===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-sk.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- src/usr.bin/ssh/ssh-sk.c	2019/11/12 19:34:40	1.9
+++ src/usr.bin/ssh/ssh-sk.c	2019/11/12 22:38:19	1.10
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-sk.c,v 1.9 2019/11/12 19:34:40 markus Exp $ */
+/* $OpenBSD: ssh-sk.c,v 1.10 2019/11/12 22:38:19 djm Exp $ */
 /*
  * Copyright (c) 2019 Google LLC
  *
@@ -296,7 +296,8 @@
 	}
 	/* Check response validity */
 	if (resp->public_key == NULL || resp->key_handle == NULL ||
-	    resp->signature == NULL || resp->attestation_cert == NULL) {
+	    resp->signature == NULL ||
+	    (resp->attestation_cert == NULL && resp->attestation_cert_len != 0)) {
 		error("%s: sk_enroll response invalid", __func__);
 		r = SSH_ERR_INVALID_FORMAT;
 		goto out;