FIDO_ERR_NO_CREDENTIALS for non-resident keys

[VedaviBalaji]

Hello,
I am trying to assert a non-resident key using fido_get_assert. But I always get FIDO_ERR_NO_CREDENTIALS error.

let client_data = CollectedClientData {
                type_field: "webauthn.get".to_string(),
                challenge: req.challenge,
                origin: origin.to_string(),
                cross_origin: !same_origin_with_ancestors,
                token_binding: None,
                top_origin: None,
                unknown_keys: HashMap::new(),
            };

            let client_data_json = match serde_json::to_string(&client_data) {
                Ok(value) => value,
                Err(e) => {
                    return Err(io::Error::new(
                        io::ErrorKind::InvalidInput,
                        format!("failed to parse client_data into json {:?}", e),
                    ));
                }
            };

            let r = libfido2::fido_assert_set_clientdata(
                assert,
                client_data_json.as_ptr() as *const u8,
                client_data_json.len(),
            );

/* Allow credentials processing */
let allow_credentials = req.allow_credentials.unwrap_or_default();
for elem in allow_credentials.iter() {
   let decoded_id = base64_url::decode(&elem.id).unwrap();
   let r = libfido2::fido_assert_allow_cred(assert, decoded_id.as_ptr(), decoded_id.len());
   self.handle_libfido2_error("fido_assert_allow_cred failed", Some(r))?;
}

...

let r = libfido2::fido_dev_get_assert(device, assert, _cptr);

