Simple files from examples directory do not work on Trezor model T about python-fido2 HOT 8 OPEN

So it seems like there are two issues here, that are potentially solvable in python-fido2.

1. Not all devices that advertise uv=True necessarily support clientPin. There should be an additional call to ClientPin.is_supported() guarding this line .
2. When "hmac-secret" extension is advertised, but "clientPin" is not, enter a fallback mode where the client can attempt to create a minimal ClientPin instance without throwing the "Not Supported" exception, just for the purposes of hmac-secret (it needs the connection's shared secret).

from python-fido2.

I agree with @ashleysommer's assessment. The assumption that uv==True in the authenticatorGetInfo response implies clientPin==True seems incorrect. uv refers to built-in user verification and clientPin refers to the capability of accepting a PIN from the client platform, e.g. from the browser. In my opinion these two are completely independent. For example the CTAP spec explicitly states that "ClientPIN is not considered a built-in user verification method".

The Trezor T supports PIN entry directly on the device's touch screen, which is superior in terms of security to ClientPin, because the PIN cannot be intercepted by a keylogger or other potential malware on the user's machine. Supporting ClientPin on Trezor would reduce the security of the device, because it would encourage users to enter their PIN on their machine rather than on Trezor's built-in touchscreen.

from python-fido2.

I created two pull requests (#190 and #191) with fixes for these two issues.

from python-fido2.

Just to give a quick response to this: At first glance this looks fine, as do the two PRs. I will need to scrutinize the spec a bit before merging and unfortunately I don't have time to do that right now. Apologies for the delay!

from python-fido2.

I have an alternative proposal for changes that I believe should address this, and would love some feedback on it: #193.

As I don't have a Trezor T I haven't been able to test this myself, but looking at the proposed other PRs I believe these changes should address both issues. One difference is that in my PR the get_uv_token method is preferred instead of internal UV if supported and additional permissions are required. I'm assuming that this is supported by the Trezor, but I am not sure. If not then this may need additional changes.

from python-fido2.

"UV token" sounds like something from CTAP 2.1. Trezor currently supports only CTAP 2.0.

from python-fido2.

"UV token" sounds like something from CTAP 2.1. Trezor currently supports only CTAP 2.0.

I believe that should still be fine, the code should fall back to pinAuth with internal_uv.

from python-fido2.

Version 1.1.2 is now released and should hopefully resolve this.

from python-fido2.