Merge pull request #51 from LedgerHQ/develop

Release 1.6.3
LedgerHQ · Jul 18, 2024 · 4dba094 · 4dba094
2 parents c5a0ac6 + 1e0f62c
commit 4dba094
Show file tree

Hide file tree

Showing 302 changed files with 1,968 additions and 545 deletions.
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -4,5 +4,5 @@
 - [ ] Target branch is `develop` <!-- unless you have a very good reason -->
 - [ ] Application version has been bumped <!-- required if your changes are to be deployed -->
 
-<!-- Make sure you followed the process described in https://developers.ledger.com/docs/embedded-app/maintenance/ before opening your Pull Request.
+<!-- Make sure you followed the process described in https://developers.ledger.com/docs/device-app/deliver/maintenance before opening your Pull Request.
 Don't hesitate to contact us directly on Discord if you have any questions ! https://developers.ledger.com/discord -->
diff --git a/.github/workflows/build_and_functional_tests.yml b/.github/workflows/build_and_functional_tests.yml
@@ -27,12 +27,15 @@ jobs:
   ragger_tests:
     name: Run ragger tests
     strategy:
+      fail-fast: false
       matrix:
         include:
           - model: nanox
 
           - model: stax
 
+          - model: flex
+
           - model: nanosp
             args: "--fast"
 
@@ -51,7 +54,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Download app binaries
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: compiled_app_binaries
           path: build/

diff --git a/Makefile b/Makefile
@@ -21,7 +21,7 @@ endif
 include $(BOLOS_SDK)/Makefile.defines
 
 $(info TARGET_NAME=$(TARGET_NAME))
-ifneq ($(TARGET_NAME),$(filter $(TARGET_NAME),TARGET_NANOS TARGET_NANOX TARGET_NANOS2 TARGET_STAX))
+ifneq ($(TARGET_NAME),$(filter $(TARGET_NAME),TARGET_NANOS TARGET_NANOX TARGET_NANOS2 TARGET_STAX TARGET_FLEX))
 $(error Environment variable TARGET_NAME is not valid or not supported)
 endif
 
@@ -32,14 +32,15 @@ PATH_APP_LOAD_PARAMS = "5722689'"  # int("WRA".encode("ascii").hex(), 16)
 PATH_APP_LOAD_PARAMS += "5262163'"  # int("PKS".encode("ascii").hex(), 16)
 
 APPVERSION_M=1
-APPVERSION_N=5
-APPVERSION_P=1
+APPVERSION_N=6
+APPVERSION_P=3
 APPVERSION=$(APPVERSION_M).$(APPVERSION_N).$(APPVERSION_P)
 
 ICON_NANOS=icons/icon_security_key_nanos.gif
 ICON_NANOX=icons/icon_security_key.gif
 ICON_NANOSP=icons/icon_security_key.gif
 ICON_STAX=icons/icon_security_key_stax.gif
+ICON_FLEX=icons/icon_security_key_flex.gif
 
 ################
 # Attestations #
@@ -84,6 +85,16 @@ ifneq ($(PROD_FIDO2_STAX_PRIVATE_KEY),0)
     DEFINES += PROD_FIDO2_STAX_PRIVATE_KEY=${PROD_FIDO2_STAX_PRIVATE_KEY}
 endif
 
+PROD_U2F_FLEX_PRIVATE_KEY?=0
+ifneq ($(PROD_U2F_FLEX_PRIVATE_KEY),0)
+    DEFINES += PROD_U2F_FLEX_PRIVATE_KEY=${PROD_U2F_FLEX_PRIVATE_KEY}
+endif
+
+PROD_FIDO2_FLEX_PRIVATE_KEY?=0
+ifneq ($(PROD_FIDO2_FLEX_PRIVATE_KEY),0)
+    DEFINES += PROD_FIDO2_FLEX_PRIVATE_KEY=${PROD_FIDO2_FLEX_PRIVATE_KEY}
+endif
+
 ############
 # Platform #
 ############
@@ -114,14 +125,16 @@ ENABLE_NOCRC_APP_LOAD_PARAMS = 1
 # then reinstall flow), and this reset was causing even more issues
 DEFINES += HAVE_NO_RESET_GENERATION_INCREMENT
 
-# Disable by default rk support and expose a setting to enable it
-# This means that by default user won't be able to create "Resident Keys",
-# which are also named "Discoverable Credentials".
-# This has been implemented to protect user from the nvram wipe mostly happening
-# during an app update which will erase their RK credentials we no possibility
+# Adds the Resident Key support and exposes a setting to enable/disable it.
+# Currently the settings default value is `False`, which means that by default
+# users will need to activate the setting before being able to create "Resident
+# Keys", also named "Discoverable Credentials".
+# This has been implemented to protect user from the NVRAM wipe mostly happening
+# during an app update which will erase their RK credentials with no possibility
 # to restore them.
-# Advanced user can still choose to enable this setting at their own risk.
-DEFINES += HAVE_RK_SUPPORT_SETTING
+# Advanced users can still choose to completely disable this setting.
+# /!\ disabled for 1.6 stable release
+# DEFINES += HAVE_RK_SUPPORT_SETTING
 
 DEFINES += HAVE_FIDO2_RPID_FILTER
 
@@ -135,6 +148,9 @@ DEFINES += HAVE_DEBUG_THROWS
 
 #DEFINES  += HAVE_CBOR_DEBUG
 
+
+ENABLE_NFC = 1
+
 ##############
 # Compiler #
 ##############

diff --git a/attestations/README.md b/attestations/README.md
@@ -31,7 +31,7 @@ You can start from a copy of an other model and should update:
 
 ## Device private key and certificate generation
 
-Then you can run `./createKeyAndCert.sh <env> <version> <model>` to generate the device key and certificate.
+Then you can run `./createDeviceKeyAndCert.sh <env> <version> <model>` to generate the device key and certificate.
 It takes three parameters:
 - `<env>`: an env (`test`, `prod`, ...) that is used when retrieving the CA inputs and generating the outputs.
 - `<version>`: either `U2F` or `FIDO2`

diff --git a/attestations/cnf/FIDO2/openssl_cert_flex.cnf b/attestations/cnf/FIDO2/openssl_cert_flex.cnf
@@ -0,0 +1,15 @@
+[req]
+distinguished_name = req_distinguished_name
+prompt = no
+
+[req_distinguished_name]
+C = FR
+O = Ledger
+OU = Authenticator Attestation
+CN = Ledger Flex FIDO 2 Attestation Batch 1
+
+[v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
+1.3.6.1.4.1.45724.1.1.4=ASN1:FORMAT:HEX,OCTETSTRING:1d8cac4647a13386af50e88ae46fe802
+basicConstraints=critical,CA:FALSE
diff --git a/attestations/cnf/FIDO2/openssl_cert_nanos.cnf b/attestations/cnf/FIDO2/openssl_cert_nanos.cnf
@@ -9,5 +9,7 @@ OU = Authenticator Attestation
 CN = Ledger Nano-S FIDO 2 Attestation Batch 1  
 
 [v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
 1.3.6.1.4.1.45724.1.1.4=ASN1:FORMAT:HEX,OCTETSTRING:341e4da93c2e81035a9faad887135200
 basicConstraints=critical,CA:FALSE
diff --git a/attestations/cnf/FIDO2/openssl_cert_nanosp.cnf b/attestations/cnf/FIDO2/openssl_cert_nanosp.cnf
@@ -9,5 +9,7 @@ OU = Authenticator Attestation
 CN = Ledger Nano-SP FIDO 2 Attestation Batch 1
 
 [v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
 1.3.6.1.4.1.45724.1.1.4=ASN1:FORMAT:HEX,OCTETSTRING:58b44d0b0a7cf33afd48f7153c871352
 basicConstraints=critical,CA:FALSE
diff --git a/attestations/cnf/FIDO2/openssl_cert_nanox.cnf b/attestations/cnf/FIDO2/openssl_cert_nanox.cnf
@@ -9,5 +9,7 @@ OU = Authenticator Attestation
 CN = Ledger Nano-X FIDO 2 Attestation Batch 1  
 
 [v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
 1.3.6.1.4.1.45724.1.1.4=ASN1:FORMAT:HEX,OCTETSTRING:fcb1bcb4f370078c6993bc24d0ae3fbe
 basicConstraints=critical,CA:FALSE
diff --git a/attestations/cnf/FIDO2/openssl_cert_stax.cnf b/attestations/cnf/FIDO2/openssl_cert_stax.cnf
@@ -9,6 +9,8 @@ OU = Authenticator Attestation
 CN = Ledger Stax FIDO 2 Attestation Batch 1
 
 [v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
 1.3.6.1.4.1.45724.1.1.4=ASN1:FORMAT:HEX,OCTETSTRING:6e24d385004a16a07bfeefd963845b34
 basicConstraints=critical,CA:FALSE
 
diff --git a/attestations/cnf/U2F/openssl_cert_flex.cnf b/attestations/cnf/U2F/openssl_cert_flex.cnf
@@ -0,0 +1,14 @@
+[req]
+distinguished_name = req_distinguished_name
+prompt = no
+
+[req_distinguished_name]
+C = FR
+O = Ledger
+OU = Authenticator Attestation
+CN = Ledger Flex FIDO 1 Attestation Batch 1
+
+[v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
+1.3.6.1.4.1.45724.2.1.1=DER:03:02:04:30 # USB + NFC
diff --git a/attestations/cnf/U2F/openssl_cert_nanos.cnf b/attestations/cnf/U2F/openssl_cert_nanos.cnf
@@ -9,4 +9,6 @@ OU = Authenticator Attestation
 CN = Ledger Nano-S FIDO 1 Attestation Batch 1
 
 [v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
 1.3.6.1.4.1.45724.2.1.1=DER:03:02:05:20 # USB
diff --git a/attestations/cnf/U2F/openssl_cert_nanosp.cnf b/attestations/cnf/U2F/openssl_cert_nanosp.cnf
@@ -9,4 +9,6 @@ OU = Authenticator Attestation
 CN = Ledger Nano-SP FIDO 1 Attestation Batch 1
 
 [v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
 1.3.6.1.4.1.45724.2.1.1=DER:03:02:05:20 # USB
diff --git a/attestations/cnf/U2F/openssl_cert_nanox.cnf b/attestations/cnf/U2F/openssl_cert_nanox.cnf
@@ -9,4 +9,6 @@ OU = Authenticator Attestation
 CN = Ledger Nano-X FIDO 1 Attestation Batch 1
 
 [v3_req]
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
 1.3.6.1.4.1.45724.2.1.1=DER:03:02:05:20 # USB
diff --git a/attestations/cnf/U2F/openssl_cert_stax.cnf b/attestations/cnf/U2F/openssl_cert_stax.cnf
@@ -9,4 +9,6 @@ OU = Authenticator Attestation
 CN = Ledger Stax FIDO 1 Attestation Batch 1
 
