From 7ff0518b6830efdc215402c95a680ee41726f2bc Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Wed, 7 May 2025 16:04:44 +0200
Subject: [PATCH] hmac-secret: Forbid up=false

Fixes: https://github.com/Nitrokey/fido-authenticator/issues/19
---
 src/ctap2.rs   | 4 ++++
 tests/basic.rs | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/src/ctap2.rs b/src/ctap2.rs
index 511becf..8cf9cf9 100644
--- a/src/ctap2.rs
+++ b/src/ctap2.rs
@@ -1448,6 +1448,10 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
                 .transpose()?
                 .unwrap_or(PinProtocolVersion::V1);
 
+            if !get_assertion_state.up_performed {
+                return Err(Error::UnsupportedOption);
+            }
+
             // We derive credRandom as an hmac of the existing private key.
             // UV is used as input data since credRandom should depend UV
             // i.e. credRandom = HMAC(private_key, uv)
diff --git a/tests/basic.rs b/tests/basic.rs
index 5e0b684..1fd014b 100644
--- a/tests/basic.rs
+++ b/tests/basic.rs
@@ -774,6 +774,11 @@ impl TestGetAssertion {
         if !self.rk && !self.allow_list {
             return Some(0x2e);
         }
+        if let Some(options) = self.options {
+            if options.up == Some(false) && self.ga_hmac_secret {
+                return Some(0x2b);
+            }
+        }
         None
     }
 }