From 026b4a66ac1d983c09d1bf9385adf52ad94411ba Mon Sep 17 00:00:00 2001
From: Jean-Michel Picod <jmichel@google.com>
Date: Wed, 25 Nov 2020 17:26:08 +0100
Subject: [PATCH] Fix CTAP2 batch attestation

---
 src/ctap/mod.rs | 36 +++++++++++++++++++-----------------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/src/ctap/mod.rs b/src/ctap/mod.rs
index 13fc951..e92afb7 100644
--- a/src/ctap/mod.rs
+++ b/src/ctap/mod.rs
@@ -522,25 +522,27 @@ where
 
         let mut signature_data = auth_data.clone();
         signature_data.extend(client_data_hash);
-        // We currently use the presence of the attestation private key in the persistent storage to
-        // decide whether batch attestation is needed.
-        let (signature, x5c) = match self.persistent_store.attestation_private_key()? {
-            Some(attestation_private_key) => {
-                let attestation_key =
-                    crypto::ecdsa::SecKey::from_bytes(attestation_private_key).unwrap();
-                let attestation_certificate = self
-                    .persistent_store
-                    .attestation_certificate()?
-                    .ok_or(Ctap2StatusCode::CTAP2_ERR_VENDOR_INTERNAL_ERROR)?;
-                (
-                    attestation_key.sign_rfc6979::<crypto::sha256::Sha256>(&signature_data),
-                    Some(vec![attestation_certificate]),
-                )
-            }
-            None => (
+
+        let (signature, x5c) = if USE_BATCH_ATTESTATION {
+            let attestation_private_key = self
+                .persistent_store
+                .attestation_private_key()?
+                .ok_or(Ctap2StatusCode::CTAP2_ERR_VENDOR_INTERNAL_ERROR)?;
+            let attestation_key =
+                crypto::ecdsa::SecKey::from_bytes(attestation_private_key).unwrap();
+            let attestation_certificate = self
+                .persistent_store
+                .attestation_certificate()?
+                .ok_or(Ctap2StatusCode::CTAP2_ERR_VENDOR_INTERNAL_ERROR)?;
+            (
+                attestation_key.sign_rfc6979::<crypto::sha256::Sha256>(&signature_data),
+                Some(vec![attestation_certificate]),
+            )
+        } else {
+            (
                 sk.sign_rfc6979::<crypto::sha256::Sha256>(&signature_data),
                 None,
-            ),
+            )
         };
         let attestation_statement = PackedAttestationStatement {
             alg: SignatureAlgorithm::ES256 as i64,