Enforce 16-byte minimum credential ID length at registration

[JanTvrdik]

The credential ID definition requires authenticators to emit at least 16 bytes (with ≥100 bits of entropy). §7.1 does not mandate this check on the relying party — it only bounds the maximum at 1023 bytes (step 25) — but a shorter ID can only come from a non-conforming or malicious authenticator, so consistent with the library's fail-closed posture, registration now rejects credential IDs shorter than 16 bytes with a new credential_id_too_short reason code.

FakeAuthenticator already emits exactly 16-byte IDs, so no test-double changes were needed.

Co-Authored-By: Claude Code

[Copilot]

Pull request overview

Adds a fail-closed registration-time validation to reject non-conforming WebAuthn credential IDs shorter than 16 bytes (per the credential ID definition), introducing a new credential_id_too_short reason code and a regression test to lock in the behavior.

Changes:

• Add RelyingParty::MIN_CREDENTIAL_ID_LENGTH = 16 and enforce it during registration verification.
• Introduce VerificationException::CREDENTIAL_ID_TOO_SHORT reason code for consistent failure signaling.
• Add a unit test ensuring undersized credential IDs are rejected.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
tests/Ceremony/RelyingPartyTest.php	Adds a negative test asserting registration rejects 15-byte credential IDs.
src/Ceremony/VerificationException.php	Adds a new stable reason code: credential_id_too_short.
src/Ceremony/RelyingParty.php	Introduces a 16-byte minimum credential ID length constant and enforces it during registration verification.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.