Update AuthenticationResponseProcessing.java

Before this fix here is HUGE security bug which successfully (without any checks ) authenticates everyone who sets UAF_ALG_SIGN_RSASSA_PSS_SHA256_DER in assertion
alain2sf · Jan 26, 2016 · 7bb6926 · 7bb6926
1 parent 9afef2a
commit 7bb6926
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/...-core/src/main/java/org/ebayopensource/fido/uaf/ops/AuthenticationResponseProcessing.java b/...-core/src/main/java/org/ebayopensource/fido/uaf/ops/AuthenticationResponseProcessing.java
@@ -101,6 +101,8 @@ private AuthenticatorRecord processAssertions(
 			String pubKey = registrationRecord.PublicKey;
 			if (algAndEncoding == AlgAndEncodingEnum.UAF_ALG_SIGN_RSASSA_PSS_SHA256_DER) {
 				// TODO Implement RSA signature check
+				authRecord.status = "FAILED_ALGORITHM_NOT_IMPLEMENTED";
+				return authRecord;
 			} else {
 				try {
 					if (!verifySignature(signnedData, signature, pubKey,