Robin Krahl 30c6cb0c89 Don’t decrement PIN retry counter for bad pinAuth in credential_management ...

The PIN retry counter should only be decremented for bad PIN entries,
not for bad pinAuth values. Most commands that accept pinAuth input
handle this correctly, but credential_management mistakenly decremented
the retry counter. Also it is not necessary to check whether PIN
authentication is blocked. The command should just return
CTAP2_ERR_PIN_AUTH_INVALID if verification fails.

See § 6.5.2.3 of the spec:
> Each incorrect PIN entry decrements the pinRetries by 1.
https://fidoalliance.org/specs/fido-v2.3-ps-20260226/fido-client-to-authenticator-protocol-v2.3-ps-20260226.html#pinretries

2026-10-27 18:40:07 +01:00

..

ctap2

Use constant-time comparisons for relevant operations

2026-10-27 18:23:42 +01:00

dispatch

Update to heapless 0.9 and trussed-core 0.2

2026-03-25 18:34:39 +01:00

state

Make credential: change the path of rks to rp_id_hash.credential_id_hash from rp_id_hash/credential_id_hash

2025-02-20 13:44:22 +01:00

constants.rs

Update dependencies for trussed-core and ctaphid-app

2025-01-08 11:28:43 +01:00

credential.rs

Update dev dependencies

2026-10-27 01:18:40 +01:00

ctap1.rs

Introduce CredentialIdVersion enum

2026-06-01 13:10:49 +02:00

ctap2.rs

Don’t decrement PIN retry counter for bad pinAuth in credential_management

2026-10-27 18:40:07 +01:00

dispatch.rs

ctap2: refactor make_credential / get_assertion to take &mut Response

2026-06-01 17:38:06 +02:00

lib.rs

ctap2.3: long-touch reset (§6.11.5, §7.7)

2026-06-03 09:35:29 +02:00

state.rs

Update dev dependencies

2026-10-27 01:18:40 +01:00