google / OpenSK / 39425510342

97%

2.1: 97%

push

github

Rejects largeBlobKey when rk is false (#810)

In `CtapState::process_make_credential`, requesting the
`largeBlobKey: true` extension when `options.rk` was `false` was
silently ignored.

Per CTAP 2.3 Section 12.3, we now return `CTAP2_ERR_INVALID_OPTION`
when `extensions.large_blob_key` is present and `options.rk` is
`false`:
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#sctn-largeBlobKey-extension

7 of 7 new or added lines in 1 file covered. (100.0%)

14120 of 14511 relevant lines covered (97.31%)

4123.46 hits per line