u2f | Go packages that provide communication | Binary Executable Format library

• I've read in multiple places that since U2F doesn’t have a concept of a user it can be used as one of the factors for login (in MFA) but not ideal for passwordless whereas webauthn has the concept of users which could help with passwordless. My question is what is that extra that webauthn adds to allow this? Yes, we do pass user information when we create the credentials but in the end we're returned a credential id (which seems to be very similar to the keyhandle) and is used to associate the user (on the server). For what i understand, webauthn def has the advantage of working with different authenticators (not just U2F keys) but apart from that what exactly does webauthn add to make passwordless easier.

• CTAP describes how the browser and operating system establish communications with a compliant authentication device over USB, NFC or BLE communication mediums. Could we say CTAP is an application layer protocol (like FTP?)

• When i use the finger print feature on my android phone to verify using webauthn, is the browser communicating with the OS (which in turn pops up the authenticator) using CTAP2? Where does ufc, nfc, ble, internal come up here?

• Here is a diagram for browser support for webauthn. In chrome/android, what does it mean to have stable support for WebAuthnAPI but In development support for CTAP2? Does it mean some authenticators wont be supported?

I'm currently experiencing issues generating a U2F public/private key-pair in the terminal with the following command:

ssh-keygen -t ecdsa-sk -vv

Running this command provides the following error:

I'm on my localhost and when i start the server it shows nothing. When i go to localhost:8080/register it should show "asdasd" (as you can see in the code) but it doesnt work. Can you guys help me out? Thank you very much!

I'm using my yubikey 5 NFC with U2F as well as for OTP codes. I get OTP codes using Yubico Authenticator app which seems to be a little too complicated and I was wondering if there is a way to assign it to short/long touch on my key so I don't need to open that app every time for codes I use often enough?

It seems that the authenticator uses something else than slots to store credentials, is it possible to read them with ykman or some other official command line utility/sdk?

There are many sources that say FIDO2/CTAP2 is backward compatible with U2F:

...all previously certified FIDO U2F Security Keys and YubiKeys will continue to work as a second-factor authentication login experience with web browsers and online services supporting WebAuthn. - Yubico

But after looking at the specifications, I'm having trouble seeing how that actually works in practice. Specifically, it seems like there is a mismatch between FIDO2's relying party identifier and U2F's application identity.

In U2F, the application identity is a URL, like https://example.com. SHA-256 of the application identity is called the application parameter. The application parameter is what is actually sent to the authenticator during registration and authentication.

In FIDO2, the equivalent seems to be the relying party identifier, which is defined to be a domain name, like example.com.

The relying party identifier and the application identity serve the same purpose in both FIDO2/CTAP2 and U2F. However, CTAP2 authenticators get the relying party identifier directly as an UTF8 string, whereas U2F authenticators only get a SHA-256 hash of the application identity (the application parameter).

The FIDO documentation for CTAP describes how CTAP2 maps onto CTAP1/U2F. In it, they simply treat the relying party identifier directly as the application identity:

Let rpIdHash be a byte array of size 32 initialized with SHA-256 hash of rp.id parameter as CTAP1/U2F application parameter (32 bytes)

This seems inconsistent. Let's say I were example.com, and I adopted U2F second-factor authentication early on. My application id would be https://example.com, so my original U2F application parameter would be SHA256("https://example.com"):

I've been investigating the implementation of CTAP2 protocol with Google Chrome (protocol between Fido Authenticator and Fido Client (e.g. Chrome)), which should be supported in Chrome since version 69.

So I dumped the chrome request to the authenticator in two cases:

Here everything goes as expected and chrome follows the CTAP1 protocol.

And the browser has a strange behaviour:

• It starts by following the CTAP2 protocol by sending a AuthenticatorGetInfoRequest
• The Authenticator replies with AuthenticatorGetInfoResponse
• But then Chrome switches to the CTAP1 protocol by sending a Registration Request Message (U2F_REGISTER)

Is it a problem with Chrome implementation: CTAP2 is not enabled entirely yet (it seems to be implemented in Chromium sources)?

Or is the problem coming from the authenticator: sending a response that makes Chrome switch to CTAP1?

Or something else entirely?

I am working on a chrome extension to modify U2F create request parameters from a web service. Is it possible to replace navigator.credentials.create request or response parameters through a Chrome extension? I couldn't find resources related to this. Any pointers would be helpful.

In particular, when a user registers a U2F for a website, it calls browsers web API navigator.credentials.create which in turn contacts the hardware token and returns the response. I want to modify the request and response from the navigator.credentials.create API, called by the webpage.

I've recently started looking at U2F in Node.js and Javascript. I get the error: TypeError: Cannot read property 'registerResponse' of undefined

Before receiving the error on the server i get the following returned:

I am building an Android authenticator for FIDO2. I got stuck with read/write characteristics. I am working on Mac - Chrome 75. Chrome can detect my Android BLE authenticator. After detecting my BLE Authenticator, onCharacteristicReadRequest() is called from authenticator side. Inside the onCharacteristicReadRequest() I am using the code written below but there is no response from client after that.

I have tried U2F with version 0b01000000. It's working fine. When I moved FIDO2 version 0b100000, I am facing this issue. I am advertising fido service and device info service from authenticator. Both services has been added with Thread.sleep(1000) interval. I couldn't add both services sequentially. When I add both services sequentially, I am getting ArrayIndexOutofBoundException.

I don't know if both issues are interlinked. Please correct me if I am doing anything wrong.