fido2.ctap2

Submodules

• fido2.ctap2.base
• fido2.ctap2.bio
• fido2.ctap2.blob
• fido2.ctap2.config
• fido2.ctap2.credman
• fido2.ctap2.extensions
• fido2.ctap2.pin

Exceptions

CaptureError

Common base class for all non-exit exceptions.

Classes

Ctap2	Implementation of the CTAP2 specification.
Info	Binary CBOR encoded response data returned by the CTAP2 GET_INFO command.
AttestationResponse	Binary CBOR encoded attestation object.
AssertionResponse	Binary CBOR encoded assertion response.
ClientPin	Implementation of the CTAP2 Client PIN API.
PinProtocolV1	Implementation of the CTAP2 PIN/UV protocol v1.
PinProtocolV2	Implementation of the CTAP2 PIN/UV protocol v2.
CredentialManagement	Implementation of a draft specification of the Credential Management API.
FPBioEnrollment	Implementation of a draft specification of the bio enrollment API.
LargeBlobs	Implementation of the CTAP2.1 Large Blobs API.
Config	Implementation of the CTAP2.1 Authenticator Config API.

Package Contents

class fido2.ctap2.Ctap2(device, strict_cbor=True)

Implementation of the CTAP2 specification.

Parameters:

• device (fido2.ctap.CtapDevice) – A CtapHidDevice handle supporting CTAP2.

• strict_cbor (bool) – Validate that CBOR returned from the Authenticator is canonical, defaults to True.

class CMD

Bases: enum.IntEnum

Enum where members are also (and must be) ints

MAKE_CREDENTIAL = 1

GET_ASSERTION = 2

GET_INFO = 4

CLIENT_PIN = 6

RESET = 7

GET_NEXT_ASSERTION = 8

BIO_ENROLLMENT = 9

CREDENTIAL_MGMT = 10

SELECTION = 11

LARGE_BLOBS = 12

CONFIG = 13

BIO_ENROLLMENT_PRE = 64

CREDENTIAL_MGMT_PRE = 65

device

property info: Info

Get a cached Info object which can be used to determine capabilities.

Return type:

Info

Returns:

The response of calling GetAuthenticatorInfo.

send_cbor(cmd, data=None, *, event=None, on_keepalive=None)

Sends a CBOR message to the device, and waits for a response.

Parameters:

• cmd (int) – The command byte of the request.

• data (Optional[Mapping[int, Any]]) – The payload to send (to be CBOR encoded).

• event (Optional[threading.Event]) – Optional threading.Event used to cancel the request.

• on_keepalive (Optional[Callable[[int], None]]) – Optional function called when keep-alive is sent by the authenticator.

Return type:

Mapping[int, Any]

get_info()

CTAP2 getInfo command.

Returns:

Information about the authenticator.

Return type:

Info

client_pin(pin_uv_protocol, sub_cmd, key_agreement=None, pin_uv_param=None, new_pin_enc=None, pin_hash_enc=None, permissions=None, permissions_rpid=None, *, event=None, on_keepalive=None)

CTAP2 clientPin command, used for various PIN operations.

This method is not intended to be called directly. It is intended to be used by an instance of the PinProtocolV1 class.

Parameters:

• pin_uv_protocol (int) – The PIN/UV protocol version to use.

• sub_cmd (int) – A clientPin sub command.

• key_agreement (Optional[Mapping[int, Any]]) – The keyAgreement parameter.

• pin_uv_param (Optional[bytes]) – The pinAuth parameter.

• new_pin_enc (Optional[bytes]) – The newPinEnc parameter.

• pin_hash_enc (Optional[bytes]) – The pinHashEnc parameter.

• permissions (Optional[int]) – The permissions parameter.

• permissions_rpid (Optional[str]) – The permissions RPID parameter.

• event (Optional[threading.Event]) – Optional threading.Event used to cancel the request.

• on_keepalive (Optional[Callable[[int], None]]) – Optional callback function to handle keep-alive messages from the authenticator.

