Solo: Not working with GitHub on Android and Linux after registering on Windows 10 1903
Recently GitHub added support for WebAuthn (upgrading from older u2f api), and after re-adding my solos (tap and standard key) I can't use either to log in on Android.
Everything seems to work after pressing the button with the correct popup appearing and nfc working with solo (getting the response), but after it disappears I just get Security key authentication failed message on GitHub (screenshot).
It doesn't work for me in both Chrome and Firefox, and using USB (with adapter) instead of NFC interface also doesn't change anything (so standard solo doesn't work as well).
The keys seems to work with other websites - or at least worked fine with webauthn.io and Twitter.
I'm using Samsung Galaxy S7.
Update: doesn't work for me on Moto G5 as well.
Aseigler on Keybase also has the same problem with Galaxy S8 and with other security keys like Yubikey 5. So it seems like it's not an issue unique to solo, but with GitHub implementation. No idea where to report it though.
Edit:
The issue only appears when registering on Windows 10 (probably only on 1903, since that version changed how Windows handles security keys), so I updated the title accordingly.
This also explains why a lot of people here might've not experienced it: if you register using Linux and probably earlier versions of Windows 10 it works fine everywhere.
oplik0
All 22 comments
Ahoy! GitHubber here.
I'm interested in debugging this. Could you let me know which Solo key you're using so I can try replicating your setup?
lgarron
on 28 Aug 2019
🎉2
It appears at least to me to mostly be an issue in general with NFC authenticators and Android phones, but it is hard to tell exactly what is going on. Perhaps we should put together a pass/fail chart for what we can test with specific phones and specific browsers and versions.
aseigler
on 28 Aug 2019
@Igarron
I tested it mostly with Solo Tap USB-A (Not sure if the nfc hardware revision is out yet but this is original version and I had no problems with it until now) with 2.4.3 firmware.
But it also doesn't seem to work with my standard Solo key (also USB-A) - also on 2.4.3 firmware - with a microUSB to USB adapter.
The key was re-added to GitHub after they added webauthn and it was added from Windows 10 1903 (only now I thought that this might be relevant - I will try to check if it works on Linux and if re-adding it from there will change anything)
oplik0
on 28 Aug 2019
I don't have a working Android phone at the moment, but you should be able to get some detailed info from solo using this hacker build, which is compiled with the following debug logs enabled.
set_logging_mask(
/*0*/
//TAG_GEN|
TAG_MC |
TAG_GA |
TAG_WALLET |
TAG_STOR |
//TAG_NFC_APDU |
TAG_NFC |
TAG_CP |
TAG_CTAP|
// TAG_HID|
TAG_U2F|
//TAG_PARSE |
//TAG_TIME|
// TAG_DUMP|
TAG_GREEN|
TAG_RED|
TAG_EXT|
TAG_ERR
);
Program it on a hacker.
unzip solo.zip
solo program bootloader solo.hex
Plug in via USB and open the serial port using putty / picocom / etc. Then run the Github request on Solo over NFC while it's plugged in. If you copy and paste the logs here that might make it clear what is going on.
conorpp
on 29 Aug 2019
Question: when you are registering/authenticating, how long are you holding the key to the phone?
I've recently learned that NFC security key operations will fail if I only wait for my phone to vibrate once, but succeed if I let it vibrate twice.
(Pixel 3, YubiKey 5 NFC)
lgarron
on 29 Aug 2019
Ooh, I think I found the issue.
The key didn't work on Linux either, but unlike Android I was able to register it (on Android I have to select desktop version, go to settings from url directly and even then registration failed) - but the weird thing is that it registered as a separate key without a problem - and then it worked on android just fine.
So the issue appears to be with how Windows 10 1903 handles security keys now. It appears that from the perspective of the key a website on Windows 10 is not the same website as on Linux and Android.
That's why I got the error - from the perspective of GitHub the key wasn't linked to my account at all.
@Igarron I held it until I got the github error mostly, sometimes even longer for no reason really :)
The length wasn't the problem it seems.
I will test it more with the logs build in a few moments, but I think I should now change the title to " Not working with GitHub on Android and Linux after registration on Windows 10"
oplik0
on 29 Aug 2019
A small update: the key added on Linux works with Windows too...
So I was wrong - it's not that Windows does something to domain... It seems it's just that the key registration is somehow broken.
oplik0
on 29 Aug 2019
Ok, got some debug logs :)
What I did here is register the key on Windows 10 > login with the key on Windows 10 > attempt to log in on Android via nfc.
