TPM registration responses in v1.6.33 appear to have invalid cert path #618

MasterKale · 2021-08-22T06:29:31Z

FIRST PRE CHECK

I SOLEMNLY SWEAR THAT I HAVE SEARCHED DOCUMENTATION AND WAS NOT ABLE TO RESOLVE MY ISSUE

What protocol are you implementing?

NOTE: UAF 1.0 certification have been officially sunset. U2F 1.2 only supported version of U2F.

What is your implementation class?

If you are platform authenticator vendor, please email conformance-tools@fidoalliance.org

What is the version of the tool are you using?

v1.6.33

What is the OS and the version are you running?

For desktop tools

OSX
Windows
Linux

For UAF mobile tools

iOS
Android

Issue description

I'm running MakeCredential: Platform tests and the TPM tests in particular seem to have trouble with validating the certificate path, starting with the first two certs in x5c:

Getting statement for a7d6d93a-8a0d-11e8-9a94-a6cf71072f73
Sub. Iss.: /C=US/ST=MY/L=Wakefield/O=FIDO Alliance/OU=CWG/CN=FIDO Fake TPM Root Certificate Authority 2018/E=conformance-tools@fidoalliance.org
Iss. Sub.: /CN=Sample Attestation Root/O=FIDO Alliance/OU=UAF TWG,/L=Palo Alto/ST=CA/C=US
RP - attestation: Could not validate certificate path with any metadata root certificates (TPM)

Getting statement for f244b67e-5364-4fd5-9f90-c396227317db
Successfully validated attestation with metadata

Getting statement for a7d6d93a-8a0d-11e8-9a94-a6cf71072f73
Sub. Iss.: /C=US/ST=MY/L=Wakefield/O=FIDO Alliance/OU=CWG/CN=FIDO Fake TPM Root Certificate Authority 2018/E=conformance-tools@fidoalliance.org
Iss. Sub.: /CN=Sample Attestation Root/O=FIDO Alliance/OU=UAF TWG,/L=Palo Alto/ST=CA/C=US
RP - attestation: Could not validate certificate path with any metadata root certificates (TPM)

Getting statement for a7d6d93a-8a0d-11e8-9a94-a6cf71072f73
Sub. Iss.: /C=US/ST=MY/L=Wakefield/O=FIDO Alliance/OU=CWG/CN=FIDO Fake TPM Root Certificate Authority 2018/E=conformance-tools@fidoalliance.org
Iss. Sub.: /CN=Sample Attestation Root/O=FIDO Alliance/OU=UAF TWG,/L=Palo Alto/ST=CA/C=US
RP - attestation: Could not validate certificate path with any metadata root certificates (TPM)

Getting statement for a7d6d93a-8a0d-11e8-9a94-a6cf71072f73
Sub. Iss.: /C=US/ST=MY/L=Wakefield/O=FIDO Alliance/OU=CWG/CN=FIDO Fake TPM Root Certificate Authority 2018/E=conformance-tools@fidoalliance.org
Iss. Sub.: /CN=Sample Attestation Root/O=FIDO Alliance/OU=UAF TWG,/L=Palo Alto/ST=CA/C=US
RP - attestation: Could not validate certificate path with any metadata root certificates (TPM)

Getting statement for a7d6d93a-8a0d-11e8-9a94-a6cf71072f73
Sub. Iss.: /C=US/ST=MY/L=Wakefield/O=FIDO Alliance/OU=CWG/CN=FIDO Fake TPM Root Certificate Authority 2018/E=conformance-tools@fidoalliance.org
Iss. Sub.: /CN=Sample Attestation Root/O=FIDO Alliance/OU=UAF TWG,/L=Palo Alto/ST=CA/C=US
RP - attestation: Could not validate certificate path with any metadata root certificates (TPM)

The cert path is invalid based just on the first two certificates - the root cert is never evaluated in the above failures.

