Skip to content

fix: remove attestation conveyance preference check in attestation statement implementations - #55

Open
tanguilp wants to merge 2 commits into
masterfrom
tl/remove_attestation_conveyance_preference_check_in_atetstation_statement_impls
Open

fix: remove attestation conveyance preference check in attestation statement implementations#55
tanguilp wants to merge 2 commits into
masterfrom
tl/remove_attestation_conveyance_preference_check_in_atetstation_statement_impls

Conversation

@tanguilp

@tanguilp tanguilp commented Apr 6, 2026

Copy link
Copy Markdown
Owner

Fixes: #51

@makmn1

makmn1 commented Apr 7, 2026

Copy link
Copy Markdown

I ran this against the official test suite and the good news is that there are no regressions from the changes here compared to the current version (0.7). That said, I did run into a few issues which you might run into when you get a chance to run the tests:

  • I had to remove the exception block that was added here for the tests to run since the test server triggers the exception to be raised.
  • The last version for wax_api_rest (0.5) causes 20+ test failures due to changes made to invalidate_challenge:
[error] #PID<0.2327.0> running WaxFidoTestSuiteServerWeb.Endpoint (connection #PID<0.448.0>, stream id 269) terminated
Server: localhost:4000 (http)                                                                                                                                    
Request: POST /attestation/result                                                                                                                                
** (exit) an exception was raised:                                                                                                                               
    ** (UndefinedFunctionError) function WaxFidoTestSuiteServerWeb.UserKeyCallbackImpl.invalidate_challenge/1 is undefined or private                            
        (wax_fido_test_suite_server 0.1.0) 
  • When running with wax_api_rest version 0.4 against wax 0.7 / the changes here, there are only four failures, with the last one being related to the metadata service tests (which the test suite instructions say to skip). Failures:
Server-ServerAuthenticatorAttestationResponse-Resp-1 Test server processing ServerAuthenticatorAttestationResponse structure
F-15 Send ServerAuthenticatorAttestationResponse with authenticatorData.flags.uv set to false when userVerification is set to 'required' and check that server returns an error‣
Error: Promise succeded when expected to fail! 
    at file:///C:/Users/makmn/AppData/Local/Programs/fido-conformance-tools-electron/resources/app.asar/app/js/utils.js:1162:39
	
Server-ServerAuthenticatorAttestationResponse-Resp-9 Test server processing "tpm" attestation
P-1 Send a valid ServerAuthenticatorAttestationResponse with "tpm" attestation for SHA-256, and check that server succeeds‣
Error: Server responed with error. The errorMessage is: Failed to verify attestation of type tpm (reason: invalid_certificate)
    at eval (eval at compileCode (js/sandbox.js:25:26), <anonymous>:4528:19)
	
P-2 Send a valid ServerAuthenticatorAttestationResponse with "tpm" attestation for SHA-1, and check that server succeeds‣
Error: Server responed with error. The errorMessage is: Failed to verify attestation of type tpm (reason: invalid_certificate)
    at eval (eval at compileCode (js/sandbox.js:25:26), <anonymous>:4528:19)
	
Server-MDS3 Test server support for Metadata Service 3
P-1 For a valid MDS blob, send a valid ServerAuthenticatorAttestationResponse with FULL "packed" attestation by authenticator from that blob and check that server succeeds.‣
Error: Server responed with error. The errorMessage is: Authenticator metadata was not found
    at eval (eval at compileCode (js/sandbox.js:25:26), <anonymous>:4528:19)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Accept fmt: "none" when attestation was requested as "direct" — leave accept/reject to RP policy

2 participants