google / OpenSK / 37959932270

97%

2.1: 97%

push

github

Reject minimum PIN lengths that no PIN could satisfy (#793)

* Reject minimum PIN lengths that no PIN could satisfy

A PIN is at most 63 bytes long, since it is padded with at least one
zero byte to 64 bytes. Accepting a larger minimum PIN length would make
it impossible to ever set or change the PIN again, permanently locking
out PIN-based user verification (in particular after a forced PIN
change). Reject such values with CTAP2_ERR_PIN_POLICY_VIOLATION.

* Reuse PIN_PADDED_LENGTH instead of a hardcoded PIN length limit

Follow-up to review feedback: derive MAX_PIN_LENGTH from
PIN_PADDED_LENGTH in client_pin.rs, and use the constant in the test
so that it does not fail if the value were to change.

---------

Co-authored-by: 17krishna8 <17krishna8@users.noreply.github.com>

22 of 22 new or added lines in 1 file covered. (100.0%)

13774 of 14170 relevant lines covered (97.21%)

4268.69 hits per line