tests/device/test_client.py::test_exclude_credentials_max Failed

[tahaelbadaoui]

Question about CBOR encoding of PublicKeyCredentialDescriptor.id in test_exclude_credentials_max

Description

Hello,

I am currently facing an issue while executing the following test:

tests/device/test_client.py::test_exclude_credentials_max

On the FIDO side, the device returns INVALID_CBOR.
After investigating, the issue appears to be related to the encoding of the 3rd key (0x03) of the CBOR APDU — specifically the allowList, which is defined as:

Array of PublicKeyCredentialDescriptor

On the applet side, I am expecting the id field inside PublicKeyCredentialDescriptor to be encoded strictly as CBOR byte string (major type 2).

However, in this specific test case, I noticed that the id value is encoded as a CBOR array, which causes the applet to reject the request and return INVALID_CBOR.

This seems to be the only test that encodes the id field in this way.

🔹 Example 1 — Failing Scenario (test_exclude_credentials_max)

A6                                      # map(6)
   01                                   # unsigned(1)
   6B                                   # text(11)
      6578616D706C652E636F6D            # "[example.com](http://example.com/)"
   02                                   # unsigned(2)
   58 20                                # bytes(32)
      0000000000000000000000000000000000000000000000000000000000000000 # "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"
   03                                   # unsigned(3)
   97                                   # array(23)
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0) # The Field which is expected as byte encoding  
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         80                             # array(0)
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
   05                                   # unsigned(5)
   A1                                   # map(1)
      62                                # text(2)
         7570                           # "up"
      F4                                # primitive(20)
   06                                   # unsigned(6)
   58 20                                # bytes(32)
      5BFDAA00DD8B49DB9CFDC9671B9D5C045909A127C57F59E3548DA8A593AC6F4A # "[\xFD\xAA\u0000\u074BIۜ\xFD\xC9g\e\x9D\\\u0004Y\t\xA1'\xC5\u007FY\xE3T\x8D\xA8\xA5\x93\xACoJ"
   07                                   # unsigned(7)
   02                                   # unsigned(2)

🔹 Example 2 — Passing Scenario (Reference Test)

A6                                      # map(6)
   01                                   # unsigned(1)
   6B                                   # text(11)
      6578616D706C652E636F6D            # "[example.com](http://example.com/)"
   02                                   # unsigned(2)
   58 20                                # bytes(32)
      0000000000000000000000000000000000000000000000000000000000000000 # "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"
   03                                   # unsigned(3)
   81                                   # array(1)
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 60                          # bytes(96) #Here is encoded as bytes data CBOR
            3EC9BCEC825A84CF6F364073A8B6622921D1890CF2E6931D8E8B84C1E9E8AD0EE68B200237FD0FC4659136C6AE9953D1931F10C945DC72657E829B6CD043AA082F9CEBBFD78FCAE6BDBA707348368F0575E32097366104A8E0BF06F597A5BE98 # ">ɼ\xEC\x82Z\x84\xCFo6@s\xA8\xB6b)!щ\f\xF2\xE6\x93\u001D\x8E\x8B\x84\xC1\xE9\xE8\xAD\u000E\xE6\x8B \u00027\xFD\u000F\xC4e\x916Ʈ\x99Sѓ\u001F\u0010\xC9E\xDCre~\x82\x9Bl\xD0C\xAA\b/\x9C\xEB\xBF\u05CF\xCA潺psH6\x8F\u0005u\xE3 \x976a\u0004\xA8\xE0\xBF\u0006\xF5\x97\xA5\xBE\x98"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
   05                                   # unsigned(5)
   A1                                   # map(1)
      62                                # text(2)
         7570                           # "up"
      F4                                # primitive(20)
   06                                   # unsigned(6)
   58 20                                # bytes(32)
      8B4DEA1BC0FCF32D4FE33F844ED0C65F355800CD386C2B654C2E97409F4C35C9 # "\x8BM\xEA\e\xC0\xFC\xF3-O\xE3?\x84N\xD0\xC6_5X\u0000\xCD8l+eL.\x97@\x9FL5\xC9"
   07                                   # unsigned(7)
   02                                   # unsigned(2)

Question

Is the purpose of this test scenario to intentionally verify that authenticators correctly reject non–byte-string encodings of the id field?

