UnblockPIN and VerifyPIN have differing behaviors

[karalabe]

Hey, played around with it a bit more and can confirm that the PUK is properly decremented if I supply all the needed 12 + 6 bytes.

However, then I have a different issue:

• In unblockPIN, you verify that the PUK + PIN is 18 digits, and don't fail the PUK attempt if the input is bad. This is imho good behavior.
• In verifyPIN however you do not check that the length is 6 digitas, so you do fail the PIN attempt if the input is bad.

I think both behaviors is fine as long as they are consistent across each other. At least this is what I would expect.

[bitgamma]

I agree with you that the VERIFY PIN behavior is somewhat inconsistent and should be changed to match the UNBLOCK PIN behavior. In the meantime format validation can be performed client-side to avoid wasting PIN attempts.