554g : 2014-01-16 KNET Co., Ltd.
网址
// xn--t60b56a : 2015-01-15 VeriSign Sarl
닷넷
// xn--tckwe : 2015-01-15 VeriSign Sarl
コム
// xn--tiq49xqyj : 2015-10-21 Pontificium Consilium de Comunicationibus Socialibus (PCCS) (Pontifical Council for Social Communication)
天主教
// xn--unup4y : 2013-07-14 Binky Moon, LLC
游戏
// xn--vermgensberater-ctb : 2014-06-23 Deutsche Vermögensberatung Aktiengesellschaft DVAG
vermögensberater
// xn--vermgensberatung-pwb : 2014-06-23 Deutsche Vermögensberatung Aktiengesellschaft DVAG
vermögensberatung
// xn--vhquv : 2013-08-27 Binky Moon, LLC
企业
// xn--vuq861b : 2014-10-16 Beijing Tele-info Network Technology Co., Ltd.
信息
// xn--w4r85el8fhu5dnra : 2015-04-30 Kerry Trading Co. Limited
嘉里大酒店
// xn--w4rs40l : 2015-07-30 Kerry Trading Co. Limited
嘉里
// xn--xhq521b : 2013-11-14 Guangzhou YU Wei Information Technology Co., Ltd.
广东
// xn--zfr164b : 2013-11-08 China Organizational Name Administration Center
政务
// xyz : 2013-12-05 XYZ.COM LLC
xyz
// yachts : 2014-01-09 DERYachts, LLC
yachts
// yahoo : 2015-04-02 Yahoo! Domain Services Inc.
yahoo
// yamaxun : 2014-12-18 Amazon Registry Services, Inc.
yamaxun
// yandex : 2014-04-10 YANDEX, LLC
yandex
// yodobashi : 2014-11-20 YODOBASHI CAMERA CO.,LTD.
yodobashi
// yoga : 2014-05-29 Minds + Machines Group Limited
yoga
// yokohama : 2013-12-12 GMO Registry, Inc.
yokohama
// you : 2015-04-09 Amazon Registry Services, Inc.
you
// youtube : 2014-05-01 Charleston Road Registry Inc.
youtube
// yun : 2015-01-08 QIHOO 360 TECHNOLOGY CO. LTD.
yun
// zappos : 2015-06-25 Amazon Registry Services, Inc.
zappos
// zara : 2014-11-07 Industria de Diseño Textil, S.A. (INDITEX, S.A.)
zara
// zero : 2014-12-18 Amazon Registry Services, Inc.
zero
// zip : 2014-05-08 Charleston Road Registry Inc.
zip
// zone : 2013-11-14 Binky Moon, LLC
zone
// zuerich : 2014-11-07 Kanton Zürich (Canton of Zurich)
zuerich
// ===END ICANN DOMAINS===
// ===BEGIN PRIVATE DOMAINS===
// (Note: these are in alphabetical order by company name)
// 1GB LLC : https://www.1gb.ua/
// Submitted by 1GB LLC
cc.ua
inf.ua
ltd.ua
// Agnat sp. z o.o. : https://domena.pl
// Submitted by Przemyslaw Plewa
beep.pl
// alboto.ca : http://alboto.ca
// Submitted by Anton Avramov
barsy.ca
// Alces Software Ltd : http://alces-software.com
// Submitted by Mark J. Titorenko
*.compute.estate
*.alces.network
// Altervista: https://www.altervista.org
// Submitted by Carlo Cannas
altervista.org
// alwaysdata : https://www.alwaysdata.com
// Submitted by Cyril
alwaysdata.net
// Amazon CloudFront : https://aws.amazon.com/cloudfront/
// Submitted by Donavan Miller
cloudfront.net
// Amazon Elastic Compute Cloud : https://aws.amazon.com/ec2/
// Submitted by Luke Wells
*.compute.amazonaws.com
*.compute-1.amazonaws.com
*.compute.amazonaws.com.cn
us-east-1.amazonaws.com
// Amazon Elastic Beanstalk : https://aws.amazon.com/elasticbeanstalk/
// Submitted by Luke Wells
cn-north-1.eb.amazonaws.com.cn
cn-northwest-1.eb.amazonaws.com.cn
elasticbeanstalk.com
ap-northeast-1.elasticbeanstalk.com
ap-northeast-2.elasticbeanstalk.com
ap-northeast-3.elasticbeanstalk.com
ap-south-1.elasticbeanstalk.com
ap-southeast-1.elasticbeanstalk.com
ap-southeast-2.elasticbeanstalk.com
ca-central-1.elasticbeanstalk.com
eu-central-1.elasticbeanstalk.com
eu-west-1.elasticbeanstalk.com
eu-west-2.elasticbeanstalk.com
eu-west-3.elasticbeanstalk.com
sa-east-1.elasticbeanstalk.com
us-east-1.elasticbeanstalk.com
us-east-2.elasticbeanstalk.com
us-gov-west-1.elasticbeanstalk.com
us-west-1.elasticbeanstalk.com
us-west-2.elasticbeanstalk.com
// Amazon Elastic Load Balancing : https://aws.amazon.com/elasticloadbalancing/
// Submitted by Luke Wells
*.elb.amazonaws.com
*.elb.amazonaws.com.cn
// Amazon S3 : https://aws.amazon.com/s3/
// Submitted by Luke Wells
s3.amazonaws.com
s3-ap-northeast-1.amazonaws.com
s3-ap-northeast-2.amazonaws.com
s3-ap-south-1.amazonaws.com
s3-ap-southeast-1.amazonaws.com
s3-ap-southeast-2.amazonaws.com
s3-ca-central-1.amazonaws.com
s3-eu-central-1.amazonaws.com
s3-eu-west-1.amazonaws.com
s3-eu-west-2.amazonaws.com
s3-eu-west-3.amazonaws.com
s3-external-1.amazonaws.com
s3-fips-us-gov-west-1.amazonaws.com
s3-sa-east-1.amazonaws.com
s3-us-gov-west-1.amazonaws.com
s3-us-east-2.amazonaws.com
s3-us-west-1.amazonaws.com
s3-us-west-2.amazonaws.com
s3.ap-northeast-2.amazonaws.com
s3.ap-south-1.amazonaws.com
s3.cn-north-1.amazonaws.com.cn
s3.ca-central-1.amazonaws.com
s3.eu-central-1.amazonaws.com
s3.eu-west-2.amazonaws.com
s3.eu-west-3.amazonaws.com
s3.us-east-2.amazonaws.com
s3.dualstack.ap-northeast-1.amazonaws.com
s3.dualstack.ap-northeast-2.amazonaws.com
s3.dualstack.ap-south-1.amazonaws.com
s3.dualstack.ap-southeast-1.amazonaws.com
s3.dualstack.ap-southeast-2.amazonaws.com
s3.dualstack.ca-central-1.amazonaws.com
s3.dualstack.eu-central-1.amazonaws.com
s3.dualstack.eu-west-1.amazonaws.com
s3.dualstack.eu-west-2.amazonaws.com
s3.dualstack.eu-west-3.amazonaws.com
s3.dualstack.sa-east-1.amazonaws.com
s3.dualstack.us-east-1.amazonaws.com
s3.dualstack.us-east-2.amazonaws.com
s3-website-us-east-1.amazonaws.com
s3-website-us-west-1.amazonaws.com
s3-website-us-west-2.amazonaws.com
s3-website-ap-northeast-1.amazonaws.com
s3-website-ap-southeast-1.amazonaws.com
s3-website-ap-southeast-2.amazonaws.com
s3-website-eu-west-1.amazonaws.com
s3-website-sa-east-1.amazonaws.com
s3-website.ap-northeast-2.amazonaws.com
s3-website.ap-south-1.amazonaws.com
s3-website.ca-central-1.amazonaws.com
s3-website.eu-central-1.amazonaws.com
s3-website.eu-west-2.amazonaws.com
s3-website.eu-west-3.amazonaws.com
s3-website.us-east-2.amazonaws.com
// Amune : https://amune.org/
// Submitted by Team Amune
t3l3p0rt.net
tele.amune.org
// Apigee : https://apigee.com/
// Submitted by Apigee Security Team
apigee.io
// Aptible : https://www.aptible.com/
// Submitted by Thomas Orozco
on-aptible.com
// ASEINet : https://www.aseinet.com/
// Submitted by Asei SEKIGUCHI
user.aseinet.ne.jp
gv.vc
d.gv.vc
// Asociación Amigos de la Informática "Euskalamiga" : http://encounter.eus/
// Submitted by Hector Martin
user.party.eus
// Association potager.org : https://potager.org/
// Submitted by Lunar
pimienta.org
poivron.org
potager.org
sweetpepper.org
// ASUSTOR Inc. : http://www.asustor.com
// Submitted by Vincent Tseng
myasustor.com
// AVM : https://avm.de
// Submitted by Andreas Weise
myfritz.net
// AW AdvisorWebsites.com Software Inc : https://advisorwebsites.com
// Submitted by James Kennedy
*.awdev.ca
*.advisor.ws
// b-data GmbH : https://www.b-data.io
// Submitted by Olivier Benz
b-data.io
// backplane : https://www.backplane.io
// Submitted by Anthony Voutas
backplaneapp.io
// Balena : https://www.balena.io
// Submitted by Petros Angelatos
balena-devices.com
// Banzai Cloud
// Submitted by Gabor Kozma
app.banzaicloud.io
// BetaInABox
// Submitted by Adrian
betainabox.com
