Questions regarding "set_min_pin_length" and "Large Blob Key"

[GN998]

Hi

Thank you for your previous update.

Apologies for bothering you again, but I have developed two test scripts to help verify these issues. Would you be interested in taking a look at them? I can share them here if that works for you.

My testing environment is:

OS: Ubuntu 22.04

Hardware: PC/SC smart card reader

[BryanJacobs]

This is the issue tracker. It's where we track issues.

[GN998]

Here is the new test script (test6).

I noticed that for a discoverable credential, it directly outputs the following without requiring any PIN verification:
51bb0458cb2f8af5506faf197502dbd1cf8e89e069b020d732f599ec390481ca

I suspect this isn't the expected behavior, but please correct me if I'm wrong.
test_5.txt
[test6.txt]

[BryanJacobs]

I've pushed a version fixing the problem with multiple RP IDs in setMinPinLength.

The second example ("test6") shows only expected behaviour. A credential generated without credProtect is usable without a PIN when alwaysUv=false. Since the credential can be asserted, the largeBlobKey can also be fetched. The assertion has UV=false.

Relevant standards block:

If other processing steps for authenticatorGetAssertion complete successfully, and the credential has an associated largeBlobKey, then set the value of largeBlobKey (0x07) in the authenticatorGetAssertion response structure (i.e., not in the extensions field of the authenticator data) to the stored largeBlobKey.

There's nothing there that says UV or a clientPin is required.

While I appreciate the effort, I do have to ask you to first read through and understand the LLM output before presenting it here - please only forward things you can explain yourself. Thank you.

[GN998]

Got it. Thanks for the fix on the first issue and for clearing up the expected behavior for "test6".

I apologize for forwarding the unverified LLM output. I'll definitely be more careful and ensure I fully grasp the technical details before opening issues in the future. Thanks for your work!