google / OpenSK / 38556196495

97%

2.1: 97%

push

github

Treat pinHashEnc decryption error as PIN mismatch (#801)

In ClientPin::verify_pin_hash_enc, shared_secret.decrypt(&pin_hash_enc)
returned early with CTAP2_ERR_PIN_INVALID. Instead, we should treat both
decryption errors and PIN hash mismatches the same way.

Per CTAP 2.3 Sections 6.5.5.6 (Changing existing PIN) [1], 6.5.5.7.1
(getPinToken) [2], and 6.5.5.7.2 (getPinUvAuthTokenUsingPinWithPermissions)
[3]:

> The authenticator decrements the pinRetries counter by 1.
> The authenticator decrypts pinHashEnc using decrypt and verifies
> against its internally stored CurrentStoredPIN.
> - If an error results, or a mismatch is detected, the authenticator
>   performs the following operations:
>   1. Calls regenerate for the selected pinUvAuthProtocol.
>   2. The authenticator returns errors according to following
>      conditions:
>      - If the pinRetries counter is 0, return CTAP2_ERR_PIN_BLOCKED
>        error.
>      - If the authenticator sees 3 consecutive mismatches, it returns
>        CTAP2_ERR_PIN_AUTH_BLOCKED, indicating that power cycling is
>        needed for further operations. This is done so that malware
>        running on the platform should not be able to block the device
>        without user interaction.
>      - Else return CTAP2_ERR_PIN_INVALID error.

Treat decryption failure of pinHashEnc the same as a PIN hash mismatch so
that key agreement regeneration, CTAP2_ERR_PIN_BLOCKED, and
CTAP2_ERR_PIN_AUTH_BLOCKED are enforced.

[1] https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#changingExistingPin
[2] https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#getPinToken
[3] https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#getPinUvAuthTokenUsingPinWithPermissions

12 of 12 new or added lines in 1 file covered. (100.0%)

13818 of 14212 relevant lines covered (97.23%)

4256.19 hits per line