You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 5 Current »

Create a copy of this page as a sibling and complete it as instructed below.

Describe the platform

To ensure a successful test of the authenticator, please follow these steps:

  • For this test, you need a computer or mobile device and a hardware or software authenticator. It may be:
    • Hardware authenticator, such as YubiKey.
    • Operating system authenticator, such as Touch ID or Windows Hello.
    • Software authenticator, such as tpm-fido.
    • Password manager with passkey support, such as Dashlane.
  • The actions performed during this test are parts of regular usage and should not affect the authenticator in any way. However, you may choose to use a brand-new authenticator, reset or clear it to avoid any conflicts during the test.
  • If necessary, delete the passkey that you create during this testing if it prevents you from creating it again. This should not happen, but if it does, please provide a screenshot and an accompanying note. If you are willing to, reset the authenticator's settings (e.g., disable PIN, unregister fingerprint).
  • Fill in the details in the table below:

Tester:
@ (name yourself){10{

Branko Marovic 

}}Date:
Use '//' to input date{15{

 

}}Authenticator (or device) vendor:
Yubico, Apple, Dell, HP, Android phone brand...{3{
Lenovo
}}Authenticator (or device) model:
YubiKey 5 NFC, iPhone 13, PC model name, MacBook year size, MacBook Air year size, MacBook Pro year size...{20{
IdeaPad 720S 14in
}}OS and its version:
iOS 13, macOS 10.5.8, Windows 10 22H2, Windows 11 22H2, Android 13...{25{

Windows 11 22H2

}}Browser and its version:
Chrome 114, Firefox 114...{30{
Chrome 114.0.5735.199

}}I registered a PIN/password/finger/face in the authenticator before the session:
Yes or No
(
The situation where you have not previously registered in the authenticator is interesting for checking if the passkey creation will trigger user registration.){35{

Yes

}}

  • Be prepared to capture screenshots of each system/browser dialogue that appears. Later in this process, you will register a passkey multiple times.

Capture the platform or browser passkey options

  • If there are any options or settings related to "passkeys", "security keys" or similar in your OS/device/spaceship settings (related to the authenticator you are going to use), capture screenshots and paste or attach them here.
    • If you are using a password manager, capture its passkey-related options.
    • If you are using a browser supporting passkeys, capture its options instead.
    • If you are using an operating system to manage passkeys, capture its options instead.

Possible locations:

    • Windows 11: Settings > Accounts > Passkeys
    • iOS: Settings > Apple ID > iCloud > Passwords & Keychain
    • Chrome (Windows): Settings > Autofill and passwords > Password Manager > Manage passkeys

These are exemplary paths. You need to screenshot the only passkey-relateD options. Please paste screenshots in or outside this table as suitable:




















Get diagnostics

}}Copy-paste the diagnostic results on the right as text (rows are labelled the same):

Platform authenticator (isUVPAA)


Conditional Mediation (Autofill UI)


CTAP2 support (Firefox)


{40{

Platform authenticator (isUVPAA)Available


Conditional Mediation (Autofill UI)Supported


CTAP2 support (Firefox)Not defined

}}

Set repeated settings

  • Click the "+" button to create a passkey. Choose the following:
    • RP Info: This domain
    • User Info: Bob
    • Attachment: Undefined
    • Require Resident Key: True
    • Resident Key (L2): Required

It should look like this:

Create passkeys using various settings


  • Capture and paste below the screenshot of various prompts, screens, dialogues, questions or messages that show up during passkey registration as you encounter them.
    • If some options are offered, snapshot them as well, but do not change anything.
    • Capture screenshots at each step of the first passkey creation.
    • Also, capture screenshots when new screens appear during subsequent passkey creations and add them here.
    • Try not to duplicate screenshots of the same steps, as interactions will likely look similar.
    • If you encounter an error message like "Authenticator data cannot be parsed", it indicates that the combination of arguments used is not supported by the authenticator being tested.

    • You can add a note to a screenshot if you encounter an error or find something interesting.

Please insert or paste screenshots in this table as suitable, preferably putting the related screenshots in one row (you can place a note beneath an image in the same cell):

Seq1

In Chrome

After switching to Fingerprint

Second time



Seq2 (just new screens)

On Use ES***, Use EdDSA

After Cancel





Seq3 (just new screens)

Chrome on timeout of the creation form






Seq4 (just new screens)





Test User Verification

  • Select User Verification: Discouraged and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{45{

bob@example.com


Credential ID
9CEDF8FC86F71AEB8B73F65C60235370724E9097724E49E50E563C41DFF5268B

RP ID
webauthntest.identitystandards.io

AAGUID
00000000-0000-0000-0000-000000000000

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: none (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Select User Verification: Required and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.
  • Note that the latest result is the rightmost in the bottom row. You may delete already pasted results.
  • All authenticators should be able to register multiple passkeys for the same domain, so you do not need to delete the previously created one. It is likely that the passkeys you create will override each other since they are for the same domain and use the same user name "bob@example.com").

