Yubico / python-fido2

Provides library functionality for FIDO 2.0, including communication with a device over USB.
BSD 2-Clause "Simplified" License
432 stars 109 forks source link

secret retrieval part of `hmac_secret.py` example doesn't work with GoTrust Idem webauthn key #183

Open glyph opened 1 year ago

glyph commented 1 year ago

This is on main as of 54cee2216a065620b04d0a4d6c75ecb2b506feda.

This could be a hardware bug in the GoTrust key, but attempting to run the example yields this:

Touch your authenticator device now...

New credential created, with the HmacSecret extension.
Authenticate with salt: <big hex key>

Touch your authenticator device now...

Traceback (most recent call last):
  File "/Users/glyph/Projects/python-fido2/fido2/client.py", line 836, in get_assertion
    return self._backend.do_get_assertion(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/glyph/Projects/python-fido2/fido2/client.py", line 683, in do_get_assertion
    assertions = self.ctap2.get_assertions(
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/glyph/Projects/python-fido2/fido2/ctap2/base.py", line 439, in get_assertions
    first = self.get_assertion(*args, **kwargs)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/glyph/Projects/python-fido2/fido2/ctap2/base.py", line 411, in get_assertion
    self.send_cbor(
  File "/Users/glyph/Projects/python-fido2/fido2/ctap2/base.py", line 241, in send_cbor
    raise CtapError(status)
fido2.ctap.CtapError: CTAP error: 0x14 - MISSING_PARAMETER

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/glyph/Projects/python-fido2/examples/hmac_secret.py", line 108, in <module>
    result = client.get_assertion(
             ^^^^^^^^^^^^^^^^^^^^^
  File "/Users/glyph/Projects/python-fido2/fido2/client.py", line 845, in get_assertion
    raise _ctap2client_err(e)
fido2.client.ClientError: (<ERR.BAD_REQUEST: 2>, CtapError('CTAP error: 0x14 - MISSING_PARAMETER'))

Perhaps someone with more experience with the CTAP2 or webauthn specs can decipher this faster than I am able to.