Yubico / yubikit-ios

Yubico Mobile iOS SDK - YubiKit
Apache License 2.0
198 stars 44 forks source link

Specifying YKFKeyFIDO2GetAssertionRequestOptionUV results in failure 100% of the time #9

Closed Brandon-T closed 4 years ago

Brandon-T commented 4 years ago

Steps to Reproduce:

  1. Add a YubiKey to Github account in settings -> security.

  2. Sign out of github.

  3. Go to the login page and enter credentions and hit log in.

  4. Tap "Use Security Key"

  5. a. If we send (login will fail):

assertionRequest.options = [
    YKFKeyFIDO2GetAssertionRequestOptionUP: true,
    YKFKeyFIDO2GetAssertionRequestOptionUV: false
 ]
  1. b. If we send (login will fail):

    assertionRequest.options = [
    YKFKeyFIDO2GetAssertionRequestOptionUP: true,
    YKFKeyFIDO2GetAssertionRequestOptionUV: true
    ]
  2. c. If we send (login will succeed):

assertionRequest.options = [
    YKFKeyFIDO2GetAssertionRequestOptionUP: true
]

Notice that in 5.c. the YKFKeyFIDO2GetAssertionRequestOptionUV option was removed.. However, documentation for this option says the default value is false so 5.a. should have worked..

Documentation below:

/*!
 @discussion
    The options provide a list of properties to influence authenticator operation when signing, as specified
    in in the table below. This parameter is optional.

    @code
    Key           | Default value      | Definition
    ----------------------------------------------------------------------------------------
    uv            | false              | user verification: Instructs the authenticator to
                                         require a gesture that verifies the user to complete
                                         the request. Examples of such gestures are fingerprint
                                         scan or a PIN.
    ----------------------------------------------------------------------------------------
    up            | true               | user presence: Instructs the authenticator to require
                                         user consent to complete the operation.
    @endcode
 */
@property (nonatomic, nullable) NSDictionary *options;