Initial commit

src/ctap/ctap1.rs

@@ -0,0 +1,675 @@
+// Copyright 2019 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::hid::ChannelID;
+use super::key_material::{ATTESTATION_CERTIFICATE, ATTESTATION_PRIVATE_KEY};
+use super::status_code::Ctap2StatusCode;
+use super::CtapState;
+use crate::timer::ClockValue;
+use alloc::vec::Vec;
+use core::convert::Into;
+use core::convert::TryFrom;
+use crypto::rng256::Rng256;
+
+// The specification referenced in this file is at:
+// https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-raw-message-formats-v1.2-ps-20170411.pdf
+
+// status codes specification (version 20170411) section 3.3
+#[allow(non_camel_case_types)]
+#[cfg_attr(any(test, feature = "debug_ctap"), derive(Debug, PartialEq))]
+pub enum Ctap1StatusCode {
+    SW_NO_ERROR = 0x9000,
+    SW_CONDITIONS_NOT_SATISFIED = 0x6985,
+    SW_WRONG_DATA = 0x6A80,
+    SW_WRONG_LENGTH = 0x6700,
+    SW_CLA_NOT_SUPPORTED = 0x6E00,
+    SW_INS_NOT_SUPPORTED = 0x6D00,
+    SW_VENDOR_KEY_HANDLE_TOO_LONG = 0xF000,
+}
+
+impl TryFrom<u16> for Ctap1StatusCode {
+    type Error = ();
+
+    fn try_from(value: u16) -> Result<Ctap1StatusCode, ()> {
+        match value {
+            0x9000 => Ok(Ctap1StatusCode::SW_NO_ERROR),
+            0x6985 => Ok(Ctap1StatusCode::SW_CONDITIONS_NOT_SATISFIED),
+            0x6A80 => Ok(Ctap1StatusCode::SW_WRONG_DATA),
+            0x6700 => Ok(Ctap1StatusCode::SW_WRONG_LENGTH),
+            0x6E00 => Ok(Ctap1StatusCode::SW_CLA_NOT_SUPPORTED),
+            0x6D00 => Ok(Ctap1StatusCode::SW_INS_NOT_SUPPORTED),
+            0xF000 => Ok(Ctap1StatusCode::SW_VENDOR_KEY_HANDLE_TOO_LONG),
+            _ => Err(()),
+        }
+    }
+}
+
+impl Into<u16> for Ctap1StatusCode {
+    fn into(self) -> u16 {
+        self as u16
+    }
+}
+
+#[cfg_attr(any(test, feature = "debug_ctap"), derive(Clone, Debug))]
+#[derive(PartialEq)]
+pub enum Ctap1Flags {
+    CheckOnly = 0x07,
+    EnforceUpAndSign = 0x03,
+    DontEnforceUpAndSign = 0x08,
+}
+
+impl TryFrom<u8> for Ctap1Flags {
+    type Error = Ctap1StatusCode;
+
+    fn try_from(value: u8) -> Result<Ctap1Flags, Ctap1StatusCode> {
+        match value {
+            0x07 => Ok(Ctap1Flags::CheckOnly),
+            0x03 => Ok(Ctap1Flags::EnforceUpAndSign),
+            0x08 => Ok(Ctap1Flags::DontEnforceUpAndSign),
+            _ => Err(Ctap1StatusCode::SW_WRONG_DATA),
+        }
+    }
+}
+
+impl Into<u8> for Ctap1Flags {
+    fn into(self) -> u8 {
+        self as u8
+    }
+}
+
+#[cfg_attr(any(test, feature = "debug_ctap"), derive(Debug, PartialEq))]
+// TODO: remove #allow when https://github.com/rust-lang/rust/issues/64362 is fixed
+enum U2fCommand {
+    #[allow(dead_code)]
+    Register {
+        challenge: [u8; 32],
+        application: [u8; 32],
+    },
+    #[allow(dead_code)]
+    Authenticate {
+        challenge: [u8; 32],
+        application: [u8; 32],
+        key_handle: Vec<u8>,
+        flags: Ctap1Flags,
+    },
+    Version,
+    #[allow(dead_code)]
+    VendorSpecific {
+        payload: Vec<u8>,
+    },
+}
+
+impl TryFrom<&[u8]> for U2fCommand {
+    type Error = Ctap1StatusCode;
+
+    fn try_from(message: &[u8]) -> Result<Self, Ctap1StatusCode> {
+        if message.len() < Ctap1Command::APDU_HEADER_LEN as usize {
+            return Err(Ctap1StatusCode::SW_WRONG_DATA);
+        }
+
+        let (apdu, payload) = message.split_at(Ctap1Command::APDU_HEADER_LEN as usize);
+
+        // ISO7816 APDU Header format. Each cell is 1 byte. Note that the CTAP flavor always
+        // encodes the length on 3 bytes and doesn't use the field "Le" (Length Expected).
