lbuchs / WebAuthn

A simple PHP WebAuthn (FIDO2/Passkey) server library
https://webauthn.lubu.ch
MIT License
419 stars 75 forks source link

Yubico Security key C, public key not in OKP format #85

Closed OH1KK closed 4 months ago

OH1KK commented 5 months ago

I am using Yubico Security key C NFC dongle. When I try to register test site https://webauthn.lubu.ch/_test/client.html, registeration start but when I press dongle button, an error message pop's up: public key not in OKP format. What this error message actually means? Do I have unsupported dongle, or is this bug in software?

This is what happens when I try to register. From Firefox web developer console

Request 1 { "GET": { "scheme": "https", "host": "webauthn.lubu.ch", "filename": "/_test/server.php", "query": { "fn": "getCreateArgs", "apple": "0", "yubico": "0", "solo": "0", "hypersecu": "0", "google": "0", "microsoft": "0", "mds": "1", "requireResidentKey": "0", "type_usb": "1", "type_nfc": "1", "type_ble": "1", "type_int": "1", "type_hybrid": "1", "fmt_android-key": "1", "fmt_android-safetynet": "1", "fmt_apple": "1", "fmt_fido-u2f": "1", "fmt_none": "0", "fmt_packed": "1", "fmt_tpm": "1", "rpId": "webauthn.lubu.ch", "userId": "64656d6f64656d6f", "userName": "demo", "userDisplayName": "Demo Demolin", "userVerification": "discouraged" }, "remote": { "Address": "149.126.4.64:443" } } }

Response 1 { "publicKey": { "rp": { "name": "WebAuthn Library", "id": "webauthn.lubu.ch" }, "authenticatorSelection": { "userVerification": "discouraged" }, "user": { "id": "=?BINARY?B?ZGVtb2RlbW8=?=", "name": "demo", "displayName": "Demo Demolin" }, "pubKeyCredParams": [ { "type": "public-key", "alg": -8 }, { "type": "public-key", "alg": -7 }, { "type": "public-key", "alg": -257 } ], "attestation": "direct", "extensions": { "exts": true }, "timeout": 240000, "challenge": "=?BINARY?B?yNv2za3CuCgkhu3VFu1jk9YBtO88VLTNzcYwdZ/GLCI=?=", "excludeCredentials": [] } }

Now I press button on Yubikey.

Request 2 payload { "attestationObject": "o2NmbXRmcGFja2VkZ2F0dFN0bXSjY2FsZyZjc2lnWEgwRgIhAKmFZT6t08xxZhIqULa/xm995aQN4rPFciodA3dbGmQLAiEAkLY9p+6ZzGli/67hYkKECubzHQHR1maW0LrcCwTQHupjeDVjgVkC3TCCAtkwggHBoAMCAQICCQDhE/DOaad1tjANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZdWJpY28gVTJGIFJvb3QgQ0EgU2VyaWFsIDQ1NzIwMDYzMTAgFw0xNDA4MDEwMDAwMDBaGA8yMDUwMDkwNDAwMDAwMFowbzELMAkGA1UEBhMCU0UxEjAQBgNVBAoMCVl1YmljbyBBQjEiMCAGA1UECwwZQXV0aGVudGljYXRvciBBdHRlc3RhdGlvbjEoMCYGA1UEAwwfWXViaWNvIFUyRiBFRSBTZXJpYWwgMTMyNDM1NjU3NzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABL4S8HkkBOONLb4ZI3h2KJDjxLyQCPmDbqsIGQN9khxBiMovqoTqAozf2uDPEPWSGSfqLUDjSKTbAL/xn/rT76qjgYEwfzATBgorBgEEAYLECg0BBAUEAwUEAzAiBgkrBgEEAYLECgIEFTEuMy42LjEuNC4xLjQxNDgyLjEuMTATBgsrBgEEAYLlHAIBAQQEAwIEMDAhBgsrBgEEAYLlHAEBBAQSBBCk6fxtTL5HWLi6N1mLtbuqMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAKFFdI4wGosry72RLhLevYxrsPPvjR9eeJ8beXwiXnshcIMsf2vepcAb35rxwFVMXgy8Y4Ewr3TAHUHwteUJQzqVEzawoNg3ZzUDGFgHdPgQSZW7FP10PC6bI46brxo6LaecYMq2DF6XH7vV2P5sq9kY3dOg7KzHxYpuyfEecOjWo05PHLF4SAoob8BePEsgCBkdNdphOtj+Hq4ZWv3qU/MoYP4ibuVWx1YT0Fx7vHNGg7rZ9phYLvXFsGI1ZT63ne/xAEOL9RrjNhHRmb9QufBFSodDhfkw8vPFHDn00GHclS5UpYLr0HLEWog6UWbnpj9S4u9ijwTdD/Cw8GPVYGtoYXV0aERhdGFZAQfCJvU49b0SQN6LBSjJOAnX4+kUbh2WN5eh2pFfXkMb6EEAAAACpOn8bUy+R1i4ujdZi7W7qgCADE9Mhwzr216GDSRJ6e0wGFkHslim4NHHjAM4xsVMzHQ5lJYX5cTnLcaISrevFcfXfF6HU5/8dKeXXxzaX0UyHT6WB6h6ZLvFL1kZ9oQ5QxOf9Etiep73/THvASu9IAssWLu3bXVVNoRXdXVCcPPJVKTm5cvC8XcfOdF84RXytLajAWNPS1ADJyBnRWQyNTUxOSGYIBgoGFcPGGMYRxjIGG0Y/goYoxicGO0Y5RjmGNoYXhhnGOoYShgfBBiIGHsYlhi0GOAYGBhnDRhHGLYYaA==", "clientDataJSON": "eyJjaGFsbGVuZ2UiOiJ5TnYyemEzQ3VDZ2todTNWRnUxams5WUJ0Tzg4VkxUTnpjWXdkWl9HTENJIiwib3JpZ2luIjoiaHR0cHM6Ly93ZWJhdXRobi5sdWJ1LmNoIiwidHlwZSI6IndlYmF1dGhuLmNyZWF0ZSJ9", "transports": null }

Response 2 { "success": false, "msg": "public key not in OKP format" }

OH1KK commented 4 months ago

This seems to be fixed now. I was able to register and check login on https://webauthn.lubu.ch/_test/client.html