You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
What protocol and version of the protocol are you testing?
FIDO2
What is your implementation class?
Server
What is the version of the tool are you using?
0.10.108
What is the OS and the version are you running?
Windows 7
Issue description
Test changed from (0.10.107):
F-5 Send ServerAuthenticatorAttestationResponse with "tpm" attestation pubArea.nameAlg is not matching algorithm used for generate attested.name, and check that server returns an error
to (0.10.108):
P-3 Send a valid ServerAuthenticatorAttestationResponse with "tpm" attestation pubArea.nameAlg is not matching algorithm used for generate attested.name, and check that server succeeds.
I realize that this was an intentional change as noted in an email to the Fido2 working group. However, there is a lack of communication for why this change occurred. The Webauthn specification states,
"[v]erify that attested contains a TPMS_CERTIFY_INFO structure as specified in [TPMv2-Part2] section 10.12.3, whose name field contains a valid Name for pubArea, as computed using the algorithm in the nameAlg field of pubArea using the procedure specified in [TPMv2-Part1] section 16." This would suggest that F-5 is the correct test that the conformance tool should be checking for.
By submitting this issue you are acknowledging that any information regarding this issue will be publicly available.
If you have privacy concerns, please email conformance-tools@fidoalliance.org
What protocol and version of the protocol are you testing?
FIDO2
What is your implementation class?
Server
What is the version of the tool are you using?
0.10.108
What is the OS and the version are you running?
Windows 7
Issue description
Test changed from (0.10.107):
F-5 Send ServerAuthenticatorAttestationResponse with "tpm" attestation pubArea.nameAlg is not matching algorithm used for generate attested.name, and check that server returns an error
to (0.10.108):
P-3 Send a valid ServerAuthenticatorAttestationResponse with "tpm" attestation pubArea.nameAlg is not matching algorithm used for generate attested.name, and check that server succeeds.
I realize that this was an intentional change as noted in an email to the Fido2 working group. However, there is a lack of communication for why this change occurred. The Webauthn specification states,
"[v]erify that attested contains a TPMS_CERTIFY_INFO structure as specified in [TPMv2-Part2] section 10.12.3, whose name field contains a valid Name for pubArea, as computed using the algorithm in the nameAlg field of pubArea using the procedure specified in [TPMv2-Part1] section 16." This would suggest that F-5 is the correct test that the conformance tool should be checking for.
Is there documentation outside of the Webauthn specification and Server Requirement that FIDO2 server implementers should be referencing?
The text was updated successfully, but these errors were encountered: