Is this library FIPS compliant?

[santhoshramaraju]

Title says it all

[LDVG]

Hi,

libfido2 has not been FIPS certified.

[VedaviBalaji]

Can we detect if the key is FIPS and fail it accordingly? Basically any touch on my FIPS key YubiKey FIPS (4.4.5) [OTP+FIDO] is not detected.

[LDVG]

Hi,

What a relying party would typically do is to request direct attestation during the registration ceremony. You would then use knowledge gained from the attestation object to verify the authenticator's make and model and, based on that, make a decision on whether to accept the credential or not.

I'll link some additional resources below:

• https://developers.yubico.com/WebAuthn/Concepts/Securing_WebAuthn_with_Attestation.html
• https://www.w3.org/TR/webauthn-3/#reg-ceremony-verify-attestation