Bug 215836

This is related to Bug 213934 For CTAP2.0 and CTAP2.1_Pre authenticators that don't support internal user verification sending the UV option will cause a CTAP2_ERR_UNSUPPORTED_OPTION. See authenticatorMakeCredential step 3 ( https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential ) and authenticatorGetAssertion Step 5. During Authenticator selection if clientPin is set in getInfo options, the platform is sending a dummy request to the authenticator to make the led blink to determine what authenticator to use. This works when the webAuthn request contains User Verification absent/Discouraged/preferred. However if User Verification required is sent by the RP the platform includes the uv=true option and that causes a CTAP2_ERR_UNSUPPORTED_OPTION error for CTAP2.0 authenticators that don't support internal UV. For Authenticators that do support internal UV it seems that some are performing internal UV (fingerprint etc) and not returning the expected error. I expect that the CTAP 2.0 authenticators with no internal UV are also going to have a further problem after authenticator selection if both a pinToken and uv option are sent to them. Bio Authenticators receiving both the uv option and pintoken may or may not work. My test CTAP2.1 authenticators that ignore the UV option work but as client pin authenticators ignoring the fingerprint, and other authenticators like the biopass I tested are not working. The first step would be to remove the uv option being sent with pintoken. That should never happen in CTAP 2.0. I hope that platforms MUST NOT do that is more clear in the CTAP2.1 spec. This should explain why the MS test page that sets user verification required won't work with a YK 5Ci but the same key will work just fine with a resident credential on a site with User Verification optional.