google / OpenSK / 38036796225

97%

2.1: 97%

Build Type

push

github

Committed by web-flow

Commit Message

Set CTAP1 Authenticate UP byte correctly (#798)

In Ctap1Command::process_command, user presence is only checked and
consumed when flags == Ctap1Flags::EnforceUpAndSign. However,
process_authenticate unconditionally passed
USER_PRESENCE_INDICATOR_BYTE (0x01) to generate_auth_data, both signing
and returning a user presence byte of 0x01 even for
DontEnforceUpAndSign requests. [1]

This means that through CTAP1, touchless assertions could be hidden to
the relying party. Resident keys are unaffected.

[1] https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-raw-message-formats-v1.2-ps-20170411.html#authentication-request-message---u2f_authenticate

Coverage Stats

5 of 5 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

13808 of 14203 relevant lines covered (97.22%)

4258.85 hits per line