chaosrebel/pico-fido
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-fido.git synced 2026-08-24 05:23:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix hmac-secret-mc check.

Browse Source 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
This commit is contained in:
Pol Henarejos
2026-07-05 01:21:21 +02:00
parent 8e077ecb7d
commit d2dd0f161a
2 changed files with 34 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/fido/cbor_make_credential.c
+14 -14
View File
@@ -212,6 +212,20 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
}
}
CBOR_PARSE_MAP_END(map, 1);
if (hmac_secret_mc && extensions.hmac_secret != ptrue) {
CBOR_ERROR(CTAP2_ERR_MISSING_PARAMETER);
}
if (hmac_secret_mc) {
if (kax.present == false || kay.present == false || crv == 0 || hmac_alg == 0 ||
salt_enc.present == false || salt_enc.len == 0 ||
salt_auth.present == false || salt_auth.len == 0) {
CBOR_ERROR(CTAP2_ERR_MISSING_PARAMETER);
}
if (salt_enc.len != 32 + (hmacSecretPinUvAuthProtocol - 1) * IV_SIZE &&
salt_enc.len != 64 + (hmacSecretPinUvAuthProtocol - 1) * IV_SIZE) {
CBOR_ERROR(CTAP1_ERR_INVALID_PARAMETER);
}
}
rp_id = rp.id.data;
user_name = user.parent.name.data;
display_name = user.displayName.data;
@@ -427,20 +441,6 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
CBOR_ERROR(CTAP2_ERR_INVALID_OPTION);
}
if (hmac_secret_mc && extensions.hmac_secret != ptrue) {
CBOR_ERROR(CTAP2_ERR_MISSING_PARAMETER);
}
if (hmac_secret_mc) {
if (kax.present == false || kay.present == false || crv == 0 || hmac_alg == 0 ||
salt_enc.present == false || salt_auth.present == false) {
CBOR_ERROR(CTAP2_ERR_MISSING_PARAMETER);
}
if (salt_enc.len != 32 + (hmacSecretPinUvAuthProtocol - 1) * IV_SIZE &&
salt_enc.len != 64 + (hmacSecretPinUvAuthProtocol - 1) * IV_SIZE) {
CBOR_ERROR(CTAP1_ERR_INVALID_PARAMETER);
}
}
if (options.up == ptrue || options.up == NULL) { //14.1
if (pinUvAuthParam.present == true) {
if (getUserPresentFlagValue() == false) {
tests/pico-fido/test_035_hmac_secret.py
+20
View File
@@ -121,6 +121,26 @@ def test_missing_saltEnc(device,):
device.GA(extensions={"hmac-secret": { 3: b'1234'}})
assert e.value.code == CtapError.ERR.MISSING_PARAMETER
def test_make_credential_hmac_secret_mc_empty_salt(device):
key_agreement = {
1: 2,
3: -25,
-1: 1,
-2: b'\x00' * 32,
-3: b'\x00' * 32,
}
with pytest.raises(CtapError) as e:
device.MC(extensions={
"hmac-secret": True,
"hmac-secret-mc": {
1: key_agreement,
2: b'',
3: b'\x00' * 32,
4: 2,
},
})
assert e.value.code == CtapError.ERR.MISSING_PARAMETER
def test_bad_auth(device, MCHmacSecret):
key_agreement = {