Comments (5)
It may be worth adding a small It's RECOMMENDED that RP's do not verify the reserved flags as future implementations MAY use them.
.
from webauthn.
@zacknewman Not all requirements can be enforced in-protocol. Authenticators are required to set the RFU bits to zero for now, but RPs should not enforce this behaviour since that would break those RPs if the bits are allocated in the future. Certification programs - such as those run by FIDO for the CTAP2 implementation of the authenticator operations - could enforce that "the RFU
bits SHALL be set to zero", but it's a bad idea to embed such enforcement in the protocol as that would undermine the point of the flags being "reserved for future use".
from webauthn.
Interesting, so CTAP 2.2 seems to align with the figures and not flags
documentation as it says, "let flags be a byte whose zeroth bit (bit 0, UP) is set, and whose sixth bit (bit 6, AT) is set, and all other bits are zero (bit zero is the least significant bit)" (emphasis added). This would suggest that flags
should be updated to not only state the bits are "reserved for future use" but that in the meantime they must be 0.
from webauthn.
It is defined under "Authenticators perform the following steps to generate an authenticator data structure" that:
However, the RP Operations procedures do not instruct to enforce that the flags be zero. Doing so would make any compliant RP implementations incompatible with future changes that allocate these flags to be used, like we have done in L3 with the BE and BS flags.
from webauthn.
I'm confused. If something SHALL/MUST be something, then shouldn't that mean it's enforced independent of the RP Operations? If not, then using RFC 2119 terminology—specifically "MUST", "SHALL", "REQUIRED", "MUST NOT", and "SHALL NOT"—is not only completely pointless but worse confusing/contradictory (how can something be both required and not required?) since it's only the RP Operations that dictate what happens.
It would be nice if the flags
documentation were updated to at least link to Authenticators perform the following steps to generate an authenticator data structure; so implementations that actually adhere to the RFC 2119 terms as stated in the Dependencies more easily find this requirement and don't accidentally ignore the bits instead.
from webauthn.
Related Issues (20)
- [[Create]] should not access the global object directly HOT 1
- Define `TypeError` behavior during `.get()` HOT 3
- Return more nuanced errors HOT 3
- Does Related Origins introduce a need for "Related RP IDs" support in `.get()`? HOT 1
- UTF-8 decode should not be required for response.clientDataJSON and cData HOT 2
- CollectedClientData fields are not ordered correctly and crossOrigin should be required HOT 3
- Add `topOrigin` to the limited verification algorithm HOT 2
- Use URI instead of URL for related origins HOT 2
- Add `publicKey` and `publicKeyAlgorithm` to `AuthenticatorAssertionResponseJSON` HOT 3
- Make `AuthenticatorAttestationResponseJSON.publicKeyAlgorithm` optional HOT 2
- Rename PublicKeyCredentialHints to PublicKeyCredentialHint? HOT 1
- CollectedClientData.crossOrigin not referenced in RP ops HOT 1
- Cross-window `Virtual Authenticator Database` HOT 2
- Make `Credential.id` a `DOMString` HOT 2
- Remove `RegistrationResponseJSON.id` and `AuthenticationResponseJSON.id` HOT 10
- Remove rp.name HOT 3
- `options.mediation` should be called something else in step 14 of Registering a New Credential HOT 2
- Add `mediation` to `PublicKeyCredentialJSON` HOT 2
- Add links where non-members can make patent licensing committments to `CONTRIBUTING.md` HOT 1
- Review privacy concerns around error conditions HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from webauthn.