@Systems Engineer
We've conducted thorough testing across multiple scenarios and observed that:
The PRF inconsistency affects all cross-platform authentication flows when using iOS 18.0-18.3 devices as authenticators (via QR code scanning), regardless of whether the relying party is on macOS, Windows OS
Our testing confirms data is permanently inaccessible when:
A user encrypts data using the incorrect PRF output from cross-platform authentication on iOS 18.0-18.3
They upgrade to iOS 18.4+ which generates different (correct) PRF outputs
This creates a critical data loss situation for applications using PRF for encryption
We currently have no reliable method to detect iOS version during cross-platform authentication or prevent affected users from using this flow.
This presents significant challenges for applications using PRF extension for cryptographic purposes. Could you please provide:
Guidance on how to safely migrate users with data encrypted using incorrect PRF values
Any API or mechanism to identify potentially affected devices during cross-platform authentication
Recommendations for maintaining backward compatibility while ensuring data integrity
Is it possible to work around this issue by implementing a custom QR code solution, or does the inconsistency occur at a deeper system level within the cross-platform authentication process?
Thank you for addressing this issue in iOS 18.4, but we urgently need guidance on handling the transition period for existing users.
Topic:
Privacy & Security
SubTopic:
General
Tags: