fido-alliance / conformance-test-tools-resources

Certification Test Tools Resources. For security and privacy related issues email tools@certification.fidoalliance.org
https://fidoalliance.org/certification/functional-certification/conformance/
40 stars 14 forks source link

Supporting Reset on NFC and BLE is optional #737

Closed jovasco closed 2 months ago

jovasco commented 9 months ago

By submitting this issue you are acknowledging that any information regarding this issue will be publicly available.

If you have privacy concerns, please email conformance-tools@fidoalliance.org

FIRST PRE CHECK

What protocol are you implementing?

NOTE: UAF 1.0 certification have been officially sunset. U2F 1.2 only supported version of U2F.

What is your implementation class?

If you are platform authenticator vendor, please email conformance-tools@fidoalliance.org

What is the version of the tool are you using?

All versions are affected.

What is the OS and the version are you running?

For desktop tools

For UAF mobile tools

Issue description

Supporting the Reset command is optional on NFC and BLE See spec. However, if you do not support the reset command on those transports, you cannot get past the tests.

yackermann commented 9 months ago

Just clarify: It is optional if you support any other transport that supports reset:

However this command MUST be supported on at least one transport. If the USB HID transport is supported then this command MUST be supported on that transport.

So if your device does support ONLY NFC or ONLY BLE then reset must be supported.

In other cases it can be supported by only one transport.

Yuriy Ackermann FIDO, Identity, Standards skype: ackermann.yuriy github: @herrjemand https://github.com/herrjemand twitter: @herrjemand https://twitter.com/herrjemand medium: @herrjemand @.***>

On Tue, 5 Dec 2023 at 22:38, Johan Verrept @.***> wrote:

By submitting this issue you are acknowledging that any information regarding this issue will be publicly available.

If you have privacy concerns, please email @.*** FIRST PRE CHECK

What protocol are you implementing?

  • FIDO2 Server
  • CTAP2.0
  • CTAP2.1
  • UAF 1.1
  • U2F 1.1
  • U2F 1.2

NOTE: UAF 1.0 certification have been officially sunset. U2F 1.2 only supported version of U2F. What is your implementation class?

  • Security Key / FIDO2 / U2F authenticators
  • Server
  • UAF Client-ASM-Authenticator combo
  • UAF Client
  • UAF ASM-Authenticator

If you are platform authenticator vendor, please email @.*** What is the version of the tool are you using?

All versions are affected. What is the OS and the version are you running?

For desktop tools

  • OSX
  • Windows
  • Linux

For UAF mobile tools

  • iOS
  • Android

Issue description

Supporting the Reset command is optional on NFC and BLE See spec https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorReset . However, if you do not support the reset command on those transports, you cannot get past the tests.

— Reply to this email directly, view it on GitHub https://github.com/fido-alliance/conformance-test-tools-resources/issues/737, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAMPOFHAPRE3M7KVCAFRILLYH3TQVAVCNFSM6AAAAABAHLVSASVHI2DSMVQWIX3LMV43ASLTON2WKOZSGAZDKNZWGQZTENY . You are receiving this because you are subscribed to this thread.Message ID: @.***>

jovasco commented 9 months ago

That is correct, Yuriy, but the tests currently assume that if you want to test NFC/BLE, reset over NFC/BLE works too. I am aware this isn't an easy thing to solve...

iirachek commented 3 months ago

The v1.7.20 build with a fix for this is available for download. You will find a new option to enable reset over HID below the Fido Authenticators list.

Check the Use HID for reset checkbox, then connect your authenticator over HID and select it in the Reset Transport list before starting the tests.

image