// BinaryLane : http://www.binarylane.com
// Submitted by Nathan O'Sullivan
bnr.la
// Blackbaud, Inc. : https://www.blackbaud.com
// Submitted by Paul Crowder
blackbaudcdn.net
// Boomla : https://boomla.com
// Submitted by Tibor Halter
boomla.net
// Boxfuse : https://boxfuse.com
// Submitted by Axel Fontaine
boxfuse.io
// bplaced : https://www.bplaced.net/
// Submitted by Miroslav Bozic
square7.ch
bplaced.com
bplaced.de
square7.de
bplaced.net
square7.net
// BrowserSafetyMark
// Submitted by Dave Tharp
browsersafetymark.io
// Bytemark Hosting : https://www.bytemark.co.uk
// Submitted by Paul Cammish
uk0.bigv.io
dh.bytemark.co.uk
vm.bytemark.co.uk
// callidomus : https://www.callidomus.com/
// Submitted by Marcus Popp
mycd.eu
// Carrd : https://carrd.co
// Submitted by AJ
carrd.co
crd.co
uwu.ai
// CentralNic : http://www.centralnic.com/names/domains
// Submitted by registry
ae.org
ar.com
br.com
cn.com
com.de
com.se
de.com
eu.com
gb.com
gb.net
hu.com
hu.net
jp.net
jpn.com
kr.com
mex.com
no.com
qc.com
ru.com
sa.com
se.net
uk.com
uk.net
us.com
uy.com
za.bz
za.com
// Africa.com Web Solutions Ltd : https://registry.africa.com
// Submitted by Gavin Brown
africa.com
// iDOT Services Limited : http://www.domain.gr.com
// Submitted by Gavin Brown
gr.com
// Radix FZC : http://domains.in.net
// Submitted by Gavin Brown
in.net
// US REGISTRY LLC : http://us.org
// Submitted by Gavin Brown
us.org
// co.com Registry, LLC : https://registry.co.com
// Submitted by Gavin Brown
co.com
// c.la : http://www.c.la/
c.la
// certmgr.org : https://certmgr.org
// Submitted by B. Blechschmidt
certmgr.org
// Citrix : https://citrix.com
// Submitted by Alex Stoddard
xenapponazure.com
// Civilized Discourse Construction Kit, Inc. : https://www.discourse.org/
// Submitted by Rishabh Nambiar
discourse.group
// ClearVox : http://www.clearvox.nl/
// Submitted by Leon Rowland
virtueeldomein.nl
// Clever Cloud : https://www.clever-cloud.com/
// Submitted by Quentin Adam
cleverapps.io
// Clerk : https://www.clerk.dev
// Submitted by Colin Sidoti
*.lcl.dev
*.stg.dev
// Cloud66 : https://www.cloud66.com/
// Submitted by Khash Sajadi
c66.me
cloud66.ws
cloud66.zone
// CloudAccess.net : https://www.cloudaccess.net/
// Submitted by Pawel Panek
jdevcloud.com
wpdevcloud.com
cloudaccess.host
freesite.host
cloudaccess.net
// cloudControl : https://www.cloudcontrol.com/
// Submitted by Tobias Wilken
cloudcontrolled.com
cloudcontrolapp.com
// Cloudera, Inc. : https://www.cloudera.com/
// Submitted by Philip Langdale
cloudera.site
// Cloudflare, Inc. : https://www.cloudflare.com/
// Submitted by Jake Riesterer
trycloudflare.com
workers.dev
// Clovyr : https://clovyr.io
// Submitted by Patrick Nielsen
wnext.app
// co.ca : http://registry.co.ca/
co.ca
// Co & Co : https://co-co.nl/
// Submitted by Govert Versluis
*.otap.co
// i-registry s.r.o. : http://www.i-registry.cz/
// Submitted by Martin Semrad
co.cz
// CDN77.com : http://www.cdn77.com
// Submitted by Jan Krpes
c.cdn77.org
cdn77-ssl.net
r.cdn77.net
rsc.cdn77.org
ssl.origin.cdn77-secure.org
// Cloud DNS Ltd : http://www.cloudns.net
// Submitted by Aleksander Hristov
cloudns.asia
cloudns.biz
cloudns.club
cloudns.cc
cloudns.eu
cloudns.in
cloudns.info
cloudns.org
cloudns.pro
cloudns.pw
cloudns.us
// Cloudeity Inc : https://cloudeity.com
// Submitted by Stefan Dimitrov
cloudeity.net
// CNPY : https://cnpy.gdn
// Submitted by Angelo Gladding
cnpy.gdn
// CoDNS B.V.