Returns:

The response of the command, decoded.

Return type:

Mapping[int, Any]

reset(*, event=None, on_keepalive=None)

CTAP2 reset command, erases all credentials and PIN.

Parameters:

• event (Optional[threading.Event]) – Optional threading.Event object used to cancel the request.

• on_keepalive (Optional[Callable[[int], None]]) – Optional callback function to handle keep-alive messages from the authenticator.

Return type:

None

make_credential(client_data_hash, rp, user, key_params, exclude_list=None, extensions=None, options=None, pin_uv_param=None, pin_uv_protocol=None, enterprise_attestation=None, *, event=None, on_keepalive=None)

CTAP2 makeCredential operation.

Parameters:

• client_data_hash (bytes) – SHA256 hash of the ClientData.

• rp (Mapping[str, Any]) – PublicKeyCredentialRpEntity parameters.

• user (Mapping[str, Any]) – PublicKeyCredentialUserEntity parameters.

• key_params (List[Mapping[str, Any]]) – List of acceptable credential types.

• exclude_list (Optional[List[Mapping[str, Any]]]) – Optional list of PublicKeyCredentialDescriptors.

• extensions (Optional[Mapping[str, Any]]) – Optional dict of extensions.

• options (Optional[Mapping[str, Any]]) – Optional dict of options.

• pin_uv_param (Optional[bytes]) – Optional PIN/UV auth parameter.

• pin_uv_protocol (Optional[int]) – The version of PIN/UV protocol used, if any.

• enterprise_attestation (Optional[int]) – Whether or not to request Enterprise Attestation.

• event (Optional[threading.Event]) – Optional threading.Event used to cancel the request.

• on_keepalive (Optional[Callable[[int], None]]) – Optional callback function to handle keep-alive messages from the authenticator.

Returns:

The new credential.

Return type:

AttestationResponse

get_assertion(rp_id, client_data_hash, allow_list=None, extensions=None, options=None, pin_uv_param=None, pin_uv_protocol=None, *, event=None, on_keepalive=None)

CTAP2 getAssertion command.

Parameters:

• rp_id (str) – The RP ID of the credential.

• client_data_hash (bytes) – SHA256 hash of the ClientData used.

• allow_list (Optional[List[Mapping[str, Any]]]) – Optional list of PublicKeyCredentialDescriptors.

• extensions (Optional[Mapping[str, Any]]) – Optional dict of extensions.

• options (Optional[Mapping[str, Any]]) – Optional dict of options.

• pin_uv_param (Optional[bytes]) – Optional PIN/UV auth parameter.

• pin_uv_protocol (Optional[int]) – The version of PIN/UV protocol used, if any.

• event (Optional[threading.Event]) – Optional threading.Event used to cancel the request.

• on_keepalive (Optional[Callable[[int], None]]) – Optional callback function to handle keep-alive messages from the authenticator.

Returns:

The new assertion.

Return type:

AssertionResponse

get_next_assertion()

CTAP2 getNextAssertion command.

Returns:

The next available assertion response.

Return type:

AssertionResponse

get_assertions(*args, **kwargs)

Convenience method to get list of assertions.

See get_assertion and get_next_assertion for details.

Return type:

List[AssertionResponse]

credential_mgmt(sub_cmd, sub_cmd_params=None, pin_uv_protocol=None, pin_uv_param=None)

CTAP2 credentialManagement command, used to manage resident credentials.

NOTE: This implements the current draft version of the CTAP2 specification and should be considered highly experimental.

This method is not intended to be called directly. It is intended to be used by an instance of the CredentialManagement class.

Parameters:

• sub_cmd (int) – A CredentialManagement sub command.

• sub_cmd_params (Optional[Mapping[int, Any]]) – Sub command specific parameters.

• pin_uv_protocol (Optional[int]) – PIN/UV auth protocol version used.

• pin_uv_param (Optional[bytes]) – PIN/UV Auth parameter.