FIDO_DEBUG=1

fido_dev_authkey_tx: dev=0x600000ea9320
fido_tx: dev=0x600000ea9320, cmd=0x10
fido_tx: buf=0x600003efa8b0, len=6
0000: 06 a2 01 02 02 02
fido_dev_authkey_rx: dev=0x600000ea9320, authkey=0x6000029caf80, ms=19999
fido_rx: dev=0x600000ea9320, cmd=0x10, ms=19999
rx_preamble: buf=0x7000077d7c10, len=64
0000: e5 a5 13 24 90 00 51 00 a1 01 a5 01 02 03 38 18
0016: 20 01 21 58 20 37 c3 0d ec 72 d0 58 22 5e c2 70
0032: 33 18 80 7e 5c 1c 91 e5 ae c8 76 a7 b6 9b 38 20
0048: 28 b0 2f d5 70 22 58 20 07 d6 c0 ac e4 fe a4 05
rx: payload_len=81
rx: buf=0x7000077d7c10, len=64
0000: e5 a5 13 24 00 41 b1 7e 6b f4 91 03 cb c1 79 96
0016: da 68 a0 51 80 af 56 61 ce 19 c3 ba 93 00 00 00
0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
fido_rx: buf=0x7ff5b38e9c00, len=81
0000: 00 a1 01 a5 01 02 03 38 18 20 01 21 58 20 37 c3
0016: 0d ec 72 d0 58 22 5e c2 70 33 18 80 7e 5c 1c 91
0032: e5 ae c8 76 a7 b6 9b 38 20 28 b0 2f d5 70 22 58
0048: 20 07 d6 c0 ac e4 fe a4 05 41 b1 7e 6b f4 91 03
0064: cb c1 79 96 da 68 a0 51 80 af 56 61 ce 19 c3 ba
0080: 93
fido_tx: dev=0x600000ea9320, cmd=0x10
fido_tx: buf=0x60000124cf80, len=120
0000: 06 a4 01 02 02 05 03 a5 01 02 03 38 18 20 01 21
0016: 58 20 c9 bc e9 13 73 5c 2e 08 e7 71 b6 40 e6 15
0032: 31 f0 5c 4f a5 86 db b1 3a 3f 32 fa ed 73 d0 07
0048: 7c 5d 22 58 20 56 ec 6d a5 75 a7 76 ae 64 11 83
0064: d0 40 51 87 3e d3 8f e1 28 b0 51 86 c2 20 83 af
0080: be d5 55 d6 5e 06 58 20 56 86 1f 30 bb f1 1b c4
0096: ef 7c f4 77 48 d6 8b 8c cb 44 1e a5 a6 c3 15 be
0112: 0d 54 af f5 e7 2a ed b6
fido_rx: dev=0x600000ea9320, cmd=0x10, ms=19992
rx_preamble: buf=0x7000077d7bb0, len=64
0000: e5 a5 13 24 90 00 35 00 a1 02 58 30 7f 23 2c 7b
0016: e8 b7 9d f3 73 90 0b 6a 9e d1 35 36 46 f6 8a f5
0032: 85 3f 95 d5 7d e2 73 b5 a0 8e 91 08 f0 bc f8 54
0048: 2e ca 53 58 f5 f2 97 84 c8 ff 25 0e 00 00 00 00
rx: payload_len=53
fido_rx: buf=0x7ff5b68c2e00, len=53
0000: 00 a1 02 58 30 7f 23 2c 7b e8 b7 9d f3 73 90 0b
0016: 6a 9e d1 35 36 46 f6 8a f5 85 3f 95 d5 7d e2 73
0032: b5 a0 8e 91 08 f0 bc f8 54 2e ca 53 58 f5 f2 97
0048: 84 c8 ff 25 0e
fido_tx: dev=0x600000ea9320, cmd=0x10
fido_tx: buf=0x600000bdeb50, len=175
0000: 02 a5 01 6b 77 65 62 61 75 74 68 6e 2e 69 6f 02
0016: 58 20 81 cf 9e 71 27 04 39 f2 6b e2 be c7 07 dc
0032: df a0 88 f9 43 e3 ca c1 58 96 d4 69 eb fc 29 ee
0048: 4f 48 03 81 a2 62 69 64 58 40 b7 47 f2 92 66 8a
0064: 2b 84 65 52 00 09 a7 c0 12 98 d8 33 42 c4 bc a1
0080: a9 7d 15 48 99 b8 43 fe ea e6 df 62 0e ee 7b 80
0096: 20 ba e6 dd 0a 8a 87 ac c2 40 4b 0e d0 86 02 42
0112: a8 00 e2 46 3d e7 28 32 ea 0c 64 74 79 70 65 6a
0128: 70 75 62 6c 69 63 2d 6b 65 79 06 58 20 63 c8 6f
0144: 8a 5b e9 06 61 01 a0 d8 6b 49 bc 23 48 9a 72 13
0160: 9a 0e 0c 3d 0d 64 73 fc b5 c9 b6 dd a1 07 02
fido_rx: dev=0x600000ea9320, cmd=0x10, ms=19909
rx_preamble: buf=0x7000077d7d00, len=64
0000: e5 a5 13 24 90 00 ca 00 a3 01 a2 62 69 64 58 40
0016: b7 47 f2 92 66 8a 2b 84 65 52 00 09 a7 c0 12 98
0032: d8 33 42 c4 bc a1 a9 7d 15 48 99 b8 43 fe ea e6
0048: df 62 0e ee 7b 80 20 ba e6 dd 0a 8a 87 ac c2 40
rx: payload_len=202
rx: buf=0x7000077d7d00, len=64
0000: e5 a5 13 24 00 4b 0e d0 86 02 42 a8 00 e2 46 3d
0016: e7 28 32 ea 0c 64 74 79 70 65 6a 70 75 62 6c 69
0032: 63 2d 6b 65 79 02 58 25 74 a6 ea 92 13 c9 9c 2f
0048: 74 b2 24 92 b3 20 cf 40 26 2a 94 c1 a9 50 a0 39
rx: buf=0x7000077d7d00, len=64
0000: e5 a5 13 24 01 7f 29 25 0b 60 84 1e f0 05 00 00
0016: 00 2f 03 58 46 30 44 02 20 54 64 6f 22 40 1b 6b
0032: ca 1a 56 d5 e0 64 61 d8 fd 40 2b 39 c5 c4 99 64
0048: f0 7f 0c d4 25 99 62 9a 97 02 20 2e c8 28 ca ba
rx: buf=0x7000077d7d00, len=64
0000: e5 a5 13 24 02 65 c2 c3 69 c6 d5 58 a7 9e 20 d6
0016: 48 fc 98 d3 d0 de bf a4 42 a7 89 96 a6 44 c8 c8
