FIDO/CTAP : Duplicate PIN verification issue with Yubikey 5c NFC on Android 15
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 14.6k
- Forks
- 3.2k
- Avg merge
- 12d 11h
- Merged PRs (30d)
- 4
Description
Describe the bug
When registering on webauthn.io with the configuration shown in the screenshot, the system prompts for the PIN a second time after the initial PIN verification and tapping the Yubikey.
To Reproduce
Steps to reproduce the behavior:
Configure the options on webauthn.io as shown in the screenshot.
Click on the registration button.
Verify the PIN when prompted, then tap the Yubikey 5c NFC.
Notice that the system incorrectly requests the PIN verification again.
Expected behavior
Registration should succeed immediately after the initial key tap, rather than prompting for the PIN a second time.
Screenshots
System
Android Version: 15
Custom ROM: Android
Hardware: Yubikey 5c NFC
Additional context
Found this issue during testing with s1m/hw-fido2-provider. Notably, other custom security keys work perfectly fine.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the registration flow on Android 15 with a Yubikey 5c NFC using the webauthn.io configuration described in the issue, and compare it with another custom security key. Trace the FIDO/CTAP interaction and the s1m/hw-fido2-provider path; done means the initial PIN verification and key tap complete registration without a second PIN prompt.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- authentication, mobile-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100