Create discoverable credentials without PIN verification

[Praveen PPT]

Can we create discoverable credentials without doing PINAuth Verification if client pin is false (Client PIN supported but PIN not set). This is coming from Step 7 and 8 of MakeCredhttps://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorMakeCredential

[Adam Langley]

On Tuesday, June 25, 2024 at 7:54:07 AM UTC-7 Praveen PPT wrote:

Can we create discoverable credentials without doing PINAuth Verification if client pin is false (Client PIN supported but PIN not set). This is coming from Step 7 and 8 of MakeCredhttps://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorMakeCredential

You should probably use a more recent version of the spec, either from GitHub or at least https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#authenticatorMakeCredential

From the latter, step 7 is fairly clear that discoverable credentials cannot be created without UV once UV is set up. But before it's set up, I believe you can create them without UV. However, I don't think Chromium-based browsers will make such requests in any case.

Cheers

AGL

[Praveen PPT]

Thank you Adam :) 

Kind Regards,

Praveen P T