From my understanding of the FIDO2 / CTAP specification, the id field in PublicKeyCredentialDescriptor should be a byte sequence. However, the specification does not explicitly clarify whether other CBOR data types are allowed or whether it must strictly be a CBOR byte string.

So the core question is:

Should PublicKeyCredentialDescriptor.id be encoded strictly as a CBOR byte string (major type 2),
or is it expected to accept other CBOR data types (e.g., array) as valid encodings?

Conclusion

At this stage, the behavior appears to be a matter of interpretation.
It remains a disputable case whether the id must strictly be CBOR byte string only, or whether other data encodings are acceptable according to the intended compliance level of the test.

Clarification on the expected behavior would be greatly appreciated.

Thank you.

apdu_TEST_FAILED.log

[dainnilsson]

I'm unable to reproduce this, the test never sends the CBOR you've provided when I run it, I get a correct message that encodes id's as byte strings:

   01                                   # unsigned(1)
   6B                                   # text(11)
      6578616D706C652E636F6D            # "example.com"
   02                                   # unsigned(2)
   58 20                                # bytes(32)
      0000000000000000000000000000000000000000000000000000000000000000 # "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"
   03                                   # unsigned(3)
   88                                   # array(8)
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            87C751F064C845820934D9E80E37E7404B0C600D324B75D1F1358956571AD66AC320B58BF4881BFDF1D362F5FA795F4DC317D01FF32045C40068A8455737BA034B11FFD1B466428C5F9E8328CCFA038279F6BF7E0CEA50917B93BE2246C33CCF9A4B6F2C3AEEC2D06C72DF5F90A28E2A882658292C65B134C8AD3BFFF681C956A5 # "\x87\xC7Q\xF0d\xC8E\x82\t4\xD9\xE8\u000E7\xE7@K\f`\r2Ku\xD1\xF15\x89VW\u001A\xD6j\xC3 \xB5\x8B\xF4\x88\e\xFD\xF1\xD3b\xF5\xFAy_M\xC3\u0017\xD0\u001F\xF3 E\xC4\u0000h\xA8EW7\xBA\u0003K\u0011\xFFѴfB\x8C_\x9E\x83(\xCC\xFA\u0003\x82y\xF6\xBF~\f\xEAP\x91{\x93\xBE\"F\xC3<ϚKo,:\xEE\xC2\xD0lr\xDF_\x90\xA2\x8E*\x88&X),e\xB14ȭ;\xFF\xF6\x81\xC9V\xA5"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            1C59FB32FE2A5AC88443B1310187AF3D40801C2A35A23DF81304A2DF0A930CC6F9681C4794DD5D3D40765B49CFF405D837090F10EFCE2C84184E45F01377AC987F7A7AFAD223AE084F8DCCD156A1A1A8D4A7DF06C9B80553E15D2E7E3B0A8830A744DD3E4B3065A51BCEAB66B0A3F9DCDD90721E88EEB47AC4231B2B40F0FD1D19 # "\u001CY\xFB2\xFE*ZȄC\xB11\u0001\x87\xAF=@\x80\u001C*5\xA2=\xF8\u0013\u0004\xA2\xDF\n\x93\f\xC6\xF9h\u001CG\x94\xDD]=@v[I\xCF\xF4\u0005\xD87\t\u000F\u0010\xEF\xCE,\x84\u0018NE\xF0\u0013w\xAC\x98\u007Fzz\xFA\xD2#\xAE\bO\x8D\xCC\xD1V\xA1\xA1\xA8ԧ\xDF\u0006ɸ\u0005S\xE1].