unlocking LUKS device using fido2 token fails roughly every other time between reboot/replugging

[nomisma-qt]

What version of libfido2 are you using?

#dnf info libfido2
Updating and loading repositories:
Repositories loaded.
Installed packages
Name : libfido2
Epoch : 0
Version : 1.15.0
Release : 2.fc41
Architecture : x86_64
Installed size : 238.2 KiB
Source : libfido2-1.15.0-2.fc41.src.rpm
From repository : anaconda

What operating system are you running?

OS: Fedora 41
Kernel: x86_64 Linux 6.12.11-200.fc41.x86_64

What application are you using in conjunction with libfido2?

/usr/sbin/cryptsetup
/usr/bin/systemd-cryptsetup

How does the problem manifest itself?

Hi. I'm opening a LUKS2 device using Onlykey Duo FIDO2 device. The problem is, between reboots, it works roughly every other time. Meaning after a reboot, about 50% of the time it will work right away. And keeps working no matter how many time i do cryptsetup open/close.

But roughly the other 50% of the time, or every other reboot, it doesn't work. I say roughly, because sometimes it might not work 2 reboots in a row, and sometimes it might work two reboots in a row. But mostly it's every other reboot.

When it doesn't work, unplugging the fido token, and replugging it, giving the pin, it will then work. And it will continue to work no matter how many times i do cryptsetup open/close after that.

Same thing happens with reboot, without unplugging the device. When it doesn't work, after the next reboot it probably will, and then it will also continue to work no matter how many times i do cryptsetup open/close.

When it works it looks like this:

Asking FIDO2 token for authentication. 👆 Please confirm presence on security token to unlock.

When it doesn't work it will just sit there in an endless timeout, no output on screen or in logs, when it should start blinking to confirm user presence.
Then pressing ctrl-C says this:

^CFailed to open FIDO2 device /dev/hidraw1: FIDO_ERR_RX Token returned error during pre-flight: Input/output error

*** some background info: ***

I'm using this to unlock a LUKS encrypted zvol used as a keystore at boot. At the beginning, now several hundred reboot attempts ago i was unlucky in that manually unlocking happened to always work, but when systemd was supposed to unlock during boot, roughly every other time it failed. Because it had worked manually, i was convinced it was a systemd issue, and i have spend a very long time trying to debug systemd, until finally i tried manually again, and it was only then i discovered that it also happens when manually unlocking, after a reboot.

It was only then i saw the "Token returned error during pre-flight: Input/output error" message.

Searching for that message lead me to this thread:
systemd/systemd#27947

So i don't know if this is a libfido2 issue, or a kernel issue as described in that linked thread. I just thought i would start here in libfido2 github.
Please excuse me if i'm writing this in the wrong place.

I'm currently testing this in a VM, which i can easily reboot over and over, and also snapshot and rollback. I'm not a coder, and i don't know how to do 'git pulls' or systrace or anything like that, but if instructed, i can install anything in this VM and do whatever i can to help solve this issue.

I have also tested this on baremetal, and with a virtual hdd/physical ssd instead of zvol and many other things, it makes no difference.

Because a reboot almost always makes it work the next time, i'm leaning towards it being a kernel issue maybe, rather than libfido2, BUT then again, unplugging and replugging the device results in same behaviour as reboot, it will then likely work, so.. it could also be a combination of libfido2 and kernel?

After now approaching probably a hundred reboots, i would be very very glad for any help.

Regards, Mike

Is the problem reproducible?

yes

What are the steps that lead to the problem?

reboot

Does the problem happen with different authenticators?

Please include the output of fido2-token -L.

fido2-token -L

$ fido2-token -L
/dev/hidraw1: vendor=0x1d50, product=0x60fc (CRYPTOTRUST ONLYKEY)

Please include the output of fido2-token -I.

fido2-token -I

$ fido2-token -I <device>
proto: 0x02
major: 0x00
minor: 0x00
build: 0x00
caps: 0x05 (wink, cbor, msg)
version strings: U2F_V2, FIDO_2_0, FIDO_2_1_PRE
extension strings: credProtect, hmac-secret
aaguid: 998f358b2dd24cbea43ae8107438dfb3
options: rk, up, noplat, credMgmt, noclientPin
fwversion: 0x0
maxmsgsiz: 1200
maxcredcntlst: 20
maxcredlen: 256
maxcredblob: 0
maxlargeblob: 0
pin protocols: 1
pin retries: 8
pin change required: false
uv retries: undefined

Please include the output of FIDO_DEBUG=1.

FIDO_DEBUG=1

$ export FIDO_DEBUG=1
$ <FIDO_DEBUG=1 fido2-token -L>
run_manifest: found 1 hid device
run_manifest: found 0 nfc devices
/dev/hidraw1: vendor=0x1d50, product=0x60fc (CRYPTOTRUST ONLYKEY)

[nomisma-qt]

Oh i forgot to mention, in another system, Debian bookworm, it works every time. every single time.

libfido2-1/stable,now 1.12.0-2+b1 amd64 [installed,automatic]

6.1.0-30-amd64

[LDVG]

One of the outcomes of the linked systemd issue was that they connected libfido2's debug logging to systemd's logging facilities. Could you please enable systemd's debug logging level and post the output of the failure case here?

[nomisma-qt]

hi, thanks for you reply. As i noted, at first i thought it was systemd related, but now i've come to realize it's not, i tried making a crontab @reboot entry that unlocks using normal cryptsetup command, and it happens there too.

So would you know how i could run a normal cryptsetup open command with libfido2 debugging enabled? I don't know if it's even libfido2 related, i just don't really know where to start looking..

I tried a few libfido commands like FIDO_DEBUG=1 fido2-token -L, but what shold i do to get debugging output when i run the cryptsetup command?

I have to connect some USB cables and do USB passthrough etc to get the test VM setup again.. (again, this happens on baremetal system too, it's not related to VM or USB things)

[nomisma-qt]

to reiterate, only now after realizing this happens when doing a manual cryptsetup open command as well, it's only now i've seen that "Token returned error during pre-flight: Input/output error" message, after hitting CTRL-C.

searching for that message led me to the linked systemd issue, where libfido2 is mentioned, and that's why i'm here.

So i'd appreciate any help on how to get libfido2 debuggin enabled, to maybe get some more output..

[LDVG]

at first i thought it was systemd related, but now i've come to realize it's not, i tried making a crontab @reboot entry that unlocks using normal cryptsetup command, and it happens there too

I'm no expert on systemd components, so take the following with a grain of salt: I'm quite sure that you're still using systemd-cryptsetup under the hood to communicate with your authenticator to decrypt the key file for the volume.

So would you know how i could run a normal cryptsetup open command with libfido2 debugging enabled? I don't know if it's even libfido2 related, i just don't really know where to start looking..

You will have to set the systemd log level to "debug". IIRC, one way of doing it is setting systemd.log_level=debug on the kernel command line and, for a running system, you can change it via systemctl log-level.

It might be easier to call /usr/bin/systemd-cryptsetup manually, in such a case you can probably just export SYSTEMD_LOG_LEVEL=debug before calling it.

searching for that message led me to the linked systemd issue, where libfido2 is mentioned, and that's why i'm here.

You might still want to consult the systemd folks.

Out of curiosity, does

$ export FIDO_DEBUG=1
$ fido2-token -I "$(fido2-token -L | tail -1 | cut -d: -f1)"

ever hang in a similar fashion?

[nomisma-qt]

Out of curiosity, does

$ export FIDO_DEBUG=1
$ fido2-token -I "$(fido2-token -L | tail -1 | cut -d: -f1)"

ever hang in a similar fashion?

nope, doesn't hang.. but i've just spent several hours trying, and now suddenly i am unable to recreate the hang situation at all. Where ctrl-C is the only way out, and is then followed by the "Token returned error during pre-flight: Input/output error" message

i have tried with both cryptsetup open, and systemd-cryptsetup attach / detach

Right now, the hangup occurs every other boot. Because the hangup is indefinite, it won't timeout ever during boot, it's highly likely that it's that specific hangout that occurs.

but again, no matter what i do, i'm suddenly unable to recreate it manually, like i was a few days ago. Occasionally i do get a:

# cryptsetup open /dev/zvol/zroot/ztest ztest
Asking FIDO2 token for authentication.
👆 Please confirm presence on security token to unlock.
Failed to ask token for assertion: FIDO_ERR_INVALID_COMMAND

error, but that is resolved by trying again, there's no indefinite hangup.

I've tried several reboots without the token plugged, so it reverts to asking for passphrase at boot, and then trying to recreate the error after boot by plugging in the token, and manually doing cryptsetup open or systemd-cryptsetup attach, but it just always works now suddenly. I can't understand it. That would again point to systemd, but again, i must be well over 100 reboots now, i've tried alot of systemd things, nothing helps. Everything points to it hanging when trying to query the fido2 token for a response forever.

These last reboots it's been exactly 50/50, it hangs, then ctrl-alt-del, and next time it works.

Right now i'm trying to figure out how to downgrade libfido2 in fedora 41, hopefully to the same version i have in the debian bookworm system, where it always works, every time. If i'm successful in that, and nothing changes, then it would point to libfido2 NOT being the issue.

Honestly, this might be a firmware bug in the onlykey duo device. But still, it works every time in debian..

If the libfido2 downgrade doesn't change anything, and if i can't ever again recreate this manually, i'm gonna have to give up. It's not the biggest issue, since i just use it to unlock /home automatically at boot, and i don't reboot that often. When it happens, ctrl-alt-del, and next time it works.

But it's still annoying as hell, just today i learnt how to enroll the fido2 token with --fido2-with-user-presence=no, and that would allow me to boot without needing to touch the key. But with this bug, i'll have no joy of that either..

if you know the command to downgrade libfido2 to version 1.12.0 using dnf5 in fedora 41, help would be appreciated, but i'm gonna try googling for that now, i'm not sure how much more time i want to spend on this today..

[nomisma-qt]

well i tried downloading libfido2 1.12.0 from https://koji.fedoraproject.org/koji/buildinfo?buildID=2087781

but it won't install it using dnf downgrade /path/to/.rpm or dnf install.. it says it needs libcbor.so.0.7()(64bit)

Anyways, i doubt this would help.. now suddenly being unable to recreate this error manually, i just have to give up again..

[nomisma-qt]

ok, another little update.. i removed everything from crypttab and fstab, and instead created a cron @reboot entry, where i manually do systemd-cryptsetup attach.

First boot it worked, second boot it hangs.

And when it is in that hanged state, it's then when i try to do cryptsetup open, which also hangs (because apparently there's another process stuck doing that), and then do the ctrl-C, that i get the:

# cryptsetup open /dev/zvol/zroot/ztest ztest
^CFailed to open FIDO2 device /dev/hidraw1: FIDO_ERR_INTERNAL
Token returned error during pre-flight: Input/output error

note, it also hangs with systemd-cryptsetup attach, but does not give the pre-flight error after ctrl-c.

So.. it's not systemd, as this happens after systemd, triggered by cron @reboot entry.
It has to be the same thing that happens during systemd boot, because it shows the same pattern, after every other reboot it works, and vice versa

When i execute

$ export FIDO_DEBUG=1
$ fido2-token -I "$(fido2-token -L | tail -1 | cut -d: -f1)"

in this hanged state, i only get these two lines as output, as opposed to a long list of info when it's not in a hanged state:

# fido2-token -I "$(fido2-token -L | tail -1 | cut -d: -f1)"
run_manifest: found 1 hid device
run_manifest: found 0 nfc devices
^C

and also here i need to do ctrl-c, to get the prompt back.

[LDVG]

Since version 1.8.0, libfido2 uses locks to serialize access to the underlying /dev/hidrawN device (per a request from systemd). If another application is holding such a lock, we'll block in the fido_dev_open() call for up to approximately ~20 seconds before erroring out.

When it hangs, can you see anything holding a lock on /dev/hidrawN (where N the number corresponding to your device as listed by fido2-token -L) by inspecting e.g. the output of lslocks -u?

[nomisma-qt]

You will have to set the systemd log level to "debug". IIRC, one way of doing it is setting systemd.log_level=debug on the kernel command line and, for a running system, you can change it via systemctl log-level.

It might be easier to call /usr/lib/systemd-cryptsetup manually, in such a case you can probably just export SYSTEMD_LOG_LEVEL=debug before calling it.

right, been so occupied with trying to recreate the error, forgot all about your reply.. i will try that next..

