Restrict passcodes to the values 00000001 to 99999998 in decimal as p…

…er 5.1.1.6 (#9977)
project-chip · Sep 27, 2021 · 12ce672 · 12ce672
1 parent 45c7a41
commit 12ce672
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/protocols/secure_channel/PASESession.cpp b/src/protocols/secure_channel/PASESession.cpp
@@ -221,8 +221,8 @@ CHIP_ERROR PASESession::GeneratePASEVerifier(PASEVerifier & verifier, uint32_t p
     {
         ReturnErrorOnFailure(DRBG_get_bytes(reinterpret_cast<uint8_t *>(&setupPIN), sizeof(setupPIN)));
 
-        // Use only kSetupPINCodeFieldLengthInBits bits out of the code
-        setupPIN &= ((1 << kSetupPINCodeFieldLengthInBits) - 1);
+        // Passcodes shall be restricted to the values 00000001 to 99999998 in decimal, see 5.1.1.6
+        setupPIN = (setupPIN % 99999998) + 1;
     }
 
     return PASESession::ComputePASEVerifier(setupPIN, pbkdf2IterCount, salt, verifier);