Return type:

Mapping[int, Any]

bio_enrollment(modality=None, sub_cmd=None, sub_cmd_params=None, pin_uv_protocol=None, pin_uv_param=None, get_modality=None, *, event=None, on_keepalive=None)

CTAP2 bio enrollment command. Used to provision/enumerate/delete bio enrollments in the authenticator.

NOTE: This implements the current draft version of the CTAP2 specification and should be considered highly experimental.

This method is not intended to be called directly. It is intended to be used by an instance of the BioEnrollment class.

Parameters:

• modality (Optional[int]) – The user verification modality being used.

• sub_cmd (Optional[int]) – A BioEnrollment sub command.

• sub_cmd_params (Optional[Mapping[int, Any]]) – Sub command specific parameters.

• pin_uv_protocol (Optional[int]) – PIN/UV protocol version used.

• pin_uv_param (Optional[bytes]) – PIN/UV auth param.

• get_modality (Optional[bool]) – Get the user verification type modality.

• event (Optional[threading.Event])

• on_keepalive (Optional[Callable[[int], None]])

Return type:

Mapping[int, Any]

selection(*, event=None, on_keepalive=None)

CTAP2 authenticator selection command.

This command allows the platform to let a user select a certain authenticator by asking for user presence.

Parameters:

• event (Optional[threading.Event]) – Optional threading.Event used to cancel the request.

• on_keepalive (Optional[Callable[[int], None]]) – Optional callback function to handle keep-alive messages from the authenticator.

Return type:

None

large_blobs(offset, get=None, set=None, length=None, pin_uv_param=None, pin_uv_protocol=None)

CTAP2 authenticator large blobs command.

This command is used to read and write the large blob array.

This method is not intended to be called directly. It is intended to be used by an instance of the LargeBlobs class.

Parameters:

• offset (int) – The offset of where to start reading/writing data.

• get (Optional[int]) – Optional (max) length of data to read.

• set (Optional[bytes]) – Optional data to write.

• length (Optional[int]) – Length of the payload in set.

• pin_uv_protocol (Optional[int]) – PIN/UV protocol version used.

• pin_uv_param (Optional[bytes]) – PIN/UV auth param.

Return type:

Mapping[int, Any]

config(sub_cmd, sub_cmd_params=None, pin_uv_protocol=None, pin_uv_param=None)

CTAP2 authenticator config command.

This command is used to configure various authenticator features through the use of its subcommands.

This method is not intended to be called directly. It is intended to be used by an instance of the Config class.

Parameters:

• sub_cmd (int) – A Config sub command.

• sub_cmd_params (Optional[Mapping[int, Any]]) – Sub command specific parameters.

• pin_uv_protocol (Optional[int]) – PIN/UV auth protocol version used.

• pin_uv_param (Optional[bytes]) – PIN/UV Auth parameter.

Return type:

Mapping[int, Any]

class fido2.ctap2.Info

Bases: _CborDataObject

Binary CBOR encoded response data returned by the CTAP2 GET_INFO command.

Parameters:

_ – The binary content of the Info data.

Variables:

• versions – The versions supported by the authenticator.

• extensions – The extensions supported by the authenticator.

• aaguid – The AAGUID of the authenticator.

• options – The options supported by the authenticator.

• max_msg_size – The max message size supported by the authenticator.

• pin_uv_protocols – The PIN/UV protocol versions supported by the authenticator.

• max_creds_in_list – Max number of credentials supported in list at a time.

• max_cred_id_length – Max length of Credential ID supported.

• transports – List of supported transports.

• algorithms – List of supported algorithms for credential creation.

• data – The Info members, in the form of a dict.

versions: List[str]

extensions: List[str]

aaguid: fido2.webauthn.Aaguid

options: Dict[str, bool]

max_msg_size: int = 1024

pin_uv_protocols: List[int]

max_creds_in_list: int | None = None

max_cred_id_length: int | None = None

transports: List[str]

algorithms: List[Dict[str, Any]] | None = None

max_large_blob: int | None = None

force_pin_change: bool = False

min_pin_length: int = 4

firmware_version: int | None = None

max_cred_blob_length: int | None = None

max_rpids_for_min_pin: int = 0

preferred_platform_uv_attempts: int | None = None

uv_modality: int | None = None

certifications: Dict | None = None

remaining_disc_creds: int | None = None

vendor_prototype_config_commands: List[int] | None = None

class fido2.ctap2.AttestationResponse

Bases: _CborDataObject

Binary CBOR encoded attestation object.