+        // We keep the 2 byte of "Le" for the packet length in mind, but always ignore its value.
+        // Lc is using big-endian encoding
+        // +-----+-----+----+----+-----+-----+-----+
+        // | CLA | INS | P1 | P2 | Lc1 | Lc2 | Lc3 |
+        // +-----+-----+----+----+-----+-----+-----+
+        if apdu[0] != Ctap1Command::CTAP1_CLA {
+            return Err(Ctap1StatusCode::SW_CLA_NOT_SUPPORTED);
+        }
+
+        let lc = (((apdu[4] as u32) << 16) | ((apdu[5] as u32) << 8) | (apdu[6] as u32)) as usize;
+
+        // Since there is always request data, the expected length is either omitted or
+        // encoded in 2 bytes.
+        if lc != payload.len() && lc + 2 != payload.len() {
+            return Err(Ctap1StatusCode::SW_WRONG_LENGTH);
+        }
+
+        match apdu[1] {
+            // U2F raw message format specification, Section 4.1
+            // +-----------------+-------------------+
+            // + Challenge (32B) | Application (32B) |
+            // +-----------------+-------------------+
+            Ctap1Command::U2F_REGISTER => {
+                if lc != 64 {
+                    return Err(Ctap1StatusCode::SW_WRONG_LENGTH);
+                }
+                Ok(Self::Register {
+                    challenge: *array_ref!(payload, 0, 32),
+                    application: *array_ref!(payload, 32, 32),
+                })
+            }
+
+            // U2F raw message format specification, Section 5.1
+            // +-----------------+-------------------+---------------------+------------+
+            // + Challenge (32B) | Application (32B) | key handle len (1B) | key handle |
+            // +-----------------+-------------------+---------------------+------------+
+            Ctap1Command::U2F_AUTHENTICATE => {
+                if lc < 65 {
+                    return Err(Ctap1StatusCode::SW_WRONG_LENGTH);
+                }
+                let handle_length = payload[64] as usize;
+                if lc != 65 + handle_length {
+                    return Err(Ctap1StatusCode::SW_WRONG_LENGTH);
+                }
+                let flag = Ctap1Flags::try_from(apdu[2])?;
+                Ok(Self::Authenticate {
+                    challenge: *array_ref!(payload, 0, 32),
+                    application: *array_ref!(payload, 32, 32),
+                    key_handle: payload[65..lc].to_vec(),
+                    flags: flag,
+                })
+            }
+
+            // U2F raw message format specification, Section 6.1
+            Ctap1Command::U2F_VERSION => {
+                if lc != 0 {
+                    return Err(Ctap1StatusCode::SW_WRONG_LENGTH);
+                }
+                Ok(Self::Version)
+            }
+
+            // For Vendor specific command.
+            Ctap1Command::VENDOR_SPECIFIC_FIRST..=Ctap1Command::VENDOR_SPECIFIC_LAST => {
+                Ok(Self::VendorSpecific {
+                    payload: payload.to_vec(),
+                })
+            }
+
+            _ => Err(Ctap1StatusCode::SW_INS_NOT_SUPPORTED),
+        }
+    }
+}
+
+pub struct Ctap1Command {}
+
+impl Ctap1Command {
+    const APDU_HEADER_LEN: u32 = 7; // CLA + INS + P1 + P2 + LC1-3
+
+    const CTAP1_CLA: u8 = 0;
+    // This byte is used in Register, but only serves backwards compatibility.
+    const LEGACY_BYTE: u8 = 0x05;
+    // This byte is hardcoded into the specification of Authenticate.
+    const USER_PRESENCE_INDICATOR_BYTE: u8 = 0x01;
+
+    // CTAP1/U2F commands
+    // U2F raw message format specification 1.2 (version 20170411)
+    const U2F_REGISTER: u8 = 0x01;
+    const U2F_AUTHENTICATE: u8 = 0x02;
+    const U2F_VERSION: u8 = 0x03;
+    const VENDOR_SPECIFIC_FIRST: u8 = 0x40;
+    const VENDOR_SPECIFIC_LAST: u8 = 0xBF;
+
+    pub fn process_command<R, CheckUserPresence>(
+        message: &[u8],
+        ctap_state: &mut CtapState<R, CheckUserPresence>,
+        clock_value: ClockValue,
+    ) -> Result<Vec<u8>, Ctap1StatusCode>
+    where
+        R: Rng256,
+        CheckUserPresence: Fn(ChannelID) -> Result<(), Ctap2StatusCode>,
+    {
+        let command = U2fCommand::try_from(message)?;
+        match command {
+            U2fCommand::Register {
+                challenge,
+                application,
+            } => {
+                if !ctap_state.u2f_up_state.consume_up(clock_value) {
+                    return Err(Ctap1StatusCode::SW_CONDITIONS_NOT_SATISFIED);
+                }
+                Ctap1Command::process_register(challenge, application, ctap_state)
+            }
+
+            U2fCommand::Authenticate {
+                challenge,
+                application,
+                key_handle,
+                flags,
+            } => {
+                // The order is important due to side effects of checking user presence.
+                if flags == Ctap1Flags::EnforceUpAndSign
+                    && !ctap_state.u2f_up_state.consume_up(clock_value)
+                {
+                    return Err(Ctap1StatusCode::SW_CONDITIONS_NOT_SATISFIED);
+                }
+                Ctap1Command::process_authenticate(
+                    challenge,
+                    application,
+                    key_handle,
+                    flags,
+                    ctap_state,
+                )
+            }
+
+            // U2F raw message format specification (version 20170411) section 6.3
+            U2fCommand::Version => Ok(Vec::<u8>::from(super::U2F_VERSION_STRING)),
+
+            // TODO: should we return an error instead such as SW_INS_NOT_SUPPORTED?
+            U2fCommand::VendorSpecific { .. } => Err(Ctap1StatusCode::SW_NO_ERROR),
+        }
+    }
+
+    // U2F raw message format specification (version 20170411) section 4.3
+    // In case of success we need to send back the following reply
+    // (excluding ISO7816 success code)
+    // +------+--------------------+---------------------+------------+------------+------+
+    // + 0x05 | User pub key (65B) | key handle len (1B) | key handle | X.509 Cert | Sign |
+    // +------+--------------------+---------------------+------------+------------+------+
+    //
+    // Where Sign is an ECDSA signature over the following structure:
+    // +------+-------------------+-----------------+------------+--------------------+
+    // + 0x00 | application (32B) | challenge (32B) | key handle | User pub key (65B) |
+    // +------+-------------------+-----------------+------------+--------------------+
+    fn process_register<R, CheckUserPresence>(
+        challenge: [u8; 32],
+        application: [u8; 32],
+        ctap_state: &mut CtapState<R, CheckUserPresence>,
+    ) -> Result<Vec<u8>, Ctap1StatusCode>
+    where
+        R: Rng256,
+        CheckUserPresence: Fn(ChannelID) -> Result<(), Ctap2StatusCode>,
+    {
+        let sk = crypto::ecdsa::SecKey::gensk(ctap_state.rng);
+        let pk = sk.genpk();
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        if key_handle.len() > 0xFF {
+            // This is just being defensive with unreachable code.
+            return Err(Ctap1StatusCode::SW_VENDOR_KEY_HANDLE_TOO_LONG);
+        }
+
+        let mut response =
+            Vec::with_capacity(105 + key_handle.len() + ATTESTATION_CERTIFICATE.len());
+        response.push(Ctap1Command::LEGACY_BYTE);
+        let user_pk = pk.to_uncompressed();
+        response.extend_from_slice(&user_pk);
+        response.push(key_handle.len() as u8);
+        response.extend(key_handle.clone());
+        response.extend_from_slice(&ATTESTATION_CERTIFICATE);
+
+        // The first byte is reserved.
+        let mut signature_data = Vec::with_capacity(66 + key_handle.len());
+        signature_data.push(0x00);
+        signature_data.extend(&application);
+        signature_data.extend(&challenge);
+        signature_data.extend(key_handle);
+        signature_data.extend_from_slice(&user_pk);
+
+        let attestation_key = crypto::ecdsa::SecKey::from_bytes(&ATTESTATION_PRIVATE_KEY).unwrap();
+        let signature = attestation_key.sign_rfc6979::<crypto::sha256::Sha256>(&signature_data);
+
+        response.extend(signature.to_asn1_der());
+        Ok(response)
+    }
+
+    // U2F raw message format specification (version 20170411) section 5.4
+    // In case of success we need to send back the following reply
+    // (excluding ISO7816 success code)
+    // +---------+--------------+-----------+
+    // + UP (1B) | Counter (4B) | Signature |
+    // +---------+--------------+-----------+
+    // UP only has 2 defined values:
+    //  - 0x00: user presence was not verified
+    //  - 0x01: user presence was verified
+    //
+    // Where Signature is an ECDSA signature over the following structure:
+    // +-------------------+---------+--------------+-----------------+
+    // + application (32B) | UP (1B) | Counter (4B) | challenge (32B) |
+    // +-------------------+---------+--------------+-----------------+
+    fn process_authenticate<R, CheckUserPresence>(
+        challenge: [u8; 32],
+        application: [u8; 32],
+        key_handle: Vec<u8>,
+        flags: Ctap1Flags,
+        ctap_state: &mut CtapState<R, CheckUserPresence>,
+    ) -> Result<Vec<u8>, Ctap1StatusCode>
+    where
+        R: Rng256,
+        CheckUserPresence: Fn(ChannelID) -> Result<(), Ctap2StatusCode>,
+    {
+        let credential_source = ctap_state.decrypt_credential_source(key_handle, &application);
+        if let Some(credential_source) = credential_source {
+            if flags == Ctap1Flags::CheckOnly {
+                return Err(Ctap1StatusCode::SW_CONDITIONS_NOT_SATISFIED);
+            }
+            ctap_state.increment_global_signature_counter();
+            let mut signature_data = ctap_state
+                .generate_auth_data(&application, Ctap1Command::USER_PRESENCE_INDICATOR_BYTE);
+            signature_data.extend(&challenge);
+            let signature = credential_source
+                .private_key
+                .sign_rfc6979::<crypto::sha256::Sha256>(&signature_data);
+
+            let mut response = signature_data[application.len()..application.len() + 5].to_vec();
+            response.extend(signature.to_asn1_der());
+            Ok(response)
+        } else {
+            Err(Ctap1StatusCode::SW_WRONG_DATA)
+        }
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::super::{ENCRYPTED_CREDENTIAL_ID_SIZE, USE_SIGNATURE_COUNTER};
+    use super::*;
+    use crypto::rng256::ThreadRng256;
+    use crypto::Hash256;
+
+    const CLOCK_FREQUENCY_HZ: usize = 32768;
+    const START_CLOCK_VALUE: ClockValue = ClockValue::new(0, CLOCK_FREQUENCY_HZ);
+    const TIMEOUT_CLOCK_VALUE: ClockValue = ClockValue::new(
+        (30001 * CLOCK_FREQUENCY_HZ as isize) / 1000,
+        CLOCK_FREQUENCY_HZ,
+    );
+
+    fn create_register_message(application: &[u8; 32]) -> Vec<u8> {
+        let mut message = vec![
+            Ctap1Command::CTAP1_CLA,
+            Ctap1Command::U2F_REGISTER,
+            0x00,
