From 695bf3e83a2ad2f2a742f869c133af0ee367a9c3 Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Thu, 6 Jul 2023 22:21:25 +0200
Subject: [PATCH] Reject RK option in get_assertion

The getAssertion command does not use the rk option so we return an
InvalidOption error if it is set.

Fixes: https://github.com/Nitrokey/fido-authenticator/issues/23
---
 src/ctap2.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/ctap2.rs b/src/ctap2.rs
index 6cef808..88c4a82 100644
--- a/src/ctap2.rs
+++ b/src/ctap2.rs
@@ -948,6 +948,11 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
 
         // 6. process any options present
 
+        // RK is not supported in get_assertion
+        if parameters.options.as_ref().and_then(|options| options.rk).is_some() {
+            return Err(Error::InvalidOption);
+        }
+
         // UP occurs by default, but option could specify not to.
         let do_up = if parameters.options.is_some() {
             parameters.options.as_ref().unwrap().up.unwrap_or(true)