Supported registration extensions

In accordance with the WebAuthn extensions specifications, the Thales Mobile FIDO SDK directly supports the use of several authentication extensions during credential creation.

The following extensions are supported:

• Authenticator description extension

• Client type extension

• Challenge verification extension

Authenticator description extension

This extension enables the customization of a friendlyName for the registered authenticator. A FIDO2 server that supports the thalesgroup_ext_v1 can receive and store a custom authenticator name, which is displayed to end users during credential management on the FIDO2 admin.

To request the SDK to use this extension, add the following value to the extensions dictionary key during credential creation.

{
  ...,
  ...,
  "extensions": {
      "thalesgroup_ext_v1": true
  }
}

When a credential creation option request contains this extension, the Mobile FIDO SDK invokes the following callbacks, to allow this friendlyName customization:

public class SampleUiCallback extends Fido2UiCallback {
    @Override
    public void retrieveAuthenticatorDescription(Fido2AuthenticatorInfo selectedAuthenticator, final AuthenticatorDescriptionCallback callback) {
        // Configure UI to request input of custom name
        AuthenticatorDescriptor descriptor = new AuthenticatorDescriptor("CUSTOM_NAME");
        callback.onAuthenticatorDescriptionProvided(descriptor);
    }
}

class SampleUiDelegate: TGFFido2UiDelegate {
    func retrieveAuthenticatorDescription(_ selectedAuthenticator: TGFFido2AuthenticatorInfo, authenticatorDescriptionHandler: @escaping (TGFAuthenticatorDescriptor) -> Void, cancelHandler: @escaping () -> Void) {
        let descriptor = TGFAuthenticatorDescriptor(friendlyName: "CUSTOM_NAME")
        authenticatorDescriptionHandler(descriptor)
    }
}

The SDK then responds with the following output:

{
    ...,
    ...,
    "clientExtensionResults": {
        "thalesgroup_ext_v1": {
            "authenticatorDescription": {
                "friendlyName": "CUSTOM_NAME"
            }
        }
    }
}

Client type extension

Using this extension, app integrators can restrict the usage of passkey types on their application. A FIDO2 server that supports the thalesgroup_client_ext_v1 can restrict the usage of passkey types on the Mobile FIDO SDK. When this extension is provided, the SDK proposes passkey types in accordance with the following client types:

• ALL: -1
• SYNCABLE_PASSKEYS: 1
• DEVICE_BOUND_PASSKEYS: 2

To request the SDK to use this extension, add the following value to the extensions dictionary key during credential creation.

{
  ...,
  ...,
  "extensions": {
      "thalesgroup_client_ext_v1": {
          "clientType": -1
      }
  }
}

When Mobile FIDO SDK receives the client type extension, it proposes the respective passkey types during authenticator selection, which can then be displayed to the end users.

The SDK then responds with the client type of the selected authenticator:

{
    ...,
    ...,
    "clientExtensionResults": {
        "thalesgroup_client_ext_v1": {
            "clientType": 2
        }
    }
}

When the client type extension is not present, Mobile FIDO SDK simply proposes all available passkeys.

Challenge verification extension

The SDK supports this extension to help prevent challenge flooding attacks, where a malicious actor rapidly sends multiple credential creation or authentication requests. A FIDO2 server that supports the thalesgroup_chl_tkn_ext_v1 can support this extension.

The format of this extension is opaque and the Mobile FIDO SDK simply matches the clientExtensionResults output with the content of the request.