 [v3_req]
-1.3.6.1.4.1.45724.2.1.1=DER:03:02:05:20 # USB
+subjectKeyIdentifier = none
+authorityKeyIdentifier = none
+1.3.6.1.4.1.45724.2.1.1=DER:03:02:04:30 # USB + NFC
diff --git a/attestations/data/prod/FIDO2/flex-cert.der b/attestations/data/prod/FIDO2/flex-cert.der
diff --git a/attestations/data/prod/FIDO2/nanos-cert.der b/attestations/data/prod/FIDO2/nanos-cert.der
diff --git a/attestations/data/prod/FIDO2/nanosp-cert.der b/attestations/data/prod/FIDO2/nanosp-cert.der
diff --git a/attestations/data/prod/FIDO2/nanox-cert.der b/attestations/data/prod/FIDO2/nanox-cert.der
diff --git a/attestations/data/prod/FIDO2/stax-cert.der b/attestations/data/prod/FIDO2/stax-cert.der
diff --git a/attestations/data/prod/U2F/flex-cert.der b/attestations/data/prod/U2F/flex-cert.der
diff --git a/attestations/data/prod/U2F/nanos-cert.der b/attestations/data/prod/U2F/nanos-cert.der
diff --git a/attestations/data/prod/U2F/nanosp-cert.der b/attestations/data/prod/U2F/nanosp-cert.der
diff --git a/attestations/data/prod/U2F/nanox-cert.der b/attestations/data/prod/U2F/nanox-cert.der
diff --git a/attestations/data/prod/U2F/stax-cert.der b/attestations/data/prod/U2F/stax-cert.der
diff --git a/attestations/data/prod/ca-cert.pem b/attestations/data/prod/ca-cert.pem
@@ -1,11 +1,11 @@
 -----BEGIN CERTIFICATE-----
-MIIBgTCCAScCFBlo0s5QYFdXbfusRdQeoLX6QenlMAoGCCqGSM49BAMCMEMxCzAJ
+MIIBgTCCAScCFFM1QCDXg122F9cvWFVmqeGX3tQWMAoGCCqGSM49BAMCMEMxCzAJ
 BgNVBAYTAkZSMQ8wDQYDVQQKDAZMZWRnZXIxIzAhBgNVBAMMGkxlZGdlciBGSURP
-IEF0dGVzdGF0aW9uIENBMB4XDTIzMDIyMzEwMzMwOFoXDTMzMDIyMDEwMzMwOFow
+IEF0dGVzdGF0aW9uIENBMB4XDTI0MDUzMDE0MTk0MFoXDTM0MDUyODE0MTk0MFow
 QzELMAkGA1UEBhMCRlIxDzANBgNVBAoMBkxlZGdlcjEjMCEGA1UEAwwaTGVkZ2Vy
 IEZJRE8gQXR0ZXN0YXRpb24gQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATK
 7nXyH4pgN3TMwCWSoMDRe4EV8Jl3XzuhicZ/2gvh+zz3WmW0OZ/EcRYEA8F26cee
-uMcd21WQRRKWpjWD+JWiMAoGCCqGSM49BAMCA0gAMEUCIQCwcsHuL8ZFL3FNyU/D
-OQn3bmx08lnn0O5RktLbOnoPHQIgOEi6ImAZ181q8RJiL0hbw7ZquuniRq6fjWjG
-oBu1Moo=
+uMcd21WQRRKWpjWD+JWiMAoGCCqGSM49BAMCA0gAMEUCIQD8J+0/b8PeYjFRQYkU
+Rcqhax27olw1jY/pbskhBuRp4AIgOAHb6n+7fNffyoxpeCq3VZ7B1jN3wqmPNfna
+eAjdoXs=
 -----END CERTIFICATE-----
diff --git a/attestations/data/test/FIDO2/flex-cert.der b/attestations/data/test/FIDO2/flex-cert.der
diff --git a/attestations/data/test/FIDO2/flex-priv-key.pem b/attestations/data/test/FIDO2/flex-priv-key.pem
@@ -0,0 +1,8 @@
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIAZglSgOMr9b7tO9Xrld6TxiEWPpIg3hywFpXO7roADKoAoGCCqGSM49
+AwEHoUQDQgAEfdKjS6TafUaMfImy8M3LesTCxAvm+Fp/I5j+12dP2CKikXNJtDbO
+Ll3g18oumdcIDlNDdX73Cf6NcNei3yrrAw==
+-----END EC PRIVATE KEY-----
diff --git a/attestations/data/test/U2F/flex-cert.der b/attestations/data/test/U2F/flex-cert.der
diff --git a/attestations/data/test/U2F/flex-priv-key.pem b/attestations/data/test/U2F/flex-priv-key.pem
@@ -0,0 +1,8 @@
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEINKkIx//8DhJ3+mVqlCH90wsAsUWkg3xWsNO3IFIBIoooAoGCCqGSM49
+AwEHoUQDQgAE8rDM8mubrpspWmOpfgHVkAy3/bB9i+ZGgfyELxVYiTH0X9JF6gSQ
+fC/ZgbSoZYbzLAy4NsTTkZiQmquOwQi2sw==
+-----END EC PRIVATE KEY-----
diff --git a/attestations/data/test/U2F/stax-cert.der b/attestations/data/test/U2F/stax-cert.der
diff --git a/attestations/generateCryptoData.py b/attestations/generateCryptoData.py
@@ -9,7 +9,7 @@
 
 
 parser = argparse.ArgumentParser()
-parser.add_argument('env', type=str, help='CA, key and cert env')
+parser.add_argument('env', type=str, help='CA, key and cert env', choices=["test", "prod"])
 parser.add_argument('version', type=str, help='target protocol version', choices=["U2F", "FIDO2"])
 parser.add_argument('model', type=str, help='device model')
 
@@ -46,9 +46,19 @@
 key_line_2 = "    " + ", ".join(["0x{}".format(x) for x in key_bytes[16:]])
 key_data = ",\n".join([key_line_1, key_line_2])
 
-key = attestation_key_prefix.format(env, version, model) \
-      + " {\n" + key_data + "};"
-print(key)
+if env == "PROD":
+    print("The key")
+    print("-"*100)
+    print(key_data.strip().replace(" ", "").replace("\n", ""))
+    print("-"*100)
+    print("What needs to be copy-pasted into `crypto_data.h`:")
+    print("-"*100)
+else:
+    print("What needs to be copy-pasted into `crypto_data.h`:")
+    print("-"*100)
+    key = attestation_key_prefix.format(env, version, model) \
+        + " {\n" + key_data + "};"
+    print(key)
 
 # Generate ATTESTATION_CERT
 with open(cert_file, 'rb') as f:
@@ -68,3 +78,4 @@
 cert = attestation_cert_prefix.format(env, version, model) \
       + " {\n" + cert_data + "};"
 print(cert)
+print("-"*100)
diff --git a/conformance/prod-flex.json b/conformance/prod-flex.json
@@ -0,0 +1,87 @@
+{
+  "legalHeader": "Submission of this statement and retrieval and use of this statement indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/.",
+  "aaguid": "1d8cac46-47a1-3386-af50-e88ae46fe802",
+  "description": "Ledger Flex FIDO2 Authenticator",
+  "alternativeDescriptions": {},
+  "authenticatorVersion": 1,
+  "protocolFamily": "fido2",
+  "schema": 3,
+  "upv": [{
+    "major": 1,
+    "minor": 0
+  }],
+  "authenticationAlgorithms": [
+    "secp256r1_ecdsa_sha256_raw",
+    "secp256k1_ecdsa_sha256_raw",
+    "ed25519_eddsa_sha512_raw"
+  ],
+  "publicKeyAlgAndEncodings": ["cose"],
+  "attestationTypes": [
+    "basic_full"
+  ],
+  "userVerificationDetails": [
+    [{
+        "userVerificationMethod": "none"
+      }
+    ],
+    [{
+        "userVerificationMethod": "presence_internal"
+      }
+    ],
+    [{
+        "userVerificationMethod": "passcode_external"
+      }
+    ],
+    [{
+        "userVerificationMethod": "presence_internal"
+      },
+      {
+        "userVerificationMethod": "passcode_external"
+      }
+    ],
+    [{
+        "userVerificationMethod": "passcode_internal",
+        "caDesc": {
+          "base": 10,
+          "minLength": 4,
+          "maxRetries": 3
+        }
+      }
+    ],
+    [{
+        "userVerificationMethod": "presence_internal"
+      },
+      {
+        "userVerificationMethod": "passcode_internal",
+        "caDesc": {
+          "base": 10,
+          "minLength": 4,
+          "maxRetries": 3
+        }
+      }
+    ]
+  ],
+  "keyProtection": ["hardware", "secure_element"],
+  "matcherProtection": ["on_chip"],
+  "cryptoStrength": 128,
+  "attachmentHint": ["external", "wired"],
+  "tcDisplay": ["any", "hardware"],
+  "tcDisplayContentType": "text/plain",
+  "attestationRootCertificates": [
+    "MIIBgTCCAScCFFM1QCDXg122F9cvWFVmqeGX3tQWMAoGCCqGSM49BAMCMEMxCzAJBgNVBAYTAkZSMQ8wDQYDVQQKDAZMZWRnZXIxIzAhBgNVBAMMGkxlZGdlciBGSURPIEF0dGVzdGF0aW9uIENBMB4XDTI0MDUzMDE0MTk0MFoXDTM0MDUyODE0MTk0MFowQzELMAkGA1UEBhMCRlIxDzANBgNVBAoMBkxlZGdlcjEjMCEGA1UEAwwaTGVkZ2VyIEZJRE8gQXR0ZXN0YXRpb24gQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATK7nXyH4pgN3TMwCWSoMDRe4EV8Jl3XzuhicZ/2gvh+zz3WmW0OZ/EcRYEA8F26ceeuMcd21WQRRKWpjWD+JWiMAoGCCqGSM49BAMCA0gAMEUCIQD8J+0/b8PeYjFRQYkURcqhax27olw1jY/pbskhBuRp4AIgOAHb6n+7fNffyoxpeCq3VZ7B1jN3wqmPNfnaeAjdoXs="
+  ],
+  "icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASYAAAEACAYAAAAeMdvxAAAAAXNSR0IArs4c6QAAAIRlWElmTU0AKgAAAAgABQESAAMAAAABAAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAABAAAAWgAAAAAAAAEsAAAAAQAAASwAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAASagAwAEAAAAAQAAAQAAAAAAe6SCkwAAAAlwSFlzAAAuIwAALiMBeKU/dgAAAVlpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IlhNUCBDb3JlIDYuMC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIKICAgICAgICAgICAgeG1sbnM6dGlmZj0iaHR0cDovL25zLmFkb2JlLmNvbS90aWZmLzEuMC8iPgogICAgICAgICA8dGlmZjpPcmllbnRhdGlvbj4xPC90aWZmOk9yaWVudGF0aW9uPgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KGV7hBwAAD65JREFUeAHt3LuOJGcVB/Bd9mIHNhLiIhOQOEaCCDkiICNG4g38CjwJCQlCBASIBN6ChAgJJERiJAvZAoyxfFnvhe/s9JFqe3tmuk9/p6d651fSN1VdVedUza9q/l299sydO3fuvD/GszGebOaxbKzX4NHm+vxqzGN6cDHzdSFwf7P88zGPeznN3Nfrva/j2jzdXK9PvzIWTAQIEFiVgGBa1eVwMgQIhIBgch8QILA6AcG0ukvihAgQEEzuAQIEVicgmFZ3SZwQAQKCyT1AgMDqBATT6i6JEyJAQDC5BwgQWJ2AYFrdJXFCBAgIJvcAAQKrExBMq7skTogAAcHkHrgtAvFLoqYzERBMZ3KhFqd5d7Oc88Umi5cIhBWvS3DWuDr/PMQx5+ad6Bi9w2vTO+eHd7g9FWmUf07j9nznN/+dHvVGEMXx95i+PUZcvH2foPKCR/1Px/jjGG+OEX/T6agTGvWmqwXC/t4Y/xkjrl145/UYi6YhkCZvjeVvjPF4s27MTE0CcQ/Gg87HY3x/jN+PEVOs3zcTct/PZjwx/WUc+L04A9PJBfIH8OQHXvkB8wb/5zjPGKbTCjw89nAzgumNzUnEycQTk6lfIAIpnnBjmHYLRDjFJ4AYsWzqF4i/pvr5GJkJ5SPOCKYMo5jncvmEFBKYKCC8J2Lu0So/ssVH56Omff9N6aiDKCZA4FYJZECVv2nBVKZTSIBAl4Bg6pLVlwCBsoBgKtMpJECgS0AwdcnqS4BAWUAwlekUEiDQJSCYumT1JUCgLCCYynQKCRDoEhBMXbL6EiBQFhBMZTqFBAh0CQimLll9CRAoCwimMp1CAgS6BARTl6y+BAiUBQRTmU4hAQJdAoKpS1ZfAgTKAoKpTKeQAIEuAcHUJasvAQJlAcFUplNIgECXgGDqktWXAIGygGAq0ykkQKBLQDB1yepLgEBZQDCV6RQSINAlIJi6ZPUlQKAsIJjKdAoJEOgSEExdsvoSIFAWEExlOoUECHQJCKYuWX0JECgLCKYynUICBLoEBFOXrL4ECJQFBFOZTiEBAl0CgqlLVl8CBMoCgqlMp5AAgS4BwdQlqy8BAmUBwVSmU0iAQJeAYOqS1ZcAgbKAYCrTKSRAoEtAMHXJ6kuAQFlAMJXpFBIg0CUgmLpk9SVAoCwgmMp0CgkQ6BIQTF2y+hIgUBYQTGU6hQQIdAkIpi5ZfQkQKAsIpjKdQgIEugQEU5esvgQIlAUEU5lOIQECXQKCqUtWXwIEygKCqUynkACBLgHB1CWrLwECZQHBVKZTSIBAl8D90fjLTfNHY35vjGeb13d3LC/XxW4PF/vEa9PpBOJaPBgjr9chR87rmNf+kFr7ErhOIO7JvLfy/sx7LmqXy8vXse/zTIov34wtY3r9Ynbw1/jhMJ1WIC9svJmYCKxFIO7LmCJXjsmFr0aDX48R4RQ3+b4f7TIF4+AfjBFTrrt45WuXQIbSt8YBfjzG48WBclusyptkeV1ye1z3/47xhzGejmEiMEMg76V/j2a/3TSM+y/vxeuOEftGBn1x3Y77bt/3wPv2s9/lAvFxO6YfjREXsjo+HLXxUTwm1+/CwdfjBabcS/HOGQl1TLNIyfjhMJ1WIJ+U4rN8XL99r2Fcr3jS/WgM120gmKYK5D2Vb6CV5s8imPIdt9IgavJEqvXqjhOIG2DfUFrut+/H9uPOTvVtFciPdaXvP4OpVKxoVQLL0LnqxHK/nF+1r20EqgJHPbB416yyqyNAoE1AMLXRakyAQFVAMFXl1BEg0CYgmNpoNSZAoCogmKpy6ggQaBMQTG20GhMgUBUQTFU5dQQItAkIpjZajQkQqAoIpqqcOgIE2gQEUxutxgQIVAUEU1VOHQECbQKCqY1WYwIEqgKCqSqnjgCBNgHB1EarMQECVQHBVJVTR4BAm4BgaqPVmACBqoBgqsqpI0CgTUAwtdFqTIBAVUAwVeXUESDQJiCY2mg1JkCgKiCYqnLqCBBoExBMbbQaEyBQFRBMVTl1BAi0CQimNlqNCRCoCgimqpw6AgTaBARTG63GBAhUBQRTVU4dAQJtAoKpjVZjAgSqAoKpKqeOAIE2AcHURqsxAQJVAcFUlVNHgECbgGBqo9WYAIGqgGCqyqkjQKBNQDC10WpMgEBVQDBV5dQRINAmIJjaaDUmQKAqIJiqcuoIEGgTEExttBoTIFAVEExVOXUECLQJCKY2Wo0JEKgKCKaqnDoCBNoEBFMbrcYECFQFBFNVTh0BAm0CgqmNVmMCBKoCgqkqp44AgTYBwdRGqzEBAlUBwVSVU0eAQJuAYGqj1ZgAgaqAYKrKqSNAoE1AMLXRakyAQFVAMFXl1BEg0CYgmNpoNSZAoCogmKpy6ggQaBMQTG20GhMgUBUQTFU5dQQItAkIpjZajQkQqAoIpqqcOgIE2gQEUxutxgQIVAUEU1VOHQECbQKCqY1WYwIEqgKCqSqnjgCBNgHB1EarMQECVQHBVJVTR4BAm4BgaqPVmACBqoBgqsqpI0CgTUAwtdFqTIBAVUAwVeXUESDQJiCY2mg1JkCgKiCYqnLqCBBoExBMbbQaEyBQFRBMVTl1BAi0CQimNlqNCRCoCgimqpw6AgTaBARTG63GBAhUBQRTVU4dAQJtAoKpjVZjAgSqAoKpKqeOAIE2AcHURqsxAQJVAcFUlVNHgECbgGBqo9WYAIGqgGCqyqkjQKBNQDC10WpMgEBVQDBV5dQRINAmIJjaaDUmQKAqIJiqcuoIEGgTEExttBoTIFAVEExVOXUECLQJCKY2Wo0JEKgKCKaqnDoCBNoE7rd11vgcBOL6Pxnj3hjPzuGEDzzHp2P/GKYzExBMZ3bBJpxuBlAE0mebfq/yD+/d8T3m9zyBT4tTCAimUyiv6xjxgxrTm2P8ZIwvx4iP9K/SD298L6+N8acx/j6GcBoIJgKdAvGxK6YfjhE/gPHkE088sbzvOHT/ffuubb+fDZOYHlzMfD0XAU9M53Kl5p5nPjVlQOXrCJaYdr2Obcsnj1zOfZ8X7viy7Jk9crfcFq+XfXK/3L7clrU5X+6Ty4/Hxnhi+iJ3Mj8vAcF0Xtdr9tnGD/zyh365HMdavs7lnG9vj9e7pqv2X25b1ub6nC+3bS8v98nl/K/N+Xq7xuuVCwimlV+g5tN7VX9wX9Xvq/l2WE/7fGdZzxk5EwLHCeTHueO6qL5RAcF0o/wO3iDgaakB9dQtBdOpxR2vW8ATU7fwCfoLphMgO8RJBTwxnZS752CCqcdVVwIEjhAQTEfgKV2lgI9yq7wsh52UYDrMy97rF/BRbv3X6NozjP+P6dgL6R3qWubWHfi/yBseTF40uYlXR+WKJ6abuGQ9x8wfxpznUS77Qd3eL/eP+XLbcjm35brL5tkrtx/6elkXy8vX2Svny+25X85zH/MzE4gnJhfxzC7a5nTzl3lznt/F9jvV9uvL9sv1MV/WLJcv25b75Dx7VV8v65