fido2-net-lib icon indicating copy to clipboard operation
fido2-net-lib copied to clipboard

Possibly incorrect TPM manufacturer ID string value

Open sbweeden opened this issue 5 months ago • 5 comments

This should be confirmed by a subject matter expert (which I confess I am not), however...

See: https://github.com/passwordless-lib/fido2-net-lib/blob/cb71a15c6df0e9d5230b7266502cd8bb26f656cd/Src/Fido2/AttestationFormat/Tpm.cs#L28C10-L28C21

The value for the IBM entry in TPM manufacturers is: "id:49424d00", // 'IBM' IBM

Refering to sections 3.2.9 and more specifically 3.1.2 of https://trustedcomputinggroup.org/wp-content/uploads/TCG-EK-Credential-Profile-V-2.5-R2_published.pdf I believe that the hex portion of this ID should be uppercase, thus: "id:49424D00", // 'IBM' IBM

My reasoning is because section 3.1.2 makes no mention of using lowercase hex chars. It says:

Each byte is
represented individually as a two digit unsigned hexadecimal number using the characters 0-9 and
A-F. The result is concatenated together to form an 8 character name which is appended after the
lower-case ASCII characters “id:”. 

sbweeden avatar Sep 10 '24 16:09 sbweeden