Bug 278662 – [WebAuthn] makeCred does not set the FIDO2 PIN

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: WebKit Misc.

[Drew Dani]

During registration of a FIDO2 security key in Safari, the UV flag has been broken in Safari. This bug is to report that makeCred is not able to set the FIDO2 PIN on the security key device during the WebAuthn registration API call.


In Chrome, in the case where a security token does not have a FIDO2 PIN set, with user verification set to `required`, the browser prompts the user to set the security token PIN during registration.

Chrome experience:
1. Reset FIDO2 on the security key.
2. Go to https://webauthn.io/.
3. Expand the advanced settings, under Registration Settings, select User Verification as Required.
4. Enter `jondoe` as a username in the example_username field.
5. Click on Register.
6. Examine the prompt to set the FIDO2 PIN and set the FIDO2 PIN.
7. Tap on the token to complete the registration.

Safari does not have an option to set the FIDO2 PIN. After the WebAuthn registration with UV=required, There is an error: `The authenticator was unable to process the specified options, or could not create a new credential`.

Yubico calls out that Safari does not have PIN support during WebAuthn registration.

https://support.yubico.com/hc/en-us/articles/360016615020-Operating-system-and-web-browser-support-for-FIDO2-and-U2F
https://developers.yubico.com/WebAuthn/Supporting_U2F_or_FIDO2_Security_Keys_on_iOS_or_iPadOS/Known_Issues.html

[Drew Dani]

Created attachment 472298 [details]
Unable to set the FIDO2 PIN with UV = required

[Drew Dani]

Created attachment 472299 [details]
Safari registration error

Registration failed: User verification is required but user was not verified during attestation

[Radar WebKit Bug Importer]

<rdar://problem/135149531>

[[e-mail]]

*** This bug has been marked as a duplicate of bug 269083 ***