Passkey registration response parse failure with yubikey - extra data in attestation object?

[timnewsham]

I'm using webauthn and I ran across a problem with a user who is using a yubikey. During registration I get an attestationObject in their response which does not parse with protocol.ParseCredentialCreationResponseBody. Looking in to the issue I find the parse is failing within protocol/webauthncbor/webauthncbor.go:22 in the call to ctap2CBORDecMode.Unmarshal(data, v). In the github.com/fxamacker/cbor/v2 package the failure is happening in the call to err := d.wellformed(false) because of extra data (!allowExtraData && d.off != len(d.data) ). Is this being caused by some sort of extension that yubikeys might be providing that the webauthn library and CBOR library does not support?

Tim

(dlv) bt
 0  0x0000000006f20e78 in github.com/fxamacker/cbor/v2.(*decoder).wellformed
    at /Users/timnewsham/go/pkg/mod/github.com/fxamacker/cbor/[email protected]/valid.go:91
 1  0x0000000006f04e77 in github.com/fxamacker/cbor/v2.(*decMode).Unmarshal
    at /Users/timnewsham/go/pkg/mod/github.com/fxamacker/cbor/[email protected]/decode.go:621
 2  0x0000000006f24d02 in github.com/go-webauthn/webauthn/protocol/webauthncbor.Unmarshal
    at /Users/timnewsham/go/pkg/mod/github.com/go-webauthn/[email protected]/protocol/webauthncbor/webauthncbor.go:22
 3  0x0000000006f500f9 in github.com/go-webauthn/webauthn/protocol.unmarshalCredentialPublicKey
    at /Users/timnewsham/go/pkg/mod/github.com/go-webauthn/[email protected]/protocol/authenticator.go:327
 4  0x0000000006f4fdac in github.com/go-webauthn/webauthn/protocol.(*AuthenticatorData).unmarshalAttestedData
    at /Users/timnewsham/go/pkg/mod/github.com/go-webauthn/[email protected]/protocol/authenticator.go:315
 5  0x0000000006f4f745 in github.com/go-webauthn/webauthn/protocol.(*AuthenticatorData).Unmarshal
    at /Users/timnewsham/go/pkg/mod/github.com/go-webauthn/[email protected]/protocol/authenticator.go:269
 6  0x0000000006f42216 in github.com/go-webauthn/webauthn/protocol.(*AuthenticatorAttestationResponse).Parse
    at /Users/timnewsham/go/pkg/mod/github.com/go-webauthn/[email protected]/protocol/attestation.go:98
 7  0x0000000006f51056 in github.com/go-webauthn/webauthn/protocol.CredentialCreationResponse.Parse
    at /Users/timnewsham/go/pkg/mod/github.com/go-webauthn/[email protected]/protocol/credential.go:99
 8  0x0000000006f50a38 in github.com/go-webauthn/webauthn/protocol.ParseCredentialCreationResponseBody
    at /Users/timnewsham/go/pkg/mod/github.com/go-webauthn/[email protected]/protocol/credential.go:74

[james-d-elliott]

It might be. Do you happen to have example data so I can take a look? Otherwise I can test this over the weekend maybe as I have some in a box at home. Also by Passeky do you just mean that you're requesting a resident key / discoverable credential?

[timnewsham]

Here's a test program with the unparsable response.

package main

import (
	"bytes"
	"log"

	"github.com/go-webauthn/webauthn/protocol"
)

