Remove U2f support#105
Merged
Merged
Conversation
Progdrasil
force-pushed
the
progdrasil/remove-u2f
branch
2 times, most recently
from
July 17, 2026 16:24
aada8d3 to
6713e68
Compare
ambareesh1510
approved these changes
Jul 17, 2026
Vogeltak
requested changes
Jul 17, 2026
Vogeltak
left a comment
Collaborator
There was a problem hiding this comment.
Nice, thank you!
I ran a quick search through the whole repo with ripgrep and still found some whiffs of U2F (I think all of these are safe to delete as well):
passkey-rs on progdrasil/remove-u2f via 🦀 on ☁️
❯ rg -i u2f
CHANGELOG.md
7:- ⚠ BBREAKING: Remove U2F support ([#105](https://github.com/1Password/passkey-rs/pull/105))
15:- ⚠ BBREAKING: Remove U2F support ([#105](https://github.com/1Password/passkey-rs/pull/105))
passkey-client/src/linux.rs
234: ctap2::StatusCode::Ctap1(ctap2::U2FError::Other).into(),
passkey-client/src/lib.rs
113: ctap2::StatusCode::Ctap1(u2f) => WebauthnError::AuthenticatorError(u2f.into()),
passkey-types/src/webauthn/attestation.rs
538: /// Used with FIDO U2F authenticators.
539: FidoU2f,
passkey-types/src/ctap2/get_assertion.rs
157: /// ## U2F Devices:
158: /// For U2F devices, this parameter is not returned as this user information is not present
159: /// for U2F credentials.
163: /// resident credentials behave same as U2F credentials where they are discovered given the
passkey-transports/src/hidraw.rs
27:/// HID usage page assigned to the FIDO Alliance for U2F / CTAP authenticators.
493: /// Does NOT implement `CTAPHID_MSG` (i.e. no U2F/CTAP1 fallback).
passkey-authenticator/src/linux.rs
24: Ctap2Command, Ctap2Error, StatusCode, U2FError, get_assertion, get_info, make_credential,
116: .map_err(|_| StatusCode::from(U2FError::Other))?;
132: .map_err(|_| StatusCode::from(U2FError::Other))?;
264: // it as the catch-all CTAP1 `U2FError::Other` (0x7F).
265: TransactionError::Hid(_) => StatusCode::from(U2FError::Other),
285: if *status != u8::from(U2FError::Success) {
passkey-transports/src/hid.rs
7: /// This command sends an encapsulated CTAP1/U2F message to the device. The semantics of the
8: /// data message is defined in the U2F Raw Message Format encoding specification. See [passkey-rs::u2f].
passkey-types/src/ctap2/error.rs
8: /// Ctap1 or U2F error codes
9: Ctap1(U2FError),
16: // Default to trying Ctap2, otherwise it must be a U2F error
19: .or_else(|err| U2FError::try_from(err.0).map(Self::from))
28: StatusCode::Ctap1(u2f) => u2f.into(),
35: /// U2F or CTAP1 error variants
36: U2FError: u8 {
61:impl From<U2FError> for StatusCode {
62: fn from(ctap1: U2FError) -> Self {
114: /// > Note that this clashes with [`U2FError::Success`] but when deserializing from
passkey-types/src/ctap2/get_info.rs
24: /// * "U2F_V2" for CTAP1/U2F authenticators.
533: U2F_V2,
passkey-types/src/ctap2/error/tests.rs
1:use crate::ctap2::error::{ExtensionError, U2FError, UnknownSpecError, VendorError};
12: assert_eq!(invalid_len, U2FError::InvalidLength.into());
passkey-authenticator/src/authenticator/make_credential.rs
27: // token is already registered to behave similarly to CTAP1/U2F authenticators.
Progdrasil
force-pushed
the
progdrasil/remove-u2f
branch
from
July 22, 2026 20:09
6713e68 to
5bb2a09
Compare
… in production it is also not going to be updated to support PQC algorithms and therefore should not be used
Progdrasil
force-pushed
the
progdrasil/remove-u2f
branch
from
July 22, 2026 21:09
5bb2a09 to
8fb2cb8
Compare
Collaborator
Author
Nice callout, I ended up moving the error cases over to Ctap2Error and renamed The only U2F case I kept around was the attestation format since I know there are other projects out there using |
Progdrasil
force-pushed
the
progdrasil/remove-u2f
branch
3 times, most recently
from
July 23, 2026 14:58
272ef77 to
ca95d76
Compare
Progdrasil
force-pushed
the
progdrasil/remove-u2f
branch
from
July 23, 2026 15:53
ca95d76 to
e9b5d5b
Compare
Vogeltak
approved these changes
Jul 23, 2026
complexspaces
approved these changes
Jul 23, 2026
ambareesh1510
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
U2F was essentially dead code from a long past POC and was only maintained in case we needed to support it in the wild. It's been a few years and we (1Password) never hooked it up to production code. U2F as a standard is also effectively deprecated and will not receive updates in the future, therefore it will not be PQC enabled.
For these reasons this PR removes it completely from tree.