"Windows Hello" authenticator on Win 11 FIDO Metadata validation alg mismatch issue #393
Replies: 1 comment 1 reply
-
|
Hello @WorldThirteen, you've certainly done your research! I agree with you that this is likely ("simply") FIDO MDS metadata for the Windows Hello AAGUID falling out of sync with the reality of Windows' evolution. If you want to continue to push this forward then I'd say your best bet is to post about this to the fido-dev mailing list and ask when the metadata will get updated to reflect the use of ES256 in Windows: https://groups.google.com/a/fidoalliance.org/g/fido-dev I'm happy to ask there on your behalf as well, it just might take me a few days to get to it. |
Beta Was this translation helpful? Give feedback.
-
|
Letting @timcappalli know about this thread as he encountered it also. |
Beta Was this translation helpful? Give feedback.
-
This topic might seem similar to the #238, but I believe it is most likely a different problem, I've tried to include as much info as requested in #238 (comment).
Brief story
There was a laptop with Win 10 installed, which successfully configured the passkey using SimpleWebAuthn-powered service.
Then Windows was updated to Windows 11 on the same device, and an error occurred trying to re-create the passkey using this service. Direct attestation is requested, and the default FIDO MDS is enabled.
The issue appears in the attestation validation with metadata:
After a brief investigation there is the following information:
08987058-cadc-4b81-b6e1-30de50dcbe96;rsassa_pkcsv15_sha256_raw, as correctly and pretty informative displayed in the error above (link for short reaching the FIDO MDS statements https://opotonniee.github.io/fido-mds-explorer);SimpleWebAuthn/packages/server/src/metadata/verifyAttestationWithMetadata.ts
Lines 64 to 116 in 0ab19d8
└── @simplewebauthn/[email protected];Additional data:
The WebAuthn registration request request
{ "challenge": "REDACTED", "rp": { "name": "REDACTED", "id": "REDACTED" }, "user": { "id": "REDACTED", "name": "REDACTED", "displayName": "REDACTED" }, "pubKeyCredParams": [ { "alg": -8, "type": "public-key" }, { "alg": -7, "type": "public-key" }, { "alg": -257, "type": "public-key" } ], "timeout": 60000, "attestation": "direct", "excludeCredentials": [ { "id": "zo54gozOFyRO-LRqTckVzw", "type": "public-key", "transports": [ "hybrid", "internal" ] } ], "authenticatorSelection": { "residentKey": "preferred", "userVerification": "required", "requireResidentKey": false }, "extensions": { "credProps": true } }Attestation object
Attestation object Parsed into JSON representation
{ "fmt": "tpm", "attStmt": { "alg": "RS1 (-65535)", "sig": "Naw3FmGXKhJHVafA_7rc_1ZfQf1IcDddite7x6viEoltTuZY_4faX5pV4mEtZs6Vi_VpHlbRAMVwym8hTRNOOT73uXzHmFXRLe8vWrSJUPcX-d_TLL6Y-_6M-r-t4XULt0sjBUyiFbEsZCbD6oTSC_Pb7RKCw42t3eUHHGAKTF0uugJwOZ35Pq8ABAlgpQhqHgR1zG9uqha41HZIRWO_atyE5WzvThshZVI9v0f_kJ_cBOd547zDSMnKZ6GLyGZqak8WPVmeG8lIP_AJzA6xe8-TPdWiXcue2a2wHc_fULchnN_I000qK6pouFgYhKGNU09nI3AIdxTP8vz_L0JFyg", "x5c": [ { "tbsCertificate": { "version": 2, "serialNumber": REDACTED SINCE TOO LONG, "signature": { "algorithm": "1.2.840.113549.1.1.11", "parameters": null }, "issuer": [ [ { "type": "2.5.4.3", "value": { "printableString": "EUS-INTC-KEYID-B066D9697F5D3A07B425C10F587CCEECF16FFE58" } } ] ], "validity": { "notBefore": { "utcTime": "2023-06-08T09:12:51.000Z" }, "notAfter": { "utcTime": "2027-06-03T17:51:05.000Z" } }, "subject": [], "subjectPublicKeyInfo": { "algorithm": { "algorithm": "1.2.840.113549.1.1.1", "parameters": null }, "subjectPublicKey": REDACTED SINCE TOO LONG } "extensions": [ { "extnID": "2.5.29.15", "critical": true, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.19", "critical": true, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.32", "critical": true, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.37", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.17", "critical": true, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.35", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.14", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "1.3.6.1.5.5.7.1.1", "critical": false, "extnValue": { "buffer": {} } } ] }, "signatureAlgorithm": { "algorithm": "1.2.840.113549.1.1.11", "parameters": null }, "signatureValue": REDACTED SINCE TOO LONG }, { "tbsCertificate": { "version": 2, "serialNumber": REDACTED SINCE TOO LONG, "signature": { "algorithm": "1.2.840.113549.1.1.11", "parameters": null }, "issuer": [ [ { "type": "2.5.4.6", "value": { "printableString": "US" } } ], [ { "type": "2.5.4.8", "value": { "printableString": "Washington" } } ], [ { "type": "2.5.4.7", "value": { "printableString": "Redmond" } } ], [ { "type": "2.5.4.10", "value": { "printableString": "Microsoft Corporation" } } ], [ { "type": "2.5.4.3", "value": { "printableString": "Microsoft TPM Root Certificate Authority 2014" } } ] ], "validity": { "notBefore": { "utcTime": "2021-06-03T17:51:05.000Z" }, "notAfter": { "utcTime": "2027-06-03T17:51:05.000Z" } }, "subject": [ [ { "type": "2.5.4.3", "value": { "printableString": "EUS-INTC-KEYID-B066D9697F5D3A07B425C10F587CCEECF16FFE58" } } ] ], "subjectPublicKeyInfo": { "algorithm": { "algorithm": "1.2.840.113549.1.1.1", "parameters": null }, "subjectPublicKey": REDACTED SINCE TOO LONG }, "extensions": [ { "extnID": "2.5.29.15", "critical": true, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.37", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.32", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.19", "critical": true, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.14", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.35", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "2.5.29.31", "critical": false, "extnValue": { "buffer": {} } }, { "extnID": "1.3.6.1.5.5.7.1.1", "critical": false, "extnValue": { "buffer": {} } } ] }, "signatureAlgorithm": { "algorithm": "1.2.840.113549.1.1.11", "parameters": null }, "signatureValue": REDACTED SINCE TOO LONG } ], "ver": "2.0", "certInfo": "_1RDR4AXACIAC7AY3Ihe-OUMs04wzBZm7WTtFXGJ-jXMGKwzJBDamyuNABSlMpSIW1AfZcZIHNwWhcSJoqoYLgAAAAA2zfyKiv86o2DwdQkBUGOr1g3Gnd8AIgAL9YG_M_u2MDikluUqaC3fM5oMULsjKeTI-F35_mEYDj4AIgALn1bHzPvJ00kpZQQ5IRF95vsVpfGyJZ1Pxm9Q90TF6s4", "pubArea": "ACMACwAEAHIAIJ3_y_NsODrmmfuYaNxty4nXFTiEvigDkiwSQVi_rSKuABAAEAADABAAIGxNSHLCi54-Ey_FtT3PKY0BRhLY0mnf-BgfNXXPD4QbACBjeDmnHy1TMeqwWeESYQxJwW9Lnv6-8f-Foy3ktQ2qtA" }, "authData": { "rpIdHash": "B98cvlVg0pb4iFdppy0yWgTbbCDYP9NbL70XzcM2zN4", "flags": { "userPresent": true, "userVerified": true, "backupEligible": false, "backupStatus": false, "attestedData": true, "extensionData": false }, "counter": 0, "aaguid": "08987058-cadc-4b81-b6e1-30de50dcbe96", "credentialID": "AS2zpcqF6j7z3xTekAzCckR4dD61Gaqar5wRm1eJc-o", "credentialPublicKey": "pQECAyYgASFYIGxNSHLCi54-Ey_FtT3PKY0BRhLY0mnf-BgfNXXPD4QbIlggY3g5px8tUzHqsFnhEmEMScFvS57-vvH_haMt5LUNqrQ", "parsedCredentialPublicKey": { "keyType": "EC2 (2)", "algorithm": "ES256 (-7)", "curve": 1, "x": "bE1IcsKLnj4TL8W1Pc8pjQFGEtjSad_4GB81dc8PhBs", "y": "Y3g5px8tUzHqsFnhEmEMScFvS57-vvH_haMt5LUNqrQ" } } }I am not familiar with the all procedures required to update the metadata statement in FIDO, so I could be missing something here. I also found out @MasterKale's mention that Windows Hello starting using ES256 here: w3c/webauthn#1757 (comment).
Asking for community help to understand the nature of the issue. I would also appreciate hints of potential mitigation.
Beta Was this translation helpful? Give feedback.
All reactions