google / OpenSK

97%

2.1: 97%

LAST BUILD ON BRANCH develop

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• add-sk-cbor-boundary-tests
• app-protect
• audit
• backwards-compatible
• bloat-workflow
• bugfix
• bump-audit
• bump-dependencies
• clear-token-flags-on-get-assertion
• clippy-nightly
• commit-lock
• constant-time-hmac-verify
• coveralls-fingerprint
• crates-store
• ctap1-authenticate-up-byte
• ctaphid-channel-handling
• dependabot/cargo/cargo-21e645d217
• dependabot/cargo/cargo-77aade85bb
• dependabot/cargo/cargo-d88cdd6c88
• dependabot/cargo/libraries/crypto/cargo-8b98ca1b5c
• dependabot/cargo/libraries/opensk/cargo-65180b6f17
• dependabot/uv/uv-f7f3875fe2
• develop
• disable-audit
• env-ed25519
• env-private-key
• erase-doc
• fingerprint-flow
• fix-apdu-case-2e
• fix-applet
• fix-artemis-touch-usb
• fix-cbor-usize-length
• fix-credential-descriptor-parsing
• fix-force-pin-change-handling
• fix-large-blob-key-extension-validation
• fix-large-blobs-usize-length
• fix/reject-long-min-pin-rp-ids
• fix/reject-long-rp-id
• fix/set-min-pin-length-rp-ids-first
• fix/update-user-info-truncation
• flash-script
• fuzz-audit
• handle-pin-hash-decrypt-failure
• implicit-up
• install-doc
• integer-overflow
• lazy-template-id
• less-missing
• lock-bump-2-1
• macos-support
• more-errors
• multi-pin
• optional-dependencies
• patch-1
• preserve-large-blob-state-on-error
• propagate-attestation-keygen-errors
• propagate-usb-read-error-in-up
• publish-crates
• pylint
• rand-core
• readme
• refs/tags/hybrid-pqc
• refs/tags/last_tock
• reject-oversized-min-pin-length
• reject-oversized-user-handles
• remove-ecb
• rename
• reset-fingerprint-enrollments
• rustcrypto
• secure-crypto
• stable
• submission
• upgrade-lock
• uv-bio-enrollment
• uv-error
• vendor-command
• versions
• warn-debug
• wasefire-bump
• wrap-private

Build # 39429259829

Build Type

push

github

Committed by web-flow

Commit Message

Improves forcePINChange enforcement (#812)

We fix two issues around `force_pin_change` and PIN token state:

- When `force_pin_change` is set, `changePIN` now rejects a new PIN
  whose hash matches the current PIN hash with
  `CTAP2_ERR_PIN_POLICY_VIOLATION`.
- Resetting the `pinUvAuthToken` in `changePIN` and `setMinPINLength`
  now also calls `stop_using_pin_uv_auth_token()` so existing tokens
  are invalidated.

See CTAP 2.3 Sections 6.5.5.6 and 6.11.4:
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#changingExistingPin

Coverage Stats

14169 of 14560 relevant lines covered (97.31%)

4109.89 hits per line