Parameters:

_ (bytes) – The binary representation of the attestation object.

Variables:

• fmt – The type of attestation used.

• auth_data – The attested authenticator data.

• att_stmt – The attestation statement.

fmt: str

auth_data: fido2.webauthn.AuthenticatorData

att_stmt: Dict[str, Any]

ep_att: bool | None = None

large_blob_key: bytes | None = None

class fido2.ctap2.AssertionResponse

Bases: _CborDataObject

Binary CBOR encoded assertion response.

Parameters:

_ – The binary representation of the assertion response.

Variables:

• credential – The credential used for the assertion.

• auth_data – The authenticator data part of the response.

• signature – The digital signature of the assertion.

• user – The user data of the credential.

• number_of_credentials – The total number of responses available (only set for the first response, if > 1).

credential: Mapping[str, Any]

auth_data: fido2.webauthn.AuthenticatorData

signature: bytes

user: Dict[str, Any] | None = None

number_of_credentials: int | None = None

user_selected: bool | None = None

large_blob_key: bytes | None = None

verify(client_param, public_key)

Verify the digital signature of the response with regard to the client_param, using the given public key.

Parameters:

• client_param (bytes) – SHA256 hash of the ClientData used for the request.

• public_key (fido2.cose.CoseKey) – The public key of the credential, to verify.

classmethod from_ctap1(app_param, credential, authentication)

Create an AssertionResponse from a CTAP1 SignatureData instance.

Parameters:

• app_param (bytes) – SHA256 hash of the RP ID used for the CTAP1 request.

• credential (Mapping[str, Any]) – Credential used for the CTAP1 request (from the allowList).

• authentication – The CTAP1 signature data.

Returns:

The assertion response.

Return type:

AssertionResponse

class fido2.ctap2.ClientPin(ctap, protocol=None)

Implementation of the CTAP2 Client PIN API.

Parameters:

• ctap (fido2.ctap2.base.Ctap2) – An instance of a CTAP2 object.

• protocol (Optional[PinProtocol]) – An optional instance of a PinUvAuthProtocol object. If None is provided then the latest protocol supported by both library and Authenticator will be used.

PROTOCOLS

class CMD

Bases: enum.IntEnum

Enum where members are also (and must be) ints

GET_PIN_RETRIES = 1

GET_KEY_AGREEMENT = 2

SET_PIN = 3

CHANGE_PIN = 4

GET_TOKEN_USING_PIN_LEGACY = 5

GET_TOKEN_USING_UV = 6

GET_UV_RETRIES = 7

GET_TOKEN_USING_PIN = 9

class RESULT

Bases: enum.IntEnum

Enum where members are also (and must be) ints

KEY_AGREEMENT = 1

PIN_UV_TOKEN = 2

PIN_RETRIES = 3

POWER_CYCLE_STATE = 4

UV_RETRIES = 5

class PERMISSION

Bases: enum.IntFlag

Support for integer-based Flags

MAKE_CREDENTIAL = 1

GET_ASSERTION = 2

CREDENTIAL_MGMT = 4

BIO_ENROLL = 8

LARGE_BLOB_WRITE = 16

AUTHENTICATOR_CFG = 32

static is_supported(info)

Checks if ClientPin functionality is supported.

Note that the ClientPin function is still usable without support for client PIN functionality, as UV token may still be supported.

static is_token_supported(info)

Checks if pinUvAuthToken is supported.

ctap

get_pin_token(pin, permissions=None, permissions_rpid=None)

Get a PIN/UV token from the authenticator using PIN.

Parameters:

• pin (str) – The PIN of the authenticator.