Here's a cert chain I pulled from one of the failures:

The text was updated successfully, but these errors were encountered:

ynojima · 2022-05-14T10:30:46Z

@herrjemand As far as I check with v1.6.46, this issue still exists.

yackermann · 2022-05-18T08:44:29Z

@ynojima Try latest 1.6.48 https://builds.fidoalliance.org/Desktop%20UAF%20FIDO2%20U2F/EXPERIMENTAL/v1.6.48/

aseigler · 2022-05-18T13:12:00Z

v1.6.48 didn't help. Same issue.

aseigler · 2022-05-18T16:40:19Z

The CRL at this URL: https://pki.certinfra.fidoalliance.org/tpm/crl/FIDO%20Fake%20TPM%20Root%20Certificate%20Authority%202018.crl

$ openssl crl -in 'FIDO Fake TPM Root Certificate Authority 2018.crl' -text
Certificate Revocation List (CRL):
        Version 2 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = MY, L = Wakefield, O = FIDO Alliance, OU = CWG, CN = FIDO Fake TPM Root Certificate Authority 2018, emailAddress = conformance-tools@fidoalliance.org
        Last Update: Feb  1 00:00:00 2018 GMT
        Next Update: Feb  1 00:00:00 2020 GMT
        CRL extensions:
            X509v3 CRL Number:
                1
            X509v3 Authority Key Identifier:
                keyid:43:11:16:99:9A:EE:9D:50:37:C2:4F:FE:E2:5B:15:C9:09:33:3F:32

Is signed with this from the conformance metadata file Virtual RSA PKCS 1.5 SHA256 FIDO2 Conformance Testing CTAP2 Authenticator with TPM Attestation.json under attestationRootCertificates:

$ openssl x509 -in tpmroot.cer -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            8b:c2:5c:12:8b:13:42:d2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = MY, L = Wakefield, O = FIDO Alliance, OU = CWG, CN = FIDO Fake TPM Root Certificate Authority 2018, emailAddress = conformance-tools@fidoalliance.org
        Validity
            Not Before: Apr 25 05:45:38 2019 GMT
            Not After : Sep 10 05:45:38 2046 GMT
        Subject: C = US, ST = MY, L = Wakefield, O = FIDO Alliance, OU = CWG, CN = FIDO Fake TPM Root Certificate Authority 2018, emailAddress = conformance-tools@fidoalliance.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                `snipped for brevity`
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign
            X509v3 Subject Key Identifier:
                43:11:16:99:9A:EE:9D:50:37:C2:4F:FE:E2:5B:15:C9:09:33:3F:32

The authority key identifier on the CRL matches the subject key identifier on the certificate, but the X509v3 Key Usage extension only has digitalSignature and keyCertSign, it is missing cRLSign which means it cannot be accepted as a CRL signer.

Additionally, the CRL in question and the one at https://pki.certinfra.fidoalliance.org/tpm/crl/NCU-NTC-KEYID-FF990338E187079A6CD6A03ADC57237445F6A49A.crl are currently expired.

ThaminduDilshan · 2022-07-08T11:09:49Z

@herrjemand any update regarding this test failure? Seems not fixed with v1.6.48

Spomky · 2022-07-12T18:29:42Z

What about the v1.7.0?

aseigler · 2022-07-21T18:03:42Z

This is still an issue in v1.7.2, same issue as I outlined prior above.

yackermann · 2022-07-21T19:20:12Z

Did you update metadata?

On Thu, 21 Jul 2022 at 9:03 PM, Alex Seigler ***@***.***> wrote: This is still an issue in v1.7.2, same issue as I outlined prior above. — Reply to this email directly, view it on GitHub <#618 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAMPOFGYJPUEXHUOS37JKILVVGGITANCNFSM5CSUBQVA> . You are receiving this because you were mentioned.Message ID: <fido-alliance/conformance-test-tools-resources/issues/618/1191783155@ github.com>

-- Yuriy Ackermann FIDO, Identity, Standards skype: ackermann.yuriy github: @herrjemand <https://github.com/herrjemand> twitter: @herrjemand <https://twitter.com/herrjemand> medium: @herrjemand ***@***.***>

aseigler · 2022-07-21T19:50:31Z

Did you update metadata?
Yes, didn't change anything. The second cert in the attestationRootCertificates in the Virtual RSA PKCS 1.5 SHA256 FIDO2 Conformance Testing CTAP2 Authenticator with TPM Attestation.json file is the CRL signer for https://pki.certinfra.fidoalliance.org/tpm/crl/FIDO%20Fake%20TPM%20Root%20Certificate%20Authority%202018.crl and the cert does not have cRLSign key usage set, meaning it is not allowed to sign the CRL. Additionally, the CRL is expired.

aseigler · 2022-07-21T19:53:40Z

ThaminduDilshan · 2022-09-06T10:00:26Z

Any update on resolution for this issue?