[CTAP] cbor input structure: 0 bytes
[CTAP] cbor output structure: 85 bytes. Return 0x00
[CTAP] cbor input structure: 110 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] e0 f7 74 f4 e1 1f 17 cd 33 99 47 c2 21 f2 53 40 13 ba f1 f3 fb 59 c0 6e ec c6 97 76 60 15 86 99
[ERR] ../../fido2/ctap_parse.c:913: Ignoring credential is incorrect length, treating as custom
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #0 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 148 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] e0 f7 74 f4 e1 1f 17 cd 33 99 47 c2 21 f2 53 40 13 ba f1 f3 fb 59 c0 6e ec c6 97 76 60 15 86 99
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #332 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 5 bytes
[CTAP] CTAP_CLIENT_PIN
[CP] CP map has 2 elements
[CP] CP_pinProtocol
[CP] CP_subCommand
[CP] CP_cmdGetRetries
[CTAP] cbor output structure: 3 bytes. Return 0x00
[CTAP] cbor input structure: 0 bytes
[CTAP] CTAP_GET_INFO
[CTAP] cbor output structure: 85 bytes. Return 0x00
[CTAP] cbor input structure: 5 bytes
[CTAP] CTAP_CLIENT_PIN
[CP] CP map has 2 elements
[CP] CP_pinProtocol
[CP] CP_subCommand
[CP] CP_cmdGetKeyAgreement
[CTAP] cbor output structure: 80 bytes. Return 0x00
[CTAP] cbor input structure: 102 bytes
[CTAP] CTAP_CLIENT_PIN
[CP] CP map has 4 elements
[CP] CP_pinProtocol
[CP] CP_subCommand
[CP] CP_keyAgreement
[CP] CP_pinHashEnc
[CP] CP_cmdGetPinToken
[CTAP] cbor output structure: 19 bytes. Return 0x00
[CTAP] cbor input structure: 233 bytes
[CTAP] CTAP_MAKE_CREDENTIAL
[MC] e0 f7 74 f4 e1 1f 17 cd 33 99 47 c2 21 f2 53 40 13 ba f1 f3 fb 59 c0 6e ec c6 97 76 60 15 86 99
[MC] ID: github.com
[MC] name: GitHub
[MC] CTAP_user
[MC] ID: 71 7f a2 6c 4f 5b 63 97 d8 2d 31 4a 52 8f b2 cb 3e a1 52 34 b0 c6 15 e4 83 cf 47 82 2e cd 52 14 3a 5c 60 6c a7 67 1c 9d b0 80 16 a7 3a 31 85 d6 f9 d1 cc 10 f4 9d f0 1d 1c a2 62 65 1e ed 71 95
[MC] cred_type: 0x01
[MC] alg_type: -7
[MC] CTAP_pinAuth
[MC] CTAP_pinProtocol
[MC] == 1
[DEBUG] MADE credId: 75 07 bb 8d 01 16 74 47 9c 99 62 3e fb 9f 18 c1 74 cd 88 04 3c 56 34 0a 84 9a 80 2c 83 92 77 61 c4 1a 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 46 01 00 00
[MC] der sig [72]: 30 46 02 21 00 9c b5 aa e4 98 5c dc a1 6f c4 f2 20 77 20 1c d5 d9 a8 c4 46 f8 77 c5 68 05 35 59 1f 77 f8 ca 42 02 21 00 a4 83 96 ca ab c1 a9 4b 28 da 33 07 c0 ca 30 fc 76 0f 0f 33 b6 80 d5 29 59 47 40 c8 f4 be a4 f0
[CTAP] cbor output structure: 1056 bytes. Return 0x00
[CTAP] cbor input structure: 0 bytes
[CTAP] CTAP_GET_INFO
[CTAP] cbor output structure: 85 bytes. Return 0x00
[CTAP] cbor input structure: 0 bytes
[CTAP] CTAP_GET_INFO
[CTAP] cbor output structure: 85 bytes. Return 0x00
[CTAP] cbor input structure: 110 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 9e 25 71 37 ce 9d 81 00 26 19 8b f0 b3 95 55 d0 1a f5 19 d2 18 ca 59 e6 71 aa 02 a5 38 00 39 15
[ERR] ../../fido2/ctap_parse.c:913: Ignoring credential is incorrect length, treating as custom
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #0 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 148 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 9e 25 71 37 ce 9d 81 00 26 19 8b f0 b3 95 55 d0 1a f5 19 d2 18 ca 59 e6 71 aa 02 a5 38 00 39 15
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #332 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 148 bytes
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 9e 25 71 37 ce 9d 81 00 26 19 8b f0 b3 95 55 d0 1a f5 19 d2 18 ca 59 e6 71 aa 02 a5 38 00 39 15
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[DEBUG] reading RK 0 @ 8039000
[DEBUG] NO rk match for allowList item
[GA] qsort length: 1
[DEBUG] Only one account, nulling out user details on response
[GA] resulting order of creds:
[GA] CRED ID (# 326)
[GA] saved 0 credentials
[CTAP] cbor output structure: 208 bytes. Return 0x00
[CTAP] cbor input structure: 148 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 9e 25 71 37 ce 9d 81 00 26 19 8b f0 b3 95 55 d0 1a f5 19 d2 18 ca 59 e6 71 aa 02 a5 38 00 39 15
[GA] CTAP_options
[GA] up: 1
[GA] ALLOW_LIST has 1 creds
[DEBUG] reading RK 0 @ 8039000
[DEBUG] NO rk match for allowList item
[GA] qsort length: 1
[GA] resulting order of creds:
[GA] CRED ID (# 326)
[GA] saved 0 credentials
[CTAP] cbor output structure: 208 bytes. Return 0x00
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=a4 p1=04 p2=00 lc=7 le=256
[NFC] TX resp timeout. len: 0
[NFC] SELECTED 1
[NFC] prev.Iblock: 02 00 a4 04 00 07 d2 76 00 00 85 01 01 00
[NFC] -----
[NFC] apdu ok. case=03 cla=00 ins=a4 p1=00 p2=0c lc=2 le=0
[NFC] TX resp timeout. len: 0
[NFC] SELECTED 3
[NFC] prev.Iblock: 03 00 a4 00 0c 02 e1 03
[NFC] -----
[NFC] apdu ok. case=02 cla=00 ins=b0 p1=00 p2=00 lc=0 le=15
[NFC] TX resp timeout. len: 15
[NFC] prev.Iblock: 02 00 b0 00 00 0f
[NFC] -----
[NFC] apdu ok. case=03 cla=00 ins=a4 p1=00 p2=0c lc=2 le=0
[NFC] TX resp timeout. len: 0
[NFC] SELECTED 4
[NFC] prev.Iblock: 03 00 a4 00 0c 02 e1 04
[NFC] -----
[NFC] apdu ok. case=02 cla=00 ins=b0 p1=00 p2=00 lc=0 le=2
[NFC] TX resp timeout. len: 2
[NFC] prev.Iblock: 02 00 b0 00 00 02
[NFC] -----
[NFC] apdu ok. case=02 cla=00 ins=b0 p1=00 p2=02 lc=0 le=20
[NFC] TX resp timeout. len: 20
[NFC] prev.Iblock: 03 00 b0 00 02 14
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=a4 p1=04 p2=00 lc=8 le=256
[NFC] TX resp timeout. len: 6
[NFC] FIDO applet selected.
[NFC] prev.Iblock: 02 00 a4 04 00 08 a0 00 00 06 47 2f 00 01 00
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=02 p1=03 p2=00 lc=97 le=256
[NFC] U2F Authenticate command.
[EXT] Ignoring U2F auth request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[NFC] U2F resp len: 2
[NFC] U2F Authenticate processing 550218 (took 1)
[NFC] U2F Authenticate answered 550219 (took 134262857)
[NFC] prev.Iblock: 02 00 02 03 00 61 26 63 61 1a c2 17 4a 3c c2 71 ea b0 b3 a7 dc c0 a2 74 d7 5b 78 ff 0e 69 6f c9 dd a2 60 8a 94 1e 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 20 fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48 00
[NFC] Buffer being updated!
[NFC] -----
[NFC] -----
[NFC] Buffer being updated!
Edit: cleared all that white space so it's more readable :)
oplik0
on 29 Aug 2019
@all-contributors add @oplik0 for bugs
nickray
on 29 Aug 2019
@nickray
I've put up a pull request to add @oplik0! :tada:
![allcontributors[bot] picture](https://avatars.githubusercontent.com/in/23186?v=4&s=40)
allcontributors[bot]
on 29 Aug 2019
How it looks on Linux:
Some bad logs (authentication failure)
[EXT] U2F_VERSION
[U2F] u2f resp: 55 32 46 5f 56 32 90 00
[EXT] Ignoring U2F check request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] CHECK-ONLY
[U2F] key handle + appid not authentic
[U2F] calc tag:
12 e6 57 8e 3f 22 b6 f6 b1 bb d6 fb 3d 15 b4 65
[U2F] inp tag:
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00
[U2F] key handle + appid not authentic
[U2F] calc tag:
ec f9 34 89 58 0a 00 e5 1d ce 41 d1 e8 0e 29 20
[U2F] inp tag:
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
75 07 bb 8d 01 16 74 47 9c 99 62 3e fb 9f 18 c1 74 cd 88 04 3c 56 34 0a 84 9a 80 2c 83 92 77 61 c4 1a 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 46 01 00 00
[U2F] key handle + appid not authentic
[U2F] calc tag:
b1 3e 78 36 92 5e 1d 57 9d ca 38 8a 38 1e 11 02
75 07 bb 8d 01 16 74 47 9c 99 62 3e fb 9f 18 c1
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] CHECK-ONLY
[U2F] key handle + appid not authentic
[U2F] calc tag:
80 29 0c 44 38 e0 32 b7 b8 2c 3a b6 21 b1 db 89
[U2F] inp tag:
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00
[U2F] key handle + appid not authentic
22 63 f1 b5 48 05 6e 37 49 1f e1 2b 8e c8 a3 f9
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
75 07 bb 8d 01 16 74 47 9c 99 62 3e fb 9f 18 c1 74 cd 88 04 3c 56 34 0a 84 9a 80 2c 83 92 77 61 c4 1a 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 46 01 00 00
[U2F] key handle + appid not authentic
0b d4 35 41 df 76 2f a2 fe 9b cc f1 3a fd ca f1
[U2F] inp tag:
75 07 bb 8d 01 16 74 47 9c 99 62 3e fb 9f 18 c1
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[U2F] U2F_REGISTER
[U2F] U2F Error code 6985
[U2F] u2f resp: 69 85
[U2F] U2F_REGISTER
[U2F] sha256: 32 02 66 86 6c cb 36 e6 28 61 5a 51 82 8f 97 7b 2e 31 37 0e 69 45 44 06 fc d9 8a 70 24 ff 1c 0e
[U2F] u2f resp: 05 04 af 1e 19 3c 56 c6 a9 81 c3 9c ad 1f cc d1 49 de 35 f7 43 36 34 59 26 71 b8 15 3e 4b a3 8d ed b2 29 f1 c1 c5 f0 88 7d a8 cd fe cc b1 28 e5 36 be 44 e1 7a df 5b f3 74 c0 da 2c a3 4c 6d 53 a9 7e 30 82 11 0b 1f 1e 51 54 3c 81 4b a8 c0 23 c9 2f 18 6e d8 6e 2f e4 a5 f2 26 aa d9 43 75 e9 22 d9 19 da c5 d7 52 b7 98 c7 90 fb 57 71 a5 46 ad 1b d4 30 82 02 e9 30 82 02 8e a0 03 02 01 02 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 02 30 81 82 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 08 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 10 30 0e 06 03 55 04 0b 0c 07 52 6f 6f 74 20 43 41 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 30 20 17 0d 31 38 31 32 31 31 30 32 32 30 31 32 5a 18 0f 32 30 36 38 31 31 32 38 30 32 32 30 31 32 5a 30 81 94 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 22 30 20 06 03 55 04 0b 0c 19 41 75 74 68 65 6e 74 69 63 61 74 6f 72 20 41 74 74 65 73 74 61 74 69 6f 6e 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 7d 78 f6 be ca 40 76 3b c7 5c e3 ac f4 27 12 c3 94 98 13 37 a6 41 0e 92 f6 9a 3b 15 47 8d b6 ce d9 d3 4f 39 13 ed 12 7b 81 14 3b e8 f9 4c 96 38 fe e3 d6 cb 1b 53 93 a2 74 f7 13 9a 0f 9d 5e a6 a3 81 de 30 81 db 30 1d 06 03 55 1d 0e 04 16 04 14 9a fb a2 21 09 23 b5 e4 7a 2a 1d 7a 6c 4e 03 89 92 a3 0e c2 30 81 a1 06 03 55 1d 23 04 81 99 30 81 96 a1 81 88 a4 81 85 30 81 82 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 08 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 10 30 0e 06 03 55 04 0b 0c 07 52 66f 74 20 43 41 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 82 09 00 eb d4 84 50 14 ab d1 57 30 09 06 03 55 1d 13 04 02 30 00 30 0b 06 03 55 1d 0f 04 04 03 02 04 f0 30 0a 06 08 2a 86 48 ce 3d 04 03 02 03 49 00 30 46 02 21 00 a1 7b 2a 1d 4e 42 a8 68 6d 65 61 1e f5 fe 6d c6 99 ae 7c 20 83 16 ba d6 e5 0f d7 0d 7e 05 da c9 02 21 00 92 49 f3 0b 57 d1 19 72 f2 75 5a a2 e0 b6 bd 0f 07 38 d0 e5 a2 4f a0 f3 87 61 82 d8 cd 48 fc 57 30 45 02 21 00 a3 99 86 30 7b 6e 3a a1 6d 17 2c 04 9c b9 e8 a1 61 03 bb c4 82 8b d9 3a af 0e e5 a4 b0 84 a8 81 02 20 43 85 9a de d1 56 58 08 ad e0 cc e2 72 3b 50 48 15 9e c7 c8 09 77 a3 bf 81 c7 4d 23 33 22 e5 14 90 00
[EXT] U2F_VERSION
[U2F] u2f resp: 55 32 46 5f 56 32 90 00
[EXT] Ignoring U2F check request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] CHECK-ONLY
[U2F] key handle + appid not authentic
[U2F] calc tag:
d0 6f 35 ce 63 50 78 b7 ac e0 43 7e 7b 43 3b 84
[U2F] inp tag:
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00
[U2F] key handle + appid not authentic
ec f9 34 89 58 0a 00 e5 1d ce 41 d1 e8 0e 29 20
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[U2F] U2F_REGISTER
[U2F] U2F Error code 6985
[U2F] u2f resp: 69 85
[U2F] U2F_REGISTER
[U2F] sha256: 85 d9 f9 e7 82 1c 6d 7c 5c a5 d1 2e c7 27 f2 23 c2 41 0f 53 a2 97 55 38 d5 fa c4 83 33 cd 23 0b
[U2F] u2f resp: 05 04 8a 13 86 96 08 ed 8e d0 0e d4 19 5d 00 c9 80 21 d3 15 25 6e 7e 5a 64 be a3 af e7 ba d9 bb c8 b1 c6 7b e3 c6 b1 1a a4 9a 91 a6 f5 bc b1 74 e6 3e 19 fd 63 aa 38 f0 65 21 54 a1 35 b5 cd 57 c0 12 30 20 0a 8a a5 c9 64 15 2f 9b 69 4b 15 13 4c 39 47 cc 19 3b 80 88 fa 36 e6 ad 1c 40 b8 af 70 78 e2 d6 5d 2a 75 9f 1b e1 0e 2b 4e 42 3c 23 09 af 34 30 82 02 e9 30 82 02 8e a0 03 02 01 02 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 02 30 81 82 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 08 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 10 30 0e 06 03 55 04 0b 0c 07 52 6f 6f 74 20 43 41 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 30 20 17 0d 31 38 31 32 31 31 30 32 32 30 31 32 5a 18 0f 32 30 36 38 31 31 32 38 30 32 32 30 31 32 5a 30 81 94 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 22 30 20 06 03 55 04 0b 0c 19 41 75 74 68 65 6e 74 69 63 61 74 6f 72 20 41 74 74 65 73 74 61 74 69 6f 6e 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 7d 78 f6 be ca 40 76 3b c7 5c e3 ac f4 27 12 c3 94 98 13 37 a6 41 0e 92 f6 9a 3b 15 47 8d b6 ce d9 d3 4f 39 13 ed 12 7b 81 14 3b e8 f9 4c 96 38 fe e3 d6 cb 1b 53 93 a2 74 f7 13 9a 0f 9d 5e a6 a3 81 de 30 81 db 30 1d 06 03 55 1d 0e 04 16 04 14 9a fb a2 21 09 23 b5 e4 7a 2a 1d 7a 6c 4e 03 89 92 a3 0e c2 30 81 a1 06 03 55 1d 23 04 81 99 30 81 96 a1 81 88 a4 81 85 30 81 82 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 08 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 10 30 0e 06 03 55 04 0b 0c 07 52 66f 74 20 43 41 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 82 09 00 eb d4 84 50 14 ab d1 57 30 09 06 03 55 1d 13 04 02 30 00 30 0b 06 03 55 1d 0f 04 04 03 02 04 f0 30 0a 06 08 2a 86 48 ce 3d 04 03 02 03 49 00 30 46 02 21 00 a1 7b 2a 1d 4e 42 a8 68 6d 65 61 1e f5 fe 6d c6 99 ae 7c 20 83 16 ba d6 e5 0f d7 0d 7e 05 da c9 02 21 00 92 49 f3 0b 57 d1 19 72 f2 75 5a a2 e0 b6 bd 0f 07 38 d0 e5 a2 4f a0 f3 87 61 82 d8 cd 48 fc 57 30 45 02 21 00 9a ac 71 30 f3 73 d4 9c 89 62 1b 75 82 d3 73 bd e9 63 e1 e3 f5 fc 09 03 7d 2c d5 e9 70 75 58 90 02 20 65 a4 ba 02 1e 57 17 5c 7f 77 50 fb f6 ff 85 e6 7f dc f2 a2 f1 2e 7e 53 14 41 1b 4a bf 5c aa 56 90 00
[CTAP] cbor input structure: 0 bytes
[CTAP] CTAP_GET_INFO
[CTAP] cbor output structure: 85 bytes. Return 0x00
[CTAP] cbor input structure: 272 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 90 a9 5b 3d da 3a af f7 71 8c c9 14 3a 39 f8 28 74 62 2a f2 95 40 34 66 42 d8 60 b4 f5 e8 a5 ad
[ERR] ../../fido2/ctap_parse.c:913: Ignoring credential is incorrect length, treating as custom
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 3 creds
[GA] CRED #0 is invalid
[GA] CRED #332 is invalid
[DEBUG] reading RK 0 @ 8039000
[DEBUG] NO rk match for allowList item
[GA] qsort length: 3
[DEBUG] Only one account, nulling out user details on response
[GA] resulting order of creds:
[GA] CRED ID (# 0)
[GA] CRED ID (# 0)
[GA] saved 0 credentials
[CTAP] cbor output structure: 171 bytes. Return 0x00
[CTAP] cbor input structure: 266 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 3 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 90 a9 5b 3d da 3a af f7 71 8c c9 14 3a 39 f8 28 74 62 2a f2 95 40 34 66 42 d8 60 b4 f5 e8 a5 ad
[ERR] ../../fido2/ctap_parse.c:913: Ignoring credential is incorrect length, treating as custom
[GA] ALLOW_LIST has 3 creds
[GA] CRED #0 is invalid
[GA] CRED #332 is invalid
Correct logs (registration, 2 logins on Linux, 1 login on android via nfc):
[CTAP] cbor input structure: 0 bytes
[CTAP] cbor output structure: 85 bytes. Return 0x00
