kmwebnet/OpenSK
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

improves documentation to address comments

Browse Source
This commit is contained in:
Fabian Kaczmarczyck
2020-07-27 22:18:51 +02:00
parent 9c673844d5
commit a398c404dc
3 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -107,7 +107,7 @@ a few things you can personalize:
The current minimum is 4. Values from 4 to 63 are allowed. Requiring longer The current minimum is 4. Values from 4 to 63 are allowed. Requiring longer
PINs can help establish trust between users and relying parties. It makes PINs can help establish trust between users and relying parties. It makes
user verification harder to break, but less convenient. user verification harder to break, but less convenient.
NIST recommends 6 at least digit PINs in section 5.1.9.1: NIST recommends at least 6-digit PINs in section 5.1.9.1:
https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html
You can add relying parties to the list of readers of the minimum PIN length. You can add relying parties to the list of readers of the minimum PIN length.

7
src/ctap/mod.rs
View File

@@ -755,8 +755,11 @@ where
&mut self, &mut self,
client_pin_params: AuthenticatorClientPinParameters, client_pin_params: AuthenticatorClientPinParameters,
) -> Result<ResponseData, Ctap2StatusCode> { ) -> Result<ResponseData, Ctap2StatusCode> {
self.pin_protocol_v1 self.pin_protocol_v1.process_subcommand(
.process(self.rng, &mut self.persistent_store, client_pin_params) self.rng,
&mut self.persistent_store,
client_pin_params,
)
} }
fn process_reset(&mut self, cid: ChannelID) -> Result<ResponseData, Ctap2StatusCode> { fn process_reset(&mut self, cid: ChannelID) -> Result<ResponseData, Ctap2StatusCode> {

9
src/ctap/pin_protocol_v1.rs
View File

@@ -72,6 +72,7 @@ fn encrypt_hmac_secret_output(
// Initialization of 4 blocks in any case makes this function more readable. // Initialization of 4 blocks in any case makes this function more readable.
let mut blocks = [[0u8; 16]; 4]; let mut blocks = [[0u8; 16]; 4];
// With the if clause restriction above, block_len can only be 2 or 4.
let block_len = salt_enc.len() / 16; let block_len = salt_enc.len() / 16;
for i in 0..block_len { for i in 0..block_len {
blocks[i].copy_from_slice(&salt_enc[16 * i..16 * (i + 1)]); blocks[i].copy_from_slice(&salt_enc[16 * i..16 * (i + 1)]);
@@ -395,6 +396,8 @@ impl PinProtocolV1 {
if self.consecutive_pin_mismatches >= 3 { if self.consecutive_pin_mismatches >= 3 {
return Err(Ctap2StatusCode::CTAP2_ERR_PIN_AUTH_BLOCKED); return Err(Ctap2StatusCode::CTAP2_ERR_PIN_AUTH_BLOCKED);
} }
// TODO(kaczmarczyck) Values are taken from the (not yet public) new revision
// of CTAP 2.1. The code should link the specification when published.
let mut message = vec![0xFF; 32]; let mut message = vec![0xFF; 32];
message.extend(&[0x06, 0x08]); message.extend(&[0x06, 0x08]);
message.extend(&[min_pin_length as u8, 0x00, 0x00, 0x00]); message.extend(&[min_pin_length as u8, 0x00, 0x00, 0x00]);
@@ -449,7 +452,7 @@ impl PinProtocolV1 {
Ok(response) Ok(response)
} }
pub fn process( pub fn process_subcommand(
&mut self, &mut self,
rng: &mut impl Rng256, rng: &mut impl Rng256,
persistent_store: &mut PersistentStore, persistent_store: &mut PersistentStore,
@@ -975,7 +978,7 @@ mod test {
permissions_rp_id: None, permissions_rp_id: None,
}; };
assert!(pin_protocol_v1 assert!(pin_protocol_v1
.process(&mut rng, &mut persistent_store, client_pin_params) .process_subcommand(&mut rng, &mut persistent_store, client_pin_params)
.is_ok()); .is_ok());
let client_pin_params = AuthenticatorClientPinParameters { let client_pin_params = AuthenticatorClientPinParameters {
@@ -999,7 +1002,7 @@ mod test {
#[cfg(feature = "with_ctap2_1")] #[cfg(feature = "with_ctap2_1")]
let error_code = Ctap2StatusCode::CTAP1_ERR_INVALID_PARAMETER; let error_code = Ctap2StatusCode::CTAP1_ERR_INVALID_PARAMETER;
assert_eq!( assert_eq!(
pin_protocol_v1.process(&mut rng, &mut persistent_store, client_pin_params), pin_protocol_v1.process_subcommand(&mut rng, &mut persistent_store, client_pin_params),
Err(error_code) Err(error_code)
); );
} }