Bug 247344
| Summary: | [WebAuthn] Incorrect RP ID hash when using U2F keys | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | pascoe <pascoe> |
| Component: | WebKit Misc. | Assignee: | pascoe <pascoe> |
| Status: | NEW | ||
| Severity: | Major | CC: | gianluca.varisco, joost.vandijk, webkit-bug-importer |
| Priority: | P1 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
pascoe@apple.com
This causes registrations to fail whenever we fall back to U2F or the key only supports U2F.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
pascoe@apple.com
rdar://100466116
Joost van Dijk
To reproduce:
Point your browser at https://demo.yubico.com/webauthn-technical/registration and use your U2F security key to register a FIDO credential. When the RP ID Hash mismatch occurs, you will get an error message: Wrong RP ID hash in response.
OR
Point your browser at https://webauthn.io/ and click Advanced Settings. In the Registration Settings, Uncheck "Require User Verification" and select "Cross-Platform" as Authenticator Attachment. Then click "Register" and use your U2F security key to register a FIDO credential.
When the RP ID Hash mismatch occurs, you will get an error message: Registration failed: Unexpected RP ID hash.
pascoe@apple.com
rdar://102718464
pascoe@apple.com
Pull request: https://github.com/WebKit/WebKit/pull/6862
pascoe@apple.com
rdar://100466116
Joost van Dijk
Seems to be resolved with Safari 17.1