Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIDO2 TPM P-3 nameAlg test directly contradicts Webauthn specification #375

Closed
tfvbhy opened this issue Aug 14, 2018 · 1 comment
Closed

Comments

@tfvbhy
Copy link

tfvbhy commented Aug 14, 2018

By submitting this issue you are acknowledging that any information regarding this issue will be publicly available.

If you have privacy concerns, please email conformance-tools@fidoalliance.org

What protocol and version of the protocol are you testing?

FIDO2

What is your implementation class?

Server

What is the version of the tool are you using?

0.10.108

What is the OS and the version are you running?

Windows 7

Issue description

Test changed from (0.10.107):
F-5 Send ServerAuthenticatorAttestationResponse with "tpm" attestation pubArea.nameAlg is not matching algorithm used for generate attested.name, and check that server returns an error
to (0.10.108):
P-3 Send a valid ServerAuthenticatorAttestationResponse with "tpm" attestation pubArea.nameAlg is not matching algorithm used for generate attested.name, and check that server succeeds.

I realize that this was an intentional change as noted in an email to the Fido2 working group. However, there is a lack of communication for why this change occurred. The Webauthn specification states,
"[v]erify that attested contains a TPMS_CERTIFY_INFO structure as specified in [TPMv2-Part2] section 10.12.3, whose name field contains a valid Name for pubArea, as computed using the algorithm in the nameAlg field of pubArea using the procedure specified in [TPMv2-Part1] section 16." This would suggest that F-5 is the correct test that the conformance tool should be checking for.

Is there documentation outside of the Webauthn specification and Server Requirement that FIDO2 server implementers should be referencing?

@tfvbhy
Copy link
Author

tfvbhy commented Sep 4, 2018

Can I get an explanation why F-5 was the incorrect test and P-3 is the correct test?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants