Device Selection

[olastor]

The CTAP spec defines an operation authenticatorSelection() with opcode 0x0b, but I haven't found any method that implements selection this way and the code is not listed here, so I assume it's not implemented. I am generally wondering what the correct or preferred method of device selection is since the approaches seem to vary:

• There is an example in this repo for selection which uses a polling approach and fido_dev_get_touch_begin / fido_dev_get_touch_status.
• The python library does implement the 0x0b opcode, but the selection method also has a fallback which creates a dummy credential to check user presence.

My questions would be:

a. Is there a specific reason why 0x0b has not been implemented or could it be added in the future?
b. What method of selection would be better: The C example (polling) or the python example (0x0b with some fallback for older tokens)?

Thanks!

[LDVG]

Hi,

Your analysis is correct. We've not yet added support for authenticatorSelection; python-fido2's fallback version is essentially idential our fido_dev_get_touch_*() functions. The main difference is how the touch is signaled back to the application. As far as I'm aware, the fallback version works across all CTAP versions, whereas authenticatorSelection was an addition to CTAP 2.1. If we were to add support for the latter at some point, we'd likely retrofit it to the fido_dev_get_touch_*() functions.

Hope that helps!

[olastor]

Thanks for the clarification!