~;\n\x880\xA7D\xDD>K0e\xA5\eΫf\xB0\xA3\xF9\xDCݐr\u001E\x88\xEE\xB4z\xC4#\e+@\xF0\xFD\u001D\u0019"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            0743F413F5E70B667495D5B2560B2FB276704C1746CE8C5EB24FEA56FE5BAA07CF2327923152FEA2185E752BB3037DC09C398B181E29D0CA0CDA03872DEEE7FE217F5FD5FEC3ACBD13A7C13C9C563177B982EA9006D8B4BC510E5A8BC4CBD1CD99ECBA6234FCB7CB0AB8E0AF3AA8FFB1E2BD75C2255BA674218334B6916E7A0BED # "\aC\xF4\u0013\xF5\xE7\vft\x95ղV\v/\xB2vpL\u0017FΌ^\xB2O\xEAV\xFE[\xAA\a\xCF#'\x921R\xFE\xA2\u0018^u+\xB3\u0003}\xC0\x9C9\x8B\u0018\u001E)\xD0\xCA\f\xDA\u0003\x87-\xEE\xE7\xFE!\u007F_\xD5\xFEì\xBD\u0013\xA7\xC1<\x9CV1w\xB9\x82\xEA\x90\u0006ش\xBCQ\u000EZ\x8B\xC4\xCB\xD1͙\xEC\xBAb4\xFC\xB7\xCB\n\xB8\xE0\xAF:\xA8\xFF\xB1\xE2\xBDu\xC2%[\xA6t!\x834\xB6\x91nz\v\xED"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            34F2FCA7BC2729B10D227449D16B0A12500A237360CD08E0982491169C57AD438B21457259F435B4E7E2DD2967320D519B374AEF3E50F452EB9C7C5FE127B8461AD8DA95E79D474B529F4D6D63639BBEE8DC68CB9F48836B78962D074F3571AA7F9F463845A204F2094B09686B7C9CD341C830066055FE7A33170F04FE93C87DDB # "4\xF2\xFC\xA7\xBC')\xB1\r\"tI\xD1k\n\u0012P\n#s`\xCD\b\xE0\x98$\x91\u0016\x9CW\xADC\x8B!ErY\xF45\xB4\xE7\xE2\xDD)g2\rQ\x9B7J\xEF>P\xF4R\xEB\x9C|_\xE1'\xB8F\u001A\xD8ڕ\xE7\x9DGKR\x9FMmcc\x9B\xBE\xE8\xDCh˟H\x83kx\x96-\aO5q\xAA\u007F\x9FF8E\xA2\u0004\xF2\tK\thk|\x9C\xD3A\xC80\u0006`U\xFEz3\u0017\u000F\u0004\xFE\x93\xC8}\xDB"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            391AAFFB0E97371058B7767EC9D7359EAF484A5A8816F1A84D6C24B8CCB8981B3AD4018E0BDB8F9D58331CC18097A7B3BEE9EA41242C7006693B77977F647FD7366F3DEA04A9870065A559135FEA31142173C1E22D1959EF4BD8ED8F9D8E5E9E9F6FF249302A1378A910A01D416AB3F9C2229CD776622F1E2F8C06DF602BE3822E # "9\u001A\xAF\xFB\u000E\x977\u0010X\xB7v~\xC9\xD75\x9E\xAFHJZ\x88\u0016\xF1\xA8Ml$\xB8̸\x98\e:\xD4\u0001\x8E\vۏ\x9DX3\u001C\xC1\x80\x97\xA7\xB3\xBE\xE9\xEAA$,p\u0006i;w\x97\u007Fd\u007F\xD76o=\xEA\u0004\xA9\x87\u0000e\xA5Y\u0013_\xEA1\u0014!s\xC1\xE2-\u0019Y\xEFK\xD8폝\x8E^\x9E\x9Fo\xF2I0*\u0013x\xA9\u0010\xA0\u001DAj\xB3\xF9\xC2\"\x9C\xD7vb/\u001E/\x8C\u0006\xDF`+\xE3\x82."
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            42E64A49B90DAF080AC3A22FE5B136657F132A229E3B8B20995ADF991F4B204E7C585F5BCE025D41B7193F2494DD298A5BCD04300281F51F653E15C07105B3181D58C7C57661E215CBE8111B9573BAA6E7FE549678A8E0C9E59B2452C58A8B6A1B6239F8D780264C6301167BBD3F832F2C667FFC07C964C93309160F5471114891 # "B\xE6JI\xB9\r\xAF\b\nâ/\xE5\xB16e\u007F\u0013*\"\x9E;\x8B \x99Zߙ\u001FK N|X_[\xCE\u0002]A\xB7\u0019?