[CTAP] cbor input structure: 110 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 94 49 e4 e1 72 47 3b 08 0a 12 27 d6 eb 8a 97 59 3f 91 7e 5d d8 07 19 9b 91 f8 d9 b0 92 9f a0 8f
[ERR] ../../fido2/ctap_parse.c:913: Ignoring credential is incorrect length, treating as custom
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #0 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 148 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 94 49 e4 e1 72 47 3b 08 0a 12 27 d6 eb 8a 97 59 3f 91 7e 5d d8 07 19 9b 91 f8 d9 b0 92 9f a0 8f
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #332 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 126 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 94 49 e4 e1 72 47 3b 08 0a 12 27 d6 eb 8a 97 59 3f 91 7e 5d d8 07 19 9b 91 f8 d9 b0 92 9f a0 8f
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[DEBUG] reading RK 0 @ 8039000
[DEBUG] NO rk match for allowList item
[GA] qsort length: 1
[DEBUG] Only one account, nulling out user details on response
[GA] resulting order of creds:
[GA] CRED ID (# 0)
[GA] saved 0 credentials
[CTAP] cbor output structure: 185 bytes. Return 0x00
[CTAP] cbor input structure: 120 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 3 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 94 49 e4 e1 72 47 3b 08 0a 12 27 d6 eb 8a 97 59 3f 91 7e 5d d8 07 19 9b 91 f8 d9 b0 92 9f a0 8f
[GA] ALLOW_LIST has 1 creds
[DEBUG] reading RK 0 @ 8039000
[DEBUG] NO rk match for allowList item
[GA] qsort length: 1
[DEBUG] Only one account, nulling out user details on response
[GA] resulting order of creds:
[GA] CRED ID (# 0)
[GA] saved 0 credentials
[CTAP] cbor output structure: 185 bytes. Return 0x00
[CTAP] cbor input structure: 0 bytes
[CTAP] CTAP_GET_INFO
[CTAP] cbor output structure: 85 bytes. Return 0x00
[EXT] Ignoring U2F auth request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F auth request
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00
[U2F] u2f resp: 6a 80
[U2F] U2F_REGISTER
[U2F] U2F Error code 6985
[U2F] u2f resp: 69 85
[U2F] U2F_REGISTER
[U2F] sha256: b1 71 b0 02 d3 73 06 e3 39 4f b3 6f f3 bd 1a c3 c4 d8 0c 53 e7 8e 4e 04 ec c9 e8 7c d6 7a f2 bc
[U2F] u2f resp: 05 04 95 7c bf 58 f3 95 b3 15 62 b0 2b a9 1b 9c ac 77 15 31 9b 63 43 30 08 c0 5e 8d 9d e6 26 95 ce b6 69 c6 8a e4 da d3 2b 72 17 36 b2 4e b0 ba c0 c0 08 ab cc cc 9a 00 51 6e 83 ec 2a b1 ff 30 b0 7a 30 e0 6d ba 31 88 53 19 df 1c 99 ab b8 2d d8 5e 90 3a b2 31 aa d5 87 e6 63 20 85 58 91 fe df 83 b5 f2 99 5c 64 5b 23 f6 0a 2c 04 e0 2e 96 11 dd 69 30 82 02 e9 30 82 02 8e a0 03 02 01 02 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 02 30 81 82 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 08 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 10 30 0e 06 03 55 04 0b 0c 07 52 6f 6f 74 20 43 41 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 30 20 17 0d 31 38 31 32 31 31 30 32 32 30 31 32 5a 18 0f 32 30 36 38 31 31 32 38 30 32 32 30 31 32 5a 30 81 94 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 22 30 20 06 03 55 04 0b 0c 19 41 75 74 68 65 6e 74 69 63 61 74 6f 72 20 41 74 74 65 73 74 61 74 69 6f 6e 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 7d 78 f6 be ca 40 76 3b c7 5c e3 ac f4 27 12 c3 94 98 13 37 a6 41 0e 92 f6 9a 3b 15 47 8d b6 ce d9 d3 4f 39 13 ed 12 7b 81 14 3b e8 f9 4c 96 38 fe e3 d6 cb 1b 53 93 a2 74 f7 13 9a 0f 9d 5e a6 a3 81 de 30 81 db 30 1d 06 03 55 1d 0e 04 16 04 14 9a fb a2 21 09 23 b5 e4 7a 2a 1d 7a 6c 4e 03 89 92 a3 0e c2 30 81 a1 06 03 55 1d 23 04 81 99 30 81 96 a1 81 88 a4 81 85 30 81 82 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0f 06 03 55 04 08 0c 08 4d 61 72 79 6c 61 6e 64 31 14 30 12 06 03 55 04 0a 0c 0b 53 4f 4c 4f 20 48 41 43 4b 45 52 31 10 30 0e 06 03 55 04 0b 0c 07 52 66f 74 20 43 41 31 15 30 13 06 03 55 04 03 0c 0c 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 31 21 30 1f 06 09 2a 86 48 86 f7 0d 01 09 01 16 12 68 65 6c 6c 6f 40 73 6f 6c 6f 6b 65 79 73 2e 63 6f 6d 82 09 00 eb d4 84 50 14 ab d1 57 30 09 06 03 55 1d 13 04 02 30 00 30 0b 06 03 55 1d 0f 04 04 03 02 04 f0 30 0a 06 08 2a 86 48 ce 3d 04 03 02 03 49 00 30 46 02 21 00 a1 7b 2a 1d 4e 42 a8 68 6d 65 61 1e f5 fe 6d c6 99 ae 7c 20 83 16 ba d6 e5 0f d7 0d 7e 05 da c9 02 21 00 92 49 f3 0b 57 d1 19 72 f2 75 5a a2 e0 b6 bd 0f 07 38 d0 e5 a2 4f a0 f3 87 61 82 d8 cd 48 fc 57 30 44 02 20 7a d3 2e 3b 46 66 55 92 95 b6 95 45 28 e8 a4 ca bb 82 3c 41 37 19 2a a7 d4 b0 98 5c c6 a2 d9 74 02 20 53 a7 2e 1b 43 3b 02 2f 73 96 e5 5b 80 72 c5 32 fc 83 a8 90 4c 42 74 29 9f a5 97 74 0d 68 e1 67 90 00
