google / OpenSK / 39429259829

97%

2.1: 97%

push

github

Improves forcePINChange enforcement (#812)

We fix two issues around `force_pin_change` and PIN token state:

- When `force_pin_change` is set, `changePIN` now rejects a new PIN
  whose hash matches the current PIN hash with
  `CTAP2_ERR_PIN_POLICY_VIOLATION`.
- Resetting the `pinUvAuthToken` in `changePIN` and `setMinPINLength`
  now also calls `stop_using_pin_uv_auth_token()` so existing tokens
  are invalidated.

See CTAP 2.3 Sections 6.5.5.6 and 6.11.4:
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#changingExistingPin

64 of 64 new or added lines in 2 files covered. (100.0%)

14169 of 14560 relevant lines covered (97.31%)

4109.89 hits per line