From 223bc11eece2da0185f747068be93c308254050a Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Wed, 7 May 2025 21:57:44 +0200
Subject: [PATCH] Always reject uv = true in make_credential and get_assertion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the error code if uv = true to InvalidOption even if a PIN
is set.  Previously, we returned PinRequired if a PIN is set.  The new
implementation follows § 6.1.2 Step 5 of the specification more closely.

https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#sctn-makeCred-authnr-alg
---
 src/ctap2.rs   | 9 ++++++---
 tests/basic.rs | 9 +++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/ctap2.rs b/src/ctap2.rs
index 8cf9cf9..ddd9cab 100644
--- a/src/ctap2.rs
+++ b/src/ctap2.rs
@@ -1383,9 +1383,12 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
         }
 
         // 4. If authenticator is protected by som form of user verification, do it
-        //
-        // TODO: Should we should fail if `uv` is passed?
-        // Current thinking: no
+
+        // Reject uv = true as we do not support built-in user verification
+        if pin_auth.is_none() && options.as_ref().and_then(|options| options.uv) == Some(true) {
+            return Err(Error::InvalidOption);
+        }
+
         if self.state.persistent.pin_is_set() {
             // let mut uv_performed = false;
             if let Some(pin_auth) = pin_auth {
diff --git a/tests/basic.rs b/tests/basic.rs
index 1fd014b..7114a8b 100644
--- a/tests/basic.rs
+++ b/tests/basic.rs
@@ -599,6 +599,9 @@ impl TestMakeCredential {
             if options.up.is_some() {
                 return Some(0x2c);
             }
+            if !matches!(self.pin_auth, PinAuth::PinToken(_)) && options.uv == Some(true) {
+                return Some(0x2c);
+            }
         }
         match &self.pin_auth {
             PinAuth::PinToken(
@@ -611,12 +614,6 @@ impl TestMakeCredential {
             }
             _ => {}
         }
-        if let Some(options) = self.options {
-            // TODO: review if uv should be always rejected due to the lack of built-in uv
-            if !matches!(self.pin_auth, PinAuth::PinToken(_)) && options.uv == Some(true) {
-                return Some(0x2c);
-            }
-        }
         if !self.valid_pub_key_alg {
             return Some(0x26);
         }