Add support for CTAP 2.2

[rayc345]

CTAP 2.2 is released, is there any plan to support 2.2 features? Some is quite useful such as the persistent UV authn.

[robin-nitrokey]

Hi @rayc345, generally we want to add support for CTAP 2.2 at some point but there is no specific plan or ETA for the implementation yet. I’m keeping this issue open as a feature request.

Anyone who is interested in CTAP 2.2 support: Please add a 👍 reaction to the issue. Leave a comment if there is a specific feature or use case that is relevant for you.

[rayc345]

Thank you for your response.

CTAP 2.2 mainly differences:

1. Persistent PIN/UV Auth Tokens
2. PIN Complexity Policies
3. thirdPartyPayment Extension
4. Persistent Credential Management – Read-only (pcmr) permission
5. hmac-secret-mc / PRF

I think 1 is the most valuable, taking myself as an example. I want to use FIDO for SSH authentication, git signing. So I have to type PIN many times a day, eliminating unnecessary input improves my experience.
2, 4 and 5 are low-priority. As for 3, I'm not sure as I do not know any shopping sites use this, but it seems Chrome already support this long ago.

[robin-nitrokey]

Thanks for the feedback! We already support the thirdPartyPayment extension because it only requires minimal implementation efforts, but I don’t know any real-world use case for it either.

[rayc345]

I want to implement CTAP2.2 by myself, I read the spec carefully, and I found I misunderstood the spec, CTAP 2.2 does not allow Persistent PIN/UV Auth Token for commands such as mc and ga, only for credential discovery. So, I think CTAP 2.2 is only a minor update, and it even does not update the version info in getinfo command.
CTAP2.3 maybe a bigger update, it changed the version info in getinfo command, but currently only adds long touch reset feature.