var dat = `
{
  "id": "q-PCAfl0LKxYEbpiTfr77GGWWWJRUTuKQoglD2a4DiHp4CTMWrd0XQqrdEhxRkYg",
  "rawId": "q-PCAfl0LKxYEbpiTfr77GGWWWJRUTuKQoglD2a4DiHp4CTMWrd0XQqrdEhxRkYg",
  "response": {
    "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjCZHiMS28AxJJNGPY-DFpK5v72JgJhAu3F_Fd4P2VDSNTFAAAABAAAAAAAAAAAAAAAAAAAAAAAMKvjwgH5dCysWBG6Yk36--xhllliUVE7ikKIJQ9muA4h6eAkzFq3dF0Kq3RIcUZGIKUBAgMmIAEhWCCr48IB-XQsrFgRumJNajlGCQMSbUPimT9fUEgwefCeJSJYIB41LApR9BSYCHqgPebmlQl7xme2ASpds3PfUwp_xkDroWtjcmVkUHJvdGVjdAI",
    "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoibGcwX1RpOFdDemFHVnNROVVLbWhBbGpjTDB4VjFBX1VyRzJjekZ2RS1rYyIsIm9yaWdpbiI6Imh0dHBzOi8vbG9naW4uZGV2LmF3cy5wYW5nZWEuY2xvdWQiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
    "transports": [
      "nfc",
      "usb"
    ],
    "publicKeyAlgorithm": -7,
    "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEq-PCAfl0LKxYEbpiTWo5RgkDEm1D4pk_X1BIMHnwniUeNSwKUfQUmAh6oD3m5pUJe8ZntgEqXbNz31MKf8ZA6w",
    "authenticatorData": "ZHiMS28AxJJNGPY-DFpK5v72JgJhAu3F_Fd4P2VDSNTFAAAABAAAAAAAAAAAAAAAAAAAAAAAMKvjwgH5dCysWBG6Yk36--xhllliUVE7ikKIJQ9muA4h6eAkzFq3dF0Kq3RIcUZGIKUBAgMmIAEhWCCr48IB-XQsrFgRumJNajlGCQMSbUPimT9fUEgwefCeJSJYIB41LApR9BSYCHqgPebmlQl7xme2ASpds3PfUwp_xkDroWtjcmVkUHJvdGVjdAI"
  },
  "type": "public-key",
  "clientExtensionResults": {},
  "authenticatorAttachment": "cross-platform"
}
`

func main() {
	reader := bytes.NewReader([]byte(dat))
	parsedReg, err := protocol.ParseCredentialCreationResponseBody(reader)
	if err != nil {
		log.Printf("Error parsing: %v", err)
	} else {
		log.Printf("Parsed: %v", parsedReg)
	}
}

[james-d-elliott]

I didn't get around to this. But I'll make a test build today you can try which disables the option which I think causes this. I'd like to figure out which value is an issue though.

[james-d-elliott]

Actually, what happens with the newest version? Seems to be fine for me. See the below tests.

func Test229(t *testing.T) {
	var example229 = `
{
  "id": "q-PCAfl0LKxYEbpiTfr77GGWWWJRUTuKQoglD2a4DiHp4CTMWrd0XQqrdEhxRkYg",
  "rawId": "q-PCAfl0LKxYEbpiTfr77GGWWWJRUTuKQoglD2a4DiHp4CTMWrd0XQqrdEhxRkYg",
  "response": {
    "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjCZHiMS28AxJJNGPY-DFpK5v72JgJhAu3F_Fd4P2VDSNTFAAAABAAAAAAAAAAAAAAAAAAAAAAAMKvjwgH5dCysWBG6Yk36--xhllliUVE7ikKIJQ9muA4h6eAkzFq3dF0Kq3RIcUZGIKUBAgMmIAEhWCCr48IB-XQsrFgRumJNajlGCQMSbUPimT9fUEgwefCeJSJYIB41LApR9BSYCHqgPebmlQl7xme2ASpds3PfUwp_xkDroWtjcmVkUHJvdGVjdAI",
    "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoibGcwX1RpOFdDemFHVnNROVVLbWhBbGpjTDB4VjFBX1VyRzJjekZ2RS1rYyIsIm9yaWdpbiI6Imh0dHBzOi8vbG9naW4uZGV2LmF3cy5wYW5nZWEuY2xvdWQiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
    "transports": [
      "nfc",
      "usb"
    ],
    "publicKeyAlgorithm": -7,
    "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEq-PCAfl0LKxYEbpiTWo5RgkDEm1D4pk_X1BIMHnwniUeNSwKUfQUmAh6oD3m5pUJe8ZntgEqXbNz31MKf8ZA6w",
    "authenticatorData": "ZHiMS28AxJJNGPY-DFpK5v72JgJhAu3F_Fd4P2VDSNTFAAAABAAAAAAAAAAAAAAAAAAAAAAAMKvjwgH5dCysWBG6Yk36--xhllliUVE7ikKIJQ9muA4h6eAkzFq3dF0Kq3RIcUZGIKUBAgMmIAEhWCCr48IB-XQsrFgRumJNajlGCQMSbUPimT9fUEgwefCeJSJYIB41LApR9BSYCHqgPebmlQl7xme2ASpds3PfUwp_xkDroWtjcmVkUHJvdGVjdAI"
  },
  "type": "public-key",
  "clientExtensionResults": {},
  "authenticatorAttachment": "cross-platform"
}
`

	reader := bytes.NewReader([]byte(example229))
	parsedReg, err := ParseCredentialCreationResponseBody(reader)

	assert.NoError(t, err)
	assert.NotNil(t, parsedReg)
}

[timnewsham]

verified no parse error with v0.10.2. Thank you.