search

shimunn / fido2luks

Decrypt your LUKS partition using a FIDO2 compatible authenticator
Mozilla Public License 2.0
131 stars 18 forks source link

fido2luks can't find Nitrokey 3A NFC #51

Open intr-cx opened 1 year ago

intr-cx commented 1 year ago

Hi, Thank you for creating and maintaining fido2luks.

I've successfully used it with the Nitrokey FIDO2, however the Nitrokey 3A NFC - which supports fido2 - is not detected. Using fido2luks connected returns nothing with exit code 1, and fido2luks credential hangs indefinitely. My Rust knowledge is very limited, but I'd like to help get this resolved. I've tried running https://github.com/shimunn/ctap/blob/f982494d5158062b7ebb9f84cd04f28d2be36ce7/examples/hmac.rs but it panics at line 17 with 'No authenticator found'. However, testing the same device on something like https://webauthn.io/ works fine. If more information is needed I'll do my best to provide it.

robin-nitrokey commented 1 year ago

I suspect that this is caused by a bug in the USB descriptor parsing in the ctap/ctap_hmac crate. See https://github.com/trussed-dev/usbd-ctaphid/issues/1#issuecomment-1430148638 for more information.

I’ve prepared a patch for the ctap and ctap_hmac crates that fixes device enumeration for my NK3CN. You can use the new list example to test it (cargo run --example list). I haven’t tested fido2luks with it, but this should at least let it detect the device.

https://github.com/ArdaXi/ctap/pull/5 https://github.com/shimunn/ctap/pull/8

intr-cx commented 1 year ago

Hi @robin-nitrokey

I've cloned and built your PR and ran the list example, and it indeed detects it!