Repository navigation
Conversation
The CTAP HID binding spec states that each continuation frame carry a sequence number, which uses 7 bits. This caps the number of possible continuation frames at 128, or (given frame sizes and space reserved for payload bits) the maximum size of a CTAP HID message at 7609 bytes. There are larger payloads, however (e.g., PQC algs). The BLE HID spec, and other CTAP HID implementations allow the sequence number to wrap around. This still allows us to detect dropped or spurious frames, but removes the limit of 128 continuation frames. (We're still capping the processing of frames at payload_len.) This change brings libfido2 in line with those implementations.
dacav
force-pushed
the
pqc-algo
branch
2 times, most recently
from
October 8, 2026 12:38
08284d1 to
be0df10
Compare
fido2-cred does not preserve the attestation signature algorithm across fido2-cred -M | fido2-cred -V Infer the algorithm from the certificate instead.
The previous implementation leverages EVP_PKEY_new_raw_private_key_ex(), invoked by mldsa_pk_to_EVP_PKEY(), validate the source buffer length. While doing so, it leaked the obtained EVP_PKEY object. The memory leak could could be solved by calling EVP_PKEY_free() on the EVP_PKEY object. But in practice none of this is needed: the correct size of the key can be simply checked against the mldsaXX_pk_t::pk buffer size.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.