Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

is_fido function #61

Closed
shimritd opened this issue Oct 3, 2019 · 23 comments
Closed

is_fido function #61

shimritd opened this issue Oct 3, 2019 · 23 comments

Comments

@shimritd
Copy link

shimritd commented Oct 3, 2019

hi,

in the is_fido function we have:
return (usage_page == 0xf1d0);

well, it worked perfect but suddenly i get 1 as the device usage_page and therefor this condition returns false.
any idea what can be the reason?
i updated windows yesterday, this is the only reason i can think of...

thanks,
Shimrit

@martelletto
Copy link
Contributor

martelletto commented Oct 4, 2019 via email

@shimritd
Copy link
Author

shimritd commented Oct 5, 2019 via email

@prusnak
Copy link
Contributor

prusnak commented Oct 22, 2019

@shimritd any news?

@shimritd
Copy link
Author

shimritd commented Oct 23, 2019 via email

@shimritd
Copy link
Author

shimritd commented Oct 23, 2019 via email

@martelletto
Copy link
Contributor

martelletto commented Oct 23, 2019 via email

@shimritd
Copy link
Author

shimritd commented Oct 23, 2019 via email

@shimritd
Copy link
Author

shimritd commented Oct 23, 2019 via email

@martelletto
Copy link
Contributor

Hi Shimrit,

This is what I observe on a Windows 1903 (build 19008.1) VM running libfido2 HEAD against a YubiKey 5.2.4:

  • If I execute 'fido2-token -L' without administrator privileges, the application is unable to see the key, let alone communicate with it. This is a known problem in Windows 1903, as it restricts access to FIDO HID devices to applications using its native FIDO API or applications running in administrator mode (see issue windows: abstraction layer for system's native API #34);
  • If I execute 'fido2-token L' with administrator privileges, the application sees one YubiKey;
  • If I execute 'fido2-token -I ' with administrator privileges, the application correctly identifies the YubiKey as a FIDO2 device.

Regarding the issues described:

  • Did you modify is_fido() or comment out its invocation? If so, it is possible the library is detecting the OTP interface (keyboard) as FIDO, which would explain the two devices listed for a single key (and the \kbd suffix on the second one);
  • Could the failure to reset be caused by the 5-second rule (see issue Cannot reset the YubiKey 5 NFC? #15)?

Thank you,

-p.

@shimritd
Copy link
Author

shimritd commented Oct 24, 2019 via email

@martelletto
Copy link
Contributor

Are you running with commit 325ef43, from June 10? The described behaviour suggests otherwise.

-p.

@shimritd
Copy link
Author

shimritd commented Oct 29, 2019 via email

@shimritd
Copy link
Author

shimritd commented Oct 30, 2019 via email

@martelletto
Copy link
Contributor

martelletto commented Oct 30, 2019 via email

@martelletto
Copy link
Contributor

Hi,

I was able to use fido2-cred.exe from https://developers.yubico.com/libfido2/Releases/libfido2-1.2.0-win64.zip to generate a credential on a key with firmware 5.2.4.

A third question: is your application calling fido_cred_set_options() and setting UV to true? If so, you may want to set UV to false, or use fido_assert_set_up() and fido_assert_set_uv() instead. I believe there is a difference in behaviour between 5.2.4 and previous versions that could be causing the problem you are observing.

-p.

@shimritd
Copy link
Author

shimritd commented Oct 30, 2019 via email

@martelletto
Copy link
Contributor

Yes, that should also work. You will get FIDO_ERR_UNSUPPORTED_OPTION from examples/cred if you pass it -v on a YubiKey, as the YubiKey does not support UV as understood by FIDO2.

@shimritd
Copy link
Author

shimritd commented Oct 30, 2019 via email

@shimritd
Copy link
Author

shimritd commented Oct 30, 2019 via email

@martelletto
Copy link
Contributor

Hi,

UV means the device is "capable of verifying the user within itself"; ClientPIN means PIN code verification: https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetInfo

How are you trying to use hmac-secret?

Regarding a phone call, please contact Yubico's support at https://www.yubico.com/support/contact/.

-p.

@shimritd
Copy link
Author

shimritd commented Oct 30, 2019 via email

@shimritd
Copy link
Author

shimritd commented Oct 31, 2019 via email

@martelletto
Copy link
Contributor

Hi,

Great to hear! I will close this issue, then. If anything else pops up, let me know.

-p.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

3 participants