co.nl
co.no
// Combell.com : https://www.combell.com
// Submitted by Thomas Wouters
webhosting.be
hosting-cluster.nl
// COSIMO GmbH : http://www.cosimo.de
// Submitted by Rene Marticke
dyn.cosidns.de
dynamisches-dns.de
dnsupdater.de
internet-dns.de
l-o-g-i-n.de
dynamic-dns.info
feste-ip.net
knx-server.net
static-access.net
// Craynic, s.r.o. : http://www.craynic.com/
// Submitted by Ales Krajnik
realm.cz
// Cryptonomic : https://cryptonomic.net/
// Submitted by Andrew Cady
*.cryptonomic.net
// Cupcake : https://cupcake.io/
// Submitted by Jonathan Rudenberg
cupcake.is
// cyon GmbH : https://www.cyon.ch/
// Submitted by Dominic Luechinger
cyon.link
cyon.site
// Daplie, Inc : https://daplie.com
// Submitted by AJ ONeal
daplie.me
localhost.daplie.me
// Datto, Inc. : https://www.datto.com/
// Submitted by Philipp Heckel
dattolocal.com
dattorelay.com
dattoweb.com
mydatto.com
dattolocal.net
mydatto.net
// Dansk.net : http://www.dansk.net/
// Submitted by Anani Voule
biz.dk
co.dk
firm.dk
reg.dk
store.dk
// dapps.earth : https://dapps.earth/
// Submitted by Daniil Burdakov
*.dapps.earth
*.bzz.dapps.earth
// Debian : https://www.debian.org/
// Submitted by Peter Palfrader / Debian Sysadmin Team
debian.net
// deSEC : https://desec.io/
// Submitted by Peter Thomassen
dedyn.io
// DNShome : https://www.dnshome.de/
// Submitted by Norbert Auler
dnshome.de
// DotArai : https://www.dotarai.com/
// Submitted by Atsadawat Netcharadsang
online.th
shop.th
// DrayTek Corp. : https://www.draytek.com/
// Submitted by Paul Fang
drayddns.com
// DreamHost : http://www.dreamhost.com/
// Submitted by Andrew Farmer
dreamhosters.com
// Drobo : http://www.drobo.com/
// Submitted by Ricardo Padilha
mydrobo.com
// Drud Holdings, LLC. : https://www.drud.com/
// Submitted by Kevin Bridges
drud.io
drud.us
// DuckDNS : http://www.duckdns.org/
// Submitted by Richard Harper
duckdns.org
// dy.fi : http://dy.fi/
// Submitted by Heikki Hannikainen
dy.fi
tunk.org
// DynDNS.com : http://www.dyndns.com/services/dns/dyndns/
dyndns-at-home.com
dyndns-at-work.com
dyndns-blog.com
dyndns-free.com
dyndns-home.com
dyndns-ip.com
dyndns-mail.com
dyndns-office.com
dyndns-pics.com
dyndns-remote.com
dyndns-server.com
dyndns-web.com
dyndns-wiki.com
dyndns-work.com
dyndns.biz
dyndns.info
dyndns.org
dyndns.tv
at-band-camp.net
ath.cx
barrel-of-knowledge.info
barrell-of-knowledge.info
better-than.tv
blogdns.com
blogdns.net
blogdns.org
blogsite.org
boldlygoingnowhere.org
broke-it.net
buyshouses.net
cechire.com
dnsalias.com
dnsalias.net
dnsalias.org
dnsdojo.com
dnsdojo.net
dnsdojo.org
does-it.net
doesntexist.com
doesntexist.org
dontexist.com
dontexist.net
dontexist.org
doomdns.com
doomdns.org
dvrdns.org
dyn-o-saur.com
dynalias.com
dynalias.net
dynalias.org
dynathome.net
dyndns.ws
endofinternet.net
endofinternet.org
endoftheinternet.org
est-a-la-maison.com
est-a-la-masion.com
est-le-patron.com
est-mon-blogueur.com
for-better.biz
for-more.biz
for-our.info
for-some.biz
for-the.biz
forgot.her.name
forgot.his.name
from-ak.com
from-al.com
from-ar.com
from-az.net
from-ca.com
from-co.net
from-ct.com
from-dc.com
from-de.com
from-fl.com
from-ga.com
from-hi.com
from-ia.com
from-id.com
from-il.com
from-in.com
from-ks.com
from-ky.com
from-la.net
from-ma.com
from-md.com
from-me.org
from-mi.com
from-mn.com
from-mo.com
from-ms.com
from-mt.com
from-nc.com
from-nd.com
from-ne.com
from-nh.com
from-nj.com
from-nm.com
from-nv.com
from-ny.net
from-oh.com
from-ok.com
from-or.com
from-pa.com
from-pr.com
from-ri.com
from-sc.com
from-sd.com
from-tn.com
from-tx.com
from-ut.com
from-va.com
from-vt.com
from-wa.com
from-wi.com
from-wv.com
from-wy.com
ftpaccess.cc
fuettertdasnetz.de
game-host.org
game-server.cc
getmyip.com
gets-it.net
go.dyndns.org
gotdns.com
gotdns.org
groks-the.info
groks-this.info
ham-radio-op.net
here-for-more.info
hobby-site.com
hobby-site.org
home.dyndns.org
homedns.org
homeftp.net
homeftp.org
homeip.net
homelinux.com
homelinux.net
homelinux.org
homeunix.com
homeunix.net
homeunix.org
iamallama.com
in-the-band.net
is-a-anarchist.com
is-a-blogger.com
is-a-bookkeeper.com
is-a-bruinsfan.org
