A handful of server errors coming from Windows devices

Hi @MasterKale ! We’re using SimpleWebAuth at https://github.com/padloc/padloc (server and client) and we’ve been seeing quite a few errors for Windows devices, failing authentication. These vary, but always fall into one of these two:

Error: PubArea unique is not same as public key x and y (TPM|ECC)

    at verifyAttestationTPM (/padloc/packages/server/node_modules/@simplewebauthn/server/src/registration/verifications/tpm/verifyAttestationTPM.ts:115:13)

    at verifyRegistrationResponse (/padloc/packages/server/node_modules/@simplewebauthn/server/src/registration/verifyRegistrationResponse.ts:223:42)

    at WebAuthnServer.activateAuthenticator (/padloc/packages/server/src/auth/webauthn.ts:116:80)

Stack Trace:

Error: Public key algorithm [object Object] did not match any metadata algorithms [] (TPM)

    at verifyAttestationTPM (/padloc/packages/server/node_modules/@simplewebauthn/server/src/registration/verifications/tpm/verifyAttestationTPM.ts:267:13)

    at runMicrotasks ()

    at processTicksAndRejections (node:internal/process/task_queues:96:5)

    at verifyRegistrationResponse (/padloc/packages/server/node_modules/@simplewebauthn/server/src/registration/verifyRegistrationResponse.ts:223:16)

    at WebAuthnServer.activateAuthenticator (/padloc/packages/server/src/auth/webauthn.ts:116:48)

We’re wondering if there’s something we should do differently, or if these are a symptom of something else (like Windows Hello)?

Thanks!

FYI @MaKleSoft

[MasterKale]

Both fixes are to @simplewebauthn/server only, correct? Just asking because we’re planning our next release and I’m wondering if it makes sense to wait for this fix.

Yes, that’s correct, both are improvements to server. I figured out how to fix the second bug already, I’m just confirming some values with industry contacts for a bit of validation of my fix. I can probably release the second fix within the next few days to close out this issue.

[MasterKale]

Alright, I found the metadata statement for aaguid "08987058-cadc-4b81-b6e1-30de50dcbe96" in that response. It’s for a “Windows Hello Hardware Authenticator”, and the statement defines the following authenticationAlgorithms:

"authenticationAlgorithms": ["rsa_emsa_pkcs1_sha256_raw"],

Unfortunately I wasn’t able to map this algorithm to COSE info because the FIDO registry I referenced at the time didn’t have values for this one. I see that v2.2 of the registry does at least reference it, so I’ll attempt to define COSE info for at least this algorithm. I’m pretty sure once I can do that then the second error will go away.

Stay tuned 👀