[nomisma-qt]

# export SYSTEMD_LOG_LEVEL=debug
# systemd-cryptsetup attach zkeys /dev/zvol/zroot/zkeys
Loaded 'libcryptsetup.so.12' via dlopen()
run zkeys ← /dev/zvol/zroot/zkeys type= cipher=
Allocating context for crypt device /dev/zvol/zroot/zkeys.
Trying to open and read device /dev/zvol/zroot/zkeys with direct-io.
Direct-io is supported and works.
Initialising device-mapper backend library.
dm version   [ opencount flush ]   [16384] (*1)
dm versions   [ opencount flush ]   [16384] (*1)
Detected dm-ioctl version 4.48.0.
Detected dm-zero version 1.2.0.
Device-mapper backend running with UDEV support enabled.
dm status zkeys  [ opencount noflush ]   [16384] (*1)
Trying to load any crypt type from device /dev/zvol/zroot/zkeys.
Crypto backend (OpenSSL 3.2.2 4 Jun 2024 [default][legacy][threads][argon2]) initialized in cryptsetup library version 2.7.5.
Detected kernel Linux 6.12.11-200.fc41.x86_64 x86_64.
Loading LUKS2 header (repair disabled).
Acquiring read lock for device /dev/zvol/zroot/zkeys.
Opening lock resource file /run/cryptsetup/L_230:0
Verifying lock handle for /dev/zvol/zroot/zkeys.
Device /dev/zvol/zroot/zkeys READ lock taken.
Trying to read primary LUKS2 header at offset 0x0.
Opening locked device /dev/zvol/zroot/zkeys
Verifying locked device handle (bdev)
LUKS2 header version 2 of size 16384 bytes, checksum sha256.
Checksum:8234c780914d9aa13ed1c3a1f1794c8ca85beb0b24ad8c9cd505a2cadb844f6e (on-disk)
Checksum:8234c780914d9aa13ed1c3a1f1794c8ca85beb0b24ad8c9cd505a2cadb844f6e (in-memory)
Trying to read secondary LUKS2 header at offset 0x4000.
Reusing open ro fd on device /dev/zvol/zroot/zkeys
LUKS2 header version 2 of size 16384 bytes, checksum sha256.
Checksum:8b9ef8c4276f02aa590ec0389e9503c6f86b10ba78a3d13fba0cbb109edaf7f0 (on-disk)
Checksum:8b9ef8c4276f02aa590ec0389e9503c6f86b10ba78a3d13fba0cbb109edaf7f0 (in-memory)
Device size 104857600, offset 16777216.
Device /dev/zvol/zroot/zkeys READ lock released.
PBKDF argon2id, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
Activating volume zkeys [keyslot -1] using token.
dm versions   [ opencount flush ]   [16384] (*1)
dm status zkeys  [ opencount noflush ]   [16384] (*1)
Token 0 unusable for segment 0 with desired keyslot priority 2.
Token 1 unusable for segment 0 with desired keyslot priority 2.
Token 2 unusable for segment 0 with desired keyslot priority 2.
Token 0 unusable for segment 0 with desired keyslot priority 1.
Token 1 unusable for segment 0 with desired keyslot priority 1.
Trying to load /usr/lib64/cryptsetup/libcryptsetup-token-systemd-fido2.so.
Loading symbol cryptsetup_token_open@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_buffer_free@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_validate@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_dump@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_open_pin@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_version@CRYPTSETUP_TOKEN_1.0.
Token handler systemd-fido2-1.0 systemd-v256.11 (256.11-1.fc41) loaded successfully.
Requesting JSON for token 2.
Loaded 'libfido2.so.1' via dlopen()
libfido2: run_manifest: found 1 hid device
libfido2: run_manifest: found 0 nfc devices
libfido2: fido_hid_open: flock timeout
libfido2: fido_dev_open_tx: dev->io.open
Failed to open FIDO2 device /dev/hidraw1: FIDO_ERR_INTERNAL
Token returned error during pre-flight: Input/output error
Token 2 (systemd-fido2) open failed with -5.
Token activation unsuccessful for device /dev/zvol/zroot/zkeys: Input/output error
Beginning attempt 0 to unlock.
Requesting JSON for token 0.
Requesting JSON for token 1.
Requesting JSON for token 2.
Requesting JSON for token 3.
Requesting JSON for token 4.
Requesting JSON for token 5.
Requesting JSON for token 6.
Requesting JSON for token 7.
Requesting JSON for token 8.
Requesting JSON for token 9.
Requesting JSON for token 10.
Requesting JSON for token 11.
Requesting JSON for token 12.
Requesting JSON for token 13.
Requesting JSON for token 14.
Requesting JSON for token 15.
Requesting JSON for token 16.
Requesting JSON for token 17.
Requesting JSON for token 18.
Requesting JSON for token 19.
Requesting JSON for token 20.
Requesting JSON for token 21.
Requesting JSON for token 22.
Requesting JSON for token 23.
Requesting JSON for token 24.
Requesting JSON for token 25.
Requesting JSON for token 26.
Requesting JSON for token 27.
Requesting JSON for token 28.
Requesting JSON for token 29.
Requesting JSON for token 30.
Requesting JSON for token 31.
🔐 Please enter passphrase for disk zkeys: (press TAB for no echo)

[LDVG]

libfido2: fido_hid_open: flock timeout
libfido2: fido_dev_open_tx: dev->io.open
Failed to open FIDO2 device /dev/hidraw1: FIDO_ERR_INTERNAL
Token returned error during pre-flight: Input/output error

Please see my previous reply: #852 (comment)

[nomisma-qt]

When it hangs, can you see anything holding a lock on /dev/hidrawN (where N the number corresponding to your device as listed by fido2-token -L) by inspecting e.g. the output of lslocks -u?

nothing.

Now after a reboot into a state where it locks, this time it did NOT return to ask passphrase as a fallback, like it did previously in the output i posted a moment ago.

also now it started working after first hanging, not falling back to passphrase, and then ctrl-c.. lemme do a few more reboots, see if i can get lslocks -u to show anything of interest..

[nomisma-qt]

ok first boot, now it works fine. here debug output when it works as it should after reboot:

Loaded 'libcryptsetup.so.12' via dlopen()
run zkeys ← /dev/zvol/zroot/zkeys type= cipher=
Allocating context for crypt device /dev/zvol/zroot/zkeys.
Trying to open and read device /dev/zvol/zroot/zkeys with direct-io.
Direct-io is supported and works.
Initialising device-mapper backend library.
dm version   [ opencount flush ]   [16384] (*1)
dm versions   [ opencount flush ]   [16384] (*1)
Detected dm-ioctl version 4.48.0.
Detected dm-zero version 1.2.0.
Device-mapper backend running with UDEV support enabled.
dm status zkeys  [ opencount noflush ]   [16384] (*1)
Trying to load any crypt type from device /dev/zvol/zroot/zkeys.
Crypto backend (OpenSSL 3.2.2 4 Jun 2024 [default][legacy][threads][argon2]) initialized in cryptsetup library version 2.7.5.
Detected kernel Linux 6.12.11-200.fc41.x86_64 x86_64.
Loading LUKS2 header (repair disabled).
Acquiring read lock for device /dev/zvol/zroot/zkeys.
Opening lock resource file /run/cryptsetup/L_230:0
Verifying lock handle for /dev/zvol/zroot/zkeys.
Device /dev/zvol/zroot/zkeys READ lock taken.
Trying to read primary LUKS2 header at offset 0x0.
Opening locked device /dev/zvol/zroot/zkeys
Verifying locked device handle (bdev)
LUKS2 header version 2 of size 16384 bytes, checksum sha256.
Checksum:8234c780914d9aa13ed1c3a1f1794c8ca85beb0b24ad8c9cd505a2cadb844f6e (on-disk)
Checksum:8234c780914d9aa13ed1c3a1f1794c8ca85beb0b24ad8c9cd505a2cadb844f6e (in-memory)
Trying to read secondary LUKS2 header at offset 0x4000.
Reusing open ro fd on device /dev/zvol/zroot/zkeys
LUKS2 header version 2 of size 16384 bytes, checksum sha256.
Checksum:8b9ef8c4276f02aa590ec0389e9503c6f86b10ba78a3d13fba0cbb109edaf7f0 (on-disk)
Checksum:8b9ef8c4276f02aa590ec0389e9503c6f86b10ba78a3d13fba0cbb109edaf7f0 (in-memory)
Device size 104857600, offset 16777216.
Device /dev/zvol/zroot/zkeys READ lock released.
PBKDF argon2id, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
Activating volume zkeys [keyslot -1] using token.
dm versions   [ opencount flush ]   [16384] (*1)
dm status zkeys  [ opencount noflush ]   [16384] (*1)
Token 0 unusable for segment 0 with desired keyslot priority 2.
Token 1 unusable for segment 0 with desired keyslot priority 2.
Token 2 unusable for segment 0 with desired keyslot priority 2.
Token 0 unusable for segment 0 with desired keyslot priority 1.
Token 1 unusable for segment 0 with desired keyslot priority 1.
Trying to load /usr/lib64/cryptsetup/libcryptsetup-token-systemd-fido2.so.
Loading symbol cryptsetup_token_open@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_buffer_free@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_validate@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_dump@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_open_pin@CRYPTSETUP_TOKEN_1.0.
Loading symbol cryptsetup_token_version@CRYPTSETUP_TOKEN_1.0.
Token handler systemd-fido2-1.0 systemd-v256.11 (256.11-1.fc41) loaded successfully.
Requesting JSON for token 2.
Loaded 'libfido2.so.1' via dlopen()
libfido2: run_manifest: found 1 hid device
libfido2: run_manifest: found 0 nfc devices
libfido2: fido_tx: dev=0x564b3aa201c0, cmd=0x06
libfido2: fido_tx: buf=0x564b3aa201c0, len=8
libfido2: 0000: 05 1a 63 79 ed 8d df bc
libfido2: fido_rx: dev=0x564b3aa201c0, cmd=0x06, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18ed20, len=64
libfido2: 0000: ff ff ff ff 86 00 11 05 1a 63 79 ed 8d df bc 0e
libfido2: 0016: 00 00 00 02 00 00 00 05 00 00 00 00 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: rx: payload_len=17
libfido2: fido_rx: buf=0x564b3aa201c8, len=17
libfido2: 0000: 05 1a 63 79 ed 8d df bc 0e 00 00 00 02 00 00 00
libfido2: 0016: 05
libfido2: fido_dev_get_cbor_info_tx: dev=0x564b3aa201c0
libfido2: fido_tx: dev=0x564b3aa201c0, cmd=0x10
libfido2: fido_tx: buf=0x7ffd5d18edd7, len=1
libfido2: 0000: 04
libfido2: fido_dev_get_cbor_info_rx: dev=0x564b3aa201c0, ci=0x564b3aa207a0, ms=-1
libfido2: fido_rx: dev=0x564b3aa201c0, cmd=0x10, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18ecd0, len=64
libfido2: 0000: 0e 00 00 00 90 00 7f 00 a8 01 83 66 55 32 46 5f
libfido2: 0016: 56 32 68 46 49 44 4f 5f 32 5f 30 6c 46 49 44 4f
libfido2: 0032: 5f 32 5f 31 5f 50 52 45 02 82 6b 63 72 65 64 50
libfido2: 0048: 72 6f 74 65 63 74 6b 68 6d 61 63 2d 73 65 63 72
libfido2: rx: payload_len=127
libfido2: rx: buf=0x7ffd5d18ecd0, len=64
libfido2: 0000: 0e 00 00 00 00 65 74 03 50 99 8f 35 8b 2d d2 4c
libfido2: 0016: be a4 3a e8 10 74 38 df b3 04 a5 62 72 6b f5 62
libfido2: 0032: 75 70 f5 64 70 6c 61 74 f4 68 63 72 65 64 4d 67