+            0x00,
+            0x00,
+            0x00,
+            0x40,
+        ];
+        let challenge = [0x0C; 32];
+        message.extend(&challenge);
+        message.extend(application);
+        message
+    }
+
+    fn create_authenticate_message(
+        application: &[u8; 32],
+        flags: Ctap1Flags,
+        key_handle: &Vec<u8>,
+    ) -> Vec<u8> {
+        let mut message = vec![
+            Ctap1Command::CTAP1_CLA,
+            Ctap1Command::U2F_AUTHENTICATE,
+            flags.into(),
+            0x00,
+            0x00,
+            0x00,
+            65 + ENCRYPTED_CREDENTIAL_ID_SIZE as u8,
+        ];
+        let challenge = [0x0C; 32];
+        message.extend(&challenge);
+        message.extend(application);
+        message.push(ENCRYPTED_CREDENTIAL_ID_SIZE as u8);
+        message.extend(key_handle);
+        message
+    }
+
+    #[test]
+    fn test_process_register() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let application = [0x0A; 32];
+        let message = create_register_message(&application);
+        ctap_state.u2f_up_state.consume_up(START_CLOCK_VALUE);
+        ctap_state.u2f_up_state.grant_up(START_CLOCK_VALUE);
+        let response =
+            Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE).unwrap();
+
+        assert_eq!(response[0], Ctap1Command::LEGACY_BYTE);
+        assert_eq!(response[66], ENCRYPTED_CREDENTIAL_ID_SIZE as u8);
+        assert!(ctap_state
+            .decrypt_credential_source(
+                response[67..67 + ENCRYPTED_CREDENTIAL_ID_SIZE].to_vec(),
+                &application
+            )
+            .is_some());
+        const CERT_START: usize = 67 + ENCRYPTED_CREDENTIAL_ID_SIZE;
+        assert_eq!(
+            &response[CERT_START..CERT_START + ATTESTATION_CERTIFICATE.len()],
+            &ATTESTATION_CERTIFICATE[..]
+        );
+    }
+
+    #[test]
+    fn test_process_register_bad_message() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let application = [0x0A; 32];
+        let message = create_register_message(&application);
+        let response = Ctap1Command::process_command(
+            &message[..message.len() - 1],
+            &mut ctap_state,
+            START_CLOCK_VALUE,
+        );
+
+        assert_eq!(response, Err(Ctap1StatusCode::SW_WRONG_LENGTH));
+    }
+
+    #[test]
+    fn test_process_register_without_up() {
+        let application = [0x0A; 32];
+        let message = create_register_message(&application);
+
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        ctap_state.u2f_up_state.consume_up(START_CLOCK_VALUE);
+        ctap_state.u2f_up_state.grant_up(START_CLOCK_VALUE);
+        let response =
+            Ctap1Command::process_command(&message, &mut ctap_state, TIMEOUT_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_CONDITIONS_NOT_SATISFIED));
+    }
+
+    #[test]
+    fn test_process_authenticate_check_only() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let message = create_authenticate_message(&application, Ctap1Flags::CheckOnly, &key_handle);
+
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_CONDITIONS_NOT_SATISFIED));
+    }
+
+    #[test]
+    fn test_process_authenticate_check_only_wrong_rp() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let application = [0x55; 32];
+        let message = create_authenticate_message(&application, Ctap1Flags::CheckOnly, &key_handle);
+
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_WRONG_DATA));
+    }
+
+    #[test]
+    fn test_process_authenticate_check_only_wrong_length() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let mut message =
+            create_authenticate_message(&application, Ctap1Flags::CheckOnly, &key_handle);
+
+        message.push(0x00);
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_WRONG_LENGTH));
+
+        // Two extra zeros are okay, they could encode the expected response length.
