W3C home > Mailing lists > Public > public-webauthn@w3.org > March 2019

[webauthn] new commits pushed by equalsJeffH

From: =JeffH via GitHub <sysbot+gh@w3.org>
Date: Mon, 11 Mar 2019 21:56:17 +0000
To: public-webauthn@w3.org
Message-ID: <push-86a43b130858f80c7828970a9019d3e7673f8825-1552341376-sysbot+gh@w3.org>

The following commits were just pushed by equalsJeffH to https://github.com/w3c/webauthn:

* Note that appid should be set to the previously used AppID
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/486eb7b12fb443c4eab6ae8795d81c8f27d48710

* Remove extraneous newline
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/dafc308339f5e3875134ecb5d8b3dd87a9b67b26

* Let requireUserPresence always be true in authenticator operations

This fixes an oversight in commit
7f831e3c7ebf669041c6413acc8005c3efa0eb8b which causes it to be
technically allowed for the authenticator to return (UV = 1, UP = 0),
though the RP operations as currently specified would not accept such a
response.
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/d9de1254080f44244954f378828046108911afd1

* Determine appid extension output after authenticator returns

This fixes the following corner case:

1. The user has a U2F authenticator A plugged in, which has been
   registered via the U2F API (i.e., with AppID).
2. The user has a CTAP2 authenticator B plugged in, which has been
   registered via the WebAuthn API (i.e., with RP ID).
3. The user initiates an authentication ceremony and the RP sets the
   `appid` extension.
4. The client runs the above client processing and discovers that
   authenticator A does not contain a credential for the RP ID, and
   retries with the AppID. This succeeds, and the client sets the
   extension's _output_ to `true`.
5. The client initiates authentication requests with both authenticator
   A and B, which both prompt the user for consent.
6. The user confirms user consent on authenticator B, which generates an
   assertion for the RP ID.
7. The client returns the assertion for the RP ID and the `appid` client
   extension output set to `true`.

So it was possible for the extension output to end up being `true` even
though the RP should verify the assertion using the RP ID and not the
AppID.
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/776b7b14d6e8f64b101db7e92318c877c588e861

* Merge pull request #1140 from w3c/issue-1123-uv-up

Let requireUserPresence always be true in authenticator operations
  by J.C. Jones
https://github.com/w3c/webauthn/commit/26cf7c62581ec913a06be4eb9ea94807a0468a32

* Merge pull request #1143 from w3c/issue-1034-appid-output-corner-case

Determine appid extension output after authenticator returns
  by Emil Lundberg
https://github.com/w3c/webauthn/commit/4de25bb480f30dbca8e83381637a5e04872484fd

* Merge pull request #1118 from w3c/appid-note

Note that appid should be set to the previously used AppID
  by Adam Langley
https://github.com/w3c/webauthn/commit/11126e87846c1677f6f5bf56f33086b875ea5e66

* Move Angelo Liao to the Former Editors list (#1172)
  by Mike Jones
https://github.com/w3c/webauthn/commit/909b3c267babc181cdfc5d3aaf8b5033c5337703

*  update registries draft per issue #1176 (#1177)


* this is rev -02 of this Internet-Draft:

* update JeffH's affiliation

* add registry initialization instructions, update WebAuthn spec citation

* fixing up various things, add doc history entry

* provide erefs to dfns for attstn stmt fmt and extns idents, thx Giri!
  by =JeffH
https://github.com/w3c/webauthn/commit/3fc3b1e8a71bf3a9962e7257ffcc0789dcfae023

* merge from master, fix conflicts
  by JeffH
https://github.com/w3c/webauthn/commit/86a43b130858f80c7828970a9019d3e7673f8825
Received on Monday, 11 March 2019 21:56:19 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:59:02 UTC