Support PRF extension

[iinuwa]

Since the PRF extension is useful—for example, for password managers wanting to securely unlock vaults—it would be good for us to support so that clients don't have to replicate this functionality.

Once #5 is completed, we should add support to process the PRF extension as defined in the spec.

[iinuwa]

This may have been resolved in #15, but needs to be verified. I don't currently have a device that can test this.

[msirringhaus]

It works for GetAssertion (where the PRF actually gets calculated), but we seem to be missing a required response field when doing MakeCredential. I have to double-check that. It used to work.

[iinuwa]

@msirringhaus, you were working on PRF recently. Do you know if this is good to close (once we update to a libwebauthn version with linux-credentials/libwebauthn@5d3c9d2 applied)?

[msirringhaus]

Yes, once that bugfix lands, PRF should work.

[zR-JB]

JFYI: I tried it today over bluetooth with google password manager on android, with credentialsd built from master and with the firefox extension (and added https://securitykeys.info/ts/test_suite.html to allowed domains) and it did not work.

#1: Create discoverable credential with PRF

No PRF

Some tests failed

In Chrome this worked, so it is not an issue with ctap 2 to my phone and google password manager.

Just wanted to let you know if you thought it was resolved :D

Edit: It might be because firefox does not support it maybe?

[msirringhaus]

Firefox does support it. It worked fine for me using USB and NFC just now, but I'm using the native patch instead of the extension. Could be a problem with the extension.
If you have time, maybe you could test with the Firefox flatpak (see https://github.com/linux-credentials/credentialsd?tab=readme-ov-file#experimental-firefox-build)? But note: you would have to use the latest release of credentialsd, not directly master, because there is a breaking API change.

[AlfioEmanueleFresta]

JFYI: I tried it today over bluetooth with google password manager on android, with credentialsd built from master and with the firefox extension (and added https://securitykeys.info/ts/test_suite.html to allowed domains) and it did not work.

#1: Create discoverable credential with PRF

No PRF

Some tests failed

In Chrome this worked, so it is not an issue with ctap 2 to my phone and google password manager.

Just wanted to let you know if you thought it was resolved :D

Edit: It might be because firefox does not support it maybe?

Thanks for reporting this. I was able to reproduce the issue with Hybrid (Android + Google Password Manager):

• This may be an issue with libwebauthn, so I've opened: Investigate PRF issue with Hybrid via credentialsd libwebauthn#168
• Curiously, the PRF test fails locally on my Android device when I use Firefox for Android, but succeeds on Chrome.