From 2a1fbc7bf23086ab66bd559fe1a25d669f6fc110 Mon Sep 17 00:00:00 2001
From: Florian Franzen <Florian.Franzen@gmail.com>
Date: Sat, 3 Oct 2026 15:16:18 +0200
Subject: [PATCH] Return NotFound for an empty key history object

---
 CHANGELOG.md               |  1 +
 src/lib.rs                 |  5 +++++
 tests/command_response.ron | 25 +++++++++++++++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e1a0096..ebec9a67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
   default (5)
 - Fix the inverted parsing of the touch requirement in SET MANAGEMENT KEY's P2
   (0xFF means no touch, 0xFE means touch required)
+- Answer GET DATA for an empty key history object with NotFound
 
 ## [v0.7.0][] (2026-08-17)
 
diff --git a/src/lib.rs b/src/lib.rs
index 52aefebf..094311fa 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1039,6 +1039,11 @@ impl<T: Client> LoadedAuthenticator<'_, T> {
             }
         }
 
+        // Stay absent while there is nothing to report
+        if num_certs == 0 {
+            return Err(Status::NotFound);
+        }
+
         reply.expand(&[0xC1, 0x01])?;
         reply.expand(&[num_certs])?;
         reply.expand(&[0xC2, 0x01])?;
diff --git a/tests/command_response.ron b/tests/command_response.ron
index 7bc7ecea..faea3524 100644
--- a/tests/command_response.ron
+++ b/tests/command_response.ron
@@ -13,6 +13,31 @@
             Select
         ]
     ),
+    IoTest(
+        name: "Key history stays absent while empty",
+        cmd_resp: [
+            GetData(
+                input: "5C 03 5FC10C",
+                output: All(),
+                expected_status: NotFound,
+            ),
+            AuthenticateManagement(
+                key: (
+                    algorithm: Tdes,
+                    key: "0102030405060708 0102030405060708 0102030405060708"
+                ),
+                mutual: false,
+            ),
+            // with a certificate stored for a retired slot, the object appears
+            PutData(
+                input: "5C 03 5FC10D 53 04 DEADBEEF",
+            ),
+            GetData(
+                input: "5C 03 5FC10C",
+                output: Data("53 08 C1 01 01 C2 01 00 FE 00"),
+            ),
+        ]
+    ),
     IoTest(
         name: "Bad management key",
         cmd_resp: [