• permissions (Optional[ClientPin]) – The permissions to associate with the token.

• permissions_rpid (Optional[str]) – The permissions RPID to associate with the token.

Returns:

A PIN/UV token.

Return type:

bytes

get_uv_token(permissions=None, permissions_rpid=None, event=None, on_keepalive=None)

Get a PIN/UV token from the authenticator using built-in UV.

Parameters:

• permissions (Optional[ClientPin]) – The permissions to associate with the token.

• permissions_rpid (Optional[str]) – The permissions RPID to associate with the token.

• event (Optional[threading.Event]) – An optional threading.Event which can be used to cancel the invocation.

• on_keepalive (Optional[Callable[[int], None]]) – An optional callback to handle keep-alive messages from the authenticator. The function is only called once for consecutive keep-alive messages with the same status.

Returns:

A PIN/UV token.

Return type:

bytes

get_pin_retries()

Get the number of PIN retries remaining.

Returns:

A tuple of the number of PIN attempts remaining until the

Return type:

Tuple[int, Optional[int]]

authenticator is locked, and the power cycle state, if available.

get_uv_retries()

Get the number of UV retries remaining.

Returns:

A tuple of the number of UV attempts remaining until the

Return type:

int

authenticator is locked, and the power cycle state, if available.

set_pin(pin)

Set the PIN of the autenticator.

This only works when no PIN is set. To change the PIN when set, use change_pin.

Parameters:

pin (str) – A PIN to set.

Return type:

None

change_pin(old_pin, new_pin)

Change the PIN of the authenticator.

This only works when a PIN is already set. If no PIN is set, use set_pin.

Parameters:

• old_pin (str) – The currently set PIN.

• new_pin (str) – The new PIN to set.

Return type:

None

class fido2.ctap2.PinProtocolV1

Bases: PinProtocol

Implementation of the CTAP2 PIN/UV protocol v1.

Parameters:

ctap – An instance of a CTAP2 object.

Variables:

• VERSION – The version number of the PIV/UV protocol.

• IV – An all-zero IV used for some cryptographic operations.

VERSION = 1

IV

kdf(z)

Parameters:

z (bytes)

Return type:

bytes

encapsulate(peer_cose_key)

Generates an encapsulation of the public key. Returns the message to transmit and the shared secret.

encrypt(key, plaintext)

Encrypts data

decrypt(key, ciphertext)

Decrypts encrypted data

authenticate(key, message)

Computes a MAC of the given message.

validate_token(token)

Validates that a token is well-formed. Returns the token, or if invalid, raises a ValueError.

class fido2.ctap2.PinProtocolV2

Bases: PinProtocolV1

Implementation of the CTAP2 PIN/UV protocol v2.

Parameters:

ctap – An instance of a CTAP2 object.

Variables:

• VERSION – The version number of the PIV/UV protocol.

• IV – An all-zero IV used for some cryptographic operations.

VERSION = 2

HKDF_SALT

HKDF_INFO_HMAC = b'CTAP2 HMAC key'

HKDF_INFO_AES = b'CTAP2 AES key'

kdf(z)

encrypt(key, plaintext)

Encrypts data

decrypt(key, ciphertext)

Decrypts encrypted data

authenticate(key, message)

Computes a MAC of the given message.

validate_token(token)

Validates that a token is well-formed. Returns the token, or if invalid, raises a ValueError.

class fido2.ctap2.CredentialManagement(ctap, pin_uv_protocol, pin_uv_token)

Implementation of a draft specification of the Credential Management API. WARNING: This specification is not final and this class is likely to change.

Parameters:

• ctap (fido2.ctap2.base.Ctap2) – An instance of a CTAP2 object.

• pin_uv_protocol (fido2.ctap2.pin.PinProtocol) – An instance of a PinUvAuthProtocol.

