Skip to content

Update fido_certification.md #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BryanJacobs merged 1 commit into from
Aug 1, 2026
+7 −2
Merged

Update fido_certification.md #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions docs/fido_certification.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,18 +60,23 @@ The user private key is stored inside the key handle. The key handle consists of
Nonce := 15 random bytes
IV := 16 random bytes
Payload := SHA256(AppID) || Uauth.priv || CredProtectIndicationByte || Nonce
EncryptedPayload := IV || AES256-CBC(Payload)
KeyHandle := EncryptedPayload || Left16(SHA256(EncryptedPayload))
EncryptedPayload := IV || AES256-CBC(K_wrap, IV, Payload)
KeyHandle := EncryptedPayload || Left16(HMAC-SHA256(K_mac, EncryptedPayload))
```

Where:

- AppID is the CTAP1 Application ID or the CTAP2 Relying Party ID
- Uauth.priv is the generated User Private Key, encoded as a raw point on the NIST P-256 curve
- K_wrap is the Credential Wrapping Key (AES-256)
- K_mac is the Credential Wrapping HMAC Key (a dedicated, randomly generated 256-bit key, distinct from K_wrap, regenerated on CTAP reset)
- Left16 is a function taking the first 16 bytes of its input, discarding the remainder
- CredProtectIndicationByte is a single byte containing the credential protection level applied to the credential. If
the credential is generated as discoverable, the high bit of this byte is set to support later credential deletion

The construction is Encrypt-then-HMAC: the HMAC is computed over the entire EncryptedPayload (including the IV) and is
verified prior to any decryption or use of decrypted data.

The Key Handle is used as the opaque Credential ID, for both discoverable and non-discoverable credentials.

The relevant implementation source code for the construction of the key handle / Credential ID is the
Expand Down