Conformance fix: Remove trustpath subject-issuer comparison (#555)

* Revert "Conformance-breaking: Keep the stricter rules"

This reverts commit ac11a81.

* Improve comments

Author: abergs

Src/Fido2/Extensions/CryptoUtils.cs

@@ -58,10 +58,8 @@ public static bool ValidateTrustChain(X509Certificate2[] trustPath, X509Certific
         // The array does not represent a certificate chain, but only the trust anchor of that chain.
         // A trust anchor can be a root certificate, an intermediate CA certificate or even the attestation certificate itself.
 
-        // Let's check the simplest case first.  If subject and issuer are the same, and the attestation cert is in the list, that's all the validation we need
-
-        // We have the same singular root cert in trustpath and it is in attestationRootCertificates
-        if (trustPath.Length == 1 && trustPath[0].Subject.Equals(trustPath[0].Issuer, StringComparison.Ordinal))
+        // Single certificate case: if it matches a declared trust anchor, validation is complete
+        if (trustPath.Length == 1)
         {
             foreach (X509Certificate2 cert in attestationRootCertificates)
             {
@@ -72,7 +70,7 @@ public static bool ValidateTrustChain(X509Certificate2[] trustPath, X509Certific
             }
         }
 
-        // If the attestation cert is not self signed, we will need to build a chain
+        // For certificates not directly declared as trust anchors, build and validate a certificate chain
         var chain = new X509Chain();
 
         // Put all potential trust anchors into extra store

Tests/Fido2.Tests/CryptoUtilsTests.cs

@@ -66,8 +66,8 @@ public void TestValidateTrustChainSubAnchor()
 
         Assert.False(0 == attestationRootCertificates[0].Issuer.CompareTo(attestationRootCertificates[0].Subject));
         Assert.True(CryptoUtils.ValidateTrustChain(trustPath, attestationRootCertificates));
-        Assert.False(CryptoUtils.ValidateTrustChain(trustPath, trustPath));
-        Assert.False(CryptoUtils.ValidateTrustChain(attestationRootCertificates, attestationRootCertificates));
+        Assert.True(CryptoUtils.ValidateTrustChain(trustPath, trustPath));
+        Assert.True(CryptoUtils.ValidateTrustChain(attestationRootCertificates, attestationRootCertificates));
         Assert.False(CryptoUtils.ValidateTrustChain(attestationRootCertificates, trustPath));
     }