From b00cc97547426850e1f1076f7a0831ba638d18da Mon Sep 17 00:00:00 2001 From: Ian Chin Wang Date: Thu, 2 Jul 2026 13:34:05 -0400 Subject: [PATCH] Clarify challenge-response nonce encoding Signed-off-by: Ian Chin Wang --- api/challenge-response/README.md | 14 +++++++------- api/challenge-response/challenge-response.yaml | 8 ++++---- api/challenge-response/schemas/components.yaml | 9 +++++---- 3 files changed, 16 insertions(+), 15 deletions(-) diff --git a/api/challenge-response/README.md b/api/challenge-response/README.md index 9ba7b6e..bdcd720 100644 --- a/api/challenge-response/README.md +++ b/api/challenge-response/README.md @@ -59,7 +59,7 @@ session expiry has elapsed. Location: https://veraison.example/challenge-response/v1/session/1234567890 { - "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=", + "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI", "expiry": "2030-10-12T07:20:50.52Z", "accept": [ "application/psa-attestation-token" @@ -68,9 +68,9 @@ session expiry has elapsed. } ``` -`nonceSize` must be between `8` and `64`. Analogously, `nonce` must be between -8 and 64 bytes when decoded (which means the specified base64 string must be no -longer than 88 bytes). +`nonceSize` must be between `8` and `64`. Analogously, `nonce` must be +URL-safe base64 encoded and between 8 and 64 bytes when decoded (which means +the specified base64 string must be no longer than 88 bytes). ### Asynchronous verification @@ -90,7 +90,7 @@ longer than 88 bytes). Content-format: application/vnd.veraison.challenge-response-session+json { - "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=", + "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI", "expiry": "2031-10-12T07:20:50.52Z", "accept": [ "application/psa-attestation-token" @@ -116,7 +116,7 @@ longer than 88 bytes). Content-format: application/vnd.veraison.challenge-response-session+json { - "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=", + "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI", "expiry": "2031-10-12T07:20:50.52Z", "accept": [ "application/psa-attestation-token" @@ -154,7 +154,7 @@ longer than 88 bytes). Content-format: application/vnd.veraison.challenge-response-session+json { - "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=", + "nonce": "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI", "expiry": "2030-10-12T07:20:50.52Z", "accept": [ "application/psa-attestation-token" diff --git a/api/challenge-response/challenge-response.yaml b/api/challenge-response/challenge-response.yaml index 5cbc236..b84f705 100644 --- a/api/challenge-response/challenge-response.yaml +++ b/api/challenge-response/challenge-response.yaml @@ -30,13 +30,13 @@ paths: in: query description: > the API server should not generate a nonce for this session and - instead use the one supplied by the client. The supplied base64 - URL-encoded value must decode to a byte sequence between 8 and - 64 bytes long. + instead use the one supplied by the client. The supplied nonce + MUST be URL-safe base64 encoded and must decode to a byte sequence + between 8 and 64 bytes long. required: false schema: type: string - format: byte + pattern: '^[A-Za-z0-9_-]+={0,2}$' responses: '201': description: > diff --git a/api/challenge-response/schemas/components.yaml b/api/challenge-response/schemas/components.yaml index b515f1f..4c97728 100644 --- a/api/challenge-response/schemas/components.yaml +++ b/api/challenge-response/schemas/components.yaml @@ -8,11 +8,12 @@ components: properties: nonce: type: string - format: byte + pattern: '^[A-Za-z0-9_-]+={0,2}$' description: - base64 encoded random value. Must be between 8 and 64 bytes long in - its raw form (the base64 encoding must be no longer than 88 bytes). - example: MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI= + URL-safe base64 encoded random value. Must be between 8 and 64 + bytes long in its raw form (the base64 encoding must be no longer + than 88 bytes). + example: MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI expiry: type: string format: date-time