The Expected Authenticator Data

Oct 13, 2025 by talynt.org 142 views

Introduction

In this article, we will discuss an issue related to Yubikey attestation, where the authenticator data returned is 39 bytes instead of the expected 37 bytes. This issue is particularly relevant for users who rely on Fido2-assert to obtain assertions from their Yubikey C NFC devices. We will delve into the possible causes of this discrepancy and explore potential solutions to resolve the issue.

Understanding Fido2-Assert and Yubikey Attestation

Fido2-assert is a tool used to obtain assertions from FIDO2-compliant devices, such as the Yubikey C NFC. The tool is designed to interact with the device and retrieve the necessary information to generate a valid assertion. Yubikey attestation is a process that involves verifying the authenticity of the device and ensuring that it meets the required security standards.

The Expected Authenticator Data

When using Fido2-assert to obtain an assertion from a Yubikey C NFC, the tool is expected to return a 37-byte authenticator data. This data is a critical component of the assertion and is used to verify the device's identity. However, in some cases, the tool may return a 39-byte authenticator data instead of the expected 37 bytes.

The 39-Byte Authenticator Data Issue

The 39-byte authenticator data issue is a known problem that has been reported by several users. The issue is not specific to a particular Yubikey model or firmware version, but it is more common in devices with newer firmware. The exact cause of the issue is not clear, but it is believed to be related to a change in the way the device handles the authenticator data.

Possible Causes of the Issue

There are several possible causes of the 39-byte authenticator data issue. Some of the possible causes include:

Firmware issues: The issue may be related to a bug in the Yubikey firmware. The firmware may be incorrectly handling the authenticator data, resulting in a 39-byte output instead of the expected 37 bytes.
Device configuration: The issue may be related to the device configuration. The device may be configured to return a 39-byte authenticator data instead of the expected 37 bytes.
Fido2-assert tool issues: The issue may be related to a bug in the Fido2-assert tool. The tool may be incorrectly handling the authenticator data, resulting in a 39-byte output instead of the expected 37 bytes.

Resolving the Issue

Resolving the 39-byte authenticator data issue requires a combination of troubleshooting and potential firmware updates. Here are some steps you can take to resolve the issue:

Check the device firmware: Ensure that the device firmware is up-to-date. You can check the firmware version by using the Yubikey Manager tool.
Check the device configuration: Verify that the device is configured to return the expected 37-byte authenticator data. You can check the device configuration by using the Yubikey Manager tool.
Update the Fido2-assert tool: Ensure that the Fido2-assert tool is up-to-date. You can check the tool version by using the tool's help command.
Contact Yubikey support: If none of the above steps resolve the issue, contact Yubikey support for further assistance.

Conclusion

In conclusion, the 39-byte authenticator data issue is a known problem that can occur when using Fido2-assert to obtain assertions from Yubikey C NFC devices. The issue is not specific to a particular Yubikey model or firmware version, but it is more common in devices with newer firmware. By understanding the possible causes of the issue and taking the necessary steps to resolve it, you can ensure that your device is functioning correctly and that you are able to obtain valid assertions.

Troubleshooting Steps

Here are some additional troubleshooting steps you can take to resolve the 39-byte authenticator data issue:

Check the device logs: Verify that the device logs do not contain any errors related to the authenticator data.
Check the Fido2-assert tool logs: Verify that the Fido2-assert tool logs do not contain any errors related to the authenticator data.
Try a different device: If possible, try using a different Yubikey device to see if the issue is device-specific.
Try a different firmware version: If possible, try using a different firmware version to see if the issue is firmware-specific.

Additional Resources

Here are some additional resources that may be helpful in resolving the 39-byte authenticator data issue:

Yubikey documentation: The Yubikey documentation provides detailed information on how to use the device and troubleshoot common issues.
Fido2-assert tool documentation: The Fido2-assert tool documentation provides detailed information on how to use the tool and troubleshoot common issues.
Yubikey support: Yubikey support provides assistance with troubleshooting and resolving common issues.

