Post

Replies

Boosts

Views

Activity

HCE Entitlement eligibility - Device-to-Device use case for FIDO/passkey authentication
Hello, We operate PasskeyGuard, an iOS passkey/FIDO2 authentication app, and are evaluating adding NFC support. We'd like to confirm eligibility before starting development or submitting a formal entitlement request. Intended flow: Our iPhone app acts as the host (Host Card Emulation). Another device reads the iPhone over NFC to perform a FIDO2/WebAuthn authentication (the phone acts as a security-key-style authenticator, transmitting authentication data over NFC to the reading device). Based on the HCE support article, the closest matching category appears to be "Device-to-Device transactions." Our questions: Is a FIDO2/passkey authentication use case eligible under the Device-to-Device HCE entitlement, or does it fall outside the currently supported use cases? If eligible: are we permitted to register a custom applet AID (specifically the FIDO2 NFC AID A0000006472F0001) via CardSession, or is the set of allowed AIDs restricted per use case? Are there requirements beyond an EEA-established Organization account and the general "legal right / regulatory permissions" attestation that apply specifically to an authentication use case? We want to avoid investing development effort against an entitlement that may not be granted for this use case. Any guidance on eligibility and next steps would be greatly appreciated. Thank you, Alexander Friedl
1
0
127
5d
Attesting Secure Enclave-Generated Keys in a WebAuthn Flow
Hello everyone, I'm working on a project where I intend to use Secure Enclave-based, device-bound private keys within a Webauthn flow. I have the following question: Is it possible to generate private keys in the Secure Enclave with integrated attestation in order to reliably prove to a relying party the authenticity and uncompromised state of the key? If so, I would appreciate details on the implementation—specifically, any prerequisites, limitations, or particular API calls and configuration options that need to be considered. I look forward to any advice, best practices, or pointers to further documentation on this topic. Thank you in advance for your support! Best regards, Alex
1
3
222
Apr ’25
HCE Entitlement eligibility - Device-to-Device use case for FIDO/passkey authentication
Hello, We operate PasskeyGuard, an iOS passkey/FIDO2 authentication app, and are evaluating adding NFC support. We'd like to confirm eligibility before starting development or submitting a formal entitlement request. Intended flow: Our iPhone app acts as the host (Host Card Emulation). Another device reads the iPhone over NFC to perform a FIDO2/WebAuthn authentication (the phone acts as a security-key-style authenticator, transmitting authentication data over NFC to the reading device). Based on the HCE support article, the closest matching category appears to be "Device-to-Device transactions." Our questions: Is a FIDO2/passkey authentication use case eligible under the Device-to-Device HCE entitlement, or does it fall outside the currently supported use cases? If eligible: are we permitted to register a custom applet AID (specifically the FIDO2 NFC AID A0000006472F0001) via CardSession, or is the set of allowed AIDs restricted per use case? Are there requirements beyond an EEA-established Organization account and the general "legal right / regulatory permissions" attestation that apply specifically to an authentication use case? We want to avoid investing development effort against an entitlement that may not be granted for this use case. Any guidance on eligibility and next steps would be greatly appreciated. Thank you, Alexander Friedl
Replies
1
Boosts
0
Views
127
Activity
5d
Attesting Secure Enclave-Generated Keys in a WebAuthn Flow
Hello everyone, I'm working on a project where I intend to use Secure Enclave-based, device-bound private keys within a Webauthn flow. I have the following question: Is it possible to generate private keys in the Secure Enclave with integrated attestation in order to reliably prove to a relying party the authenticity and uncompromised state of the key? If so, I would appreciate details on the implementation—specifically, any prerequisites, limitations, or particular API calls and configuration options that need to be considered. I look forward to any advice, best practices, or pointers to further documentation on this topic. Thank you in advance for your support! Best regards, Alex
Replies
1
Boosts
3
Views
222
Activity
Apr ’25