[Windows 10 22H2 and Windows 11, MacOS 14] fido2-cred does not work

[akallabeth]

With the most recent versions of windows and mac os the following fails: (did reuse the same cred_param file for all os tests)

echo credential challenge | openssl sha256 -binary | base64 > cred_param
echo relying party >> cred_param
echo user name >> cred_param
dd if=/dev/urandom bs=1 count=32 | base64 >> cred_param
fido2-cred -M -i cred_param /dev/hidraw5 | fido2-cred -V -o cred

I did test this with previous versions of Mac OS and windows and it did work just like in the manpage.
so, do I miss something or did the passkey support of these OS break something?

[LDVG]

Hi,

You're likely seeing this because the windows://hello backend only supports raw client data and not a client data hash. We recently introduced a new option (still unreleased) for fido2-cred -M and fido2-assert -G intended to make these tools usable under windows://hello. Please see pull request #707 and the related discussion in #699 (reply in thread).

[akallabeth]

ouch, that is a bummer :/
so, in short, if I need to use fido2_set_clientdata_hash that will not work on windows at all?

[LDVG]

On the windows://hello backend, that is correct, unfortunately. When running as an administrator, you should still be able to use the client data hash over the HID backend.

[LDVG]

I just noticed that you mentioned MacOS though, it certainly should still work as documented in the man page.

[akallabeth]

yes, that can be ignored, looks like a transient glitch after an update (worked again after reboot)

[LDVG]

OK! Thanks. 🙂