Yubico / yubikit-android

Yubico Mobile Android SDK - YubiKit
Apache License 2.0
115 stars 42 forks source link

Fix MC/GA UserVerificationRequirement.DISCOURAGED #116

Closed AdamVe closed 10 months ago

AdamVe commented 10 months ago

Pass correct values of pinUvAuthParam and pinUvAuthProtocol to makeCredential.

Before this fix, we wrongly passed 0 pinUvAuthProtocol value instead of null.

The new integration test verify makeCredential and getAssertion with null PIN and UserVerificationRequirement.DISCOURAGED. This way it is possible to create rk = true and rk = false credentials on FIDO2 keys which don't have PIN set. FIDO2 keys with set PIN will return 0x36 PIN_REQUIRED error.