Security policy

What it is

CTAP 2.1 lets a platform change a key's security policy through the authenticatorConfig command. keyroost surfaces four of these operations in the Settings sub-view of the FIDO2 tab, and as keyroostctl commands. Each is authenticated with the device PIN at the moment it runs.

Where to find it

Open the FIDO2 tab and unlock with your PIN. Once unlocked, choose the Settings tab. Unlocking is a key-level action — it gates passkeys, fingerprints, and settings alike — so it lives above the tabs rather than inside any one panel. The Settings tab appears on any CTAP2 key — it also hosts the FIDO2 reset, which every CTAP2 key supports. The policy controls inside it appear only on keys that report authnrCfg, and each one only when the key lists it in getInfo: alwaysUv for Always require user verification, setMinPINLength for the minimum length and a forced PIN change, and ep for enterprise attestation. The CLI refuses a setting the key doesn't offer before it asks for the PIN.

The operations

Always require user verification (alwaysUv). When on, every assertion needs user verification (PIN or biometric), even for services that didn't ask for it. It can be turned on and off again. Whether it survives a key reset is vendor-specific. The CLI has one command for each state, fido config always-uv enable and fido config always-uv disable; each does nothing, and says so, when the key is already in that state. keyroost offers it only on keys that report the alwaysUv option.

Set minimum PIN length. Raises the shortest PIN the key will accept. It can only be increased — never lowered without a reset — and if the current PIN is now too short, the key requires a new one. An optional flag also forces a PIN change. Shown only on keys that list setMinPINLength, as is the next one.

Force PIN change on next use. Flags the key so the next platform interaction must set a new PIN, without otherwise changing the minimum length. Useful before handing a key to someone else.

Enable enterprise attestation. Lets the key provide a vendor attestation that can uniquely identify the individual key, for enterprise registration policies. This is typically one-way. keyroost only shows this control on keys that advertise support (the ep getInfo option); on keys that already have it enabled, the control shows its state instead of an action.

Command line

keyroostctl fido config always-uv enable
keyroostctl fido config always-uv disable
keyroostctl fido pin min-length set --length 6              # asks y/N first
keyroostctl fido pin min-length set --length 8 --force-change
keyroostctl fido pin force-change
keyroostctl fido config attestation enable                  # asks y/N first
keyroostctl fido pin min-length set --length 6 --yes --pin env:KR_PIN   # in a script

Each command asks for the PIN at a hidden prompt; a script passes --pin env:NAME (an environment variable name) or --pin stdin instead. With several keys connected, pick one with --device (or --path). The two one-way commands, fido pin min-length set and fido config attestation enable, ask first in a terminal; in a script they need --yes, and without it they refuse and change nothing.

Cautions

Minimum PIN length and enterprise attestation are one-way — undoing them needs a full reset, which wipes every passkey and the PIN. Test the recoverable operations first (fido config always-uv enable, which fido config always-uv disable undoes, and force PIN change, which clears once a new PIN is set) on a given key before relying on the irreversible ones. keyroost offers only the settings the key lists, and the CLI refuses any other before it asks for the PIN. If the key still rejects a command, keyroost reports the CTAP status with a readable hint.