Skip to content
This repository has been archived by the owner on Sep 16, 2024. It is now read-only.

Failed to parse attestation object #35

Open
jftanner opened this issue Sep 2, 2023 · 3 comments
Open

Failed to parse attestation object #35

jftanner opened this issue Sep 2, 2023 · 3 comments

Comments

@jftanner
Copy link

jftanner commented Sep 2, 2023

Hello. Hopefully you can help me get this working. I'm trying to use Windows Hello (fingerprint, specifically) to an SSH to use with Github.

I built from source, following the instructions and installed with sudo make install.

To generate a key pair, I ran:
SSH_SK_PROVIDER=/usr/local/lib/libwindowsfidobridge.so ssh-keygen -t ecdsa-sk

After a fairly long wait (#21?), I was prompted by the Windows Hello screen and touched the fingerprint reader.
Unfortunately, the result was unsuccessful:

Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
[2023-09-01 21:39:59.472] [win32-bridge] [critical] Failed to parse attestation object: Invalid or unknown attestation object format
Key enrollment failed: invalid format

Please let me know if there's any debuggint information I can provide. I'm quite stuck. :(

Versions:

  • OpenSSH_8.9p1 Ubuntu-3ubuntu0.3, OpenSSL 3.0.2 15 Mar 2022
  • Ubuntu 22.04.3 LTS
  • WSL version: 1.2.5.0
  • Windows version: 10.0.22621.2134
@mxpph
Copy link

mxpph commented Oct 7, 2023 •
edited
Loading

Same issue here.

  • OpenSSH_8.9p1 Ubuntu-3ubuntu0.4, OpenSSL 3.0.2 15 Mar 2022
  • Ubuntu 22.04.3 LTS
  • WSL version: 1.2.5.0
  • Windows version: 10.0.22621.2283

Compiled with the correct release flag (-DSK_API_VERSION=9)

Debug info:

[2023-10-07 15:12:27.494] [win32-bridge] [debug] Parsing CBOR attestation object
[2023-10-07 15:12:27.494] [win32-bridge] [debug] Map keys in CBOR attestation object: ["attStmt", "authData", "fmt"]
[2023-10-07 15:12:27.494] [win32-bridge] [debug] Attestation object format: "none"
[2023-10-07 15:12:27.495] [win32-bridge] [critical] Failed to parse attestation object: Invalid or unknown attestation object format

@bbqrob
Copy link

bbqrob commented Mar 10, 2024 •
edited
Loading

Same thing here, first suffered #21, now stumbling into this. Fix this as described (copied the so file to /mnt/c/temp temporarily and ln it back to /usr/local/lib).

  • OpenSSH_8.9p1 Ubuntu-3ubuntu0.6, OpenSSL 3.0.2 15 Mar 2022
  • Ubuntu 22.04.4 LTS
  • WSL version: 2.0.9.0
  • Windows version: 10.0.22631.3235

Debug ssh-keygen

$ SSH_SK_PROVIDER=/usr/local/lib/libwindowsfidobridge.so sshkeygen -t ecdsa-sk -C sk -vvv
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
debug3: start_helper: started pid=122630
debug3: ssh_msg_send: type 5
debug3: ssh_msg_recv entering
debug1: start_helper: starting /usr/lib/openssh/ssh-sk-helper
debug1: sshsk_enroll: provider "/usr/local/lib/libwindowsfidobridge.so", device "(null)", application "ssh:", userid "(null)", flags 0x01, challenge len 0
debug1: sshsk_enroll: using random challenge
debug1: sshsk_open: provider /usr/local/lib/libwindowsfidobridge.so implements version 0x00090000
[2024-03-10 18:36:31.673] [win32-bridge] [critical] Failed to parse attestation object: Invalid or unknown attestation object format
debug1: sshsk_enroll: provider "/usr/local/lib/libwindowsfidobridge.so" failure -1
debug1: ssh-sk-helper: Enrollment failed: invalid format
debug1: main: reply len 8
debug3: ssh_msg_send: type 5
debug1: client_converse: helper returned error -4
debug3: reap_helper: pid=122630
Key enrollment failed: invalid format

EDIT:
Running with WINDOWS_FIDO_BRIDGE_DEBUG=1 adds the following information:

