Skip to content

Remove U2f support#105

Merged
Progdrasil merged 5 commits into
mainfrom
progdrasil/remove-u2f
Jul 24, 2026
Merged

Remove U2f support#105
Progdrasil merged 5 commits into
mainfrom
progdrasil/remove-u2f

Conversation

@Progdrasil

Copy link
Copy Markdown
Collaborator

U2F was essentially dead code from a long past POC and was only maintained in case we needed to support it in the wild. It's been a few years and we (1Password) never hooked it up to production code. U2F as a standard is also effectively deprecated and will not receive updates in the future, therefore it will not be PQC enabled.

For these reasons this PR removes it completely from tree.

@Progdrasil
Progdrasil force-pushed the progdrasil/remove-u2f branch 2 times, most recently from aada8d3 to 6713e68 Compare July 17, 2026 16:24
@Progdrasil Progdrasil linked an issue Jul 17, 2026 that may be closed by this pull request

@ambareesh1510 ambareesh1510 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread CHANGELOG.md Outdated
Comment thread CHANGELOG.md Outdated

@Vogeltak Vogeltak left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thank you!

I ran a quick search through the whole repo with ripgrep and still found some whiffs of U2F (I think all of these are safe to delete as well):

passkey-rs on  progdrasil/remove-u2f via 🦀 on ☁️
❯ rg -i u2f
CHANGELOG.md
7:- ⚠ BBREAKING: Remove U2F support ([#105](https://github.com/1Password/passkey-rs/pull/105))
15:- ⚠ BBREAKING: Remove U2F support ([#105](https://github.com/1Password/passkey-rs/pull/105))

passkey-client/src/linux.rs
234:                ctap2::StatusCode::Ctap1(ctap2::U2FError::Other).into(),

passkey-client/src/lib.rs
113:            ctap2::StatusCode::Ctap1(u2f) => WebauthnError::AuthenticatorError(u2f.into()),

passkey-types/src/webauthn/attestation.rs
538:    /// Used with FIDO U2F authenticators.
539:    FidoU2f,

passkey-types/src/ctap2/get_assertion.rs
157:        /// ## U2F Devices:
158:        /// For U2F devices, this parameter is not returned as this user information is not present
159:        /// for U2F credentials.
163:        /// resident credentials behave same as U2F credentials where they are discovered given the

passkey-transports/src/hidraw.rs
27:/// HID usage page assigned to the FIDO Alliance for U2F / CTAP authenticators.
493:    /// Does NOT implement `CTAPHID_MSG` (i.e. no U2F/CTAP1 fallback).

passkey-authenticator/src/linux.rs
24:    Ctap2Command, Ctap2Error, StatusCode, U2FError, get_assertion, get_info, make_credential,
116:            .map_err(|_| StatusCode::from(U2FError::Other))?;
132:            .map_err(|_| StatusCode::from(U2FError::Other))?;
264:            // it as the catch-all CTAP1 `U2FError::Other` (0x7F).
265:            TransactionError::Hid(_) => StatusCode::from(U2FError::Other),
285:        if *status != u8::from(U2FError::Success) {

passkey-transports/src/hid.rs
7:    /// This command sends an encapsulated CTAP1/U2F message to the device. The semantics of the
8:    /// data message is defined in the U2F Raw Message Format encoding specification. See [passkey-rs::u2f].

passkey-types/src/ctap2/error.rs
8:    /// Ctap1 or U2F error codes
9:    Ctap1(U2FError),
16:        // Default to trying Ctap2, otherwise it must be a U2F error
19:            .or_else(|err| U2FError::try_from(err.0).map(Self::from))
28:            StatusCode::Ctap1(u2f) => u2f.into(),
35:    /// U2F or CTAP1 error variants
36:    U2FError: u8 {
61:impl From<U2FError> for StatusCode {
62:    fn from(ctap1: U2FError) -> Self {
114:        /// > Note that this clashes with [`U2FError::Success`] but when deserializing from

passkey-types/src/ctap2/get_info.rs
24:        /// * "U2F_V2" for CTAP1/U2F authenticators.
533:    U2F_V2,

passkey-types/src/ctap2/error/tests.rs
1:use crate::ctap2::error::{ExtensionError, U2FError, UnknownSpecError, VendorError};
12:    assert_eq!(invalid_len, U2FError::InvalidLength.into());

passkey-authenticator/src/authenticator/make_credential.rs
27:        //    token is already registered to behave similarly to CTAP1/U2F authenticators.

@Progdrasil
Progdrasil force-pushed the progdrasil/remove-u2f branch from 6713e68 to 5bb2a09 Compare July 22, 2026 20:09
… in production

it is also not going to be updated to support PQC algorithms and therefore should not be used
@Progdrasil
Progdrasil force-pushed the progdrasil/remove-u2f branch from 5bb2a09 to 8fb2cb8 Compare July 22, 2026 21:09
@Progdrasil

Copy link
Copy Markdown
Collaborator Author

Nice, thank you!

I ran a quick search through the whole repo with ripgrep and still found some whiffs of U2F (I think all of these are safe to delete as well):

Nice callout, I ended up moving the error cases over to Ctap2Error and renamed Ctap2Code to StatusCode (also removing the old StatusCode).

The only U2F case I kept around was the attestation format since I know there are other projects out there using passkey-types for more than authenticator use cases. Hell we're using it as a RP now with the Linux authenticator change.

@Progdrasil
Progdrasil force-pushed the progdrasil/remove-u2f branch 3 times, most recently from 272ef77 to ca95d76 Compare July 23, 2026 14:58
Comment thread passkey-types/src/ctap2/get_info.rs
@Progdrasil
Progdrasil merged commit f0134a8 into main Jul 24, 2026
8 checks passed
@Progdrasil
Progdrasil deleted the progdrasil/remove-u2f branch July 24, 2026 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add --locked flag to typeshare-cli installation in CI

4 participants