0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
fido_rx: buf=0x7ff5b50dc200, len=202
0000: 00 a3 01 a2 62 69 64 58 40 b7 47 f2 92 66 8a 2b
0016: 84 65 52 00 09 a7 c0 12 98 d8 33 42 c4 bc a1 a9
0032: 7d 15 48 99 b8 43 fe ea e6 df 62 0e ee 7b 80 20
0048: ba e6 dd 0a 8a 87 ac c2 40 4b 0e d0 86 02 42 a8
0064: 00 e2 46 3d e7 28 32 ea 0c 64 74 79 70 65 6a 70
0080: 75 62 6c 69 63 2d 6b 65 79 02 58 25 74 a6 ea 92
0096: 13 c9 9c 2f 74 b2 24 92 b3 20 cf 40 26 2a 94 c1
0112: a9 50 a0 39 7f 29 25 0b 60 84 1e f0 05 00 00 00
0128: 2f 03 58 46 30 44 02 20 54 64 6f 22 40 1b 6b ca
0144: 1a 56 d5 e0 64 61 d8 fd 40 2b 39 c5 c4 99 64 f0
0160: 7f 0c d4 25 99 62 9a 97 02 20 2e c8 28 ca ba 65
0176: c2 c3 69 c6 d5 58 a7 9e 20 d6 48 fc 98 d3 d0 de
0192: bf a4 42 a7 89 96 a6 44 c8 c8
adjust_assert_count: cbor_type
adjust_assert_count: cbor_type
adjust_assert_count: cbor_type
cbor_decode_assert_authdata: buf=0x6000032cc090, len=37
fido_dev_authkey_tx: dev=0x600000ea9320
fido_tx: dev=0x600000ea9320, cmd=0x10
fido_tx: buf=0x600003ea4500, len=6
0000: 06 a2 01 02 02 02
fido_dev_authkey_rx: dev=0x600000ea9320, authkey=0x6000029cca40, ms=19999
fido_rx: dev=0x600000ea9320, cmd=0x10, ms=19999
rx_preamble: buf=0x7000077d7a70, len=64
0000: e5 a5 13 24 90 00 51 00 a1 01 a5 01 02 03 38 18
0016: 20 01 21 58 20 37 c3 0d ec 72 d0 58 22 5e c2 70
0032: 33 18 80 7e 5c 1c 91 e5 ae c8 76 a7 b6 9b 38 20
0048: 28 b0 2f d5 70 22 58 20 07 d6 c0 ac e4 fe a4 05
rx: payload_len=81
rx: buf=0x7000077d7a70, len=64
0000: e5 a5 13 24 00 41 b1 7e 6b f4 91 03 cb c1 79 96
0016: da 68 a0 51 80 af 56 61 ce 19 c3 ba 93 00 00 00
0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
fido_rx: buf=0x7ff5b585a000, len=81
0000: 00 a1 01 a5 01 02 03 38 18 20 01 21 58 20 37 c3
0016: 0d ec 72 d0 58 22 5e c2 70 33 18 80 7e 5c 1c 91
0032: e5 ae c8 76 a7 b6 9b 38 20 28 b0 2f d5 70 22 58
0048: 20 07 d6 c0 ac e4 fe a4 05 41 b1 7e 6b f4 91 03
0064: cb c1 79 96 da 68 a0 51 80 af 56 61 ce 19 c3 ba
0080: 93
fido_tx: dev=0x600000ea9320, cmd=0x10
fido_tx: buf=0x60000124f600, len=120
0000: 06 a4 01 02 02 05 03 a5 01 02 03 38 18 20 01 21
0016: 58 20 e5 7d 09 ab 18 eb fa 6d 03 a2 6d 7c 4b 23
0032: 03 8c 10 84 27 64 b6 20 c4 2d 9b 47 09 20 c9 de
0048: 54 52 22 58 20 e1 9d 27 c2 0e ce 08 28 ca 22 2c
0064: f7 3c 24 ff 9a 6a 6c 4a 15 0c 7f 1b b0 1f 62 4a
0080: e0 95 db 75 48 06 58 20 47 04 67 9b 0e bd f5 2a
0096: 01 a4 30 71 4f 2a f8 77 da 9d c6 a1 e0 f0 72 3f
0112: d1 12 75 fd 6f 33 6f 10
fido_rx: dev=0x600000ea9320, cmd=0x10, ms=19993
rx_preamble: buf=0x7000077d7a10, len=64
0000: e5 a5 13 24 90 00 35 00 a1 02 58 30 e2 7a 1e b5
0016: 37 22 c3 ec e1 46 5b 89 ab 0e 3d 12 47 d3 45 67
0032: 97 f6 01 4f 8f 7e ba 02 8e 98 1a 98 5d 96 04 46
0048: 7a 8c 21 0e e5 94 de 5f 61 4a 4f 9a 00 00 00 00
rx: payload_len=53
fido_rx: buf=0x7ff5b38e4600, len=53
0000: 00 a1 02 58 30 e2 7a 1e b5 37 22 c3 ec e1 46 5b
0016: 89 ab 0e 3d 12 47 d3 45 67 97 f6 01 4f 8f 7e ba
0032: 02 8e 98 1a 98 5d 96 04 46 7a 8c 21 0e e5 94 de
0048: 5f 61 4a 4f 9a
fido_tx: dev=0x600000ea9320, cmd=0x10
fido_tx: buf=0x600001f6dd60, len=78
0000: 41 a4 01 04 02 a1 01 58 20 74 a6 ea 92 13 c9 9c
0016: 2f 74 b2 24 92 b3 20 cf 40 26 2a 94 c1 a9 50 a0
0032: 39 7f 29 25 0b 60 84 1e f0 03 02 04 58 20 1d f7
0048: 4e 4d 63 4a f4 82 3f 25 5c d0 3a e4 13 32 90 c1
0064: 86 cd 32 b4 c3 fb c1 33 25 4b b2 8a 4d 0f
fido_rx: dev=0x600000ea9320, cmd=0x10, ms=19911
rx_preamble: buf=0x7000077d7c40, len=64
0000: e5 a5 13 24 90 00 01 2e 00 00 00 00 00 00 00 00
0016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
rx: payload_len=1
fido_rx: buf=0x7ff5b50dc200, len=1
0000: 2e
cbor_parse_reply: blob[0]=0x2e
credman_rx_rk: credman_parse_rk_count