• pin_uv_token (bytes) – A valid PIN/UV Auth Token for the current CTAP session.

class CMD

Bases: enum.IntEnum

Enum where members are also (and must be) ints

GET_CREDS_METADATA = 1

ENUMERATE_RPS_BEGIN = 2

ENUMERATE_RPS_NEXT = 3

ENUMERATE_CREDS_BEGIN = 4

ENUMERATE_CREDS_NEXT = 5

DELETE_CREDENTIAL = 6

UPDATE_USER_INFO = 7

class PARAM

Bases: enum.IntEnum

Enum where members are also (and must be) ints

RP_ID_HASH = 1

CREDENTIAL_ID = 2

USER = 3

class RESULT

Bases: enum.IntEnum

Enum where members are also (and must be) ints

EXISTING_CRED_COUNT = 1

MAX_REMAINING_COUNT = 2

RP = 3

RP_ID_HASH = 4

TOTAL_RPS = 5

USER = 6

CREDENTIAL_ID = 7

PUBLIC_KEY = 8

TOTAL_CREDENTIALS = 9

CRED_PROTECT = 10

LARGE_BLOB_KEY = 11

static is_supported(info)

Parameters:

info (fido2.ctap2.base.Info)

Return type:

bool

static is_update_supported(info)

Parameters:

info (fido2.ctap2.base.Info)

Return type:

bool

ctap

pin_uv

get_metadata()

Get credentials metadata.

This returns the existing resident credentials count, and the max possible number of remaining resident credentials (the actual number of remaining credentials may depend on algorithm choice, etc).

Returns:

A dict containing EXISTING_CRED_COUNT, and MAX_REMAINING_COUNT.

Return type:

Mapping[int, Any]

enumerate_rps_begin()

Start enumeration of RP entities of resident credentials.

This will begin enumeration of stored RP entities, returning the first entity, as well as a count of the total number of entities stored.

Returns:

A dict containing RP, RP_ID_HASH, and TOTAL_RPS.

Return type:

Mapping[int, Any]

enumerate_rps_next()

Get the next RP entity stored.

This continues enumeration of stored RP entities, returning the next entity.

Returns:

A dict containing RP, and RP_ID_HASH.

Return type:

Mapping[int, Any]

enumerate_rps()

Convenience method to enumerate all RPs.

See enumerate_rps_begin and enumerate_rps_next for details.

Return type:

Sequence[Mapping[int, Any]]

enumerate_creds_begin(rp_id_hash)

Start enumeration of resident credentials.

This will begin enumeration of resident credentials for a given RP, returning the first credential, as well as a count of the total number of resident credentials stored for the given RP.

Parameters:

rp_id_hash (bytes) – SHA256 hash of the RP ID.

Returns:

A dict containing USER, CREDENTIAL_ID, PUBLIC_KEY, and TOTAL_CREDENTIALS.

Return type:

Mapping[int, Any]

enumerate_creds_next()

Get the next resident credential stored.

This continues enumeration of resident credentials, returning the next credential.

Returns:

A dict containing USER, CREDENTIAL_ID, and PUBLIC_KEY.

Return type:

Mapping[int, Any]

enumerate_creds(*args, **kwargs)

Convenience method to enumerate all resident credentials for an RP.

See enumerate_creds_begin and enumerate_creds_next for details.

Return type:

Sequence[Mapping[int, Any]]

delete_cred(cred_id)

Delete a resident credential.

Parameters:

cred_id (fido2.webauthn.PublicKeyCredentialDescriptor) – The PublicKeyCredentialDescriptor of the credential to delete.

Return type:

None

update_user_info(cred_id, user_info)

Update the user entity of a resident key.

Parameters:

• cred_id (fido2.webauthn.PublicKeyCredentialDescriptor) – The PublicKeyCredentialDescriptor of the credential to update.

• user_info (fido2.webauthn.PublicKeyCredentialUserEntity) – The user info update.

Return type:

None

class fido2.ctap2.FPBioEnrollment(ctap, pin_uv_protocol, pin_uv_token)

Bases: BioEnrollment

Implementation of a draft specification of the bio enrollment API. WARNING: This specification is not final and this class is likely to change.

