google / OpenSK / 38562988563

97%

2.1: 97%

push

github

Clear PIN token flags on GetAssertion with UP (#802)

In CtapState::process_get_assertion, clear_token_flags() was only called
inside the !self.has_valid_up(has_pin_uv_auth_param, options.uv) branch
(unlike process_make_credential, which calls clear_token_flags() after
that branch).

When a pinUvAuthToken had its userPresent flag set (such as a token
obtained via getPinUvAuthTokenUsingUvWithPermissions), has_valid_up
returned true and clear_token_flags() was skipped, leaving the token's
userPresent flag, userVerified flag, and permissions active for reuse
across subsequent assertions without user interaction.

Per CTAP 2.3 Section 6.2.2 (authenticatorGetAssertion Algorithm), Step 9
[1]:

> 9. If the "up" option is set to true or not present:
>   1. If the pinUvAuthParam parameter is present then:
>     1. Let userPresentFlagValue be the result of calling
>        getUserPresentFlagValue().
>     2. If userPresentFlagValue is false:
>       1. Request evidence of user interaction in an
>          authenticator-specific way (e.g., flash the LED light).
>          [...]
>   2. Else (implying the pinUvAuthParam parameter is not present):
>     [...]
>   3. Set the "up" bit to true in the response.
>   4. Call clearUserPresentFlag(), clearUserVerifiedFlag(), and
>      clearPinUvAuthTokenPermissionsExceptLbw().

Always call clear_token_flags() whenever options.up is true after
verifying or consuming user presence.

[1] https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#authenticatorGetAssertion

62 of 62 new or added lines in 1 file covered. (100.0%)

13878 of 14272 relevant lines covered (97.24%)

4238.43 hits per line