Copy-paste the result on the right:
Put Unsupported if there was an error{50{

bob@example.com


Credential ID
05A81DBFA7330EFE5DF83B9DE49CC99EA56992DECF5508C870EB2696240A8F44

RP ID
webauthntest.identitystandards.io

AAGUID
00000000-0000-0000-0000-000000000000

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: none (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

Test Attestation

  • Select Attestation: Enterprise and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{55{

bob@example.com


Credential ID
85F10FEFCBE8E0EF63F3FC93D3ADBF23D4F0F92C36740C725003D38D0019E10A

RP ID
webauthntest.identitystandards.io

AAGUID
00000000-0000-0000-0000-000000000000

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: none (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Select Attestation: Direct and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{60{

bob@example.com


Credential ID
C0713674D980EC38E8E5ED8B6F105E6B28F640EA12380B8A213A05C43EFE3C97

RP ID
webauthntest.identitystandards.io

AAGUID
6028B017-B1D4-4C02-B4B3-AFCDAFC96BB2

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: packed (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Select Attestation: Indirect and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{65{

bob@example.com


Credential ID
C4901D36D4BCED62E8B41AD35D480155C3C1D38A397CE4DC81FB5360AE0DEFC3

RP ID
webauthntest.identitystandards.io

AAGUID
6028B017-B1D4-4C02-B4B3-AFCDAFC96BB2

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: packed (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Select Attestation: None and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{70{

bob@example.com


Credential ID
277F30670894579B697920ABBC693274C31EF42E1BEFF872D948D974B516F5D0

RP ID
webauthntest.identitystandards.io

AAGUID
00000000-0000-0000-0000-000000000000

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: none (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • If none of the previous four tries worked:
    • Select Attestation: Undefined and click CREATE.
    • Follow the requested steps to create a passkey, then copy-paste the result from the web app.
  • Otherwise, skip this step.

Copy-paste the result on the right:
Put Unsupported if there was an error{75{

bob@example.com


Credential ID
FBB5977FD49698A5EBDCEA347DBBE62C250EE96A95D83D79DCBEA9C2E6CA0462

RP ID
webauthntest.identitystandards.io

AAGUID
00000000-0000-0000-0000-000000000000

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: none (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • If Attestation: Direct worked, select it. Otherwise, if Attestation: Indirect worked, select it. Otherwise, select Attestation: Undefined.

Test CredProtect Extension

  • Select CredProtect Extension: UVOptional and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{80{

bob@example.com


Credential ID
2B4778CE2FA83D3BB086511EA2F70E1899658E9DE496F54A39C2DCA56AF6F778

RP ID
webauthntest.identitystandards.io

AAGUID
6028B017-B1D4-4C02-B4B3-AFCDAFC96BB2

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: packed (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Select CredProtect Extension: UVOptionalWithCredIDList and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{85{

bob@example.com


Credential ID
C3C629A8F3414EC7C8A1302DF0762919711EF7262BB9D395087721B3D3582039

RP ID
webauthntest.identitystandards.io

AAGUID
6028B017-B1D4-4C02-B4B3-AFCDAFC96BB2

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: packed (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Select CredProtect Extension: UVRequired and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{90{

bob@example.com


Credential ID
57A9BEAB12CE815743ACF372BBD39DB22EFC7F90BE720B4128024911077570C6

RP ID
webauthntest.identitystandards.io

AAGUID
6028B017-B1D4-4C02-B4B3-AFCDAFC96BB2

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: packed (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • If none of the previous three tries worked:
    • Select CredProtect Extension: Undefined and click CREATE.
    • Follow the requested steps to create a passkey, then copy-paste the result from the web app.
  • Otherwise, skip this step.

Copy-paste the result on the right:
Put Unsupported if there was an error{95{

bob@example.com


Credential ID
8071C004B5BBE4EC75DD463FAC3A03BD5E6E88F08E683116EF5A24B5E5338D47

RP ID
webauthntest.identitystandards.io

AAGUID
6028B017-B1D4-4C02-B4B3-AFCDAFC96BB2

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: packed (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Select CredProtect Extension: Undefined (if not selected already).

Test cryptography

  • Uncheck all the following checkboxes: Use ES256, Use ES384, Use ES512, Use RS256, Use EdDSA.
  • Check Use ES256 and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{100{

Unsupported
Reqiredsecurity key, I chose 'Cancel'

}}

  • Uncheck Use ES256, check Use ES384 and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{105{

Unsupported
Reqiredsecurity key, I chose 'Cancel'

}}

  • Uncheck Use ES384, check Use ES512 and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{110{

Unsupported
Reqiredsecurity key, I chose 'Cancel'

}}

  • Uncheck Use ES512, check Use RS256 and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{115{

bob@example.com


Credential ID
F96E53AA339979385F8F36447F6C2AC463870D39C1ACEF2F2D3D652022FBDF5B

RP ID
webauthntest.identitystandards.io

AAGUID
6028B017-B1D4-4C02-B4B3-AFCDAFC96BB2

Credential Registration Data [more details]
Key Type: RSA
Discoverable Credential: true
Attestation Type: packed (unverified)
UP=1, UV=1, AT=1, ED=0, SignCount=0

Last Authentication Data [more details]
No authentications

}}

  • Uncheck Use RS256, check Use EdDSA
  • and click CREATE.
  • Follow the requested steps to create a passkey, then copy-paste the result from the web app.

Copy-paste the result on the right:
Put Unsupported if there was an error{120{

Unsupported, required security key

}}

Conclusion

Do you have any additional observations or comments related to the entire procedure:{125{

The same as for Firefox, except for the extra first screen.

It would be interesting to try to select eg ES512 or EdDSA and also RS256 and see what a security keay would choose.

}}

  • Please do not forget to paste any pending screenshots in the above tables.
  • You may also paste the screenshot with the passkey(s) created during this test. The list of created passkeys is usually shown along with platform or browser passkey options that you were already asked to screenshot.

Thank you!

  • No labels