+        message.push(0x00);
+        message.push(0x00);
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_WRONG_LENGTH));
+    }
+
+    #[test]
+    fn test_process_authenticate_check_only_wrong_cla() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let mut message =
+            create_authenticate_message(&application, Ctap1Flags::CheckOnly, &key_handle);
+        message[0] = 0xEE;
+
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_CLA_NOT_SUPPORTED));
+    }
+
+    #[test]
+    fn test_process_authenticate_check_only_wrong_ins() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let mut message =
+            create_authenticate_message(&application, Ctap1Flags::CheckOnly, &key_handle);
+        message[1] = 0xEE;
+
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_INS_NOT_SUPPORTED));
+    }
+
+    #[test]
+    fn test_process_authenticate_check_only_wrong_flags() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let mut message =
+            create_authenticate_message(&application, Ctap1Flags::CheckOnly, &key_handle);
+        message[2] = 0xEE;
+
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_WRONG_DATA));
+    }
+
+    #[test]
+    fn test_process_authenticate_enforce() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let message =
+            create_authenticate_message(&application, Ctap1Flags::EnforceUpAndSign, &key_handle);
+
+        ctap_state.u2f_up_state.consume_up(START_CLOCK_VALUE);
+        ctap_state.u2f_up_state.grant_up(START_CLOCK_VALUE);
+        let response =
+            Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE).unwrap();
+        assert_eq!(response[0], 0x01);
+        if USE_SIGNATURE_COUNTER {
+            assert_eq!(response[1..5], [0x00, 0x00, 0x00, 0x01]);
+        } else {
+            assert_eq!(response[1..5], [0x00, 0x00, 0x00, 0x00]);
+        }
+    }
+
+    #[test]
+    fn test_process_authenticate_dont_enforce() {
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let sk = crypto::ecdsa::SecKey::gensk(&mut rng);
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        let rp_id = "example.com";
+        let application = crypto::sha256::Sha256::hash(rp_id.as_bytes());
+        let key_handle = ctap_state.encrypt_key_handle(sk, &application);
+        let message = create_authenticate_message(
+            &application,
+            Ctap1Flags::DontEnforceUpAndSign,
+            &key_handle,
+        );
+
+        let response =
+            Ctap1Command::process_command(&message, &mut ctap_state, TIMEOUT_CLOCK_VALUE).unwrap();
+        assert_eq!(response[0], 0x01);
+        if USE_SIGNATURE_COUNTER {
+            assert_eq!(response[1..5], [0x00, 0x00, 0x00, 0x01]);
+        } else {
+            assert_eq!(response[1..5], [0x00, 0x00, 0x00, 0x00]);
+        }
+    }
+
+    #[test]
+    fn test_process_authenticate_bad_key_handle() {
+        let application = [0x0A; 32];
+        let key_handle = vec![0x00; ENCRYPTED_CREDENTIAL_ID_SIZE];
+        let message =
+            create_authenticate_message(&application, Ctap1Flags::EnforceUpAndSign, &key_handle);
+
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        ctap_state.u2f_up_state.consume_up(START_CLOCK_VALUE);
+        ctap_state.u2f_up_state.grant_up(START_CLOCK_VALUE);
+        let response = Ctap1Command::process_command(&message, &mut ctap_state, START_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_WRONG_DATA));
+    }
+
+    #[test]
+    fn test_process_authenticate_without_up() {
+        let application = [0x0A; 32];
+        let key_handle = vec![0x00; ENCRYPTED_CREDENTIAL_ID_SIZE];
+        let message =
+            create_authenticate_message(&application, Ctap1Flags::EnforceUpAndSign, &key_handle);
+
+        let mut rng = ThreadRng256 {};
+        let dummy_user_presence = |_| panic!("Unexpected user presence check in CTAP1");
+        let mut ctap_state = CtapState::new(&mut rng, dummy_user_presence);
+
+        ctap_state.u2f_up_state.consume_up(START_CLOCK_VALUE);
+        ctap_state.u2f_up_state.grant_up(START_CLOCK_VALUE);
+        let response =
+            Ctap1Command::process_command(&message, &mut ctap_state, TIMEOUT_CLOCK_VALUE);
+        assert_eq!(response, Err(Ctap1StatusCode::SW_CONDITIONS_NOT_SATISFIED));
+    }
+}