Is my allow credentials called correctly? I saw that it needs to be decoded base64url and not base64.

[LDVG]

Hi,

Given your debug log, it seems to me that fido_dev_get_assert() should be returning FIDO_OK. The authenticator responds to your assertion request with

fido_rx: buf=0x7ff5b50dc200, len=202
0000: 00 a3 01 a2 62 69 64 58 40 b7 47 f2 92 66 8a 2b
0016: 84 65 52 00 09 a7 c0 12 98 d8 33 42 c4 bc a1 a9
0032: 7d 15 48 99 b8 43 fe ea e6 df 62 0e ee 7b 80 20
0048: ba e6 dd 0a 8a 87 ac c2 40 4b 0e d0 86 02 42 a8
0064: 00 e2 46 3d e7 28 32 ea 0c 64 74 79 70 65 6a 70
0080: 75 62 6c 69 63 2d 6b 65 79 02 58 25 74 a6 ea 92
0096: 13 c9 9c 2f 74 b2 24 92 b3 20 cf 40 26 2a 94 c1
0112: a9 50 a0 39 7f 29 25 0b 60 84 1e f0 05 00 00 00
0128: 2f 03 58 46 30 44 02 20 54 64 6f 22 40 1b 6b ca
0144: 1a 56 d5 e0 64 61 d8 fd 40 2b 39 c5 c4 99 64 f0
0160: 7f 0c d4 25 99 62 9a 97 02 20 2e c8 28 ca ba 65
0176: c2 c3 69 c6 d5 58 a7 9e 20 d6 48 fc 98 d3 d0 de
0192: bf a4 42 a7 89 96 a6 44 c8 c8

which as far as I can tell is a successful response. I can't see anything in the log indicating that the assertion request did not succeed.

However, immediately after the assertion request you seem to be calling fido_credman_get_dev_rk()

fido_tx: buf=0x600001f6dd60, len=78
0000: 41 a4 01 04 02 a1 01 58 20 74 a6 ea 92 13 c9 9c
0016: 2f 74 b2 24 92 b3 20 cf 40 26 2a 94 c1 a9 50 a0
0032: 39 7f 29 25 0b 60 84 1e f0 03 02 04 58 20 1d f7
0048: 4e 4d 63 4a f4 82 3f 25 5c d0 3a e4 13 32 90 c1
0064: 86 cd 32 b4 c3 fb c1 33 25 4b b2 8a 4d 0f

for which the authenticator returns

fido_rx: buf=0x7ff5b50dc200, len=1
0000: 2e

i.e. FIDO_ERR_NO_CREDENTIALS, and rightly so since you are saying you have not registered any discoverable/resident credentials.

Are you sure you are checking the correct return value from fido_dev_get_assert()?

[VedaviBalaji]

You are right, I missed this case. I was not checking that FIDO_NO_CREDENTIALS is a valid error in this case and was just checking for FIDO_OK and returning an error.