$\x94\xDD)\x8A[\xCD\u00040\u0002\x81\xF5\u001Fe>\u0015\xC0q\u0005\xB3\u0018\u001DX\xC7\xC5va\xE2\u0015\xCB\xE8\u0011\e\x95s\xBA\xA6\xE7\xFET\x96x\xA8\xE0\xC9\xE5\x9B$RŊ\x8Bj\eb9\xF8׀&Lc\u0001\u0016{\xBD?\x83/,f\u007F\xFC\a\xC9d\xC93\t\u0016\u000FTq\u0011H\x91"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            A71BCFC9EC6EED5238E9CA064F9E5A2B074D2529C56138A059EC5A9BED461A5148CEF3DE43370CC808C55375269FD1E686138C3239184DDC7AC90B5130415E95B5F99875F73CD629E682894D89DA00CD86C3F79FF707FA5868DED71AE63E9F78516BEC8541F873E821DC29B0FA17699E14FE5048DB3813D6E5B6A5F7CBFAAED2C7 # "\xA7\e\xCF\xC9\xECn\xEDR8\xE9\xCA\u0006O\x9EZ+\aM%)\xC5a8\xA0Y\xECZ\x9B\xEDF\u001AQH\xCE\xF3\xDEC7\f\xC8\b\xC5Su&\x9F\xD1\xE6\x86\u0013\x8C29\u0018M\xDCz\xC9\vQ0A^\x95\xB5\xF9\x98u\xF7<\xD6)悉M\x89\xDA\u0000͆\xC3\xF7\x9F\xF7\a\xFAXh\xDE\xD7\u001A\xE6>\x9FxQk\xEC\x85A\xF8s\xE8!\xDC)\xB0\xFA\u0017i\x9E\u0014\xFEPH\xDB8\u0013\xD6嶥\xF7\xCB\xFA\xAE\xD2\xC7"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
      A2                                # map(2)
         62                             # text(2)
            6964                        # "id"
         58 81                          # bytes(129)
            122F4D08A44B844CC707B2FFBC39399508EFC9D682BFA979A07B42A82612CC9195DD99A4B2D99E56630771761D3E56B144D4FC1484E1E32624F1B5ECC37B4D3675EA64EB32A34A58A3D9480CFF777993A4A84002E56928A7081439B19D2DEED20D03EEE633B4B385FC494389DBC22151203B6C9B14EC91949394EB913546713BDC # "\u0012/M\b\xA4K\x84L\xC7\a\xB2\xFF\xBC99\x95\b\xEF\xC9ւ\xBF\xA9y\xA0{B\xA8&\u0012̑\x95ݙ\xA4\xB2ٞVc\aqv\u001D>V\xB1D\xD4\xFC\u0014\x84\xE1\xE3&$\xF1\xB5\xEC\xC3{M6u\xEAd\xEB2\xA3JX\xA3\xD9H\f\xFFwy\x93\xA4\xA8@\u0002\xE5i(\xA7\b\u00149\xB1\x9D-\xEE\xD2\r\u0003\xEE\xE63\xB4\xB3\x85\xFCIC\x89\xDB\xC2!Q ;l\x9B\u0014쑔\x93\x94\xEB\x915Fq;\xDC"
         64                             # text(4)
            74797065                    # "type"
         6A                             # text(10)
            7075626C69632D6B6579        # "public-key"
   05                                   # unsigned(5)
   A1                                   # map(1)
      62                                # text(2)
         7570                           # "up"
      F4                                # primitive(20)
   06                                   # unsigned(6)
   58 20                                # bytes(32)
      0D163A2BC8A4E8B1E69917EC77F5A01D9020EB6F8E75CA9FB571899EFD7C46C2 # "\r\u0016:+Ȥ\xE8\xB1\xE6\x99\u0017\xECw\xF5\xA0\u001D\x90 \xEBo\x8Euʟ\xB5q\x89\x9E\xFD|F\xC2"
   07                                   # unsigned(7)
   02                                   # unsigned(2)