Key not supported on ios for Apple Id 2fa

[iayanpahwa]

Expected Behavior

I tried adding my OpenSK NRF52840 dongle key with Apple. Since the implementation is FIDO certified it should work with Apple ID

Actual Behavior

Steps to Reproduce the Problem

1. Go to settings on ios device
2. Click on your apple account
3. Tap Sign in & Security
4. Tap on two-factor authentication
5. Tap on security keys > Add new key
6. Insert and activate OpenSK key

Specifications

• Version: CTAP 2.0 release
• Platform: ios 17.0

[ia0]

Hi, thanks for the report!

Could you provide the following information to help debug further:

• How did you compile, flash, and configure OpenSK on the dongle?
• How do you connect the dongle to your phone?
• Does it work with iOS 16?

Thanks!

[iayanpahwa]

Thank you for swift response @ia0 ,

How did you compile, flash, and configure OpenSK on the dongle?

I followed exact steps mentioned in install.md and nrf52840_dongle.md i.e DFU flashing

How do you connect the dongle to your phone?

Using Lightning to USB A adaptor

Does it work with iOS 16?

No, just checked on iPad running ios16 with USB C to USB A dongle

FYI, my Yubikey 5 worked flawlessly on both.

[ia0]

Thanks! We will need to find a way to reproduce to be able to debug (unless you happen to also have a dev-board). This may take some time.

[iayanpahwa]

I do have a NRF52840DK dev board. But it’s not handy atm. If you could guide me thru the process I could give it a try next week.

[ia0]

That would be great!

1. Checkout the develop branch of a clean OpenSK in a temporary directory:

   cd /tmp
   git clone -b develop https://github.com/google/OpenSK.git
   cd OpenSK
   ./setup.sh
   

2. Plug the dev-kit to your computer through the JTAG port (see this picture).
3. Compile, flash, and configure OpenSK with debugging:

   ./deploy.py --board=nrf52840dk_opensk --opensk --debug --panic-console --clear-storage
   ./tools/configure.py --certificate=crypto_data/opensk_cert.pem --private-key=crypto_data/opensk.key
   

4. Plug the dev-kit to your phone through the USB port, keeping the JTAG port connected to your computer.
5. In one terminal run JLinkExe -device nrf52 -if swd -speed 1000 -autoconnect 1.
6. In another (new) terminal run JLinkRTTClient. Make sure you have infinite scrolling, there will be a lot of input.
7. Try to add a security key on your phone.
8. Ctrl-C the second terminal and copy the full content of the terminal in a gist or some other place and share the link here.

Thanks!

[iayanpahwa]

Hi @ia0 , I tried this today. Unfortunately getting some errors during flashing. Please note I've copied udev rules and replugged the device. Any idea what else can I do ?

info: Generating Tock TAB file for application/example ctap2
info: Erasing the persistent storage
info: Erasing all installed applications
WARNING:root:Unknown TLV block in TBF header.
WARNING:root:You might want to update tockloader.
info: Flashing padding application
info: Installing Tock application ctap2
WARNING:root:Unknown TLV block in TBF header.
WARNING:root:You might want to update tockloader.
WARNING:root:Unknown TLV block in TBF header.
WARNING:root:You might want to update tockloader.
info: Configuring device.
info: Your device is not yet configured, and lacks some functionality. You can check its configuration status with:

./tools/configure.py

If you run into issues, this command might help:

./tools/configure.py \
    --certificate=crypto_data/opensk_cert.pem \
    --private-key=crypto_data/opensk.key

Please read the Certificate considerations in docs/customization.md to understand the privacy trade-off.
fatal: No device to configure found.

lsusb output shows SEGGER J-Link connected

[ia0]

That's the expected output. You may ignore those warnings. I have them too and it's not a problem.

You should be able to follow up with the instructions continuing from ./tools/configure.py .

Note that the device is extremely slow with debug enabled, so you may have to wait longer than expected for some steps.

[iayanpahwa]

Thanks @ia0 , I was able to reproduce this issue using the NRF52840 DK dev board. You can find the logs in public gist here. I'm looking forward to learn from your diagnosis, many thanks!

[ia0]

Thanks a lot! So it looks like we send a MakeCredential response which makes me believe that iOS is probably refusing our AAGUID or certificate. @jmichelp what do you think?

[iayanpahwa]

Apple has a page talking about Keys specifications : https://support.apple.com/en-in/HT213154

[jmichelp]

It's possible that they whitelist AAGUID to the FIDO certified ones.
But my first guess would be to say that they're simply more pedantic about the attestation certificate.
IIRC I haven't patched the certificate generation to include the x509v3 extensions they need (it needs to embed the AAGUID, the supported transports, etc.).
It works 99% of the cases because nobody cares about it, but with CTAP2.1 they seem to do more checks :)

[iayanpahwa]

I'm happy to work on a PR if you could guide me thru.

[kaczmarczyck]

Sorry for the wait (and more waiting is to be expected, see below). A few observations:

• I downloaded the metadata blob from FIDO Alliance to double check, and I can't find OpenSK. The file metadata/metadata.json in our repository should be contained.
• We are still listed as a certified product, i.e., search for OpenSK as the product name.

So if we are indeed rejected because of attestation problems, then this could be related. I'll reach out to FIDO.

[kaczmarczyck]

Turns out I missed a step to submit an OpenSK entry to the MDS. So we likely have to fix #457 and / or add register OpenSK correctly to FIDO.

[iayanpahwa]

Thanks for the update @kaczmarczyck , happy to test it over once we've the fix.