Kieun · 2022-10-06T08:50:25Z

Still has same issue in v1.7.6

All certificate path validation for the tpm attestation fails.
Plus, Android safetynet attestation also fails to verify the trust chain.

Kieun · 2022-11-02T01:47:09Z

@herrjemand is there any update on this issue? This issue blocks our interop testing plans.

yackermann · 2022-11-30T10:58:44Z

Ok... how about now? https://builds.fidoalliance.org/Desktop%20UAF%20FIDO2%20U2F/v1.7.7/

Kieun · 2022-11-30T14:43:08Z

@herrjemand let me check them again. Anyway, thanks for your effort. I'll give you the feedbacks.

ptravers-byid · 2022-12-06T19:49:26Z

@herrjemand we are still seeing the same issue with the certificates in 1.7.7

Milton-Ch · 2023-04-27T04:17:25Z

@herrjemand
Testing with version 1.7.7 I usually pass all tests with TPM.
But from 1.7.8 onwards I have the same problem with certificates as reported in this issue.

Kieun · 2023-05-26T01:48:03Z

This issue seems to be resolved in v1.7.11.

yackermann · 2023-09-27T10:09:29Z

Based on the recent feedback this issue resolved since 1.7.10

MasterKale mentioned this issue Aug 22, 2021

feat/fido-mds-3 MasterKale/SimpleWebAuthn#144

Merged

4 tasks

aseigler mentioned this issue Sep 2, 2021

Support MDS3 passwordless-lib/fido2-net-lib#238

Merged

ynojima mentioned this issue Dec 26, 2021

MDS3 Support webauthn4j/webauthn4j#599

Merged

MasterKale mentioned this issue Feb 10, 2022

fix/fido-mds-authr-pubkey-check MasterKale/SimpleWebAuthn#178

Merged

yackermann closed this as completed May 6, 2022

yackermann reopened this Jul 25, 2022

aseigler mentioned this issue Oct 3, 2022

FIDO Alliance Conformance Test Failures passwordless-lib/fido2-net-lib#318

Open

Kieun mentioned this issue May 26, 2023

Certificate path validation for Safetynet attestation test #712

Closed

17 tasks

yackermann closed this as completed Sep 27, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TPM registration responses in v1.6.33 appear to have invalid cert path #618

TPM registration responses in v1.6.33 appear to have invalid cert path #618

MasterKale commented Aug 22, 2021

ynojima commented May 14, 2022

yackermann commented May 18, 2022

aseigler commented May 18, 2022

aseigler commented May 18, 2022

ThaminduDilshan commented Jul 8, 2022

Spomky commented Jul 12, 2022

aseigler commented Jul 21, 2022

yackermann commented Jul 21, 2022 via email

aseigler commented Jul 21, 2022

aseigler commented Jul 21, 2022

ThaminduDilshan commented Sep 6, 2022

Kieun commented Oct 6, 2022

Kieun commented Nov 2, 2022

yackermann commented Nov 30, 2022

Kieun commented Nov 30, 2022

ptravers-byid commented Dec 6, 2022

Milton-Ch commented Apr 27, 2023

Kieun commented May 26, 2023

yackermann commented Sep 27, 2023

TPM registration responses in v1.6.33 appear to have invalid cert path #618

TPM registration responses in v1.6.33 appear to have invalid cert path #618

Comments

MasterKale commented Aug 22, 2021

FIRST PRE CHECK

What protocol are you implementing?

What is your implementation class?

What is the version of the tool are you using?

What is the OS and the version are you running?

Issue description

ynojima commented May 14, 2022

yackermann commented May 18, 2022

aseigler commented May 18, 2022

aseigler commented May 18, 2022

ThaminduDilshan commented Jul 8, 2022

Spomky commented Jul 12, 2022

aseigler commented Jul 21, 2022

yackermann commented Jul 21, 2022 via email

aseigler commented Jul 21, 2022

aseigler commented Jul 21, 2022

ThaminduDilshan commented Sep 6, 2022

Kieun commented Oct 6, 2022

Kieun commented Nov 2, 2022

yackermann commented Nov 30, 2022

Kieun commented Nov 30, 2022

ptravers-byid commented Dec 6, 2022

Milton-Ch commented Apr 27, 2023

Kieun commented May 26, 2023

yackermann commented Sep 27, 2023