cred: support for enterprise attestation #824
Conversation
Can be used to enable enterprise attestation.
Returns true if an enterprise attestation was returned for this credential, false otherwise.
Use excl_cred's first byte as an input to fido_cred_set_entattest(); like what fido_cred_set_prot() is doing with user_id. This saves adding additional members to the parameter struct.
To request enterprise attestation.
To request enterprise attestation.
|
we seem to be missing MAN_ALIAS bits for the new functions, otherwise LGTM. for my own education, what does |
Thanks!
Here's my understanding: It is for the to indicate whether the authenticator used EA. The client may, for example, replace the attestation with an empty ("none") attestation statement if the authenticator did not return an EA and instead downgraded to regular attestation, I believe Chrome does this(?). If this boolean was not present in the response, the client would need knowledge of how to parse and discern EA, i.e. what constitutes individually identifiable information. |
|
understood; thank you. is there wire data we could use for regression tests? |
We could definitely record some. I'll make sure to do so before marking this PR as ready. Thanks! |
To be able to specify multiple source files to add_regress_test().
No functional change.
This makes use of mocked i/o to ensure that our parsers work correctly. To do this, new wiredata was recorded and the contents of the response were extracted so that we can re-use the same expected data throughout these tests.
Recorded from a device provisioned with the FIDO alliance test data [0]. [0] https://github.com/fido-alliance/conformance-test-tools-resources/blob/821c7114ae193148d276464a80c98d5535fa5681/docs/FIDO2/Authenticator/README.md
|
I've added regression tests where we can assert that we parse the response to |
In short, the following user visible changes are applied:
fido_cred_set_entattest()is added for the client to be able to request enterprise attestation;fido_cred_entattest()is added to query whether the authenticator performed enterprise attestation; andfido2-cred -M -ais added to request enterprise attestation (ditoexamples/cred).Internally,
fido_dev_make_cred_tx()learned how to encode the enterprise attestation parameter;fido_dev_make_cred_rx()learned how to decode the response; andwinhello.cequivalents.Finally, the fuzzer and manual pages are updated accordingly.
Further resources: