Skip to content

R02 — USB FIDO, passkey creation and authentication

Status: NOT EXECUTED as a complete hardware procedure — T2B1 and T3B1.

Use the shared acceptance record, with a separate result for every required model/OS. Host and emulator output remains separate evidence.

Preconditions

R01 passed; both models; macOS, Windows and Linux; WebAuthn browser and disposable account supporting USB keys; independent recovery key.

Steps

  1. In normal mode, record USB interfaces and verify FIDO HID + CCID, without CDC, MSC or debuglink.
  2. Register a USB security key/passkey on the test account. Set a FIDO PIN if requested, verify service/account on the device and confirm physically.
  3. Sign out and authenticate in a fresh session. Repeat with device refusal, then with request timeout.
  4. Unplug, reconnect, unlock and authenticate again. Test U2F/second-factor registration where the service supports it.
  5. Under Authentication → Passkeys → Services, locate the discoverable account and delete only that entry. Verify that its use fails while a second entry remains usable. Repeat on each OS.

Expected result

Standard clients recognise the device; valid registration/assertion; refusal and timeout never succeed; persistence after power loss. Local listing and targeted deletion match discoverable credentials.

Evidence to retain

OS/browser versions, USB descriptors, test service name, registration/login/refusal/deletion results and redacted flow captures.