Run and conform to the fido webauth conformance tests about webauthn-rs HOT 7 CLOSED

I think the major tasks outstanding here are:

• TPM attestation
• Android Attestation
• RS384, RS512, PS*, ECDSA_384, ECDSA_512, and ED25519 crypto
• Extensions

I think once those are implemented, we'd be most of the way there, then it will be a case of running the conformance suite to catch anything we missed. We should consider that any test we fail can become a test vector within the codebase to ensure continued conformance.

from webauthn-rs.

Okay, interestingly due to the recent security discoveries with regard to userVerification me may not be able to pass the FIDO conformance suite. I would prefer to be "correct" that "conformant" in this case, but we'll see how it goes during the test.

from webauthn-rs.

The FIDO conformance tests do not always align with the WebAuthn spec. One issue I came across is that the conformance tests do not require user presence (UP) to be always set (they call it 'silent authentication' which WebAuthn does not allow), while WebAuthn is clear about this. To solve these kind of issues I used a policy/config object that allows to toggle such behavior (eg setUserPresenceRequired, while sticking to the WebAuthn spec rather than FIDO by default). Also I have come across a fair amount of bugs in the conformance tests as well.

from webauthn-rs.

Hmmm that's an interesting thought. We could have a 'fidoConformance' flag that we toggle if it's required to change some behaviour (but off by default) especially if we deviate from the conformance tests.

from webauthn-rs.

Is there an executable to test webauthn-rs with the conformance tests already?

from webauthn-rs.

No, we don't currently have that. It would be interesting for certain to port the conformance tests into our test suite to execute them there automatically, but so far it's not been a critical issue as most people care more the library working :)

from webauthn-rs.

It's unclear if we'll ever be able to do or bother to do this, and no one seems to care much if it's compliant anyway

from webauthn-rs.