I'm testing PRF evaluation with a YubiKey Bio through AuthenticationServices on iOS.
Registration succeeds, but during later authentication with the enrolled fingerprint, I don't receive a PRF result. Using the key’s FIDO2 PIN works.
Environment
- iPhone 12
- iOS 27.0.1
- YubiKey Bio connected through USB
- Firmware: 5.7.0
Steps to reproduce
- Configure a FIDO2 PIN and enroll a fingerprint on the YubiKey Bio.
- Connect the key to the iPhone.
- Register a credential using ASAuthorizationSecurityKeyPublicKeyCredentialProvider with PRF support requested.
- Request authentication for the registered credential with PRF input and userVerificationPreference = .required.
- Authenticate using the enrolled fingerprint.
- Check the returned PRF result.
- Compare this with authentication using the FIDO2 PIN.
Expected result
Successful authentication with PRF evaluation returns a 32-byte PRF output.
Actual result
No PRF result is returned when using fingerprint verification. The PIN flow works.
Related report
I found WebKit bug #314934, which reports missing PRF results with a YubiKey C Bio in Safari. The reporter observed successful authentication but a null PRF output.
Could AuthenticationServices be affected by a similar issue? Is there a known limitation or workaround for PRF evaluation with YubiKey Bio fingerprint verification?