Skip to content

Commit e538caf

Browse files
BccorbBccorb
authored
Merge pull request #133 from fells-code/docs/fido-self-validation
docs: publish the FIDO2 server self-validation results
2 parents b49ccad + 7c2e135 commit e538caf

3 files changed

Lines changed: 113 additions & 2 deletions

File tree

‎public/fido-self-validation-2026-10-21.webp‎

268 KB
Loading

‎src/content/docs/understand/fido-self-validation.mdx‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
title: 'FIDO2 Server Self-Validation'
3+
description: 'Results of running the FIDO Alliance conformance tools against the Seamless Auth API: tool version, date, pass or fail per suite, the tests that did not run and why, and known deviations. Self-validation, not certification.'
4+
sidebar:
5+
order: 7
6+
---
7+
8+
import { Aside } from '@astrojs/starlight/components';
9+
import Image from '../../../components/Image.astro';
10+
11+
<Aside type="caution" title="Self-validation, not certification">
12+
These are results of running the FIDO Alliance's public conformance tools ourselves. The FIDO
13+
Alliance has not reviewed them, and Seamless Auth is not FIDO Certified. Interoperability testing
14+
and certification are planned for v1.0
15+
([#397](https://github.com/fells-code/seamless-auth-api/issues/397)).
16+
</Aside>
17+
18+
## Latest Run
19+
20+
| | |
21+
| --- | --- |
22+
| Date | 2026-10-21 |
23+
| Tool | FIDO Conformance Tools 1.9.1 (desktop), FIDO2 Server tests |
24+
| Server | [`seamless-auth-api` v0.19.3](https://github.com/fells-code/seamless-auth-api/tree/v0.19.3) |
25+
| Result | **159 passed, 0 failed** (21.52 s) |
26+
| Test groups | All selected: MakeCredential Request, MakeCredential Response, MakeCredential Platform Attestations, GetAssertion Request, GetAssertion Response, Metadata Service Tests |
27+
| Optional features selected | Android Keystore attestation |
28+
29+
<Image
30+
src="/fido-self-validation-2026-10-21.webp"
31+
alt="FIDO Conformance Tools 1.9.1, FIDO2 Server tests: passes 159, failures 0, duration 21.52s"
32+
caption="Summary and configuration of the 2026-10-21 run"
33+
/>
34+
35+
## Results Per Suite
36+
37+
Every test the tool ran in each suite passed.
38+
39+
| Suite | What it tests | Result |
40+
| --- | --- | --- |
41+
| Server-ServerPublicKeyCredentialCreationOptions-Req-1 | Registration options | Pass |
42+
| Server-ServerAuthenticatorAttestationResponse-Resp-1 | Registration response structure | Pass |
43+
| Server-ServerAuthenticatorAttestationResponse-Resp-2 | Registration `clientDataJSON` | Pass |
44+
| Server-ServerAuthenticatorAttestationResponse-Resp-3 | `attestationObject` | Pass |
45+
| Server-ServerAuthenticatorAttestationResponse-Resp-4 | Authentication algorithms | Pass, optional algorithms not run (below) |
46+
| Server-ServerAuthenticatorAttestationResponse-Resp-5 | `packed` full attestation | Pass |
47+
| Server-ServerAuthenticatorAttestationResponse-Resp-6 | `packed` self attestation | Pass |
48+
| Server-ServerAuthenticatorAttestationResponse-Resp-7 | `none` attestation | Pass |
49+
| Server-ServerAuthenticatorAttestationResponse-Resp-8 | `fido-u2f` attestation | Pass |
50+
| Server-ServerAuthenticatorAttestationResponse-Resp-9 | `tpm` attestation | Pass, P-3 and P-4 not run (below) |
51+
| Server-ServerAuthenticatorAttestationResponse-Resp-A | `android-key` attestation | Pass |
52+
| Server-ServerPublicKeyCredentialGetOptionsResponse-Req-1 | Authentication options | Pass |
53+
| Server-ServerAuthenticatorAssertionResponse-Resp-1 | Authentication response structure | Pass |
54+
| Server-ServerAuthenticatorAssertionResponse-Resp-2 | Authentication `clientDataJSON` | Pass |
55+
| Server-ServerAuthenticatorAssertionResponse-Resp-3 | `authenticatorData` | Pass |
56+
| Server-MDS3 | FIDO Metadata Service 3 | Pass |
57+
58+
## Tests That Did Not Run
59+
60+
The tool runs an optional test only when it is selected, and only for the algorithms the server
61+
supports. The API supports EdDSA, ES256, RS256 and RS1
62+
([`webauthnAlgorithms.ts`](https://github.com/fells-code/seamless-auth-api/blob/v0.19.3/src/lib/webauthnAlgorithms.ts)),
63+
so these did not run:
64+
65+
- **Resp-4 P-1, P-2, P-3, P-4, P-6, P-7, P-10, P-11:** the optional algorithms ES256K (secp256k1),
