webauthn.me icon indicating copy to clipboard operation
webauthn.me copied to clipboard

CredentialId is not zero-padded

Open osresearch opened this issue 5 years ago • 0 comments

Description

The attestationObject.authData.credentialId hex value in the debugger is not zero padded, so it can appear to be a nibble or byte short of the credentialIdLength field.

Reproduction

image

Register a key and attempt to convert it from hex to binary:

echo 7f9a74798aa5199b39ea57bdbf3ebbbf897356a319bd50192969c7877bb27987c7ddb4edc7fa3856ebb2d5e6c9af32bdfaac72ddefce597f24be88ac4c1a04a \
| xxd -p -r | xxd -g1
00000000: 7f 9a 74 79 8a a5 19 9b 39 ea 57 bd bf 3e bb bf  ..ty....9.W..>..
00000010: 89 73 56 a3 19 bd 50 19 29 69 c7 87 7b b2 79 87  .sV...P.)i..{.y.
00000020: c7 dd b4 ed c7 fa 38 56 eb b2 d5 e6 c9 af 32 bd  ......8V......2.
00000030: fa ac 72 dd ef ce 59 7f 24 be 88 ac 4c 1a 04     ..r...Y.$...L..

Since there is no leading 0, the resulting value is offset by four bits and the 64th byte is missing.

osresearch avatar Dec 23 '20 14:12 osresearch