Enforce 16-byte minimum credential ID length at registration

src/Ceremony/RelyingParty.php

@@ -53,6 +53,14 @@ final class RelyingParty
      */
     public const int MAX_CREDENTIAL_ID_LENGTH = 1023;
 
+    /**
+     * The {@link https://w3c.github.io/webauthn/#credential-id credential ID definition} requires
+     * authenticators to emit at least 16 bytes (with ≥100 bits of entropy). §7.1 does not mandate
+     * this check on the relying party, but a shorter ID can only come from a non-conforming or
+     * malicious authenticator, so it is rejected fail-closed.
+     */
+    public const int MIN_CREDENTIAL_ID_LENGTH = 16;
+
     private const string FMT_NONE = 'none';
     private const string FMT_PACKED = 'packed';
 
@@ -163,7 +171,8 @@ private function doVerifyRegistration(
         // an X.509 trust path are rejected fail-closed until the attestation layer lands.
         $attestationType = $this->verifyAttestationStatement($attestationObject, $publicKey, $response->clientDataJSON);
 
-        // §7.1 step 25: credential ids are bounded at 1023 bytes.
+        // §7.1 step 25: credential ids are bounded at 1023 bytes. The 16-byte floor comes from the
+        // credential ID definition (an authenticator obligation, not a §7.1 step) — see the constant.
         $credentialId = $attestedCredentialData->credentialId;
 
         if (strlen($credentialId) > self::MAX_CREDENTIAL_ID_LENGTH) {
@@ -173,6 +182,13 @@ private function doVerifyRegistration(
             );
         }
 
+        if (strlen($credentialId) < self::MIN_CREDENTIAL_ID_LENGTH) {
+            throw new VerificationException(
+                VerificationException::CREDENTIAL_ID_TOO_SHORT,
+                'Credential ID is shorter than ' . self::MIN_CREDENTIAL_ID_LENGTH . ' bytes',
+            );
+        }
+
         // §7.1 step 26: the credential id must not already be registered for any user.
         if ($store->findCredentialByCredentialId($credentialId) !== null) {
             throw new VerificationException(

src/Ceremony/VerificationException.php

@@ -39,6 +39,7 @@ final class VerificationException extends RuntimeException
     public const string MISSING_ATTESTED_CREDENTIAL_DATA = 'missing_attested_credential_data';
     public const string UNSUPPORTED_ALGORITHM = 'unsupported_algorithm';
     public const string CREDENTIAL_ID_TOO_LONG = 'credential_id_too_long';
+    public const string CREDENTIAL_ID_TOO_SHORT = 'credential_id_too_short';
     public const string CREDENTIAL_ALREADY_REGISTERED = 'credential_already_registered';
     public const string CREDENTIAL_NOT_ALLOWED = 'credential_not_allowed';
     public const string UNKNOWN_CREDENTIAL = 'unknown_credential';

tests/Ceremony/RelyingPartyTest.php

@@ -423,6 +423,14 @@ public function testRegistrationRejectsOversizedCredentialId(): void
         );
     }
 
+    public function testRegistrationRejectsUndersizedCredentialId(): void
+    {
+        $this->assertRegistrationFails(
+            VerificationException::CREDENTIAL_ID_TOO_SHORT,
+            self::registrationCredential($this->coseEntries, credentialId: str_repeat("\x2a", 15)),
+        );
+    }
+
     public function testRegistrationRejectsAlreadyRegisteredCredential(): void
     {
         $store = self::storeWith($this->registeredRecord());