bL2Xc5X27P5YebHfzy7lLqtMtH5UpcyN+N8dYYj8aIJ6hDGkawvTvGXze18Uuhpl6BuGZxjb42xg/GiL8uEFP+UF68ut1f4z6MX+L98xjvjZFmY9HUKBBvknE/vj3GLzfHOSRPYt/o8XnUfjxGrKiOd6LJmLbfuS/W+tohIIT2V2W1v9Wxe+YT6vdGo2qePK+LJ56Pxog/GpZPTGPx2imKY4oTiT8xYTqtQPjHD5w3g6vd48nJU/zVRjO3Zi7EU1M+yee6fY4T+0YmfRJfYsQU833/MXx5MO9Iz/lO/iWugTeFk7M74B4CyzfNuE/3zYjc9/6+QbTHudiFAAECcwQE0xxHXQgQmCggmCZiakWAwBwBwTTHURcCBCYKCKaJmFoRIDBHQDDNcdSFAIGJAoJpIqZWBAjMERBMcxx1IUBgooBgmoipFQECcwQE0xxHXQgQmCggmCZiakWAwBwBwTTHURcCBCYKCKaJmFoRIDBHQDDNcdSFAIGJAoJpIqZWBAjMERBMcxx1IUBgooBgmoipFQECcwQE0xxHXQgQmCggmCZiakWAwBwBwTTHURcCBCYKCKaJmFoRIDBHQDDNcdSFAIGJAoJpIqZWBAjMERBMcxx1IUBgooBgmoipFQECcwQE0xxHXQgQmCggmCZiakWAwBwBwTTHURcCBCYKCKaJmFoRIDBHQDDNcdSFAIGJAoJpIqZWBAjMERBMcxx1IUBgooBgmoipFQECcwQE0xxHXQgQmCggmCZiakWAwBwBwTTHURcCBCYKCKaJmFoRIDBHQDDNcdSFAIGJAoJpIqZWBAjMERBMcxx1IUBgooBgmoipFQECcwQE0xxHXQgQmCggmCZiakWAwBwBwTTHURcCBCYKCKaJmFoRIDBHQDDNcdSFAIGJAoJpIqZWBAjMERBMcxx1IUBgooBgmoipFQECcwQE0xxHXQgQmChwf0KvDLd7E3ppsb/As7Hr0/13v5V7xr1591Z+5zfzTUeePB7j6CyYEUyfbAwe3YzFrT5q/NBFQJleFggbwf2yS+eaJ5vmHx97kBnB9M44iYdjvDFGnJh3qIHQOEUQPRjj/TH+NoZwGghbU5q8PdZ/Z4wvx3BfbiFNfhn3ZeTJ/8b47ozecYNH0wiVmBvnYfCbca1iipAyvSiQb7i/GKvdz+djEE+4cb0+zQv44mU97FVe+MOq7F0RiHf9ePePJ9QvKg1uWU3+80LMZ9zrt4yv/O3GfXrUE+qMi5UnkPPt7yaCK7flcsxjivW57vmKHV92bc91yz7L0twe65bL+Xq5byxvn9/29nidx4rl7fNeHiOXt+fbPeJ1TMtjX6zZvS73zf1znjXmLwukUcyXy3ltoiKWY8rty20XW178utw/9835cs/tdfk651ftm9ti35zi/PL1vueatYccM2tynrU5z/Ux37Vuub28PCOY4uAJtetElttyOefX1V62Petzvn3c5frl8mX9sn5731y/q265767lXJfzXT2u6n/d/stay9cLXHYdluv3MV/un8s5X57F9rp8nfOr9s1t2/te9zrrtufbdbF917rtuuV+u/bftW5Xj4PX5X/qP7hQAQECBLoEBFOXrL4ECJQFBFOZTiEBAl0CgqlLVl8CBMoCgqlMp5AAgS4BwdQlqy8BAmUBwVSmU0iAQJeAYOqS1ZcAgbKAYCrT3Vhh2//UdmPfkQMT2BKI//M7/zREzrd28XJlAvHL1nHd4tcBTFcLpFHc2+7vq63WsDWuV/wtp6dxg7++OaNZv56yaWfWJPDapm/8Iq/paoH8ywtpdvXetq5F4PUIo39szubzMffRbi2X5vLziL8Q+PUxPtzskk8Fl1fcvi1p8q/xrcd9/cEYca/7GDwQVjzlE9On/weba0V5U6WJqgAAAABJRU5ErkJggg==",
+  "authenticatorGetInfo": {
+    "versions": ["U2F_V2", "FIDO_2_0"],
+    "extensions": ["hmac-secret", "txAuthSimple"],
+    "aaguid": "1d8cac4647a13386af50e88ae46fe802",
+    "options": {
+      "rk": true,
+      "up": true,
+      "uv": true,
+      "clientPin": true
+    },
+    "maxMsgSize": 1024,
+    "pinUvAuthProtocols": [1]
+  }
+}