libfido2: 0048: 6d 74 f5 69 63 6c 69 65 6e 74 50 69 6e f4 05 19
libfido2: rx: buf=0x7ffd5d18ecd0, len=64
libfido2: 0000: 0e 00 00 00 01 04 b0 06 81 01 07 14 08 19 01 00
libfido2: 0016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: fido_rx: buf=0x564b3aa34f30, len=127
libfido2: 0000: 00 a8 01 83 66 55 32 46 5f 56 32 68 46 49 44 4f
libfido2: 0016: 5f 32 5f 30 6c 46 49 44 4f 5f 32 5f 31 5f 50 52
libfido2: 0032: 45 02 82 6b 63 72 65 64 50 72 6f 74 65 63 74 6b
libfido2: 0048: 68 6d 61 63 2d 73 65 63 72 65 74 03 50 99 8f 35
libfido2: 0064: 8b 2d d2 4c be a4 3a e8 10 74 38 df b3 04 a5 62
libfido2: 0080: 72 6b f5 62 75 70 f5 64 70 6c 61 74 f4 68 63 72
libfido2: 0096: 65 64 4d 67 6d 74 f5 69 63 6c 69 65 6e 74 50 69
libfido2: 0112: 6e f4 05 19 04 b0 06 81 01 07 14 08 19 01 00
libfido2: fido_dev_open_rx: FIDO_MAXMSG=2048, maxmsgsiz=1200
libfido2: fido_dev_get_cbor_info_tx: dev=0x564b3aa201c0
libfido2: fido_tx: dev=0x564b3aa201c0, cmd=0x10
libfido2: fido_tx: buf=0x7ffd5d18ed87, len=1
libfido2: 0000: 04
libfido2: fido_dev_get_cbor_info_rx: dev=0x564b3aa201c0, ci=0x564b3aa32f40, ms=-1
libfido2: fido_rx: dev=0x564b3aa201c0, cmd=0x10, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18eca0, len=64
libfido2: 0000: 0e 00 00 00 90 00 7f 00 a8 01 83 66 55 32 46 5f
libfido2: 0016: 56 32 68 46 49 44 4f 5f 32 5f 30 6c 46 49 44 4f
libfido2: 0032: 5f 32 5f 31 5f 50 52 45 02 82 6b 63 72 65 64 50
libfido2: 0048: 72 6f 74 65 63 74 6b 68 6d 61 63 2d 73 65 63 72
libfido2: rx: payload_len=127
libfido2: rx: buf=0x7ffd5d18eca0, len=64
libfido2: 0000: 0e 00 00 00 00 65 74 03 50 99 8f 35 8b 2d d2 4c
libfido2: 0016: be a4 3a e8 10 74 38 df b3 04 a5 62 72 6b f5 62
libfido2: 0032: 75 70 f5 64 70 6c 61 74 f4 68 63 72 65 64 4d 67
libfido2: 0048: 6d 74 f5 69 63 6c 69 65 6e 74 50 69 6e f4 05 19
libfido2: rx: buf=0x7ffd5d18eca0, len=64
libfido2: 0000: 0e 00 00 00 01 04 b0 06 81 01 07 14 08 19 01 00
libfido2: 0016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: fido_rx: buf=0x564b3aa34f30, len=127
libfido2: 0000: 00 a8 01 83 66 55 32 46 5f 56 32 68 46 49 44 4f
libfido2: 0016: 5f 32 5f 30 6c 46 49 44 4f 5f 32 5f 31 5f 50 52
libfido2: 0032: 45 02 82 6b 63 72 65 64 50 72 6f 74 65 63 74 6b
libfido2: 0048: 68 6d 61 63 2d 73 65 63 72 65 74 03 50 99 8f 35
libfido2: 0064: 8b 2d d2 4c be a4 3a e8 10 74 38 df b3 04 a5 62
libfido2: 0080: 72 6b f5 62 75 70 f5 64 70 6c 61 74 f4 68 63 72
libfido2: 0096: 65 64 4d 67 6d 74 f5 69 63 6c 69 65 6e 74 50 69
libfido2: 0112: 6e f4 05 19 04 b0 06 81 01 07 14 08 19 01 00
FIDO2 device implements extension: credProtect
FIDO2 device implements extension: hmac-secret
FIDO2 device implements option rk: yes
FIDO2 device implements option up: yes
FIDO2 device implements option plat: no
FIDO2 device implements option credMgmt: yes
FIDO2 device implements option clientPin: no
Has rk ('Resident Key') support: yes
Has clientPin support: no
Has up ('User Presence') support: yes
Has uv ('User Verification') support: no
libfido2: fido_tx: dev=0x564b3aa201c0, cmd=0x10
libfido2: fido_tx: buf=0x564b3a9fd690, len=160
libfido2: 0000: 02 a4 01 75 69 6f 2e 73 79 73 74 65 6d 64 2e 63
libfido2: 0016: 72 79 70 74 73 65 74 75 70 02 58 20 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 03 81 a2 62
libfido2: 0064: 69 64 58 46 cd f9 c1 ae f3 20 b8 81 a9 fa 84 35
libfido2: 0080: 41 ce 1b 77 84 c9 e3 db d2 86 de 7c 42 63 08 bc
libfido2: 0096: 64 c8 6d 30 c9 38 3b a2 a1 21 ff 04 55 14 ab e1
libfido2: 0112: b8 2a 95 99 df d9 be 3c 43 64 db 0d 6c d0 10 00
libfido2: 0128: d7 29 10 1a ba 8f b3 77 14 02 64 74 79 70 65 6a
libfido2: 0144: 70 75 62 6c 69 63 2d 6b 65 79 05 a1 62 75 70 f4
libfido2: fido_rx: dev=0x564b3aa201c0, cmd=0x10, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18ec40, len=64
libfido2: 0000: 0e 00 00 00 90 00 d1 00 a3 01 a2 62 69 64 58 46
libfido2: 0016: cd f9 c1 ae f3 20 b8 81 a9 fa 84 35 41 ce 1b 77
libfido2: 0032: 84 c9 e3 db d2 86 de 7c 42 63 08 bc 64 c8 6d 30
libfido2: 0048: c9 38 3b a2 a1 21 ff 04 55 14 ab e1 b8 2a 95 99
libfido2: rx: payload_len=209
libfido2: rx: buf=0x7ffd5d18ec40, len=64
libfido2: 0000: 0e 00 00 00 00 df d9 be 3c 43 64 db 0d 6c d0 10
libfido2: 0016: 00 d7 29 10 1a ba 8f b3 77 14 02 64 74 79 70 65
libfido2: 0032: 6a 70 75 62 6c 69 63 2d 6b 65 79 02 58 25 3b a2
libfido2: 0048: a1 21 ff 04 55 14 ab e1 b8 2a 95 99 df d9 be 3c
libfido2: rx: buf=0x7ffd5d18ec40, len=64
libfido2: 0000: 0e 00 00 00 01 43 64 db 0d 6c d0 10 00 d7 29 10
libfido2: 0016: 1a ba 8f 00 02 14 78 04 03 58 47 30 45 02 20 32
libfido2: 0032: c6 8a b7 58 f3 7e db 6f bc bc 6e 79 1f e5 fc 1d