[CTAP] cbor input structure: 0 bytes
[CTAP] cbor output structure: 85 bytes. Return 0x00
[CTAP] cbor input structure: 110 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 6f b3 46 4f 15 16 e8 08 d5 6e 32 6e dc aa 91 8a ad ad e2 20 47 04 18 22 72 fa 1b ac 82 bf b5 b5
[ERR] ../../fido2/ctap_parse.c:913: Ignoring credential is incorrect length, treating as custom
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #0 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 148 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 6f b3 46 4f 15 16 e8 08 d5 6e 32 6e dc aa 91 8a ad ad e2 20 47 04 18 22 72 fa 1b ac 82 bf b5 b5
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[GA] CRED #332 is invalid
[GA] qsort length: 1
[ERR] ../../fido2/ctap.c:1174: Error, no authentic credential
[CTAP] cbor output structure: 0 bytes. Return 0x2e
[CTAP] cbor input structure: 126 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 4 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 6f b3 46 4f 15 16 e8 08 d5 6e 32 6e dc aa 91 8a ad ad e2 20 47 04 18 22 72 fa 1b ac 82 bf b5 b5
[GA] CTAP_options
[GA] up: 0
[GA] ALLOW_LIST has 1 creds
[DEBUG] reading RK 0 @ 8039000
[DEBUG] NO rk match for allowList item
[GA] qsort length: 1
[DEBUG] Only one account, nulling out user details on response
[GA] resulting order of creds:
[GA] CRED ID (# 0)
[GA] saved 0 credentials
[CTAP] cbor output structure: 186 bytes. Return 0x00
[CTAP] cbor input structure: 120 bytes
[CTAP] CTAP_GET_ASSERTION
[GA] GA map has 3 elements
[GA] GA_rpId
[GA] ID: github.com
[GA] GA_clientDataHash
[GA] 6f b3 46 4f 15 16 e8 08 d5 6e 32 6e dc aa 91 8a ad ad e2 20 47 04 18 22 72 fa 1b ac 82 bf b5 b5
[GA] ALLOW_LIST has 1 creds
[DEBUG] reading RK 0 @ 8039000
[DEBUG] NO rk match for allowList item
[GA] qsort length: 1
[DEBUG] Only one account, nulling out user details on response
[GA] resulting order of creds:
[GA] CRED ID (# 0)
[GA] saved 0 credentials
[CTAP] cbor output structure: 185 bytes. Return 0x00
[EXT] U2F_VERSION
[U2F] u2f resp: 55 32 46 5f 56 32 90 00
[EXT] Ignoring U2F check request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] key handle + appid not authentic
[U2F] calc tag:
e3 10 9f 2c 5e 4c 5b ba 93 8b 38 61 9d 28 7e ba
[U2F] inp tag:
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00
[U2F] key handle + appid not authentic
[U2F] calc tag:
ec f9 34 89 58 0a 00 e5 1d ce 41 d1 e8 0e 29 20
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[EXT] Ignoring U2F check request
e0 6d ba 31 88 53 19 df 1c 99 ab b8 2d d8 5e 90 3a b2 31 aa d5 87 e6 63 20 85 58 91 fe df 83 b5 f2 99 5c 64 5b 23 f6 0a 2c 04 e0 2e 96 11 dd 69
[U2F] U2F Error code 6985
[U2F] u2f resp: 69 85
[EXT] Ignoring U2F auth request
e0 6d ba 31 88 53 19 df 1c 99 ab b8 2d d8 5e 90 3a b2 31 aa d5 87 e6 63 20 85 58 91 fe df 83 b5 f2 99 5c 64 5b 23 f6 0a 2c 04 e0 2e 96 11 dd 69
[U2F] sha256: e8 a0 70 fb ab bc e4 c2 e4 28 27 d1 33 36 a4 56 01 5a fb f6 e8 31 bf 50 c6 a9 93 fb 2d 06 a1 39
[U2F] u2f resp: 01 00 00 01 55 30 45 02 20 16 37 bf 55 7a 76 d6 ba 55 c5 62 f2 c5 9b 62 d8 46 17 c5 a3 0d 76 a6 f2 07 f8 31 03 9e 7d f2 3d 02 21 00 ae b9 b9 74 b3 0e dc f1 ba 74 a0 06 67 ac 4b 98 84 1b ae 6f 4b f6 6a 84 12 d9 2c 50 4a b6 08 cd 90 00
[EXT] Ignoring U2F auth request
e0 6d ba 31 88 53 19 df 1c 99 ab b8 2d d8 5e 90 3a b2 31 aa d5 87 e6 63 20 85 58 91 fe df 83 b5 f2 99 5c 64 5b 23 f6 0a 2c 04 e0 2e 96 11 dd 69
[U2F] U2F Error code 6985
[U2F] u2f resp: 69 85
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=a4 p1=04 p2=00 lc=7 le=256
[NFC] TX resp timeout. len: 0
[NFC] SELECTED 1
[NFC] prev.Iblock: 02 00 a4 04 00 07 d2 76 00 00 85 01 01 00
[NFC] -----
[NFC] apdu ok. case=03 cla=00 ins=a4 p1=00 p2=0c lc=2 le=0
[NFC] TX resp timeout. len: 0
[NFC] SELECTED 3
[NFC] prev.Iblock: 03 00 a4 00 0c 02 e1 03
[NFC] -----
[NFC] apdu ok. case=02 cla=00 ins=b0 p1=00 p2=00 lc=0 le=15
[NFC] TX resp timeout. len: 15
[NFC] prev.Iblock: 02 00 b0 00 00 0f
[NFC] -----
[NFC] apdu ok. case=03 cla=00 ins=a4 p1=00 p2=0c lc=2 le=0
[NFC] TX resp timeout. len: 0
[NFC] SELECTED 4
[NFC] prev.Iblock: 03 00 a4 00 0c 02 e1 04
[NFC] -----
[NFC] apdu ok. case=02 cla=00 ins=b0 p1=00 p2=00 lc=0 le=2
[NFC] TX resp timeout. len: 2
[NFC] prev.Iblock: 02 00 b0 00 00 02
[NFC] -----
[NFC] apdu ok. case=02 cla=00 ins=b0 p1=00 p2=02 lc=0 le=20
[NFC] APP_NDEF_TAG
[NFC] TX resp timeout. len: 20
[NFC] prev.Iblock: 03 00 b0 00 02 14
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=a4 p1=04 p2=00 lc=8 le=256
[NFC] TX resp timeout. len: 6
[NFC] FIDO applet selected.