66+
PS256, PS384, PS512, RS384, RS512, ES384 and ES512, which the API does not offer.
67+
- **Resp-9 P-4,** `tpm` attestation with ES256. The tool lists it as experimental, and it was
68+
deselected for this run. With it selected, it fails: the attestation is refused with
69+
`PubArea unique is not same as public key x and y (TPM|ECC)`. The cause is in the WebAuthn
70+
library the API uses (SimpleWebAuthn 14.0.3): its TPM structure parser does not read the hash
71+
algorithm that follows an ECDSA signing scheme, so every later field is read two bytes early.
72+
The authenticator's key matches the credential. A TPM that sets an ECDSA scheme on an ES256 key
73+
cannot register a passkey with `attestation: 'direct'` until the library is fixed. Reported
74+
upstream as [SimpleWebAuthn#818](https://github.com/MasterKale/SimpleWebAuthn/issues/818).
75+
- **Resp-9 P-3,** `tpm` attestation whose `pubArea.nameAlg` differs from the algorithm used for
76+
`attested.name`. The tool did not run it in this configuration.
77+
78+
## Known Deviations
79+
80+
- **Android SafetyNet attestation is not tested.** Tool 1.9.1 has no SafetyNet suite, and
81+
SafetyNet cannot be tested with fixtures: its statements expire within a minute and the tools
82+
never emit one. The API still verifies SafetyNet attestation through SimpleWebAuthn.
83+
- **The tools drive a test-only interface.** They speak their own message format, so the API mounts
84+
`/conformance` routes only when `FIDO_CONFORMANCE_MODE=true`, and never under
85+
`NODE_ENV=production`
86+
([`conformanceMode.ts`](https://github.com/fells-code/seamless-auth-api/blob/v0.19.3/src/config/conformanceMode.ts)).
87+
Those routes verify registrations and assertions with the same SimpleWebAuthn calls, origins,
88+
RP ID and supported algorithms as the production WebAuthn routes
89+
([`conformance.ts`](https://github.com/fells-code/seamless-auth-api/blob/v0.19.3/src/controllers/conformance.ts),
90+
[`webauthn.ts`](https://github.com/fells-code/seamless-auth-api/blob/v0.19.3/src/controllers/webauthn.ts)).
91+
They skip what the tools cannot exercise: the pre-auth flow, session issuance, and the
92+
deployment's authenticator policy. The options they return echo the selection criteria,
93+
attestation conveyance and extensions the tools request, as the tools require.
94+
- **Test metadata and roots.** For the run, the API loads the tools' own metadata statements and
95+
Metadata Service endpoints and trusts the tools' test root certificate, because the tools sign
96+
every attestation with test keys.
97+
98+
## Earlier Runs
99+
100+
The first runs, on 2026-09-02 against the development branch after v0.7.4, found and fixed two issues: the
101+
conformance metadata loader did not read the tools' nested statement directory, so every
102+
attestation was refused as unlisted, and the registration options carried an extension the tools
103+
had not asked for. The tool's own report was not kept from those runs, so they are not published
104+
as results.
105+
106+
---
107+
108+
## Related Docs
109+
110+
- [Security Posture and Threat Model](/understand/security)

‎src/content/docs/understand/security.mdx‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ can be checked rather than taken on trust.
1515

1616
<Aside type="note">
1717
This page describes `seamless-auth-api` v0.19.1. The project is pre-1.0. Seamless Auth holds no
18-
security certification: FIDO certification is deferred to v1.0, and FIDO self-validation results
19-
are not published yet.
18+
security certification: FIDO certification is deferred to v1.0. The FIDO2 server
19+
[self-validation results](/understand/fido-self-validation) are published.
2020
</Aside>
2121

2222
The longer rationale for each accepted tradeoff lives in the API repository's
@@ -397,6 +397,7 @@ Source code checks run in CI:
397397
## Related Docs
398398

399399
- [OAuth Client and RFC 9700](/understand/oauth-rfc9700)
400+
- [FIDO2 Server Self-Validation](/understand/fido-self-validation)
400401
- [Session Model](/understand/sessions)
401402
- [Auth Events and Auditing](/understand/authevents)
402403
- [Cookies, Sessions, and Tokens](/reference/cookies-sessions-tokens)

0 commit comments

Comments
 (0)