1631010 - Windows Hello Web Authentication doesn't work for direct TPM attestation

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P3)

Description

[Ismail S]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0

Steps to reproduce:

Make sure you're on Windows 10 (I'm on version 1909). I'm using Firefox 75.0 64-bit.

1. Go to eg https:://webauthn.io, but really any website which requires WebAuthn direct attestation.
2. Perform a WebAuthn registration with attestation type set to direct.

Actual results:

The WebAuthn registration call itself is successful, but returns attestation type none.

Expected results:

The WebAuthn registration call is successful with attestation type tpm.

Comment 1

[Ismail S]

Note that what probably should have happened is the prompt from https://bugzilla.mozilla.org/show_bug.cgi?id=1430150 should have appeared, but this didn't happen. I have tried using older versions of Firefox eg Firefox v66, and have tried using a new profile, but to no avail.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 3

[Firefox Bug Husbandry Bot]

Resetting severity to default of --.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jcj, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[J.C. Jones [:jcj] (he/him)]

Just to clarify, are you seeing the Windows Hello dialog, or do you have Hello disabled and are seeing the standard Firefox dialog?

Comment 6

[Firefox Bug Husbandry Bot]

Because this bug's Severity has not been changed from the default since it was filed, and it's Priority is -- (non,) indicating it has has not been previously triaged, the bug's Severity is being updated to -- (default, untriaged.)

Comment 7

[Ismail S]

I'm seeing the Windows Hello dialog, and am not seeing any Firefox dialog.

Comment 8

[J.C. Jones [:jcj] (he/him)]

So it does work for me for a removable CTAP2 token, but I don't have the necessary hardware to test a TPM attestation. Probably something in https://searchfox.org/mozilla-central/source/dom/webauthn/WinWebAuthnManager.cpp is not expressly permitting TPMs, but I'm not sure off-hand what that might be.

I do note that the Windows Hello header has a comment:

// Note, new fields will be added to the following data structure to
// support additional attestation format types, such as, TPM.
// When fields are added, the dwVersion will be incremented.

https://github.com/microsoft/webauthn/blob/507e696d58fe56cd6721b237cbf01ea174816524/webauthn.h#L477-L479

... which kind of implies this might not be available to Firefox yet. Akshay, if you have a free moment, do you know off-hand if that's expected given this version of the Hello interface we're using?

Comment 9

[Ismail S]

Yes, we've noticed more recently as well that CTAP2 tokens (eg Yubikeys) which use the packed attestation format do work in Firefox.

This bug is specific to Firefox, in Chrome TPM attestations work fine, and from a very cursory glance at their source code, they are using the same Windows Hello header as Firefox is.

Comment 10

[R. Martinho Fernandes [:rmf]]

Does this still fail for you on the latest FF release? I'm on FF92 and if I pick direct TPM attestation on webauthn.io it succeeds and returns attestation type direct.

(However, I do not get the prompt from https://bugzilla.mozilla.org/show_bug.cgi?id=1430150 so maybe that's something else to look into)

Can you confirm whether you get correct attestation type as well?

Comment 11

[Ismail S]

Yes, this still fails for me. I've just tried in FF 93.0 (64 bit). To make things clearer, here's some better steps to reproduce this:

1. Go to https://webauthn.io
2. Open up FF devtools
3. Enter some username, select Direct attestion type and Platform (TPM) authenticator type
4. Click Register, action the Windows Hello prompt that appears
5. In the JS console, it will log the credential that's created. FF gives you a link (on the right-hand side) to navigate to the JS code that produced the console log. Go to that line of code and add a breakpoint. This should be on the code:

   console.log("PublicKeyCredential Created");
   console.log(newCredential);
   

6. Refresh the page. The breakpoint should remain
7. Enter some username, select Direct attestion type and Platform (TPM) authenticator type. Click Register. Action the Windows Hello prompt that appears.
8. You should now end up in the debugger
9. Copy-paste the JS code here into the JS console and press Enter. This adds cbor decoding capability.
10. Type this code into the JS console: CBOR.decode(newCredential.response.attestationObject)

Expected

you see output in the JS console that looks like:

{fmt: 'tpm', attStmt: {…}, authData: Uint8Array(359)}

Actual

you see output in the JS console that looks like:

Object { fmt: "none", attStmt: {}, authData: Uint8Array(359) }

Comment 12

[R. Martinho Fernandes [:rmf]]

Attachment: Bug 1631010 - Update windows webauthn header

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:rmf, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/10298f1b10cb
Update windows webauthn header r=dveditz

Comment 15

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/10298f1b10cb