[NFC] prev.Iblock: 02 00 a4 04 00 08 a0 00 00 06 47 2f 00 01 00
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=02 p1=03 p2=00 lc=97 le=256
[NFC] U2F Authenticate command.
[EXT] Ignoring U2F auth request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[NFC] U2F resp len: 2
[NFC] U2F Authenticate processing 1448539 (took 2)
[NFC] U2F Authenticate answered 1448539 (took 134262857)
[NFC] prev.Iblock: 02 00 02 03 00 61 98 cc 08 90 3d 9f 60 24 26 ca 83 af 52 bb d1 52 0a ce 4d 55 6a 35 84 b6 fb 8c dd a8 5f 8d 8a 99 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 20 fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48 00
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=02 p1=03 p2=00 lc=97 le=256
[NFC] U2F Authenticate command.
[EXT] Ignoring U2F auth request
fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48
[U2F] U2F Error code 6a80
[U2F] u2f resp: 6a 80
[NFC] U2F resp len: 2
[NFC] U2F Authenticate processing 1448588 (took 1)
[NFC] U2F Authenticate answered 1448588 (took 134262857)
[NFC] prev.Iblock: 02 00 02 03 00 61 98 cc 08 90 3d 9f 60 24 26 ca 83 af 52 bb d1 52 0a ce 4d 55 6a 35 84 b6 fb 8c dd a8 5f 8d 8a 99 70 61 7d fe d0 65 86 3a f4 7c 15 55 6c 91 79 88 80 82 8c c4 07 fd f7 0a e8 50 11 56 94 65 a0 75 20 fd eb 81 aa 93 c2 3f 92 8f 07 d8 52 a3 dd 65 fe 5c 2c 68 ee 7f 28 08 30 8e c2 52 79 0c 9a e4 48 00
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=02 p1=03 p2=00 lc=135 le=256
[NFC] U2F Authenticate command.
[EXT] Ignoring U2F auth request
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00
[U2F] u2f resp: 6a 80
[NFC] U2F resp len: 2
[NFC] U2F Authenticate processing 1448641 (took 1)
[NFC] U2F Authenticate answered 1448641 (took 134262857)
[NFC] prev.Iblock: 03 00 02 03 00 87 98 cc 08 90 3d 9f 60 24 26 ca 83 af 52 bb d1 52 0a ce 4d 55 6a 35 84 b6 fb 8c dd a8 5f 8d 8a 99 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 46 8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00 00
[NFC] Buffer being updated!
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=02 p1=03 p2=00 lc=135 le=256
[NFC] U2F Authenticate command.
[EXT] Ignoring U2F auth request
8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00
[U2F] u2f resp: 6a 80
[NFC] U2F resp len: 2
[NFC] U2F Authenticate processing 1448701 (took 1)
[NFC] U2F Authenticate answered 1448702 (took 134262857)
[NFC] prev.Iblock: 02 00 02 03 00 87 98 cc 08 90 3d 9f 60 24 26 ca 83 af 52 bb d1 52 0a ce 4d 55 6a 35 84 b6 fb 8c dd a8 5f 8d 8a 99 70 61 7d fe d0 65 86 3a f4 7c 15 55 6c 91 79 88 80 82 8c c4 07 fd f7 0a e8 50 11 56 94 65 a0 75 46 8a 6d 25 3e a5 c3 64 44 17 ae 0a 72 02 1d d6 4c b9 bd 42 b0 d8 f1 c9 f3 db 95 cc 8c 76 7d 50 5b c5 73 3a eb 00 24 60 38 1c 6f 25 8e 83 95 d3 02 6f 57 1f 0d 9a 76 48 8d cd 83 76 39 b1 3a ed 31 65 60 4c 01 00 00 00
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] -----
[NFC] apdu ok. case=04 cla=00 ins=02 p1=03 p2=00 lc=113 le=256
[EXT] Ignoring U2F auth request
e0 6d ba 31 88 53 19 df 1c 99 ab b8 2d d8 5e 90 3a b2 31 aa d5 87 e6 63 20 85 58 91 fe df 83 b5 f2 99 5c 64 5b 23 f6 0a 2c 04 e0 2e 96 11 dd 69
[U2F] sha256: bb a9 c0 88 ab 09 4f 5e 3a 48 ab eb e8 51 00 81 85 e8 ad 6d 96 53 60 e2 d9 1b 7e 94 bc a8 79 34
[U2F] u2f resp: 01 00 00 01 56 30 44 02 20 20 b9 f8 c4 97 5c d9 11 2c c3 ee 34 44 26 1c 25 fb d5 59 24 b5 5f 4c 1d a7 6a 31 d2 47 5e ba f2 02 20 47 27 f1 ba 86 14 ac c4 93 82 a4 a2 24 ca 24 65 78 52 8e e8 d2 9f 8f e3 80 61 a1 cf 9e a9 8c 4e 90 00
[NFC] U2F Authenticate answered 1448919 (took 134262857)
[NFC] prev.Iblock: 03 00 02 03 00 71 20 b9 f8 c4 97 5c d9 11 2c c3 ee 34 44 26 1c 25 fb d5 59 24 b5 5f 4c 1d a7 6a 31 d2 47 5e ba f2 47 27 f1 ba 86 14 ac c4 93 82 a4 a2 24 ca 24 65 78 52 8e e8 d2 9f 8f e3 80 61 a1 cf 9e a9 8c 4e 30 e0 6d ba 31 88 53 19 df 1c 99 ab b8 2d d8 5e 90 3a b2 31 aa d5 87 e6 63 20 85 58 91 fe df 83 b5 f2 99 5c 64 5b 23 f6 0a 2c 04 e0 2e 96 11 dd 69 00
[NFC] -----
[NFC] NFC_CMD_RBLOCK
It looks like the problem is the credential is registered with FIDO2 (and has a FIDO2 keyID), and then on Linux or Android, U2F is used with the FIDO2 keyID. KeyID/credentialID is defined by the authenticator to identify a particular credential.
