Is it possible to edit resident key metadata on FIDO_2_1_PRE?

[aksel]

I want to modify the user and display name of a resident key, but I can't get it to work.

fido2-token -Sc ultimately results in FIDO_ERR_CBOR_UNEXPECTED_TYPE.

From what I gather, it's because my security key doesn't support the updateUserInformation subcommand.

I'm using a Security Key C NFC (5.4.3), which has FIDO_2_0, FIDO_2_1_PRE version strings.

Is it not possible to modify the display name of a resident key on FIDO_2_1_PRE?

---

Some additional context: I got into a rabbit hole because ssh-keygen always sets the username and display name to openssh, even when using -O user=mycooluser. This is contrary to their docs, kinda.

A colleague of mine pointed out that the current ssh-keygen man page description of -O user is inaccurate - what it actually does is set the user handle (AKA user ID) instead of the username.

Yubico/yubikey-manager#444 (comment)

[LDVG]

Hi,

From what I gather, it's because my security key doesn't support the updateUserInformation subcommand.

Yes, that's correct.

Is it not possible to modify the display name of a resident key on FIDO_2_1_PRE?

I don't think it was part of the credential management preview interface. Note that the first public review draft of CTAP 2.1 did not include that subcommand. It was only added in later drafts of the specification.

[aksel]

Nice, thanks for confirming.

Would it make sense to add something like this into fido2-token? Like performing additional feature detection prior to using a command. Checking whether credMgmt or credMgmtPreview are true before using authenticatorCredentialManagement, and explicitly disallowing updateUserInformation when it's credMgmtPreview.

Purely from a developer-experience perspective, I think it would make sense to include it in fido2-token. Out of scope? PR's welcome?

[LDVG]

Thanks for the suggestion!

We've historically done little to none feature checking up front to keep complexity low while also allowing for some flexibility in our tools; e.g. when attempting to communicate with authenticators that are not strictly compatible with the specification. 🙂

[aksel]

Makes sense :)

Thanks for the help!