Post

Replies

Boosts

Views

Activity

Reply to Different PRF output when using platform or cross-platform authentication attachement
@Systems Engineer We've conducted thorough testing across multiple scenarios and observed that: The PRF inconsistency affects all cross-platform authentication flows when using iOS 18.0-18.3 devices as authenticators (via QR code scanning), regardless of whether the relying party is on macOS, Windows OS Our testing confirms data is permanently inaccessible when: A user encrypts data using the incorrect PRF output from cross-platform authentication on iOS 18.0-18.3 They upgrade to iOS 18.4+ which generates different (correct) PRF outputs This creates a critical data loss situation for applications using PRF for encryption We currently have no reliable method to detect iOS version during cross-platform authentication or prevent affected users from using this flow. This presents significant challenges for applications using PRF extension for cryptographic purposes. Could you please provide: Guidance on how to safely migrate users with data encrypted using incorrect PRF values Any API or mechanism to identify potentially affected devices during cross-platform authentication Recommendations for maintaining backward compatibility while ensuring data integrity Is it possible to work around this issue by implementing a custom QR code solution, or does the inconsistency occur at a deeper system level within the cross-platform authentication process? Thank you for addressing this issue in iOS 18.4, but we urgently need guidance on handling the transition period for existing users.
Topic: Privacy & Security SubTopic: General Tags:
Apr ’25
Reply to Different PRF output when using platform or cross-platform authentication attachement
@Systems Engineer Hello Apple Team, I would like to bring to your attention that this issue also occurs when using cross-device authentication on Windows when using Iphone 18.3.1 Could you clarify whether this is a broader cross-device issue, an iOS/macOS-specific issue, or something else? Additionally, how can we ensure backward compatibility with older versions, or at least prevent users from using versions where this issue persists?
Topic: Privacy & Security SubTopic: General Tags:
Mar ’25
Reply to PRF Extension Not Supported in Safari's Cross-Device WebAuthn Flow
[quote='825352022, Systems Engineer, /thread/774112?answerId=825352022#825352022'] This issue was partially fixed in Safari 18.2. As of that version, PRF is available again in hybrid, but it's returning a different value over hybrid than when invoked on-device. This remaining issue will be fixed soon. 0  comments [/quote] I have tested again with Safari 18.4 (20621.1.14.11.3) on macOS 15.4 Beta (24E5228e) with cross device: Iphone IOS 18.2.1, and the issue persists. PRF support is still reported as false, and the extension results remain empty. Could you confirm whether this fix is included in the latest beta, or if further updates are needed?
Topic: Safari & Web SubTopic: General Tags:
Mar ’25