is-a-bulls-fan.com
is-a-candidate.org
is-a-caterer.com
is-a-celticsfan.org
is-a-chef.com
is-a-chef.net
is-a-chef.org
is-a-conservative.com
is-a-cpa.com
is-a-cubicle-slave.com
is-a-democrat.com
is-a-designer.com
is-a-doctor.com
is-a-financialadvisor.com
is-a-geek.com
is-a-geek.net
is-a-geek.org
is-a-green.com
is-a-guru.com
is-a-hard-worker.com
is-a-hunter.com
is-a-knight.org
is-a-landscaper.com
is-a-lawyer.com
is-a-liberal.com
is-a-libertarian.com
is-a-linux-user.org
is-a-llama.com
is-a-musician.com
is-a-nascarfan.com
is-a-nurse.com
is-a-painter.com
is-a-patsfan.org
is-a-personaltrainer.com
is-a-photographer.com
is-a-player.com
is-a-republican.com
is-a-rockstar.com
is-a-socialist.com
is-a-soxfan.org
is-a-student.com
is-a-teacher.com
is-a-techie.com
is-a-therapist.com
is-an-accountant.com
is-an-actor.com
is-an-actress.com
is-an-anarchist.com
is-an-artist.com
is-an-engineer.com
is-an-entertainer.com
is-by.us
is-certified.com
is-found.org
is-gone.com
is-into-anime.com
is-into-cars.com
is-into-cartoons.com
is-into-games.com
is-leet.com
is-lost.org
is-not-certified.com
is-saved.org
is-slick.com
is-uberleet.com
is-very-bad.org
is-very-evil.org
is-very-good.org
is-very-nice.org
is-very-sweet.org
is-with-theband.com
isa-geek.com
isa-geek.net
isa-geek.org
isa-hockeynut.com
issmarterthanyou.com
isteingeek.de
istmein.de
kicks-ass.net
kicks-ass.org
knowsitall.info
land-4-sale.us
lebtimnetz.de
leitungsen.de
likes-pie.com
likescandy.com
merseine.nu
mine.nu
misconfused.org
mypets.ws
myphotos.cc
neat-url.com
office-on-the.net
on-the-web.tv
podzone.net
podzone.org
readmyblog.org
saves-the-whales.com
scrapper-site.net
scrapping.cc
selfip.biz
selfip.com
selfip.info
selfip.net
selfip.org
sells-for-less.com
sells-for-u.com
sells-it.net
sellsyourhome.org
servebbs.com
servebbs.net
servebbs.org
serveftp.net
serveftp.org
servegame.org
shacknet.nu
simple-url.com
space-to-rent.com
stuff-4-sale.org
stuff-4-sale.us
teaches-yoga.com
thruhere.net
traeumtgerade.de
webhop.biz
webhop.info
webhop.net
webhop.org
worse-than.tv
writesthisblog.com
// ddnss.de : https://www.ddnss.de/
// Submitted by Robert Niedziela
ddnss.de
dyn.ddnss.de
dyndns.ddnss.de
dyndns1.de
dyn-ip24.de
home-webserver.de
dyn.home-webserver.de
myhome-server.de
ddnss.org
// Definima : http://www.definima.com/
// Submitted by Maxence Bitterli
definima.net
definima.io
// dnstrace.pro : https://dnstrace.pro/
// Submitted by Chris Partridge
bci.dnstrace.pro
// Dynu.com : https://www.dynu.com/
// Submitted by Sue Ye
ddnsfree.com
ddnsgeek.com
giize.com
gleeze.com
kozow.com
loseyourip.com
ooguy.com
theworkpc.com
casacam.net
dynu.net
accesscam.org
camdvr.org
freeddns.org
mywire.org
webredirect.org
myddns.rocks
blogsite.xyz
// dynv6 : https://dynv6.com
// Submitted by Dominik Menke
dynv6.net
// E4YOU spol. s.r.o. : https://e4you.cz/
// Submitted by Vladimir Dudr
e4.cz
// Enalean SAS: https://www.enalean.com
// Submitted by Thomas Cottier
mytuleap.com
// ECG Robotics, Inc: https://ecgrobotics.org
// Submitted by
onred.one
staging.onred.one
// Enonic : http://enonic.com/
// Submitted by Erik Kaareng-Sunde
enonic.io
customer.enonic.io
// EU.org https://eu.org/
// Submitted by Pierre Beyssac
eu.org
al.eu.org
asso.eu.org
at.eu.org
au.eu.org
be.eu.org
bg.eu.org
ca.eu.org
cd.eu.org
ch.eu.org
cn.eu.org
cy.eu.org
cz.eu.org
de.eu.org
dk.eu.org
edu.eu.org
ee.eu.org
es.eu.org
fi.eu.org
fr.eu.org
gr.eu.org
hr.eu.org
hu.eu.org
ie.eu.org
il.eu.org
in.eu.org
int.eu.org
is.eu.org
it.eu.org
jp.eu.org
kr.eu.org
lt.eu.org
lu.eu.org
lv.eu.org
mc.eu.org
me.eu.org
mk.eu.org
mt.eu.org
my.eu.org
net.eu.org
ng.eu.org
nl.eu.org
no.eu.org
nz.eu.org
paris.eu.org
pl.eu.org
pt.eu.org
q-a.eu.org
ro.eu.org
ru.eu.org
se.eu.org
si.eu.org
sk.eu.org
tr.eu.org
uk.eu.org
us.eu.org
// Evennode : http://www.evennode.com/
// Submitted by Michal Kralik
eu-1.evennode.com
eu-2.evennode.com
eu-3.evennode.com
eu-4.evennode.com
us-1.evennode.com
us-2.evennode.com
us-3.evennode.com
us-4.evennode.com
// eDirect Corp. : https://hosting.url.com.tw/
// Submitted by C.S. chang
twmail.cc
twmail.net
twmail.org
mymailer.com.tw
url.tw
// Facebook, Inc.
