[webauthn] new commits pushed by emlun

The following commits were just pushed by emlun to https://github.com/w3c/webauthn:

* Fix #848: Weirdness in RP UP verification

§7.1. Registering a new credential currently reads (and §7.2. Verifying
an authentication assertion is analogous):

>10. If user verification is required for this registration, verify that
the User Verified bit of the `flags` in _authData_ is set.
>11. If user verification is not required for this registration, verify
that the User Present bit of the `flags` in _authData_ is set.

This results in the following truth table:

    UV req.     | UP req? | UV res. | UP res. | Accept?
    ------------+---------+---------+---------+--------
    discouraged | Yes     | 0       | 0       | No
    discouraged | Yes     | 0       | 1       | Yes
    discouraged | Yes     | 1       | 0       | No
    discouraged | Yes     | 1       | 1       | Yes
    preferred   | Yes     | 0       | 0       | No
    preferred   | Yes     | 0       | 1       | Yes
    preferred   | Yes     | 1       | 0       | No
    preferred   | Yes     | 1       | 1       | Yes
    required    | No      | 0       | 0       | No
    required    | No      | 0       | 1       | No
    required    | No      | 1       | 0       | Yes
    required    | No      | 1       | 1       | Yes

Note, for example, how UV `preferred` means that a response with `(UV=1,
UP=0)` should be rejected.

It makes more sense to let the UP requirement be defined by the UV
_response_ instead of the UV _requirement_:

    UV req.     | UV res. | UP req? | UP res. | Accept?
    ------------+---------+---------+---------+--------
    discouraged | 0       | Yes     | 0       | No
    discouraged | 0       | Yes     | 1       | Yes
    discouraged | 1       | No      | 0       | Yes
    discouraged | 1       | No      | 1       | Yes
    preferred   | 0       | Yes     | 0       | No
    preferred   | 0       | Yes     | 1       | Yes
    preferred   | 1       | No      | 0       | Yes
    preferred   | 1       | No      | 1       | Yes
    required    | 0       | Yes     | 0       | No
    required    | 0       | Yes     | 1       | No
    required    | 1       | No      | 0       | Yes
    required    | 1       | No      | 1       | Yes
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/5b026ad5fcab52b853995a8ca8f4959bd9f9c0b7

* Always verify UP bit in RP ops

As pointed out by @akshayku, recent drafts of CTAP now support this.
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/a46247182ccbda508a619f27d4437649a30004a3

* Merge branch 'master' into issue-848-rp-up-verification
  by JeffH
https://github.com/w3c/webauthn/commit/2ae16c671edfbce5dc6ec020deae706a13d751c9

* Fix |authData| -> |aData|
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/2dabcf8ac7a5734504443148697c69c86697a799

* Merge pull request #849 from w3c/issue-848-rp-up-verification

Fix #848: Weirdness in RP UP verification
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/c22b1ac49d3cbb4ba1902272ae5470bc2292ea55

Received on Wednesday, 2 May 2018 11:18:36 UTC