Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RP UP verification instruction is weird #848

Closed
emlun opened this issue Mar 21, 2018 · 0 comments · Fixed by #849
Closed

RP UP verification instruction is weird #848

emlun opened this issue Mar 21, 2018 · 0 comments · Fixed by #849

Comments

@emlun
Copy link
Member

emlun commented Mar 21, 2018

§7.1. Registering a new credential currently reads (and §7.2. Verifying an authentication assertion is analogous):

  1. If user verification is required for this registration, verify that the User Verified bit of the flags in authData is set.
  2. If user verification is not required for this registration, verify that the User Present bit of the flags in authData is set.

This results in the following truth table:

UV req.     | UP req? | UV res. | UP res. | Accept?
------------+---------+---------+---------+--------
discouraged | Yes     | 0       | 0       | No
discouraged | Yes     | 0       | 1       | Yes
discouraged | Yes     | 1       | 0       | No
discouraged | Yes     | 1       | 1       | Yes
preferred   | Yes     | 0       | 0       | No
preferred   | Yes     | 0       | 1       | Yes
preferred   | Yes     | 1       | 0       | No
preferred   | Yes     | 1       | 1       | Yes
required    | No      | 0       | 0       | No
required    | No      | 0       | 1       | No
required    | No      | 1       | 0       | Yes
required    | No      | 1       | 1       | Yes

Note, for example, how UV preferred means that a response with (UV=1, UP=0) should be rejected.

It would make more sense to let the UP requirement be defined by the UV response instead of the UV requirement:

UV req.     | UV res. | UP req? | UP res. | Accept?
------------+---------+---------+---------+--------
discouraged | 0       | Yes     | 0       | No
discouraged | 0       | Yes     | 1       | Yes
discouraged | 1       | No      | 0       | Yes
discouraged | 1       | No      | 1       | Yes
preferred   | 0       | Yes     | 0       | No
preferred   | 0       | Yes     | 1       | Yes
preferred   | 1       | No      | 0       | Yes
preferred   | 1       | No      | 1       | Yes
required    | 0       | Yes     | 0       | No
required    | 0       | Yes     | 1       | No
required    | 1       | No      | 0       | Yes
required    | 1       | No      | 1       | Yes
@emlun emlun added this to the PR milestone Mar 21, 2018
@emlun emlun self-assigned this Mar 21, 2018
emlun added a commit that referenced this issue Mar 21, 2018
§7.1. Registering a new credential currently reads (and §7.2. Verifying
an authentication assertion is analogous):

>10. If user verification is required for this registration, verify that
the User Verified bit of the `flags` in _authData_ is set.
>11. If user verification is not required for this registration, verify
that the User Present bit of the `flags` in _authData_ is set.

This results in the following truth table:

    UV req.     | UP req? | UV res. | UP res. | Accept?
    ------------+---------+---------+---------+--------
    discouraged | Yes     | 0       | 0       | No
    discouraged | Yes     | 0       | 1       | Yes
    discouraged | Yes     | 1       | 0       | No
    discouraged | Yes     | 1       | 1       | Yes
    preferred   | Yes     | 0       | 0       | No
    preferred   | Yes     | 0       | 1       | Yes
    preferred   | Yes     | 1       | 0       | No
    preferred   | Yes     | 1       | 1       | Yes
    required    | No      | 0       | 0       | No
    required    | No      | 0       | 1       | No
    required    | No      | 1       | 0       | Yes
    required    | No      | 1       | 1       | Yes

Note, for example, how UV `preferred` means that a response with `(UV=1,
UP=0)` should be rejected.

It makes more sense to let the UP requirement be defined by the UV
_response_ instead of the UV _requirement_:

    UV req.     | UV res. | UP req? | UP res. | Accept?
    ------------+---------+---------+---------+--------
    discouraged | 0       | Yes     | 0       | No
    discouraged | 0       | Yes     | 1       | Yes
    discouraged | 1       | No      | 0       | Yes
    discouraged | 1       | No      | 1       | Yes
    preferred   | 0       | Yes     | 0       | No
    preferred   | 0       | Yes     | 1       | Yes
    preferred   | 1       | No      | 0       | Yes
    preferred   | 1       | No      | 1       | Yes
    required    | 0       | Yes     | 0       | No
    required    | 0       | Yes     | 1       | No
    required    | 1       | No      | 0       | Yes
    required    | 1       | No      | 1       | Yes
@emlun emlun closed this as completed in #849 May 2, 2018
emlun added a commit that referenced this issue May 2, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants