Unable to add more credentials

[Sector14]

My NK3 had 10 credentials and I needed to add one more,so I deleted an old test credential for passkeys.io however the device still showed 0 estimated slots available. So I deleted one other credential and list-credentials says "There are 8 registered credentials" ... "estimated amount of 0 credential slots left".

If I try to create a new passkey via google or passkeys.io I receive an error on windows saying the device is full and on linux a generic, something went wrong message.

$ nitropy nk3 version
Command line tool to interact with Nitrokey devices 0.8.1
v1.8.1

My second NK3 has 9 registered credentials and shows an estimated 1 slots free. This is running an older firmware version:

Command line tool to interact with Nitrokey devices 0.8.1
v1.5.0

With v1.5.0 I was able to use up all 10 slots, then delete a passkeys.io credential and it again shows 1 slot spare. On version 1.8.1 it shows 0 slots spare.

Has the number of slots being reduced on newer firmware versions? It's quite frustrating how many sites are using discoverable credentials that take up slots rather than requesting email and then using non-discoverable :(

edit: It appears if you use Google Chome to add a passkey to a google account, if there are 0 slots left it will automatically add a non-discoverable passkey, which is what I want. However, the above issue still remains that I have 8 slots used and 0 available so can't add any further discoverable credentials on this token. I might try a factory reset over the weekend and generate new passkeys.

edit2: Did a factory reset and created 10 dummy credentials via webauthn and then deleted a few and the slots became available. Whatever the issue was, reset fixed it. I don't plan to update my 2nd NK3 just yet to latest firmware, but when I do I'll add a note to this issue if it experiences the same problem after the update and before a factory reset.

edit3: Updated my 2nd NK2 to latest firmware, this time I did the upgrade on Linux. No issue with this key deleting credentials and adding more again. First one I upgraded via windows, may or may not be relevant though.

I have noticed with both keys I'm unable to delete credentials via nitropy on windows (msi installer version). Works fine on linux though. It raises an exception stating the credential id is not a valid hex.

[robin-nitrokey]

Thank you for the report! The main cause for the behavior you saw is probably that there are two credential limits: a hard limit (currently ten) and a soft limit based on the device usage with other applications. The soft limit is a conservative guess as credentials do not have a fixed size. So even if list-credentials reports an estimate of one remaining credential, you might still be able to create two or three.

Also, this behavior changed with some firmware updates. In earlier versions, we only had the hard limit. In v1.8.0, we fixed a bug where the FIDO2 metadata only considered the hard limit and not the soft limit. It looks like you observed a combination of these factors.

The good news is that we will increase the hard limit to at least 50 in the next test firmware release. Also, we optimize the way credentials are stored so that even the soft limit should increase. The exact numbers depend on the size of the credentials, the NK3 model and the usage of other applications.

For the problem with nitropy on Windows, can you please create a separate issue with the full error message and the log file? Thank you!

[Sector14]

@robin-nitrokey Good to hear about the slot increase.

By soft limit, do you mean if you're using the NitroKey for GPG/PIV/Password/other features and not just Fido2 storage? If so, is the available storage shared? Is it possible to maximise usage of the Fido2 credentials at the expense of other features (assuming those features are not storing any data at the time)?

Regarding the delete issue, I'll have a look again at that this week and file an issue for it for further information.

[Sector14]

@robin-nitrokey on a related note, is there any chance of a firmware feature to soft-lock the NK3 making it appear like credential storage is full even when it isn't?

Odd request perhaps, but it would be useful when adding a passkey for google where by default they make discoverable key. Anyone who's short on storage space, may prefer to enter an email address and use a non-discoverable. The only way to obtain that currently is fill the NK3 with dummy Fido2 credentials, then register for google (using Chrome) and if the key is full it falls back to creating a non-discoverable. Not much of a problem with 10 slots, but 50 slots would be more of a chore.

It may be there's a cleaner way to force google to do non-discoverable rather than fake full storage, I'm not familiar with the Fido2 protocol to know.

If it's something you'd consider, do you want me to create an issue for this request?

[robin-nitrokey]

The NK3 has three types of storage: the flash of the MCU (internal storage), a separate flash chip (external storage) and the secure element. For FIDO2, only the internal storage is used so that all data is available over NFC too. The other applications like OpenPGP, PIV and Passwords mostly use the external storage or the secure element, but some metadata is also stored in the internal storage. This can affect the space that is available for FIDO2. So if you only use FIDO2 and not the other features, you might be able to store some more credentials (especially with the upcoming changes). But it is not like every password or OpenPGP key occupies a FIDO2 credential slot. If you run nitropy nk3 status, you see an estimate of how much space is available on the internal and external storage (free blocks).

Regarding the soft-lock, the most realistic approach is probably to make the hard limit configurable. I don’t think we will implement this feature in the near future, but you can open a feature request in the nitrokey-3-firmware repository and we will consider it.