[2024-03-10 18:56:02.945] [linux-middleware] [debug] Parameters from OpenSSH:
[2024-03-10 18:56:02.945] [linux-middleware] [debug]     Algorithm: 0
[2024-03-10 18:56:02.945] [linux-middleware] [debug]     Challenge:
[2024-03-10 18:56:02.945] [linux-middleware] [debug]       |        0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
[2024-03-10 18:56:02.945] [linux-middleware] [debug]       | 0000: a9 a7 c5 ab 44 3d 52 c7 c1 0e 57 c8 15 ad 4c 6a  ....D=R...W...Lj
[2024-03-10 18:56:02.945] [linux-middleware] [debug]       | 0010: 14 a3 a7 53 1f 9b a3 c4 17 e7 d2 ee 76 b6 7a 15  ...S........v.z.
[2024-03-10 18:56:02.946] [linux-middleware] [debug]     Application: "ssh:"
[2024-03-10 18:56:02.946] [linux-middleware] [debug]     Flags: 0b00000001
[2024-03-10 18:56:02.946] [linux-middleware] [debug]     PIN: (not present)
[2024-03-10 18:56:02.946] [linux-middleware] [debug]     Options:
[2024-03-10 18:56:02.946] [linux-middleware] [debug]         (No options provided)
[2024-03-10 18:56:02.946] [linux-middleware] [debug] Sending CBOR to bridge: {"request_parameters": {"alg": 0, "application": "ssh:", "challenge": b"a9a7c5ab443d52c7c10e57c815ad4c6a14a3a7531f9ba3c417e7d2ee76b67a15", "flags": 1, "sk_options": []}, "request_type": "sk_enroll"}
[2024-03-10 18:56:02.946] [linux-middleware] [debug] Invoking Windows bridge with the following parameters:
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   |        0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0000: a2 72 72 65 71 75 65 73 74 5f 70 61 72 61 6d 65  .rrequest_parame
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0010: 74 65 72 73 a5 63 61 6c 67 00 6b 61 70 70 6c 69  ters.calg.kappli
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0020: 63 61 74 69 6f 6e 64 73 73 68 3a 69 63 68 61 6c  cationdssh:ichal
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0030: 6c 65 6e 67 65 58 20 a9 a7 c5 ab 44 3d 52 c7 c1  lengeX ....D=R..
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0040: 0e 57 c8 15 ad 4c 6a 14 a3 a7 53 1f 9b a3 c4 17  .W...Lj...S.....
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0050: e7 d2 ee 76 b6 7a 15 65 66 6c 61 67 73 01 6a 73  ...v.z.eflags.js
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0060: 6b 5f 6f 70 74 69 6f 6e 73 80 6c 72 65 71 75 65  k_options.lreque
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0070: 73 74 5f 74 79 70 65 69 73 6b 5f 65 6e 72 6f 6c  st_typeisk_enrol
[2024-03-10 18:56:02.946] [linux-middleware] [debug]   | 0080: 6c                                               l
[2024-03-10 18:56:02.946] [linux-middleware] [debug] Forking.
[2024-03-10 18:56:02.946] [linux-middleware] [debug] Child process PID = 128418
[2024-03-10 18:56:02.946] [linux-middleware] [debug] Sending parameters to child process.
[2024-03-10 18:56:02.946] [linux-middleware] [debug] Parameters sent to child process, waiting for reply.
[2024-03-10 18:56:02.946] [linux-middleware] [debug] [Windows bridge child] Detected own library file path is "/usr/local/lib/libwindowsfidobridge.so".
[2024-03-10 18:56:02.946] [linux-middleware] [debug] [Windows bridge child] Using Windows bridge at "/usr/local/lib/windowsfidobridge.exe".
[2024-03-10 18:56:02.946] [linux-middleware] [debug] [Windows bridge child] Setting WSLENV environment variable to "WT_SESSION:WT_PROFILE_ID::WINDOWS_FIDO_BRIDGE_DEBUG:WINDOWS_FIDO_BRIDGE_FORCE_USER_VERIFICATION".
[2024-03-10 18:56:02.946] [linux-middleware] [debug] [Windows bridge child] Execing.
[2024-03-10 18:56:02.972] [win32-bridge] [debug] Received CBOR from caller: {"request_parameters": {"alg": 0, "application": "ssh:", "challenge": b"a9a7c5ab443d52c7c10e57c815ad4c6a14a3a7531f9ba3c417e7d2ee76b67a15", "flags": 1, "sk_options": []}, "request_type": "sk_enroll"}
[2024-03-10 18:56:02.986] [win32-bridge] [debug] Spawning background thread
[2024-03-10 18:56:30.937] [win32-bridge] [debug] Parsing CBOR attestation object
[2024-03-10 18:56:30.937] [win32-bridge] [debug] Map keys in CBOR attestation object: ["attStmt", "authData", "fmt"]
[2024-03-10 18:56:30.937] [win32-bridge] [debug] Attestation object format: "none"
[2024-03-10 18:56:30.937] [win32-bridge] [critical] Failed to parse attestation object: Invalid or unknown attestation object format
[2024-03-10 18:56:30.937] [win32-bridge] [debug] Sending CBOR to caller: {"return_code": -1}
[2024-03-10 18:56:30.938] [linux-middleware] [debug] Reply received from child process:
[2024-03-10 18:56:30.938] [linux-middleware] [debug]   |        0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
[2024-03-10 18:56:30.938] [linux-middleware] [debug]   | 0000: a1 6b 72 65 74 75 72 6e 5f 63 6f 64 65 20        .kreturn_code
[2024-03-10 18:56:30.938] [linux-middleware] [debug] Waiting for child process to exit.
[2024-03-10 18:56:30.945] [linux-middleware] [debug] Received CBOR from bridge: {"return_code": -1}
[2024-03-10 18:56:30.945] [linux-middleware] [debug] Bridge return code: -1

@mxpph
Copy link

mxpph commented Mar 11, 2024

I think it's a hardware issue. For example, going to this website (webauthn.io) and selecting the "security key" advanced option leads to this pop-up:
image

So the issue could be due to the device not supporting security keys.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@bbqrob @jftanner @mxpph