Skip to content

CredentialId is not zero-padded #12

@osresearch

Description

@osresearch

Description

The attestationObject.authData.credentialId hex value in the debugger is not zero padded, so it can appear to be a nibble or byte short of the credentialIdLength field.

Reproduction

image

Register a key and attempt to convert it from hex to binary:

echo 7f9a74798aa5199b39ea57bdbf3ebbbf897356a319bd50192969c7877bb27987c7ddb4edc7fa3856ebb2d5e6c9af32bdfaac72ddefce597f24be88ac4c1a04a \
| xxd -p -r | xxd -g1
00000000: 7f 9a 74 79 8a a5 19 9b 39 ea 57 bd bf 3e bb bf  ..ty....9.W..>..
00000010: 89 73 56 a3 19 bd 50 19 29 69 c7 87 7b b2 79 87  .sV...P.)i..{.y.
00000020: c7 dd b4 ed c7 fa 38 56 eb b2 d5 e6 c9 af 32 bd  ......8V......2.
00000030: fa ac 72 dd ef ce 59 7f 24 be 88 ac 4c 1a 04     ..r...Y.$...L..

Since there is no leading 0, the resulting value is offset by four bits and the 64th byte is missing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions