Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CTAP 2.0 does not always require UV in MakeCredentials #285

Merged
merged 1 commit into from
Aug 1, 2023
Merged

CTAP 2.0 does not always require UV in MakeCredentials #285

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions src/ctap2/commands/make_credentials.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
use super::get_info::{AuthenticatorInfo, AuthenticatorVersion};
use super::get_info::AuthenticatorInfo;
use super::{
Command, CommandError, PinUvAuthCommand, Request, RequestCtap1, RequestCtap2, Retryable,
StatusCode,
Expand Down Expand Up @@ -247,20 +247,22 @@ impl PinUvAuthCommand for MakeCredentials {

let supports_uv = info.options.user_verification == Some(true);
let pin_configured = info.options.client_pin == Some(true);

// CTAP 2.0 authenticators require user verification if the device is protected
let device_protected = supports_uv || pin_configured;
// make_cred_uv_not_rqd is only relevant for rk = false

// CTAP 2.1 authenticators may allow the creation of non-discoverable credentials without
// user verification. This is only relevant if the relying party has not requested user
// verification.
let make_cred_uv_not_required = info.options.make_cred_uv_not_rqd == Some(true)
&& self.options.resident_key != Some(true);
// For CTAP2.0, UV is always required when doing MakeCredential
let always_uv = info.options.always_uv == Some(true)
|| info.max_supported_version() == AuthenticatorVersion::FIDO_2_0;
let uv_discouraged = uv_req == UserVerificationRequirement::Discouraged;
&& self.options.resident_key != Some(true)
&& uv_req == UserVerificationRequirement::Discouraged;

// CTAP 2.1 authenticators can allow MakeCredential without PinUvAuth,
// but that is only relevant, if RP also discourages UV.
let can_make_cred_without_uv = make_cred_uv_not_required && uv_discouraged;
// Alternatively, CTAP 2.1 authenticators may require user verification regardless of the
// RP's requirement.
let always_uv = info.options.always_uv == Some(true);

!always_uv && (!device_protected || can_make_cred_without_uv)
!always_uv && (!device_protected || make_cred_uv_not_required)
}

fn get_pin_uv_auth_param(&self) -> Option<&PinUvAuthParam> {
Expand Down
Loading