// Submitted by Peter Ruibal
apps.fbsbx.com
// FAITID : https://faitid.org/
// Submitted by Maxim Alzoba
// https://www.flexireg.net/stat_info
ru.net
adygeya.ru
bashkiria.ru
bir.ru
cbg.ru
com.ru
dagestan.ru
grozny.ru
kalmykia.ru
kustanai.ru
marine.ru
mordovia.ru
msk.ru
mytis.ru
nalchik.ru
nov.ru
pyatigorsk.ru
spb.ru
vladikavkaz.ru
vladimir.ru
abkhazia.su
adygeya.su
aktyubinsk.su
arkhangelsk.su
armenia.su
ashgabad.su
azerbaijan.su
balashov.su
bashkiria.su
bryansk.su
bukhara.su
chimkent.su
dagestan.su
east-kazakhstan.su
exnet.su
georgia.su
grozny.su
ivanovo.su
jambyl.su
kalmykia.su
kaluga.su
karacol.su
karaganda.su
karelia.su
khakassia.su
krasnodar.su
kurgan.su
kustanai.su
lenug.su
mangyshlak.su
mordovia.su
msk.su
murmansk.su
nalchik.su
navoi.su
north-kazakhstan.su
nov.su
obninsk.su
penza.su
pokrovsk.su
sochi.su
spb.su
tashkent.su
termez.su
togliatti.su
troitsk.su
tselinograd.su
tula.su
tuva.su
vladikavkaz.su
vladimir.su
vologda.su
// Fancy Bits, LLC : http://getchannels.com
// Submitted by Aman Gupta
channelsdvr.net
// Fastly Inc. : http://www.fastly.com/
// Submitted by Fastly Security
fastly-terrarium.com
fastlylb.net
map.fastlylb.net
freetls.fastly.net
map.fastly.net
a.prod.fastly.net
global.prod.fastly.net
a.ssl.fastly.net
b.ssl.fastly.net
global.ssl.fastly.net
// FASTVPS EESTI OU : https://fastvps.ru/
// Submitted by Likhachev Vasiliy
fastpanel.direct
fastvps-server.com
// Featherhead : https://featherhead.xyz/
// Submitted by Simon Menke
fhapp.xyz
// Fedora : https://fedoraproject.org/
// submitted by Patrick Uiterwijk
fedorainfracloud.org
fedorapeople.org
cloud.fedoraproject.org
app.os.fedoraproject.org
app.os.stg.fedoraproject.org
// Fermax : https://fermax.com/
// submitted by Koen Van Isterdael
mydobiss.com
// Filegear Inc. : https://www.filegear.com
// Submitted by Jason Zhu
filegear.me
filegear-au.me
filegear-de.me
filegear-gb.me
filegear-ie.me
filegear-jp.me
filegear-sg.me
// Firebase, Inc.
// Submitted by Chris Raynor
firebaseapp.com
// Flynn : https://flynn.io
// Submitted by Jonathan Rudenberg
flynnhub.com
flynnhosting.net
// Freebox : http://www.freebox.fr
// Submitted by Romain Fliedel
freebox-os.com
freeboxos.com
fbx-os.fr
fbxos.fr
freebox-os.fr
freeboxos.fr
// freedesktop.org : https://www.freedesktop.org
// Submitted by Daniel Stone
freedesktop.org
// Futureweb OG : http://www.futureweb.at
// Submitted by Andreas Schnederle-Wagner
*.futurecms.at
*.ex.futurecms.at
*.in.futurecms.at
futurehosting.at
futuremailing.at
*.ex.ortsinfo.at
*.kunden.ortsinfo.at
*.statics.cloud
// GDS : https://www.gov.uk/service-manual/operations/operating-servicegovuk-subdomains
// Submitted by David Illsley
service.gov.uk
// Gehirn Inc. : https://www.gehirn.co.jp/
// Submitted by Kohei YOSHIDA
gehirn.ne.jp
usercontent.jp
// Gentlent, Limited : https://www.gentlent.com
// Submitted by Tom Klein
lab.ms
// GitHub, Inc.
// Submitted by Patrick Toomey
github.io
githubusercontent.com
// GitLab, Inc.
