RFE-325

Add checks to verify successful downloads during installation

The expected SHA256SUM hashes for required distributables are now stored in the installation script. The script uses these hashes to verify the files were downloaded successfully.

This change avoids issues with interrupted Payara, MariaDB, and/or connector downloads or issues with storage space during installation.

RFE-326

Remove insecure RSA signatures from policies

The following RSA signature algorithms have been removed from all SKFS FIDO Policies:

• 'RS256'
• 'RS384'
• 'RS512'

This change comes as an effort to tighten the security of the default SKFS FIDO Policies starting with the removal of these deterministic signature algorithms.

RFE-327

Remove insecure ciphers from Payara http listener

The following insecure ciphers have been removed from the HTTP Listener on new installations:

• 'TLS_DHE_RSA_WITH_AES_256_CBC_SHA'
• 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA'

These ciphers are also removed from existing installations during the upgrade.

This change comes as an effort to remove TLS 1.0 & 1.1 cipher suites (according to RFC8996) from the SKFS environment.

RFE-328

Enforce User Presence during Registration and Authentication

SKFS now enforces the user-presence setting defined by the SKFS FIDO Policy.

Before SKFS v4.21, SKFS only logged whether an authenticator's User Presence setting was enabled or disabled. This change adds a default 'true' value to require User Presence in all SKFS FIDO Policies which enforces User Presence during Registration and Authentication. 

If User Presence is required and the SKFS does not receive User Presence from an incoming attestation object during Registration or Authentication, the server will respond with:

FIDO-ERR-6014: Policy violation: User Presence required by policy

Existing SKFS FIDO Policies are updated with this change when upgrading to v4.21.

BUG-136

Fix potential issue with duplicate keyhandles

Registered keyhandles must now be unique across domains, not just across a single user's registered keys. Any Register request where the registering authenticator's keyhandle already exists within the domain will be rejected.

When upgrading to SKFS version 4.21.0, if duplicate keyhandles are found, the upgrade script informs the system administrator that duplicate keyhandles exist and should be addressed.

BUG-137

Fix issue with origin checks allowing origins that strictly end with the Policy-specified RPID

Origin checks now correctly verify that the top-level [DNS] domain + 1 (aka TLD+1) in a defined relying party identifier (RPID) matches exactly as specified in the SKFS Policy.

For example, if the SKFS FIDO Policy specifies 'example.com' as the RPID, the server previously accepted 'notexample.com'. The origin check now requires the proper dot delimiter before the RPID.

BUG-138

Fix issue where sendfakeKH property allows fake users to be distinguished

Before SKFS v4.21, when the `skfs.cfg.property.fido2.user.sendfakeKH` property was enabled, sending a pre-authentication request for a non-existent username returned fake credential IDs generated from a pseudorandom alphanumeric string. 

Repeating the same request with the same nonexistent username produced a different credential ID, allowing the nonexistent username to be distinguished.

This change makes the generated credential ID deterministic. The same nonexistent username now produces the same credential ID each time.

The username is hashed, and the resulting hash is used as the seed for the random number generator when creating the alphanumeric string.