libfido2 with Token2 NFC Card + Smartcard Reader

[ondrej-krc-jediny]

Hello,
I use libfido2 1.15.0 successfully with various FIDO hardware keys from various vendors. Recently I attempted to make it work with:
Token2 NFC Card: https://www.token2.com/shop/product/token2-t2f2-nfc-card-pin-fido2-1-u2f-security-card-with-pin-complexity-feature
connected to my PC via
Smartcard Reader: https://www.token2.com/shop/product/token2-t2sr-compact-usb-nfc-and-smart-card-reader
fido_dev_info_manifest() does not recognize the token2 device (only 1 device - Windows Hello is returned).
Using this setup in browser - i.e. registering and authenticating via https://webauthn.io works, so the device is recognized by the operating system.
Should this work in libfido2, and if yes, can you please suggest how to make it work?
Thank you.

[LDVG]

Hi,

The Windows Hello device is a pseudo-device that works as a proxy for communication with compliant FIDO authenticators on Windows systems. You should be able to use that device to register new credentials and getting assertions from your authenticator, just like your browser can.

For privileged applications (running as administrator), libfido2 also provides direct access to HID devices and, if built with the experimental -DUSE_PCSC=ON support, smartcard/NFC readers. As you would expect, we recommend using the Windows Hello backend even if it's a bit more limited.

[ondrej-krc-jediny]

Here is the full debug log from fido_make_cred call: fido.log
Towards the end you can see line tx_short_apdu: retrying with length f0, where my retry attempt is done.
After that, it returns tx_short_apdu: unexpected sw 6883, which according to specs means: Last command of the chain expected.

[LDVG]

Would you mind testing the following diff (against main)?

diff --git a/src/nfc.c b/src/nfc.c
index 55e3661dd1..f2f65a237d 100644
--- a/src/nfc.c
+++ b/src/nfc.c
@@ -34,7 +34,10 @@
        apdu[3] = h->p2;
        apdu[4] = payload_len;
        memcpy(&apdu[5], payload, payload_len);
-       apdu_len = (size_t)(5 + payload_len + 1);
+       apdu_len = (size_t)(5 + payload_len);
+
+       if (!(cla_flags & 0x10))
+               apdu_len += 1;

        if (d->io.write(d->io_handle, apdu, apdu_len) < 0) {
                fido_log_debug("%s: write", __func__);

[ondrej-krc-jediny]

It worked, thanks a lot. Logs from successful fido_make_cred call: fido2.log

Now all three scenarios are OK:

• was the card is tapped on the T2SR smartcard reader (NFC)
• when the card is inserted into T2SR smartcard reader
• when the card is inserted into (Lenovo) laptop's integrated smartcard reader

Would you like me to prepare a PR with your fix?

[LDVG]

Thank you for verifying!

Would you like me to prepare a PR with your fix?

If you'd like to, sure! 🙂

We'll try to verify that this fix does not break any of the other readers that we know should work with libfido2.

[ondrej-krc-jediny]

I prepared the PR: #864.

[ondrej-krc-jediny]

By the way, does a9a0990 mean that PCSC support is now enabled by default and I don't need to compile with -DUSE_PCSC=ON?

[LDVG]

We've historically disabled USE_PCSC just prior to a release since we've kept considering it experimental.