libfido2: 0048: ef 82 25 79 67 6c bf 64 e6 76 f2 ef 39 f6 af 02
libfido2: rx: buf=0x7ffd5d18ec40, len=64
libfido2: 0000: 0e 00 00 00 02 21 00 bd b3 2e b4 4d fb 87 c2 a2
libfido2: 0016: 4d 23 5e f4 46 7e 68 5c a7 dd 5f ae f9 01 1d 23
libfido2: 0032: 30 d6 bb 27 4c 03 8e 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: fido_rx: buf=0x564b3aa34f30, len=209
libfido2: 0000: 00 a3 01 a2 62 69 64 58 46 cd f9 c1 ae f3 20 b8
libfido2: 0016: 81 a9 fa 84 35 41 ce 1b 77 84 c9 e3 db d2 86 de
libfido2: 0032: 7c 42 63 08 bc 64 c8 6d 30 c9 38 3b a2 a1 21 ff
libfido2: 0048: 04 55 14 ab e1 b8 2a 95 99 df d9 be 3c 43 64 db
libfido2: 0064: 0d 6c d0 10 00 d7 29 10 1a ba 8f b3 77 14 02 64
libfido2: 0080: 74 79 70 65 6a 70 75 62 6c 69 63 2d 6b 65 79 02
libfido2: 0096: 58 25 3b a2 a1 21 ff 04 55 14 ab e1 b8 2a 95 99
libfido2: 0112: df d9 be 3c 43 64 db 0d 6c d0 10 00 d7 29 10 1a
libfido2: 0128: ba 8f 00 02 14 78 04 03 58 47 30 45 02 20 32 c6
libfido2: 0144: 8a b7 58 f3 7e db 6f bc bc 6e 79 1f e5 fc 1d ef
libfido2: 0160: 82 25 79 67 6c bf 64 e6 76 f2 ef 39 f6 af 02 21
libfido2: 0176: 00 bd b3 2e b4 4d fb 87 c2 a2 4d 23 5e f4 46 7e
libfido2: 0192: 68 5c a7 dd 5f ae f9 01 1d 23 30 d6 bb 27 4c 03
libfido2: 0208: 8e
libfido2: adjust_assert_count: cbor_type
libfido2: adjust_assert_count: cbor_type
libfido2: adjust_assert_count: cbor_type
libfido2: cbor_decode_assert_authdata: buf=0x564b3aa20dc0, len=37
libfido2: fido_tx: dev=0x564b3aa33d70, cmd=0x06
libfido2: fido_tx: buf=0x564b3aa33d70, len=8
libfido2: 0000: 26 7b db 0e 42 46 4e c6
libfido2: fido_rx: dev=0x564b3aa33d70, cmd=0x06, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18ece0, len=64
libfido2: 0000: ff ff ff ff 86 00 11 26 7b db 0e 42 46 4e c6 0f
libfido2: 0016: 00 00 00 02 00 00 00 05 00 00 00 00 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: rx: payload_len=17
libfido2: fido_rx: buf=0x564b3aa33d78, len=17
libfido2: 0000: 26 7b db 0e 42 46 4e c6 0f 00 00 00 02 00 00 00
libfido2: 0016: 05
libfido2: fido_dev_get_cbor_info_tx: dev=0x564b3aa33d70
libfido2: fido_tx: dev=0x564b3aa33d70, cmd=0x10
libfido2: fido_tx: buf=0x7ffd5d18ed97, len=1
libfido2: 0000: 04
libfido2: fido_dev_get_cbor_info_rx: dev=0x564b3aa33d70, ci=0x564b3aa20410, ms=-1
libfido2: fido_rx: dev=0x564b3aa33d70, cmd=0x10, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18ec90, len=64
libfido2: 0000: 0f 00 00 00 90 00 7f 00 a8 01 83 66 55 32 46 5f
libfido2: 0016: 56 32 68 46 49 44 4f 5f 32 5f 30 6c 46 49 44 4f
libfido2: 0032: 5f 32 5f 31 5f 50 52 45 02 82 6b 63 72 65 64 50
libfido2: 0048: 72 6f 74 65 63 74 6b 68 6d 61 63 2d 73 65 63 72
libfido2: rx: payload_len=127
libfido2: rx: buf=0x7ffd5d18ec90, len=64
libfido2: 0000: 0f 00 00 00 00 65 74 03 50 99 8f 35 8b 2d d2 4c
libfido2: 0016: be a4 3a e8 10 74 38 df b3 04 a5 62 72 6b f5 62
libfido2: 0032: 75 70 f5 64 70 6c 61 74 f4 68 63 72 65 64 4d 67
libfido2: 0048: 6d 74 f5 69 63 6c 69 65 6e 74 50 69 6e f4 05 19
libfido2: rx: buf=0x7ffd5d18ec90, len=64
libfido2: 0000: 0f 00 00 00 01 04 b0 06 81 01 07 14 08 19 01 00
libfido2: 0016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: fido_rx: buf=0x564b3aa34f30, len=127
libfido2: 0000: 00 a8 01 83 66 55 32 46 5f 56 32 68 46 49 44 4f
libfido2: 0016: 5f 32 5f 30 6c 46 49 44 4f 5f 32 5f 31 5f 50 52
libfido2: 0032: 45 02 82 6b 63 72 65 64 50 72 6f 74 65 63 74 6b
libfido2: 0048: 68 6d 61 63 2d 73 65 63 72 65 74 03 50 99 8f 35
libfido2: 0064: 8b 2d d2 4c be a4 3a e8 10 74 38 df b3 04 a5 62
libfido2: 0080: 72 6b f5 62 75 70 f5 64 70 6c 61 74 f4 68 63 72
libfido2: 0096: 65 64 4d 67 6d 74 f5 69 63 6c 69 65 6e 74 50 69
libfido2: 0112: 6e f4 05 19 04 b0 06 81 01 07 14 08 19 01 00
libfido2: fido_dev_open_rx: FIDO_MAXMSG=2048, maxmsgsiz=1200
libfido2: fido_dev_get_cbor_info_tx: dev=0x564b3aa33d70
libfido2: fido_tx: dev=0x564b3aa33d70, cmd=0x10
libfido2: fido_tx: buf=0x7ffd5d18ed47, len=1
libfido2: 0000: 04
libfido2: fido_dev_get_cbor_info_rx: dev=0x564b3aa33d70, ci=0x564b3aa32bd0, ms=-1
libfido2: fido_rx: dev=0x564b3aa33d70, cmd=0x10, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18ec60, len=64
libfido2: 0000: 0f 00 00 00 90 00 7f 00 a8 01 83 66 55 32 46 5f
libfido2: 0016: 56 32 68 46 49 44 4f 5f 32 5f 30 6c 46 49 44 4f
libfido2: 0032: 5f 32 5f 31 5f 50 52 45 02 82 6b 63 72 65 64 50
libfido2: 0048: 72 6f 74 65 63 74 6b 68 6d 61 63 2d 73 65 63 72
libfido2: rx: payload_len=127
libfido2: rx: buf=0x7ffd5d18ec60, len=64
libfido2: 0000: 0f 00 00 00 00 65 74 03 50 99 8f 35 8b 2d d2 4c
libfido2: 0016: be a4 3a e8 10 74 38 df b3 04 a5 62 72 6b f5 62
