Nuno Sung

Information: Become a Microsoft-compatible FIDO2 security key vendor

1

Maybe useful, but I'm not the stockholder of this information... https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-fido2-hardware-vendor

Fuzzing test use pinUvAuthToken to check if device is crashed or not

1

https://github.com/google/CTAP2-test-tool/blob/d7437911c7bf282bd0d91569041fe8854d45fe7b/src/monitors/blackbox_monitor.cc#L44 But in ctap2.1 spec, this method won't work due to > 6.5.5.7.1. Getting pinUvAuthToken using getPinToken (superseded) > .. > - Create a new pinUvAuthToken by calling resetPinUvAuthToken()

GetAssertionOptionUvTrueTest - pinUvAuthToken can't be used again for GetAssertionPositiveTest.

1

In latest ctap2.1 spec, step 6.1.2.14 `If the "up" option is set to true:` The last step4. will `Call clearUserPresentFlag(), clearUserVerifiedFlag(), and clearPinUvAuthTokenPermissionsExceptLbw().` So the result of following GetAssertionPositiveTest should...

MakeCredentialPinAuthMissingParameterTest - "Missing PIN parameters were not rejected when PIN is set."

1

This test item need to consider `[=getInfo/makeCredUvNotRqd=] [=option ID=]` is true case. Thanks!

Test item GetAssertionEmptyUserIdTest

15

{ "description": "Tests if empty user IDs are omitted in the response.", "error_message": "Cannot make credential with an empty user ID.", "id": "get_assertion_empty_user_id", "observations": [ "A prompt was expected, but...

Test item MakeCredentialCredParamsTest

10

test item:　MakeCredentialCredParamsTest { "description": "Tests entries in the credential parameters list.", "error_message": "Falsely rejected cred params list with 1 good and 1 bad element.", "id": "make_credential_cred_params", "observations": [ "A...

cbor.decodeFirstSync will failed and throw errors if there is extra data.

1

Seems due to recent node-cbor module update in this project. And below is related information. https://github.com/hildjj/node-cbor/issues/118#issuecomment-761741260 This will cause authenticator data parsing failed if there is any extra extension data.