New method to check for FIDO2 device locked (FIDO_ERR_PIN_AUTH_BLOCKED)

[ikerexxe]

When the user enters their PIN 3 times incorrectly the FIDO2 device is blocked until it is disconnected and connected again to the system. I don't seem to find any method in the manuals that enables the application to check whether the FIDO2 device is blocked in this way (FIDO_ERR_PIN_AUTH_BLOCKED). Would it be possible to implement this method?

Reference: SSSD/sssd#7631 (comment)

[LDVG]

Hi Iker!

The only portable way of checking is by acting on the return value itself. Recent versions of CTAP (2.1) added an (optional) way of communicating whether a power cycle is required, but we have not yet implemented querying this in libfido2 (and needless to say requires authenticator support).

Ludvig

[ikerexxe]

Do existing authenticators support this feature? Or do you need to implement this support first, and then ask users to update the authenticator firmware?

[LDVG]

As far as YubiKeys go: no, this feature is not supported (nor is firmware upgrades). Checking the return value is the only portable option of checking whether a power cycle is required.

[ikerexxe]

Ok, thank you for the explanation. I'm closing this ticket.