Skip to content

Clarify challenge-response nonce encoding #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cowbon wants to merge 3 commits into
base: main
Choose a base branch
from
+17 −15
Open

Clarify challenge-response nonce encoding #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b00cc97
Clarify challenge-response nonce encoding
cowbon Jul 2, 2026
98405ad
Use base64url format for nonces
cowbon Jul 21, 2026
257c487
Clarify unpadded nonce encoding
cowbon Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions api/challenge-response/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ session expiry has elapsed.
Location: https://veraison.example/challenge-response/v1/session/1234567890

{
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI",
Comment thread
cowbon marked this conversation as resolved.
"expiry": "2030-10-12T07:20:50.52Z",
"accept": [
"application/psa-attestation-token"
Expand All @@ -68,9 +68,10 @@ session expiry has elapsed.
}
```

`nonceSize` must be between `8` and `64`. Analogously, `nonce` must be between
8 and 64 bytes when decoded (which means the specified base64 string must be no
longer than 88 bytes).
`nonceSize` must be between `8` and `64`. Analogously, `nonce` must be
base64url encoded without padding and between 8 and 64 bytes when decoded
(which means the specified encoded string must be no longer than 86
characters).

### Asynchronous verification

Expand All @@ -90,7 +91,7 @@ longer than 88 bytes).
Content-format: application/vnd.veraison.challenge-response-session+json

{
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI",
"expiry": "2031-10-12T07:20:50.52Z",
"accept": [
"application/psa-attestation-token"
Expand All @@ -116,7 +117,7 @@ longer than 88 bytes).
Content-format: application/vnd.veraison.challenge-response-session+json

{
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI",
"expiry": "2031-10-12T07:20:50.52Z",
"accept": [
"application/psa-attestation-token"
Expand Down Expand Up @@ -154,7 +155,7 @@ longer than 88 bytes).
Content-format: application/vnd.veraison.challenge-response-session+json

{
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=",
"nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI",
"expiry": "2030-10-12T07:20:50.52Z",
"accept": [
"application/psa-attestation-token"
Expand Down
8 changes: 4 additions & 4 deletions api/challenge-response/challenge-response.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,13 @@ paths:
in: query
description: >
the API server should not generate a nonce for this session and
instead use the one supplied by the client. The supplied base64
URL-encoded value must decode to a byte sequence between 8 and
64 bytes long.
instead use the one supplied by the client. The supplied nonce
MUST be base64url encoded without padding and must decode to a byte
sequence between 8 and 64 bytes long.
required: false
schema:
type: string
format: byte
format: base64url
responses:
'201':
description: >
Expand Down
9 changes: 5 additions & 4 deletions api/challenge-response/schemas/components.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,12 @@ components:
properties:
nonce:
type: string
format: byte
format: base64url
description:
base64 encoded random value. Must be between 8 and 64 bytes long in
its raw form (the base64 encoding must be no longer than 88 bytes).
example: MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=
Base64url-encoded random value without padding. Must be between 8
and 64 bytes long in its raw form (the encoded value must be no
longer than 86 characters).
example: MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI
expiry:
type: string
format: date-time
Expand Down