mozilla / mozilla/authenticator-rs
Audit for use of CTAP2 canonical CBOR encoding
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 316
- Forks
- 82
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 1
Description
We need to review our serialization routines to ensure that we use CTAP2 canonical CBOR encoding form. Martin Kreichgauer noticed that the keys in our AttestationObjects maps are in the order (authData, fmt, attStmt) instead of the correct (fmt, attStmt, authData). I'll fix that issue, but we should do an audit and add tests as well.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the serialization routines for AttestationObjects maps and compare their key ordering with the linked CTAP2 canonical CBOR specification. Audit the other serialization paths and add tests that verify canonical ordering, including the fmt, attStmt, authData ordering; done means the audit findings are addressed and the tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100