nk3 test: Don’t show touch prompt if PIN is missing about pynitrokey HOT 1 CLOSED

I’m not quite sure why the PIN is required at all as we set uv to discouraged. Looking at the source code, these lines in the fido2 library trigger the PIN verification:

        elif mc and uv_configured and not self.info.options.get("makeCredUvNotRqd"):
            return True

https://github.com/Yubico/python-fido2/blob/1.1.1/fido2/client.py#L491-L492

This effectively means that the uv value is ignored for makeCredential unless the makeCredUvNotRqd option is set. The relevant info in the FIDO2 spec is:

Note: For backwards compatibility, platforms must be aware that FIDO_2_0 (aka CTAP2.0) authenticators always require some form of user verification for authenticatorMakeCredential operations. If a platform attempts to create a non-discoverable credential on a CTAP2.0 authenticator without including the "uv" option key or the pinUvAuthToken parameter that authenticator will return an error. In contrast, a FIDO_2_1 (aka CTAP2.1) authenticator with the makeCredUvNotRqd option ID (set to true) in the authenticatorGetInfo response structure, will allow creation of non-discoverable credentials without requiring some form of user verification.

https://fidoalliance.org/specs/fido-v2.1-rd-20201208/fido-client-to-authenticator-protocol-v2.1-rd-20201208.html#authenticatorMakeCredential

As far as I see, the Nitrokey 3 does not set this option. So we could probably fix this problem at the root and remove the PIN requirement if we add this option to fido-authenticator.

from pynitrokey.