Skip to content

Conversation

@explunit
Copy link

@explunit explunit commented Dec 9, 2025

So far this PR is only the unit tests that illustrate what (I think) is a problem, and I am interested in feedback before I attempt the fix.

My expectation was that any type of invalid signature, regardless of how malformed it was, would throw the Fido2VerificationException with message "Signature does not match". But, as illustrated by these unit tests, some signatures throw other exceptions:

Assert.Throws() Failure: Exception type was not an exact match
Expected: typeof(Fido2NetLib.Fido2VerificationException)
Actual:   typeof(System.Formats.Asn1.AsnContentException)
---- System.Formats.Asn1.AsnContentException : The ASN.1 value is invalid.

and

 Assert.Throws() Failure: Exception type was not an exact match
 Expected: typeof(Fido2NetLib.Fido2VerificationException)
 Actual:   typeof(System.ArgumentOutOfRangeException)
 ---- System.ArgumentOutOfRangeException : Index was out of range. Must be non-negative and less than the size of the collection. (Parameter 'index')

Should the VerifyAsync method trap these exceptions or should the underlying CryptoUtils.SigFromEcDsaSig throw a Fido2VerificationException? I see that another method in that file, HashAlgFromCOSEAlg, does throw a Fido2VerificationException.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant