google / OpenSK / 39592931593

97%

2.1: 97%

push

github

Checks key handle before UP in CTAP1 (#819)

In `U2F_AUTHENTICATE` with `EnforceUpAndSign`, user presence was
checked and consumed before unwrapping and validating the key handle.
Because of this, an unrecognized key handle requested user presence
and returned `SW_COND_USE_NOT_SATISFIED` instead of `SW_WRONG_DATA`,
or consumed an already granted touch before failing.

We now validate the key handle in `process_authenticate` before
checking user presence:
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#u2f-authenticatorGetAssertion-interoperability

17 of 17 new or added lines in 1 file covered. (100.0%)

14460 of 14846 relevant lines covered (97.4%)

4035.06 hits per line