For Solo, FIDO2 and U2F Credential ID's are not the same.
FIDO2 & U2F keyIDs should work when used for FIDO2, but only U2F keyIDs work for U2F. I'm not sure if I should update Solo U2F to handle FIDO2 keyIDs... I don't see why not.
conorpp
on 30 Aug 2019
👍1
If you're using a key to register and authenticate on GitHub right now, all the operations use WebAuthn. We don't purposely convert the key, and we shouldn't be falling back to the U2F API.
I've ordered a Solo key, so I should hopefully be able to test soon.
lgarron
on 4 Sep 2019
🎉1
One Edge keys are working which are newly registered, but they no longer work with Firefox.
Already registered keys work with Firefox, but not with Edge.
JackGruber
on 4 Sep 2019
Similar problem here. Registered multiple Solo Secure USB-A under Win7/Chrome with github. Tried to login in Firefox 69 (Win or Linux), does not work. Tested with the Solo Hacker, Firefox uses the U2F API to talk to the Solo Key.
For testing:
Register key in Firefox, U2F is used
- Auth via Firefox: Uses U2F -> Works
- Auth via Chrome: Uses CTAP1 over WebAuthn -> Works
Register key in Chrome, FIDO2 is used
- Auth via Firefox: Uses U2F -> Error
- Auth via Chrome: Uses FIDO2 -> Works
[U2F] key handle + appid not authentic
[U2F] calc tag:
89 f1 6b 0e f4 40 a8 c8 dd 0f c4 ed 04 4d ff a7
48 68 ef e0 e0 9b 7a 42 7f ec 2c ac f1 e3 73 01
@conorpp
So this seems to be a problem of Firefox, not using Webauthn.
Is there any way to make it upwards compatible as you mentioned? (U2F -> FIDO2 Key?)
elratt0r
on 11 Sep 2019
I finally got a Solo key in the mail! 😄
I was able to reproduce this:
- Register in Chrome:
- Auth works in Chrome, re-registration blocked in Chrome
- Auth fails in Firefox, re-registration succeeds in Firefox
- Register in Firefox:
- Auth works in Firefox, re-registration blocked in Firefox
- Auth works in Chrome, re-registration blocked in Chrome
I haven't tried to dig into the internals, but I believe this is consistent with Firefox using FIDO U2F to talk to the Solo key while Chrome uses FIDO2/CTAP2. (We only call the WebAuthn API from Javascript.)
lgarron
on 26 Sep 2019
Interesting considering the fact that Firefox got Webauthn (and FIDO 2) support first, and I believe u2f is there just because of backwards compatibility requirements :D
EDIT:
Are you sure you have security.webauth.webauthn and security.webauth.webauthn_enable_usbtoken enabled in about:config in Firefox? Because it seems to register FIDO2 for me with these settings on.
EDIT 2: And the problem seems to be that at least for some users Android doesn't want to use FIDO2 with GitHub, so the fact that depending on settings Firefox permits registration using u2f at best provides a workaroud :)
oplik0
on 26 Sep 2019
Note: in my comment above I'm actually just on "desktop" (macOS) for both browsers using their latest versions — that's enough to exhibit the incompatibility.
Are you sure you have
security.webauth.webauthnandsecurity.webauth.webauthn_enable_usbtokenenabled inabout:configin Firefox? Because it seems to register FIDO2 for me with these settings on.
These are enabled!
Is there an easy way to poke into the internals to see if FIDO2 is being used?
In any case, it's looking less like RPs can do anything to fix this, so I don't think I'll keep debugging this myself. But I'm happy to run some tests or update GitHub's WebAuthn code to be compatible if someone determines what is needed.
lgarron
on 1 Oct 2019
I've verified with @jcjones that:
Firefox on MacOS supports WebAuthn level 1 with security keys that implement CTAP1.
... but Firefox on macOS doesn't support CTAP2 yet.
I don't know specifically of a browser on Windows/Android/Linux that only implements CTAP1 (Firefox implements CTAP2 on Android and with Windows Hello, I believe).
If I understand correctly, there's nothing that RPs (websites) can do to be compatible with Solo keys on all platforms using WebAuthn.
lgarron
on 11 Oct 2019
I can confirm that 26db2b3f6b7f72e3461e547ef3c6c598418d6e9a fixed the problem.
Have tested it back and forth so far with Windows/Linux/Android and Firefox/Chrome.
Thanks @conorpp for fixing/enhancing this!
elratt0r
on 13 Oct 2019
👍2
Thank you for checking it! Will release official update soon.
conorpp
on 13 Oct 2019
I can also confirm that #323 fixed the issue (tested on 3.0.0 ). I think I can close this issue now.
oplik0
on 29 Oct 2019
Was this page helpful?
0 / 5 - 0 ratings
Related issues
craftyguy
·
10Comments
Frederick888
·
8Comments
conorpp
·
3Comments
Wesseldr
·
8Comments
tscs37
·
7Comments
Most helpful comment
I can confirm that 26db2b3f6b7f72e3461e547ef3c6c598418d6e9a fixed the problem.
Have tested it back and forth so far with Windows/Linux/Android and Firefox/Chrome.
Thanks @conorpp for fixing/enhancing this!