Settings — security policy (authenticatorConfig)

What it is

CTAP 2.1 lets a platform change a key's security policy through the authenticatorConfig command. keyroost surfaces four of these operations in the Settings sub-view of the FIDO2 tab, and as keyroostctl commands. Each is authenticated with the device PIN at the moment it runs.

Some of these are one-way: a higher minimum PIN length can't be lowered again, and enterprise attestation can't be turned off, without a full reset of the key. keyroost asks for explicit confirmation before applying those.

Where to find it

Open the FIDO2 tab and unlock with your PIN. Once unlocked, choose the Settings tab. Unlocking is a key-level action — it gates passkeys, fingerprints, and settings alike — so it lives above the tabs rather than inside any one panel. The Settings tab appears only when the key reports authnrCfg support in its getInfo options.

The operations

Always require user verification (alwaysUv). When on, every assertion needs user verification (PIN or biometric), even for services that didn't ask for it. This is a reversible toggle. Whether it survives a key reset is vendor-specific.

Set minimum PIN length. Raises the shortest PIN the key will accept. It can only be increased — never lowered without a reset — and if the current PIN is now too short, the key requires a new one. An optional flag also forces a PIN change.

Force PIN change on next use. Flags the key so the next platform interaction must set a new PIN, without otherwise changing the minimum length. Useful before handing a key to someone else.

Enable enterprise attestation. Lets the key provide a vendor attestation that uniquely identifies the model, for enterprise registration policies. This is typically one-way. keyroost only shows this control on keys that advertise support (the ep getInfo option); on keys that already have it enabled, the control shows its state instead of an action.

Command line

keyroostctl fido always-uv               --pin-env KR_PIN
keyroostctl fido set-min-pin --length 6  --pin-env KR_PIN
keyroostctl fido set-min-pin --length 8 --force-change --pin-env KR_PIN
keyroostctl fido force-pin-change        --pin-env KR_PIN
keyroostctl fido enterprise-attestation  --pin-env KR_PIN

Each command takes the PIN via --pin-env (an environment variable name), --pin-stdin, and an optional --path to select a specific key.

Cautions

Minimum PIN length and enterprise attestation are one-way — undoing them needs a full reset, which wipes every passkey and the PIN. Test the reversible operations first (fido always-uv, force PIN change) on a given key before relying on the irreversible ones. If a command is rejected, the key may not support that sub-command; keyroost reports the CTAP status with a readable hint.

Authoritative resources