Documentation

Author: BryanJacobs

docs/FAQ.md

@@ -74,12 +74,15 @@ a getAssertion call is made with an `allowList` given, CTAP2.0 says that the
 authenticator should iterate through assertions generated with the matching
 credentials from the allowlist. CTAP2.1 says the authenticator should pick one
 matching credential, return an assertion generated with it, and ignore any
-other matches.
+other matches. 
 
 This implementation allows toggling either behavior by flipping a boolean in the
 code, but because one or the other must be chosen, it can't be both fully CTAP2.0
 compatible and CTAP2.1 compatible at the same time.
 
+Another more minor difference is that CTAP2.0 allows PINs of 64  bytes or longer.
+This authenticator and CTAP2.1 cap PINs at 63 bytes long.
+
 ## Why don't you implement U2F/CTAP1?
 
 U2F doesn't support PINs, and requires an attestation certificate.
@@ -107,7 +110,8 @@ It will store:
 - the credential ID (an AES256 encrypted blob of the RP ID SHA-256
   hash and the credential private key)
 - up to 32 characters of the RP ID, again AES256 encrypted
-- a max 64-character-long user ID, again AES256 encrypted
+- a max 64-byte-long user ID, again AES256 encrypted
+- the 64-byte public key associated with the credential, again AES256 encrypted
 - the length of the RP ID, unencrypted
 - the length of the user ID, unencrypted
 - a boolean set to true on the first credential from a given RP ID, used

src/main/java/us/q3q/fido2/FIDO2Applet.java

@@ -3153,6 +3153,16 @@ private void handleEnumerateCreds(APDU apdu, short bufferIdx, short startCredIdx
         sendErrorByte(apdu, FIDOConstants.CTAP2_ERR_NO_CREDENTIALS);
     }
 
+    /**
+     * Pack a credential ID (CBOR-wrapped) into a target buffer
+     *
+     * @param credBuffer Buffer containing credential ID
+     * @param credOffset Offset of credential ID in input buffer
+     * @param writeBuffer Output buffer into which to write CBOR
+     * @param writeOffset Write index into output buffer
+     *
+     * @return New write index into output buffer, after writing credential CBOR
+     */
     private short packCredentialId(byte[] credBuffer, short credOffset, byte[] writeBuffer, short writeOffset) {
         writeBuffer[writeOffset++] = (byte) 0xA2; // map: two entries
 
@@ -3163,7 +3173,6 @@ private short packCredentialId(byte[] credBuffer, short credOffset, byte[] write
         writeOffset = Util.arrayCopyNonAtomic(credBuffer, credOffset,
                 writeBuffer, writeOffset, CREDENTIAL_ID_LEN);
 
-
         writeBuffer[writeOffset++] = 0x64; // string - four bytes long
         writeBuffer[writeOffset++] = 0x74; // t
         writeBuffer[writeOffset++] = 0x79; // y