From 9e1bf2bcb78cf4777d474d2ffd4d828681ad76dd Mon Sep 17 00:00:00 2001 From: Pol Henarejos Date: Sun, 12 Jul 2026 20:05:57 +0200 Subject: [PATCH] AUT_ENABLE now requires that same exact encrypted-key length before decrypting or using it as a ChaChaPoly key. Signed-off-by: Pol Henarejos --- src/fido/cbor_config.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/fido/cbor_config.c b/src/fido/cbor_config.c index 7b68b35..0c58f49 100644 --- a/src/fido/cbor_config.c +++ b/src/fido/cbor_config.c @@ -163,6 +163,9 @@ int cbor_config(const uint8_t *data, size_t len) { if (mse.init == false) { CBOR_ERROR(CTAP2_ERR_NOT_ALLOWED); } + if (vendorParamByteString.present == false || vendorParamByteString.len != 32 + 16) { + CBOR_ERROR(CTAP1_ERR_INVALID_PARAMETER); + } mbedtls_chachapoly_context chatx; int ret = mse_decrypt_ct(vendorParamByteString.data, vendorParamByteString.len);