// Submitted by Alex Hanselka
gitlab.io
// Glitch, Inc : https://glitch.com
// Submitted by Mads Hartmann
glitch.me
// GMO Pepabo, Inc. : https://pepabo.com/
// Submitted by dojineko
lolipop.io
// GOV.UK Platform as a Service : https://www.cloud.service.gov.uk/
// Submitted by Tom Whitwell
cloudapps.digital
london.cloudapps.digital
// UKHomeOffice : https://www.gov.uk/government/organisations/home-office
// Submitted by Jon Shanks
homeoffice.gov.uk
// GlobeHosting, Inc.
// Submitted by Zoltan Egresi
ro.im
shop.ro
// GoIP DNS Services : http://www.goip.de
// Submitted by Christian Poulter
goip.de
// Google, Inc.
// Submitted by Eduardo Vela
run.app
a.run.app
web.app
*.0emm.com
appspot.com
blogspot.ae
blogspot.al
blogspot.am
blogspot.ba
blogspot.be
blogspot.bg
blogspot.bj
blogspot.ca
blogspot.cf
blogspot.ch
blogspot.cl
blogspot.co.at
blogspot.co.id
blogspot.co.il
blogspot.co.ke
blogspot.co.nz
blogspot.co.uk
blogspot.co.za
blogspot.com
blogspot.com.ar
blogspot.com.au
blogspot.com.br
blogspot.com.by
blogspot.com.co
blogspot.com.cy
blogspot.com.ee
blogspot.com.eg
blogspot.com.es
blogspot.com.mt
blogspot.com.ng
blogspot.com.tr
blogspot.com.uy
blogspot.cv
blogspot.cz
blogspot.de
blogspot.dk
blogspot.fi
blogspot.fr
blogspot.gr
blogspot.hk
blogspot.hr
blogspot.hu
blogspot.ie
blogspot.in
blogspot.is
blogspot.it
blogspot.jp
blogspot.kr
blogspot.li
blogspot.lt
blogspot.lu
blogspot.md
blogspot.mk
blogspot.mr
blogspot.mx
blogspot.my
blogspot.nl
blogspot.no
blogspot.pe
blogspot.pt
blogspot.qa
blogspot.re
blogspot.ro
blogspot.rs
blogspot.ru
blogspot.se
blogspot.sg
blogspot.si
blogspot.sk
blogspot.sn
blogspot.td
blogspot.tw
blogspot.ug
blogspot.vn
cloudfunctions.net
cloud.goog
codespot.com
googleapis.com
googlecode.com
pagespeedmobilizer.com
publishproxy.com
withgoogle.com
withyoutube.com
// Hakaran group: http://hakaran.cz
// Submited by Arseniy Sokolov
fin.ci
free.hr
caa.li
ua.rs
conf.se
// Handshake : https://handshake.org
// Submitted by Mike Damm
hs.zone
hs.run
// Hashbang : https://hashbang.sh
hashbang.sh
// Hasura : https://hasura.io
// Submitted by Shahidh K Muhammed
hasura.app
hasura-app.io
// Hepforge : https://www.hepforge.org
// Submitted by David Grellscheid
hepforge.org
// Heroku : https://www.heroku.com/
// Submitted by Tom Maher
herokuapp.com
herokussl.com
// Hibernating Rhinos
// Submitted by Oren Eini
myravendb.com
ravendb.community
ravendb.me
development.run
ravendb.run
// HOSTBIP REGISTRY : https://www.hostbip.com/
// Submitted by Atanunu Igbunuroghene
bpl.biz
orx.biz
ng.city
biz.gl
ng.ink
col.ng
firm.ng
gen.ng
ltd.ng
ng.school
sch.so
// Häkkinen.fi
// Submitted by Eero Häkkinen
häkkinen.fi
// Ici la Lune : http://www.icilalune.com/
// Submitted by Simon Morvan
*.moonscale.io
moonscale.net
// iki.fi
// Submitted by Hannu Aronsson
iki.fi
// Individual Network Berlin e.V. : https://www.in-berlin.de/
// Submitted by Christian Seitz
dyn-berlin.de
in-berlin.de
in-brb.de
in-butter.de
in-dsl.de
in-dsl.net
in-dsl.org
in-vpn.de
in-vpn.net
in-vpn.org
// info.at : http://www.info.at/
biz.at
info.at
// info.cx : http://info.cx
// Submitted by Jacob Slater
info.cx
// Interlegis : http://www.interlegis.leg.br
// Submitted by Gabriel Ferreira
ac.leg.br
al.leg.br
am.leg.br
ap.leg.br
ba.leg.br
ce.leg.br
df.leg.br
es.leg.br
go.leg.br
ma.leg.br
mg.leg.br
ms.leg.br
mt.leg.br
pa.leg.br
pb.leg.br
pe.leg.br
pi.leg.br
pr.leg.br
rj.leg.br
rn.leg.br
ro.leg.br
rr.leg.br
rs.leg.br
sc.leg.br
se.leg.br
sp.leg.br
to.leg.br
// intermetrics GmbH : https://pixolino.com/
// Submitted by Wolfgang Schwarz
pixolino.com
// IPiFony Systems, Inc. : https://www.ipifony.com/
// Submitted by Matthew Hardeman
ipifony.net
// IServ GmbH : https://iserv.eu
// Submitted by Kim-Alexander Brodowski
mein-iserv.de
test-iserv.de
