The remaining P3 tail is done:
- §13.5: three TOTP codes for the shared RFC secret computed by an
independent implementation (Python stdlib, anchored to RFC 4226 App D
counter 0 = 755224) at recorded wall-clock Unix seconds, pinned in
platform/auth TestInteropCapturePythonTOTP — the Go code must produce
identical codes at the same instants and VerifyWindow(0) must accept
each at its capture time (cross-implementation agreement).
- §14.4: a full WebAuthn ceremony through real Chrome (navigator.credentials
with a CDP virtual authenticator: ctap2/internal, resident key, UV,
ES256) against a live go-auth instance — registration + passwordless
login both completed via the RP handlers. The raw browser-produced
blobs (clientDataJSON, attestationObject, authenticatorData, signature)
are stored verbatim as a golden fixture and replayed by
TestInteropCaptureChromeRegistration/Assertion: the parser must decode
the real CBOR/COSE/authenticator-data, and the real ECDSA signature
must verify over SHA-256(authData ‖ clientDataJSON) with the parsed key.
Plan doc §13.5/§14.4 updated with the recorded values; P3 row marked
complete. Both new suites green.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
mats
1decb5e53a