NOTE: The get_fingerprint_sensor_info method does not require authentication, and can be used by setting pin_uv_protocol and pin_uv_token to None.

Parameters:

• ctap (fido2.ctap2.base.Ctap2) – An instance of a CTAP2 object.

• pin_uv_protocol (fido2.ctap2.pin.PinProtocol) – The PIN/UV protocol version used.

• pin_uv_token (bytes) – A valid PIN/UV Auth Token for the current CTAP session.

class CMD

Bases: enum.IntEnum

Enum where members are also (and must be) ints

ENROLL_BEGIN = 1

ENROLL_CAPTURE_NEXT = 2

ENROLL_CANCEL = 3

ENUMERATE_ENROLLMENTS = 4

SET_NAME = 5

REMOVE_ENROLLMENT = 6

GET_SENSOR_INFO = 7

class PARAM

Bases: enum.IntEnum

Enum where members are also (and must be) ints

TEMPLATE_ID = 1

TEMPLATE_NAME = 2

TIMEOUT_MS = 3

class FEEDBACK

Bases: enum.IntEnum

Enum where members are also (and must be) ints

FP_GOOD = 0

FP_TOO_HIGH = 1

FP_TOO_LOW = 2

FP_TOO_LEFT = 3

FP_TOO_RIGHT = 4

FP_TOO_FAST = 5

FP_TOO_SLOW = 6

FP_POOR_QUALITY = 7

FP_TOO_SKEWED = 8

FP_TOO_SHORT = 9

FP_MERGE_FAILURE = 10

FP_EXISTS = 11

FP_DATABASE_FULL = 12

NO_USER_ACTIVITY = 13

NO_UP_TRANSITION = 14

__str__()

Return str(self).

pin_uv_protocol

pin_uv_token

get_fingerprint_sensor_info()

Get fingerprint sensor info.

Returns:

A dict containing FINGERPRINT_KIND and MAX_SAMPLES_REQUIRES.

Return type:

Mapping[int, Any]

enroll_begin(timeout=None, event=None, on_keepalive=None)

Start fingerprint enrollment.

Starts the process of enrolling a new fingerprint, and will wait for the user to scan their fingerprint once to provide an initial sample.

Parameters:

• timeout (Optional[int]) – Optional timeout in milliseconds.

• event (Optional[threading.Event])

• on_keepalive (Optional[Callable[[int], None]])

Returns:

A tuple containing the new template ID, the sample status, and the number of samples remaining to complete the enrollment.

Return type:

Tuple[bytes, FPBioEnrollment, int]

enroll_capture_next(template_id, timeout=None, event=None, on_keepalive=None)

Continue fingerprint enrollment.

Continues enrolling a new fingerprint and will wait for the user to scan their fingerpring once to provide a new sample. Once the number of samples remaining is 0, the enrollment is completed.

Parameters:

• template_id (bytes) – The template ID returned by a call to enroll_begin.

• timeout (Optional[int]) – Optional timeout in milliseconds.

• event (Optional[threading.Event])

• on_keepalive (Optional[Callable[[int], None]])

Returns:

A tuple containing the sample status, and the number of samples remaining to complete the enrollment.

Return type:

Tuple[FPBioEnrollment, int]

enroll_cancel()

Cancel any ongoing fingerprint enrollment.

Return type:

None

enroll(timeout=None)

Convenience wrapper for doing fingerprint enrollment.

See FPEnrollmentContext for details. :return: An initialized FPEnrollmentContext.

Parameters:

timeout (Optional[int])

Return type:

FPEnrollmentContext

enumerate_enrollments()

Get a dict of enrolled fingerprint templates which maps template ID’s to their friendly names.

Returns:

A dict of enrolled template_id -> name pairs.

Return type:

Mapping[bytes, Optional[str]]

set_name(template_id, name)

Set/Change the friendly name of a previously enrolled fingerprint template.

Parameters:

• template_id (bytes) – The ID of the template to change.

• name (str) – A friendly name to give the template.

Return type:

None

remove_enrollment(template_id)

Remove a previously enrolled fingerprint template.