libfido2: 0032: 75 70 f5 64 70 6c 61 74 f4 68 63 72 65 64 4d 67
libfido2: 0048: 6d 74 f5 69 63 6c 69 65 6e 74 50 69 6e f4 05 19
libfido2: rx: buf=0x7ffd5d18ec60, len=64
libfido2: 0000: 0f 00 00 00 01 04 b0 06 81 01 07 14 08 19 01 00
libfido2: 0016: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: fido_rx: buf=0x564b3aa34f30, len=127
libfido2: 0000: 00 a8 01 83 66 55 32 46 5f 56 32 68 46 49 44 4f
libfido2: 0016: 5f 32 5f 30 6c 46 49 44 4f 5f 32 5f 31 5f 50 52
libfido2: 0032: 45 02 82 6b 63 72 65 64 50 72 6f 74 65 63 74 6b
libfido2: 0048: 68 6d 61 63 2d 73 65 63 72 65 74 03 50 99 8f 35
libfido2: 0064: 8b 2d d2 4c be a4 3a e8 10 74 38 df b3 04 a5 62
libfido2: 0080: 72 6b f5 62 75 70 f5 64 70 6c 61 74 f4 68 63 72
libfido2: 0096: 65 64 4d 67 6d 74 f5 69 63 6c 69 65 6e 74 50 69
libfido2: 0112: 6e f4 05 19 04 b0 06 81 01 07 14 08 19 01 00
FIDO2 device implements extension: credProtect
FIDO2 device implements extension: hmac-secret
FIDO2 device implements option rk: yes
FIDO2 device implements option up: yes
FIDO2 device implements option plat: no
FIDO2 device implements option credMgmt: yes
FIDO2 device implements option clientPin: no
Has rk ('Resident Key') support: yes
Has clientPin support: no
Has up ('User Presence') support: yes
Has uv ('User Verification') support: no
Asking FIDO2 token for authentication.
👆 Please confirm presence on security token to unlock.
libfido2: fido_dev_authkey_tx: dev=0x564b3aa33d70
libfido2: fido_tx: dev=0x564b3aa33d70, cmd=0x10
libfido2: fido_tx: buf=0x564b3aa27980, len=6
libfido2: 0000: 06 a2 01 01 02 02
libfido2: fido_dev_authkey_rx: dev=0x564b3aa33d70, authkey=0x564b3aa27570, ms=-1
libfido2: fido_rx: dev=0x564b3aa33d70, cmd=0x10, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18eb40, len=64
libfido2: 0000: 0f 00 00 00 90 00 51 00 a1 01 a5 01 02 03 38 18
libfido2: 0016: 20 01 21 58 20 18 d5 07 ca 25 13 60 72 21 21 e8
libfido2: 0032: ab 4f 8e ce 41 ff 2f d3 03 ca 44 41 43 59 a2 f5
libfido2: 0048: 91 76 f0 b0 98 22 58 20 e5 c1 dc 5c fb 47 bc 56
libfido2: rx: payload_len=81
libfido2: rx: buf=0x7ffd5d18eb40, len=64
libfido2: 0000: 0f 00 00 00 00 a2 65 14 77 e1 a8 82 b9 04 ac d9
libfido2: 0016: 21 4e 2b a7 e6 1a 96 71 66 ae 92 52 3a 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: fido_rx: buf=0x564b3aa51bd0, len=81
libfido2: 0000: 00 a1 01 a5 01 02 03 38 18 20 01 21 58 20 18 d5
libfido2: 0016: 07 ca 25 13 60 72 21 21 e8 ab 4f 8e ce 41 ff 2f
libfido2: 0032: d3 03 ca 44 41 43 59 a2 f5 91 76 f0 b0 98 22 58
libfido2: 0048: 20 e5 c1 dc 5c fb 47 bc 56 a2 65 14 77 e1 a8 82
libfido2: 0064: b9 04 ac d9 21 4e 2b a7 e6 1a 96 71 66 ae 92 52
libfido2: 0080: 3a
libfido2: fido_tx: dev=0x564b3aa33d70, cmd=0x10
libfido2: fido_tx: buf=0x564b3aa5b1f0, len=307
libfido2: 0000: 02 a5 01 75 69 6f 2e 73 79 73 74 65 6d 64 2e 63
libfido2: 0016: 72 79 70 74 73 65 74 75 70 02 58 20 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 03 81 a2 62
libfido2: 0064: 69 64 58 46 cd f9 c1 ae f3 20 b8 81 a9 fa 84 35
libfido2: 0080: 41 ce 1b 77 84 c9 e3 db d2 86 de 7c 42 63 08 bc
libfido2: 0096: 64 c8 6d 30 c9 38 3b a2 a1 21 ff 04 55 14 ab e1
libfido2: 0112: b8 2a 95 99 df d9 be 3c 43 64 db 0d 6c d0 10 00
libfido2: 0128: d7 29 10 1a ba 8f b3 77 14 02 64 74 79 70 65 6a
libfido2: 0144: 70 75 62 6c 69 63 2d 6b 65 79 04 a1 6b 68 6d 61
libfido2: 0160: 63 2d 73 65 63 72 65 74 a3 01 a5 01 02 03 38 18
libfido2: 0176: 20 01 21 58 20 a2 e7 79 ec 10 fd d1 80 80 25 92
libfido2: 0192: 01 ee aa 1a 1d a2 aa 9b 2c 18 a3 d8 46 6d 15 30
libfido2: 0208: 91 24 98 66 4a 22 58 20 f6 2a a1 f7 78 f9 1a 16
libfido2: 0224: c0 8d 6d 65 12 ea 55 19 f4 8b 3a 94 29 e1 f3 c2
libfido2: 0240: 31 2b 28 35 97 19 3b 51 02 58 20 76 07 79 cc ea
libfido2: 0256: a0 8b d5 c8 b7 50 dc 72 19 01 c3 0a 07 f4 f5 1b
libfido2: 0272: 0a c3 74 eb 28 c5 44 ad 86 e7 bd 03 50 9d 37 09
libfido2: 0288: dc 86 fa c0 be ec ee 7e 32 fe 6f d3 c4 05 a1 62
libfido2: 0304: 75 70 f5
libfido2: fido_rx: dev=0x564b3aa33d70, cmd=0x10, ms=-1
libfido2: rx_preamble: buf=0x7ffd5d18ec00, len=64
libfido2: 0000: 0f 00 00 00 90 01 00 00 a3 01 a2 62 69 64 58 46
libfido2: 0016: cd f9 c1 ae f3 20 b8 81 a9 fa 84 35 41 ce 1b 77
libfido2: 0032: 84 c9 e3 db d2 86 de 7c 42 63 08 bc 64 c8 6d 30
libfido2: 0048: c9 38 3b a2 a1 21 ff 04 55 14 ab e1 b8 2a 95 99
libfido2: rx: payload_len=256
libfido2: rx: buf=0x7ffd5d18ec00, len=64
libfido2: 0000: 0f 00 00 00 00 df d9 be 3c 43 64 db 0d 6c d0 10
libfido2: 0016: 00 d7 29 10 1a ba 8f b3 77 14 02 64 74 79 70 65
libfido2: 0032: 6a 70 75 62 6c 69 63 2d 6b 65 79 02 58 54 3b a2
libfido2: 0048: a1 21 ff 04 55 14 ab e1 b8 2a 95 99 df d9 be 3c
