fido2-assert multiple credentials?

[gbdlin]

Hello, is there any way to use fido2-assert command with multiple credentials, so the whole FIDO2 machinery will figure out the one credential that matches to a plugged in Yubikey?

[LDVG]

Hi,

When getting an assertion, you typically use the credential ID to identify a credential that your RP knows of.

If you're using non-discoverable credentials, you reach for fido_assert_allow_cred(3) and supply the credential ID(s) to the authenticator, which will figure out which ones it knows of, if any. Authenticators are typically limited in the number of credential IDs they can receive though; the client may need to chunk the request and use pre-flighting to improve the user experience.

For discoverable credentials, you don't need to supply any credential ID up front. Instead, the authenticator will return a list of assertions and it's up to the client to prompt the user to select which credential to pass on to the RP. Having done so, the RP can match the credential ID using its user database.

(Note that several steps for verifying the assertion has been omitted above. 🙂)

[gbdlin]

Thank you for your response. Is using multiple credential IDs possible with fido2-assert command line tool directly, or do I need to write my own tool to do that?

And if it's not currently possible, can we discuss implementing it?

[gbdlin]

One more question: how does pre-flighting work with authenticators having alwaysUv enabled?

[LDVG]

Thank you for your response. Is using multiple credential IDs possible with fido2-assert command line tool directly, or do I need to write my own tool to do that?

No, fido2-assert only allows for a single credential ID at a time (sorry for misunderstanding your initial question!) . You could loop call it in a loop over your set of credential IDs though. We usually refer to the library if one needs more complex behavior, but ideas are always welcome.

One more question: how does pre-flighting work with authenticators having alwaysUv enabled?

It depends on the authenticator implementation, refer to CTAP 2.2 § 7.2.3, step 1.3.