[pipobscure]

This makes linux-id a complete CTAP 2.1 authenticator, so it can act as the machine's passkey provider with fingerprint verification, closer to Touch ID or Windows Hello than to a security key. It's large (about 10k lines including tests), so it's a draft: I'm happy to split it or to drop parts you'd rather not take.

What changes for users

• Firefox and Chromium: keepalives are sent while waiting for the finger, and cancelling in the browser stops the scan.
• Several accounts per site: they work, and the browser offers an account picker.
• Silent probes no longer prompt.
• PIN: the fingerprint stays the everyday check, and a CTAP PIN is the fallback when the finger isn't recognised or fprintd is unavailable.
  • Chrome's "Manage security keys → passkeys" needs a PIN set, and works once one is.
• Managing passkeys: list and delete them from the browser, fido2-token, or linux-id creds list|delete.
• Reset: from the browser (restart the service when it asks to re-insert the key), or with linux-id reset.
• PRF (hmac-secret) for password managers and end-to-end encrypted apps, plus credProtect.
• OpenSSH resident keys: ssh-keygen -O resident -O verify-required and ssh-keygen -K both work.
• Optional notification: --notify names the site while fprintd waits. Browsers already show their own prompt, so it's off by default.
• Startup fix: the unit now has Restart=on-failure. The service used to give up at boot when it started before logind granted the TPM/uhid ACLs.

Compatibility

• Existing credentials keep working after upgrading. That covers both passkeys and U2F/2FA key handles, until the user's first reset.
• New state in the TPM: the credential generation is a monotonic NV counter at 0x013C1D01, and the "legacy credentials retired" marker is at 0x013C1D02. Both are in the owner range and created on first use; they assume an empty owner authValue, as everything else in linux-id already does.
• Remaining state on disk: creds.json holds TPM-wrapped key handles and metadata; pin.json holds only a TPM-wrapped PIN object and the retry counter.
• Go 1.27 is now required, because of the new dependency github.com/telesma-app/ctap v0.52.0. It provides the PIN/UV protocol primitives and the COSE and CBOR types, rather than re-implementing them.

Design notes

• No secret in local files:
  • The generation secret is derived inside the TPM from the counter value.
  • The PIN is a DA-protected sealed object whose authValue is the PIN hash. It's checked over a salted HMAC session, so offline guessing needs the TPM, and the TPM's lockout applies. Note that the TPM's DA counter is machine-wide.
  • hmac-secret's CredRandom is a TPM2_HMAC under a non-exportable key.
• Credential ID header: new credential IDs carry a small header (credProtect level, hmac-secret flag) that the key's application parameter is bound to, so a stripped or downgraded ID doesn't sign.
• Tokens and the verification cache: a pinUvAuthToken is never issued from the verification cache. Chrome treats getting a token as "the user picked this authenticator", and a cached answer made it send a sign-in meant for a phone passkey to linux-id.

Relation to open PRs

• fix: send CTAPHID_KEEPALIVE while CTAP2 requests are pending #43 (keepalive) and ctap2, fidohid: support silent GetAssertion pre-flight, MakeCredential blink probe, and CTAPHID_CANCEL #42 (silent pre-flight, CANCEL): this covers both, through a general CTAPHID state machine.
• feat: add native system authentication and more reliable passkey flows #41: its CTAP fixes overlap. Its polkit --auth system mode is a different verification approach and could be added alongside this as another verifier.

Testing

• Unit: go test -race ./....
• TPM: LINUXID_TPM_TEST=1 go test ./... runs against /dev/tpmrm0. These tests use their own NV indices and remove them, and the PIN test makes one deliberate wrong guess.
• End-to-end: e2e/ runs a throwaway instance over the real uhid transport, driven by python-fido2 (resident credentials, tokens, PIN incl. fallback, credential management, extensions, reset) and by OpenSSH in a bubblewrap sandbox. See e2e/README.md.
• Daily use: about a day with --auth fprintd on Arch with Chrome. That covered webauthn.io, a self-hosted app with step-up re-authentication, Chrome's PIN setup and passkey management, and ssh. Also using this with firefox (though obviously not managing credentials there)

Not included

• The AAGUID is still all zeros. A project AAGUID, plus an entry in the community AAGUID list so sites can show "linux-id", would be a good follow-up, and it's your call as maintainer.