libfido2: rx: buf=0x7ffd5d18ec00, len=64
libfido2: 0000: 0f 00 00 00 01 43 64 db 0d 6c d0 10 00 d7 29 10
libfido2: 0016: 1a ba 8f 81 02 14 78 05 a1 6b 68 6d 61 63 2d 73
libfido2: 0032: 65 63 72 65 74 58 20 68 37 eb c4 aa b9 ad 46 32
libfido2: 0048: 88 d5 5d 6a c9 e7 d3 84 1e 75 4f a8 b5 8a 1c f0
libfido2: rx: buf=0x7ffd5d18ec00, len=64
libfido2: 0000: 0f 00 00 00 02 2b 0b 35 9e b5 66 1c 03 58 47 30
libfido2: 0016: 45 02 20 2f 95 58 8c f5 d3 34 94 37 ed 70 2a 8c
libfido2: 0032: 8a a7 23 c8 23 c3 9b 28 f1 58 cd 7c 35 59 95 2b
libfido2: 0048: 3e 15 8f 02 21 00 da 91 7e 41 51 a5 c2 01 fc 5d
libfido2: rx: buf=0x7ffd5d18ec00, len=64
libfido2: 0000: 0f 00 00 00 03 c0 ac 85 18 4a c7 4e 49 00 e2 57
libfido2: 0016: b3 14 7f 48 71 e6 37 2b 7b 83 8d 00 00 00 00 00
libfido2: 0032: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: 0048: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
libfido2: fido_rx: buf=0x564b3aa5b330, len=256
libfido2: 0000: 00 a3 01 a2 62 69 64 58 46 cd f9 c1 ae f3 20 b8
libfido2: 0016: 81 a9 fa 84 35 41 ce 1b 77 84 c9 e3 db d2 86 de
libfido2: 0032: 7c 42 63 08 bc 64 c8 6d 30 c9 38 3b a2 a1 21 ff
libfido2: 0048: 04 55 14 ab e1 b8 2a 95 99 df d9 be 3c 43 64 db
libfido2: 0064: 0d 6c d0 10 00 d7 29 10 1a ba 8f b3 77 14 02 64
libfido2: 0080: 74 79 70 65 6a 70 75 62 6c 69 63 2d 6b 65 79 02
libfido2: 0096: 58 54 3b a2 a1 21 ff 04 55 14 ab e1 b8 2a 95 99
libfido2: 0112: df d9 be 3c 43 64 db 0d 6c d0 10 00 d7 29 10 1a
libfido2: 0128: ba 8f 81 02 14 78 05 a1 6b 68 6d 61 63 2d 73 65
libfido2: 0144: 63 72 65 74 58 20 68 37 eb c4 aa b9 ad 46 32 88
libfido2: 0160: d5 5d 6a c9 e7 d3 84 1e 75 4f a8 b5 8a 1c f0 2b
libfido2: 0176: 0b 35 9e b5 66 1c 03 58 47 30 45 02 20 2f 95 58
libfido2: 0192: 8c f5 d3 34 94 37 ed 70 2a 8c 8a a7 23 c8 23 c3
libfido2: 0208: 9b 28 f1 58 cd 7c 35 59 95 2b 3e 15 8f 02 21 00
libfido2: 0224: da 91 7e 41 51 a5 c2 01 fc 5d c0 ac 85 18 4a c7
libfido2: 0240: 4e 49 00 e2 57 b3 14 7f 48 71 e6 37 2b 7b 83 8d
libfido2: adjust_assert_count: cbor_type
libfido2: adjust_assert_count: cbor_type
libfido2: adjust_assert_count: cbor_type
libfido2: cbor_decode_assert_authdata: buf=0x564b3aa504d0, len=84
libfido2: decode_assert_extensions: buf=0x564b3aa504f5, len=47
libfido2: 0000: a1 6b 68 6d 61 63 2d 73 65 63 72 65 74 58 20 68
libfido2: 0016: 37 eb c4 aa b9 ad 46 32 88 d5 5d 6a c9 e7 d3 84
libfido2: 0032: 1e 75 4f a8 b5 8a 1c f0 2b 0b 35 9e b5 66 1c
Trying to open keyslot 1 with token 2 (type systemd-fido2).
Trying to open LUKS2 keyslot 1.
Running keyslot key derivation.
Reading keyslot area [0x47000].
Acquiring read lock for device /dev/zvol/zroot/zkeys.
Opening lock resource file /run/cryptsetup/L_230:0
Verifying lock handle for /dev/zvol/zroot/zkeys.
Device /dev/zvol/zroot/zkeys READ lock taken.
Reusing open ro fd on device /dev/zvol/zroot/zkeys
Device /dev/zvol/zroot/zkeys READ lock released.
Verifying key from keyslot 1, digest 0.
dm target-version crypt  [ opencount flush ]   [16384] (*1)
dm versions   [ opencount flush ]   [16384] (*1)
Detected dm-crypt version 1.28.0.
Loading key (type logon, name cryptsetup:87c5cf5f-64da-4e5f-a55a-8aac0dbe080b-d0) in thread keyring.
dm versions   [ opencount flush ]   [16384] (*1)
dm status zkeys  [ opencount noflush ]   [16384] (*1)
Calculated device size is 139264 sectors (RW), offset 65536.
DM-UUID is CRYPT-LUKS2-87c5cf5f64da4e5fa55a8aac0dbe080b-zkeys
Udev cookie 0xd4d334b (semid 0) created
Udev cookie 0xd4d334b (semid 0) incremented to 1
Udev cookie 0xd4d334b (semid 0) incremented to 2
Udev cookie 0xd4d334b (semid 0) assigned to CREATE task(0) with flags DISABLE_LIBRARY_FALLBACK         (0x20)
dm create zkeys CRYPT-LUKS2-87c5cf5f64da4e5fa55a8aac0dbe080b-zkeys [ opencount flush ]   [16384] (*1)
dm reload   (253:0) [ opencount flush securedata ]   [16384] (*1)
dm resume zkeys  [ opencount flush securedata ]   [16384] (*1)
zkeys: Stacking NODE_ADD (253,0) 0:6 0660 [trust_udev]
zkeys: Stacking NODE_READ_AHEAD 131072 (flags=1)
Udev cookie 0xd4d334b (semid 0) decremented to 1
Udev cookie 0xd4d334b (semid 0) waiting for zero
Udev cookie 0xd4d334b (semid 0) destroyed
zkeys: Skipping NODE_ADD (253,0) 0:6 0660 [trust_udev]
zkeys: Processing NODE_READ_AHEAD 131072 (flags=1)
zkeys (253:0): read ahead is 131072
zkeys: retaining kernel read ahead of 131072 (requested 131072)
Volume zkeys activated with LUKS token id 0.
Releasing crypt device /dev/zvol/zroot/zkeys context.
Releasing device-mapper backend.
Closing read only fd for /dev/zvol/zroot/zkeys.
Unloading systemd-fido2 token handler.