FIDO2 list-credentials fails

[zimward]

like the title says, running nitropy fido2 list-crdentials fails.

I've installed the udev rules and can normally use the key, but managing the credentails is not working. The firmware of the FIDO2 key is the newest version.
I also tried to use chromium but it only offers me an empty list so it might also be a firmware bug.

Here is the log-file (host- and username as well as other usb-devices have been censored):
nitropy.log

[robin-nitrokey]

The error occurs inside fido2/ctap2/credman.py:

  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.10/site-packages/pynitrokey/cli/fido2.py", l
ine 221, in list_credentials
    reliable_party_list = cred_manager.enumerate_rps()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.10/site-packages/fido2/ctap2/credman.py", li
ne 159, in enumerate_rps
    n_rps = first[CredentialManagement.RESULT.TOTAL_RPS]
KeyError: <RESULT.TOTAL_RPS: 5>

https://github.com/Yubico/python-fido2/blob/1.1.0/fido2/ctap2/credman.py#L159

The totalRPs field is missing from the enumerateRPsBegin response although it is required (§ 6.8.3 of the spec). Looking at the source code, it is omitted if zero:

https://github.com/Nitrokey/nitrokey-fido2-firmware/blob/12f2c14c6d7752293385c4c2f5317f16b0b63e61/fido2/ctap.c#L1456-L1462

So my understanding is that there really are no credentials to be listed. Note that not all credentials are discoverable with this command. In fact, most credentials used for 2FA are not. Typically, you’ll only have discoverable credentials (“resident keys”) if you use pasword-less login, e. g. with Google or Microsoft. Are you sure this is the case for your device?

[zimward]

Ah so there is a difference between those credentials. I do in fact have no passwordless logins configured. although there should still be a proper message to the user instead of a KeyError.

[szszszsz]

To do:

• this error should be handled in pynitrokey by providing a proper message;
• fix this in Nitrokey FIDO2 firmware (for other FIDO clients) (see Missing totalRPs field when no RK are registered nitrokey-fido2-firmware#75)