How to use the FIDO Conformance self test tool

[Vishisht Tiwari]

Hello All,

I have developed an Android client and not want to check it using the FIDO Conformance self-test tool. I have installed the .apk file for the conformance tool onto the android phone and have put in the client name, package name, and a sample metadata information. When I run the registration test for FIDO UAF Client, I passed 119 tests and failed 23. The point is that at this point my android FIDO client was not even installed on the phone and obviously was not running as well. My question is how is the self-test tool testing the android client. I initially thought some sort of server would be involved in this process which would be checking the data I will be sending but I don't see any server in the conformance tool. I am really confused how this self-test tool is working and how will it check my FIDO client using just the package name and metadata.

Thanks,

Vish

[Bao Hoa]

Hi Vish,

I am also working with this tool. So far, I see that FIDO Conformance Tool plays roles of FIDO Client. It communicates with Server to validate server APIs exposed. It also communicate with external authenticator to validate authenticator APIs exposed. So, make sure you have your FIDO server, FIDO authenticator ready to be validated.

For server validation, you need to provide metadata which tells the tool which algorithms your server supports.

For authenticator validation, here I am only using app authenticator on Android, just make sure the app is opening and bluetooth is advertising. I have no idea if you are using USB or NFC authenticator.

[Vishisht Tiwari]

Thank you for your reply Boa,

The thing is I don't have a FIDO server, I am thinking of using an open source FIDO server. I am just creating a FIDO client on iOS and Android where the authenticators will be touchID/faceID on iOS and other native touch recognition systems in Android. I need to test this client and I thought I could use the conformance tool to test my FIDO client. Am I wrong in this inderstanding?

Thanks,

Vish

[Arshad Noor]

Hi Vish,

You can find a FIDO Certified, open-source FIDO2 server at
https://github.com/strongkey.  You can also find useful information at
https://encryptedweb.org.

Arshad Noor
StrongKey

[Bao Hoa]

Hi Vish,

Actually you are developing authenticator in iOS, Android. That's great idea, I have also done it in Android. However, when we develop authenticator in iOS, we can face one issue which is related to Apple policy. Please check it here: https://groups.google.com/a/fidoalliance.org/forum/#!topic/fido-dev/xDriNjLzcIg

I hope apple will change policy so that it works with FIDO specification.

[Vish]

Thanks for your response Boa. Could you then how can I use the conformance test tool. Do i need a server to use the conformance tool? Also how can i get the metadata for the authenticators?

Thanks,

Vish

[Bao Hoa]

Vish, 

here

[Ching Lin]

So for those who are going to test the external authenticator, it seems that before using the testing tool given by the FIDO Alliance, we should first build a server?