PASSKEY Factor Fails Registration on YubiKey in VIP AuthHub

Products

• VIP Authentication Hub

Issue/Introduction

It has been observed that the PASSKEY factor option fails when attempting to save to a Yubikey. This was tested and observed on both USB Type C and regular USB Yubikeys. The error observed is "Invalid attestation data buffer: leftovers"  but SECURITYKEY factor still works as expected.

When choosing PASSKEY, Windows 11 gives the option for all 3 options(Windows 11 Device, Security Key, and an External Device(Iphone etc.) Is this the intended use? It is noticed that no authenticatorAttachment is passed to the OS, which would make sense as to why You could choose both platform and cross-platform?

Environment

VIP Authentication(Auth) Hub

Release: 3.3 to 3.4.1

Resolution

Using a passkey as an authentication factor and then attempting to register it on a hardware key is a known issue. VIP AuthHub team is currently reviewing and updating the FIDO configuration to determine whether the authentication flows can be modified to support this sequence and ensure interoperability between passkeys and hardware-based authenticators. This is slated for a future release and updates will be made to this KB when the feature is available.