Parameters:

template_id (bytes) – The Id of the template to remove.

Return type:

None

exception fido2.ctap2.CaptureError(code)

Bases: Exception

Common base class for all non-exit exceptions.

Parameters:

code (int)

code

class fido2.ctap2.LargeBlobs(ctap, pin_uv_protocol=None, pin_uv_token=None)

Implementation of the CTAP2.1 Large Blobs API.

Getting a largeBlobKey for a credential is done via the LargeBlobKey extension.

Parameters:

• ctap (fido2.ctap2.base.Ctap2) – An instance of a CTAP2 object.

• pin_uv_protocol (Optional[fido2.ctap2.pin.PinProtocol]) – An instance of a PinUvAuthProtocol.

• pin_uv_token (Optional[bytes]) – A valid PIN/UV Auth Token for the current CTAP session.

static is_supported(info)

Parameters:

info (fido2.ctap2.base.Info)

Return type:

bool

ctap

max_fragment_length

pin_uv

read_blob_array()

Gets the entire contents of the Large Blobs array.

Returns:

The CBOR decoded list of Large Blobs.

Return type:

Sequence[Mapping[int, Any]]

write_blob_array(blob_array)

Writes the entire Large Blobs array.

Parameters:

blob_array (Sequence[Mapping[int, Any]]) – A list to write to the Authenticator.

Return type:

None

get_blob(large_blob_key)

Gets the Large Blob stored for a single credential.

Parameters:

large_blob_key (bytes) – The largeBlobKey for the credential, or None.

Returns:

The decrypted and deflated value stored for the credential.

Return type:

Optional[bytes]

put_blob(large_blob_key, data)

Stores a Large Blob for a single credential.

Any existing entries for the same credential will be replaced.

Parameters:

• large_blob_key (bytes) – The largeBlobKey for the credential.

• data (Optional[bytes]) – The data to compress, encrypt and store.

Return type:

None

delete_blob(large_blob_key)

Deletes any Large Blob(s) stored for a single credential.

Parameters:

large_blob_key (bytes) – The largeBlobKey for the credential.

Return type:

None

class fido2.ctap2.Config(ctap, pin_uv_protocol=None, pin_uv_token=None)

Implementation of the CTAP2.1 Authenticator Config API.

Parameters:

• ctap (fido2.ctap2.base.Ctap2) – An instance of a CTAP2 object.

• pin_uv_protocol (Optional[fido2.ctap2.pin.PinProtocol]) – An instance of a PinUvAuthProtocol.

• pin_uv_token (Optional[bytes]) – A valid PIN/UV Auth Token for the current CTAP session.

class CMD

Bases: enum.IntEnum

Enum where members are also (and must be) ints

ENABLE_ENTERPRISE_ATT = 1

TOGGLE_ALWAYS_UV = 2

SET_MIN_PIN_LENGTH = 3

VENDOR_PROTOTYPE = 255

class PARAM

Bases: enum.IntEnum

Enum where members are also (and must be) ints

NEW_MIN_PIN_LENGTH = 1

MIN_PIN_LENGTH_RPIDS = 2

FORCE_CHANGE_PIN = 3

static is_supported(info)

Parameters:

info (fido2.ctap2.base.Info)

Return type:

bool

ctap

pin_uv

enable_enterprise_attestation()

Enables Enterprise Attestation.

If already enabled, this command is ignored.

Return type:

None

toggle_always_uv()

Toggle the alwaysUV setting.

When true, the Authenticator always requires UV for credential assertion.

Return type:

None

set_min_pin_length(min_pin_length=None, rp_ids=None, force_change_pin=False)

Set the minimum PIN length allowed when setting/changing the PIN.

Parameters:

• min_pin_length (Optional[int]) – The minimum PIN length the Authenticator should allow.

• rp_ids (Optional[List[str]]) – A list of RP IDs which should be allowed to get the current minimum PIN length.

• force_change_pin (bool) – True if the Authenticator should enforce changing the PIN before the next use.

Return type:

None