JanssenProject / JanssenProject/jans

fix(jans-fido2): AAID-identified MDS TOC entries silently dropped during metadata parsing

Open
#13,992 0 comments 0 reactions 1 assignee Claimed by @imran-ishaq View on GitHub
comp-jans-fido2 kind-bug
Dominant language
Java
Stars
648
Forks
174
Avg merge
1d 18h
Merged PRs (30d)
110

Description

Describe the bug

In TocService.java:434-436, the processMetadataEntries method parses three types of authenticator identifiers from the FIDO MDS TOC blob, namely aaguid for FIDO2 authenticators, aaid for FIDO UAF authenticators, and attestationCertificateKeyIdentifiers for U2F authenticators. While the aaguid and attestationCertificateKeyIdentifiers cases are properly handled through their respective processing methods, the aaid branch is not implemented and only logs a debug-level TODO message. As a result, AAID-based entries are never inserted into tocEntries, causing getAuthenticatorsMetadata(aaid) to always return null for any UAF authenticator.

Expected behavior

AAID entries should be processed and added to tocEntries, keyed by the AAID value, after proper status verification, mirroring the behavior implemented in processAaguidEntry for AAGUID entries.

Impact

All FIDO UAF authenticators whose MDS TOC entries include an aaid field have their metadata silently dropped during startup. Any downstream attestation verification that depends on AAID-based metadata lookup will receive null, which can lead to verification failures or silent degradation. This issue is difficult to detect because the only indication in logs is a warning such as WARN: No entry found for AAGUID, which does not clearly point to the missing AAID handling.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.