What's Changed

• Make FIDO MDS blob decoding tolerant and align it with MDS v3.1.1 by @vanbukin in #32
• Improve tpm by @vanbukin in #30
• Harden ceremonies, decoding, attestation and FIDO metadata handling against the issues found by a WebAuthn L3 security review by @vanbukin in #33
• Ignore no chain validation errors in the default attestation trust path policy and keep the conformance relaxation in the FIDO Conformance demo by @vanbukin in #34
• Run the unit tests in parallel, each test case with its own fixture instance by @vanbukin in #35
• Serialize Uri-based expected origins in ASCII form and document origin validation, ceremony lifetime and FIDO metadata start-up by @vanbukin in #36
• Report the attStmt members outside the syntax of the packed and TPM formats with a single bounded Warning by @vanbukin in #37
• Reject registration responses with unknown, duplicate or too many transports and report every rejection with a Warning and a metric by @vanbukin in #38
• Count the anomalies and FIDO metadata failures that were only logged by @vanbukin in #39
• Reject the attestation of authenticators that the FIDO metadata doesn't allow to trust, also when it chains up to an embedded root by @vanbukin in #40
• Drop .NET 8 and .NET 9, target .NET 10 only by @vanbukin in #41
• Identify the FIDO U2F authenticator model by the attestation certificate only, not by the unsigned aaguid of the authenticator data by @vanbukin in #43
• Look up FIDO U2F metadata by the key identifier of the certificate, and accept self attestation and no attestation only with an empty trust path by @vanbukin in #42
• Load the FIDO metadata embedded in the application first, retry a failed download every minute and refresh the metadata daily by @vanbukin in #44
• Update libs by @vanbukin in #45
• Limit the size of attestationObject and authenticatorData, and don't use declared CBOR lengths as capacities by @vanbukin in #46
• Remove the android-safetynet attestation statement format by @vanbukin in #47
• Reject a FIDO U2F attestation statement whose authenticator data has a non-zero aaguid by @vanbukin in #48
• Limit the size of clientDataJSON by @vanbukin in #49
• Take the trust anchors of TPM and Android Key attestation from the metadata of the aaguid by @vanbukin in #50
• Move the settings that were overridable methods into WebAuthnOptions by @vanbukin in #51
• Reword a comment of the Android Key verifier tests by @vanbukin in #52
• Accept FIDO metadata blobs only when they are signed by the certificate of mds.fidoalliance.org by @vanbukin in #53
• Dispose the database connection when the storage context can't be created by @vanbukin in #54
• Accept FIDO metadata blobs only when their certificate chain ends at GlobalSign Root R46 by @vanbukin in #55
• Accept Android Key attestation of software keys in the FIDO conformance demo by @vanbukin in #56
• Explain the Android Key setting in the README of the FIDO conformance demo by @vanbukin in #57
• Keep the highest stored signCount and report a signCount that didn't increase by @vanbukin in #58
• Sanitize the unknown fmt, JSON errors and ceremony identifiers before they are logged by @vanbukin in #59
• Reject Android Key attestation statements whose certificates are in Google's revocation status list by @vanbukin in #60
• Remove the default implementations of interface methods by @vanbukin in #61

Full Changelog: 2.1.1...3.0.0

What's Changed

• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #26
• Upgrade actions by @vanbukin in #29
• Fido mds root cert r46 by @vanbukin in #31

Full Changelog: 2.1.0...2.1.1

What's Changed

• Update fido mds blob parsing by @vanbukin in #25

Full Changelog: 2.0.0...2.1.0

What's Changed

• Add .NET 9 / 10.
• Drop .NET 6.
• Upgrade to latest WebAuthn Level 3 specification draft.

by @vanbukin in #24

Full Changelog: 1.3.4...2.0.0

What's Changed

• set publicKey to null if getPublicKey returns null by @Keroosha in #16
• Update .NET libs by @vanbukin in #17

Full Changelog: 1.3.3...1.3.4

What's Changed

• Update .NET SDK and libs. by @vanbukin in #15

Full Changelog: 1.3.2...1.3.3

What's Changed

• Bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in #10
• [Demo] Use username hash as userhandle by @Keroosha in #12
• [Demo] Explicit check on return type from getAuthenticatorData and getPublicKey by @Keroosha in #11
• Update dependencies by @vanbukin in #13

New Contributors

• @dependabot made their first contribution in #10

Full Changelog: 1.3.1...1.3.2

What's Changed

• Fido metadata RootCA tolerant parse by @vanbukin in #9
• Bump .NET SDK versions
  8.0.200 => 8.0.201

Full Changelog: 1.3.0...1.3.1

• Added missing extension methods for logging exceptions (to avoid situations when the exception is "silenced" and the application is unaware of the situation).
  Public methods are additionally marked with the virtual modifier for flexible behavior overriding and API uniformity.
• Bump .NET SDKs versions
  6.0.418 => 6.0.419
  8.0.101 => 8.0.200
• Bump Microsoft.NET.Test.Sdk 17.8.0 => 17.9.0
• Bump Npgsql driver 8.0.1 => 8.0.2

Full Changelog: 1.2.0...1.3.0

• For all databases, a missing unique index has been added to the CredentialId and RpId columns
• The unique index previously existing on the columns RpId, UserHandle, and CredentialId has been deleted. Instead, a new unique index with a different column order has been created. More selective columns have been moved to the beginning of the composite index
• SQL queries have been reworked in accordance with changes in the indexes
• .NET dependencies have been updated