...
Tester: | |
|---|---|
| }}Date: Use '//' to input date{15{ |
|
| }}Authenticator (or device) vendor: Yubico, Apple, Dell, HP, Android phone brand...{3{ | Lenovo |
| }}Authenticator (or device) model: YubiKey 5 NFC, iPhone 13, PC model name, MacBook year size, MacBook Air year size, MacBook Pro year size...{20{ | IdeaPad 720S 14in |
| }}OS and its version: iOS 13, macOS 10.5.8, Windows 10 22H2, Windows 11 22H2, Android 13...{25{ | Windows 11 22H2 |
| }}Browser and its version: Chrome 114, Firefox 114...{30{ | Chrome 114.0.5735.199 |
}}I registered a PIN/password/finger/face in the authenticator before the session: trigger user registration.){35{ | yesYes |
}}
- Be prepared to capture screenshots of each system/browser dialogue that appears. Later in this process, you will register a passkey multiple times.
...
- Windows 11: Settings > Accounts > Passkeys
- iOS: Settings > Apple ID > iCloud > Passwords & Keychain
- Chrome (Windows): Settings > Autofill and passwords > Password Manager > Manage passkeys
These are exemplary paths. You need to screenshot the only passkey-relates options
...
. Please paste screenshots in or outside this table as suitable:
| ||||
Get diagnostics
- Open https://webauthntest.identitystandards.io/.
- Click the "..." button.
}}Copy-paste the diagnostic results on the right as text (rows are labelled the same): Platform authenticator (isUVPAA) : Conditional Mediation (Autofill UI) : CTAP2 support (Firefox) : {40{ | Platform authenticator (isUVPAA)Available Conditional Mediation (Autofill UI)Supported CTAP2 support (Firefox)Not defined |
|---|
}}
Set repeated settings
- Click the "+" button to create a passkey. Choose the following values:
- RP Info: This domain
- User Info: Bob
- Attachment: undefinedUndefined
- Require Resident Key: trueTrue
- Resident Key (L2): requiredRequired
It should look like this:
...
- Capture and paste below the screenshot of various prompts, screens, dialogues, questions or messages that show up during passkey registration as you encounter them.
- If some options are offered, snapshot them as well, but do not change anything.
- Capture screenshots at each step of the first passkey creation.
- Also, capture screenshots when new screens appear during subsequent passkey creations and add them here.
- Try not to duplicate screenshots of the same steps, as interactions will likely look similar.
If you encounter an error message like "Authenticator data cannot be parsed", it indicates that the combination of arguments used is not supported by the authenticator being tested.
- You can add a note to a screenshot if you encounter an error or find something interesting.
Please insert or paste screenshots in this table as suitable, preferably putting the related screenshots in one row (you can place a note beneath an image in the same cell):
| Seq1 |
In Chrome |
|
After switching to Fingerprint |
Second time | ||
| Seq2 (just new screens) |
On Use ES***, Use EdDSA |
After Cancel | ||||
| Seq3 (just new screens) |
Chrome on timeout of the creation form | |||||
| Seq4 (just new screens) |
Place one row after each?
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | Unsupported, required security key |
|---|
}}
- Uncheck Use ES256, check Use ES384 and click CREATE.
- Follow the requested steps to create a passkey, then copy-paste the result from the web app.
Copy-paste the result on the right: | Unsupported, required security key |
|---|
}}
- Uncheck Use ES384, check Use ES512 and click CREATE.
- Follow the requested steps to create a passkey, then copy-paste the result from the web app.
Copy-paste the result on the right: | Unsupported, required security key |
|---|
}}
- Uncheck Use ES512, check Use RS256 and click CREATE.
- Follow the requested steps to create a passkey, then copy-paste the result from the web app.
Copy-paste the result on the right: | bob@example.comCredential ID RP ID AAGUID Credential Registration Data [more details] Last Authentication Data [more details] |
|---|
...
Copy-paste the result on the right: | Unsupported, required security key |
|---|
}}
...
Conclusion
Do you have any additional observations or comments related to the entire procedure:{125{ | The same as for Firefox, except for the extra first screen. It would be interesting to try to select eg ES512 or EdDSA and also RS256 and see what a security keay would choose. |
|---|
...