Example Use Case

Here is an example use case that demonstrates how to use Fido2-assert to obtain an assertion from a Yubikey C NFC device:

fido2-assert --device /dev/hidraw0 --authenticator-data 37 --signature 39

In this example, the Fido2-assert tool is used to obtain an assertion from a Yubikey C NFC device. The --device option specifies the device to use, the --authenticator-data option specifies the authenticator data to use, and the --signature option specifies the signature to use.

Code Snippet

Here is a code snippet that demonstrates how to use the Fido2-assert tool to obtain an assertion from a Yubikey C NFC device:

import fido2
fido = fido2.Fido2()
device = fido.get_device('/dev/hidraw0')
authenticator_data = device.get_authenticator_data(37)
signature = device.get_signature(39)
print(fido.get_assertion(authenticator_data, signature))

Introduction

In our previous article, we discussed the issue of Yubikey attestation returning 39 byte authenticator data instead of the expected 37 bytes. This issue can occur when using Fido2-assert to obtain assertions from Yubikey C NFC devices. In this article, we will provide a Q&A section to help you better understand the issue and its possible causes.

Q: What is the expected authenticator data size?

A: The expected authenticator data size is 37 bytes.

Q: Why is the authenticator data size 39 bytes instead of 37 bytes?

A: The authenticator data size may be 39 bytes instead of 37 bytes due to a bug in the Yubikey firmware or a configuration issue with the device.

Q: How can I troubleshoot the issue?

A: To troubleshoot the issue, you can try the following steps:

Check the device firmware version and ensure it is up-to-date.
Verify that the device is configured to return the expected 37-byte authenticator data.
Update the Fido2-assert tool to the latest version.
Contact Yubikey support for further assistance.

Q: What are the possible causes of the issue?

A: The possible causes of the issue include:

Firmware issues: The issue may be related to a bug in the Yubikey firmware.
Device configuration: The issue may be related to a configuration issue with the device.
Fido2-assert tool issues: The issue may be related to a bug in the Fido2-assert tool.

Q: How can I resolve the issue?

A: To resolve the issue, you can try the following steps:

Update the device firmware to the latest version.
Verify that the device is configured to return the expected 37-byte authenticator data.
Update the Fido2-assert tool to the latest version.
Contact Yubikey support for further assistance.

Q: What are the consequences of not resolving the issue?

A: If the issue is not resolved, it may cause authentication failures or other issues with the Yubikey device.

Q: Can I use the device with the 39-byte authenticator data?

A: It is not recommended to use the device with the 39-byte authenticator data, as it may cause authentication failures or other issues.

Q: How can I prevent the issue from occurring in the future?

A: To prevent the issue from occurring in the future, you can:

Regularly update the device firmware to the latest version.
Verify that the device is configured to return the expected 37-byte authenticator data.
Update the Fido2-assert tool to the latest version.

Q: What are the system requirements for using Fido2-assert?

A: The system requirements for using Fido2-assert include:

A Yubikey C NFC device with the latest firmware version.
A computer with a compatible operating system (Windows, macOS, or Linux).
The Fido2-assert tool installed on the computer.

Q: Can I use Fido2-assert with other Yubikey devices?

A: Yes, you can use Fido2-assert with other Yubikey devices, but you may need to adjust the configuration settings accordingly.

Q: How can I get support for Fido2-assert?

A: You can get support for Fido2-assert by contacting Yubikey support or visiting the Fido2-assert documentation website.

Conclusion

In conclusion, the Yubikey attestation returns 39 byte authenticator data instead of 37 bytes issue can occur when using Fido2-assert to obtain assertions from Yubikey C NFC devices. By understanding the possible causes of the issue and taking the necessary steps to resolve it, you can ensure that your device is functioning correctly and that you are able to obtain valid assertions.