[HmFlashy]

Summary

Fixes FIDO2 / Passkey authentication in Firefox (authenticator-rs) and improves CTAP 2.1 / CTAPHID compliance for Chromium-based browsers when using linux-id (tested end-to-end with hardware TPM 2.0 + --auth fprintd against Google Passkeys on Linux).

Root Cause & Changes

1. Silent authenticatorGetAssertion pre-flight (options.up = false, CTAP 2.1 §6.2.2)

   • During WebAuthn sign-in with an allowList, Firefox first probes authenticators silently with options: {"up": false} to discover which token holds a matching credential before prompting the user.
   • Previously, handleGetAssertion ignored options.up and immediately invoked VerifyUser (blocking on fprintd / pinentry), causing Firefox's silent pre-flight to time out or consume a fingerprint touch prematurely.
   • Fix:
     • Parse options.up (defaulting to true).
     • Reject invalid up=false && uv=true combinations with CTAP2_ERR_INVALID_OPTION (0x2C).
     • When up == false, skip VerifyUser, clear UP/UV flags (0x00), and omit the user entity (response[4]) so PII is never leaked without user presence.
     • Check the resident credential cache (FindByRPID) first on allowList lookups to avoid an unnecessary TPM round-trip during pre-flight, and select the most recently saved resident credential when multiple exist for the same RP.

2. Dummy authenticatorMakeCredential blink probe (pinUvAuthParam, CTAP 2.1 §6.1.2 steps 2 & 4)

   • Firefox (rp.id = "make.me.blink") and Chromium (rp.id = ".dummy") send MakeCredential with a zero-length pinUvAuthParam (h"") to trigger a user-presence check and expect CTAP2_ERR_PIN_NOT_SET (0x35) when clientPin is not supported/set.
   • Previously, pinUvAuthParam was ignored and linux-id minted and stored a dummy credential returning StatusOK (0x00).
   • Fix:
     • For len(pinUvAuthParam) == 0, perform user-presence verification via VerifyUser and return StatusPinNotSet (0x35) without minting or persisting a credential.
     • For len(pinUvAuthParam) > 0, return StatusPinNotSet (0x35) immediately without prompting for user presence.

3. CTAPHID_CANCEL (0x11) & unknown command error framing (CTAPHID §11.2.9.1.4 & §11.2.9.1.6)

   • Previously, CTAPHID_CANCEL (0x11) hit default: in SoftToken.Run and wrote a 0x6D00 payload back on command 0x11, violating CTAPHID §11.2.9.1.4 ("CTAPHID_CANCEL has no response") and confusing browser HID state machines when cancelling sibling probes.
   • Fix: Ignore CmdCancel (0x11) without writing a response frame, echo CmdPing (0x01), and return CmdError (0x3F) with ERR_INVALID_CMD (0x01) for unknown CTAPHID commands.

Test Plan

• go test ./... passes, including 4 new unit tests:
  • TestRealWorld_FirefoxSilentPreFlightThenUVAssertion
  • TestGetAssertion_RejectUVTrueWithUPFalse
  • TestMakeCredential_ZeroLengthPinUvAuthParamBlinkProbe
  • TestMakeCredential_NonEmptyPinUvAuthParamRejectedWithoutUP
• Verified live on Manjaro Linux (KDE Plasma 6, TPM 2.0 /dev/tpmrm0, Goodix fingerprint sensor via --auth fprintd) registering and signing in with Passkeys on accounts.google.com in Firefox.