iserv.dev
// I-O DATA DEVICE, INC. : http://www.iodata.com/
// Submitted by Yuji Minagawa
iobb.net
// Jino : https://www.jino.ru
// Submitted by Sergey Ulyashin
myjino.ru
*.hosting.myjino.ru
*.landing.myjino.ru
*.spectrum.myjino.ru
*.vps.myjino.ru
// Joyent : https://www.joyent.com/
// Submitted by Brian Bennett
*.triton.zone
*.cns.joyent.com
// JS.ORG : http://dns.js.org
// Submitted by Stefan Keim
js.org
// KaasHosting : http://www.kaashosting.nl/
// Submitted by Wouter Bakker
kaas.gg
khplay.nl
// Keyweb AG : https://www.keyweb.de
// Submitted by Martin Dannehl
keymachine.de
// KingHost : https://king.host
// Submitted by Felipe Keller Braz
kinghost.net
uni5.net
// KnightPoint Systems, LLC : http://www.knightpoint.com/
// Submitted by Roy Keene
knightpoint.systems
// .KRD : http://nic.krd/data/krd/Registration%20Policy.pdf
co.krd
edu.krd
// LCube - Professional hosting e.K. : https://www.lcube-webhosting.de
// Submitted by Lars Laehn
git-repos.de
lcube-server.de
svn-repos.de
// Leadpages : https://www.leadpages.net
// Submitted by Greg Dallavalle
leadpages.co
lpages.co
lpusercontent.com
// Lelux.fi : https://lelux.fi/
// Submitted by Lelux Admin
lelux.site
// Lifetime Hosting : https://Lifetime.Hosting/
// Submitted by Mike Fillator
co.business
co.education
co.events
co.financial
co.network
co.place
co.technology
// Lightmaker Property Manager, Inc. : https://app.lmpm.com/
// Submitted by Greg Holland
app.lmpm.com
// Linki Tools UG : https://linki.tools
// Submitted by Paulo Matos
linkitools.space
// linkyard ldt: https://www.linkyard.ch/
// Submitted by Mario Siegenthaler
linkyard.cloud
linkyard-cloud.ch
// Linode : https://linode.com
// Submitted by
members.linode.com
nodebalancer.linode.com
// LiquidNet Ltd : http://www.liquidnetlimited.com/
// Submitted by Victor Velchev
we.bs
// Log'in Line : https://www.loginline.com/
// Submitted by Rémi Mach
loginline.app
loginline.dev
loginline.io
loginline.services
loginline.site
// LubMAN UMCS Sp. z o.o : https://lubman.pl/
// Submitted by Ireneusz Maliszewski
krasnik.pl
leczna.pl
lubartow.pl
lublin.pl
poniatowa.pl
swidnik.pl
// Lug.org.uk : https://lug.org.uk
// Submitted by Jon Spriggs
uklugs.org
glug.org.uk
lug.org.uk
lugs.org.uk
// Lukanet Ltd : https://lukanet.com
// Submitted by Anton Avramov
barsy.bg
barsy.co.uk
barsyonline.co.uk
barsycenter.com
barsyonline.com
barsy.club
barsy.de
barsy.eu
barsy.in
barsy.info
barsy.io
barsy.me
barsy.menu
barsy.mobi
barsy.net
barsy.online
barsy.org
barsy.pro
barsy.pub
barsy.shop
barsy.site
barsy.support
barsy.uk
// Magento Commerce
// Submitted by Damien Tournoud
*.magentosite.cloud
// May First - People Link : https://mayfirst.org/
// Submitted by Jamie McClelland
mayfirst.info
mayfirst.org
// Mail.Ru Group : https://hb.cldmail.ru
// Submitted by Ilya Zaretskiy
hb.cldmail.ru
// Memset hosting : https://www.memset.com
// Submitted by Tom Whitwell
miniserver.com
memset.net
// MetaCentrum, CESNET z.s.p.o. : https://www.metacentrum.cz/en/
// Submitted by Zdeněk Šustr
cloud.metacentrum.cz
custom.metacentrum.cz
// MetaCentrum, CESNET z.s.p.o. : https://www.metacentrum.cz/en/
// Submitted by Radim Janča
flt.cloud.muni.cz
usr.cloud.muni.cz
// Meteor Development Group : https://www.meteor.com/hosting
// Submitted by Pierre Carrier
meteorapp.com
eu.meteorapp.com
// Michau Enterprises Limited : http://www.co.pl/
co.pl
// Microsoft Corporation : http://microsoft.com
// Submitted by Justin Luk
azurecontainer.io
azurewebsites.net
azure-mobile.net
cloudapp.net
// Mozilla Corporation : https://mozilla.com
// Submitted by Ben Francis
mozilla-iot.org
// Mozilla Foundation : https://mozilla.org/
// Submitted by glob
bmoattachments.org
// MSK-IX : https://www.msk-ix.ru/
// Submitted by Khannanov Roman