Created attachment 272406 [details] output of dmesg $ freebsd-version 15.0-RELEASE-p11 $ pkg info | g firefox firefox-152.0.4,2 Web browser based on the browser portion of Mozilla $ pkg info | g chromium chromium-149.0.7827.196 Google web browser based on WebKit $ Xfce version: 4.20 The output of dmesg is attached. Security Key YubiKey 5C NFC Firmware: 5.7.4 I purchased two new YubiKey 5C NFC devices (primary and backup, from yubico.com). Both exhibit identical behavior. WebAuthn credential registration and authentication fail on FreeBSD in both Firefox and Chromium. The same YubiKey works correctly on a MacBook Pro using the same websites. Steps to Reproduce Insert the YubiKey. Open https://webauthn.io. Enter a username. Click Register. Browser displays: "Touch your security key to continue with webauthn.io". Touch the YubiKey. Expected Result: Registration completes successfully. Actual Result: Registration fails. webauthn.io reports: "Registration ceremony was sent an abort signal" If the key is first registered on macOS and then used on FreeBSD for authentication, authentication also fails with: "Authentication ceremony was sent an abort signal" The same behavior occurs on: webauthn.io mail.yahoo.com fastmail.com Browser Results Firefox: Security key prompt appears. After touching the key, registration fails. Chromium: Same failure. Cross-platform Comparison Using the same YubiKey on a MacBook Pro: Registration succeeds. Authentication succeeds. Therefore the YubiKey hardware and firmware appear to be functioning correctly. YubiKey Information ykman info reports: Device: YubiKey 5C NFC Firmware: 5.7.4 USB interfaces: OTP, FIDO, CCID FIDO2 enabled FIDO U2F enabled $ sudo ykman info WARNING: PC/SC not available. Smart card (CCID) protocols will not function. ERROR: Unable to list devices for connection Device type: YubiKey 5C NFC Serial number: 38301425 Firmware version: 5.7.4 Form factor: Keychain (USB-C) Enabled USB interfaces: OTP, FIDO, CCID NFC transport is enabled Applications USB NFC Yubico OTP Enabled Enabled FIDO U2F Enabled Enabled FIDO2 Enabled Enabled OATH Enabled Enabled PIV Enabled Enabled OpenPGP Enabled Enabled YubiHSM Auth Enabled Enabled $ 'ykman fido info' successfully communicates with the authenticator: $ sudo ykman fido info WARNING: PC/SC not available. Smart card (CCID) protocols will not function. ERROR: Unable to list devices for connection AAGUID: d7781e5d-e353-46aa-afe2-3ca49f13332a PIN: Not set Minimum PIN length: 4 Always Require UV: Off Credential storage remaining: 99 swift@hawk:~ $ 'ykman fido reset' reaches the confirmation prompt. $ sudo ykman fido reset WARNING: PC/SC not available. Smart card (CCID) protocols will not function. ERROR: Unable to list devices for connection WARNING! This will delete all FIDO credentials, including FIDO U2F credentials, and restore factory settings. Proceed? [y/N]: N Aborted! $ USB Information usbconfig identifies the device correctly as: Vendor ID: 0x1050 (Yubico) Product ID: 0x0407 Interfaces: HID HID (Authenticator) CCID Smart Card The kernel creates: /dev/uhid0 -> /dev/u2f/0 No new messages appear in dmesg when the WebAuthn operation fails. $ sudo usbconfig | g Yubikey ugen0.6: <Yubikey 4/5 OTP+U2F+CCID Yubico.com> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (30mA) $ sudo usbconfig -d ugen0.6 dump_device_desc ugen0.6: <Yubikey 4/5 OTP+U2F+CCID Yubico.com> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (30mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0200 bDeviceClass = 0x0000 <Probed by interface class> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0000 bMaxPacketSize0 = 0x0040 idVendor = 0x1050 idProduct = 0x0407 bcdDevice = 0x0574 iManufacturer = 0x0001 <Yubico> iProduct = 0x0002 <YubiKey OTP+FIDO+CCID> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 $ $ sudo usbconfig -d ugen0.6 dump_all_desc ugen0.6: <Yubikey 4/5 OTP+U2F+CCID Yubico.com> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (30mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0200 bDeviceClass = 0x0000 <Probed by interface class> bDeviceSubClass = 0x0000 bDeviceProtocol = 0x0000 bMaxPacketSize0 = 0x0040 idVendor = 0x1050 idProduct = 0x0407 bcdDevice = 0x0574 iManufacturer = 0x0001 <Yubico> iProduct = 0x0002 <YubiKey OTP+FIDO+CCID> iSerialNumber = 0x0000 <no string> bNumConfigurations = 0x0001 Configuration index 0 bLength = 0x0009 bDescriptorType = 0x0002 wTotalLength = 0x0096 bNumInterfaces = 0x0003 bConfigurationValue = 0x0001 iConfiguration = 0x0000 <no string> bmAttributes = 0x0080 bMaxPower = 0x000f Interface 0 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0000 bAlternateSetting = 0x0000 bNumEndpoints = 0x0001 bInterfaceClass = 0x0003 <HID device> bInterfaceSubClass = 0x0001 bInterfaceProtocol = 0x0001 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x09 bDescriptorType = 0x21 bDescriptorSubType = 0x10 RAW dump: 0x00 | 0x09, 0x21, 0x10, 0x01, 0x00, 0x01, 0x22, 0x47, 0x08 | 0x00 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0081 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0008 bInterval = 0x000a bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 1 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0001 bAlternateSetting = 0x0000 bNumEndpoints = 0x0002 bInterfaceClass = 0x0003 <HID device> bInterfaceSubClass = 0x0000 bInterfaceProtocol = 0x0000 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x09 bDescriptorType = 0x21 bDescriptorSubType = 0x10 RAW dump: 0x00 | 0x09, 0x21, 0x10, 0x01, 0x00, 0x01, 0x22, 0x22, 0x08 | 0x00 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0004 <OUT> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0040 bInterval = 0x0002 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0084 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0040 bInterval = 0x0002 bRefresh = 0x0000 bSynchAddress = 0x0000 Interface 2 bLength = 0x0009 bDescriptorType = 0x0004 bInterfaceNumber = 0x0002 bAlternateSetting = 0x0000 bNumEndpoints = 0x0003 bInterfaceClass = 0x000b <Smart card> bInterfaceSubClass = 0x0000 bInterfaceProtocol = 0x0000 iInterface = 0x0000 <no string> Additional Descriptor bLength = 0x36 bDescriptorType = 0x21 bDescriptorSubType = 0x00 RAW dump: 0x00 | 0x36, 0x21, 0x00, 0x01, 0x00, 0x07, 0x02, 0x00, 0x08 | 0x00, 0x00, 0xa0, 0x0f, 0x00, 0x00, 0xa0, 0x0f, 0x10 | 0x00, 0x00, 0x00, 0x00, 0xb0, 0x04, 0x00, 0x00, 0x18 | 0xb0, 0x04, 0x00, 0x00, 0xf6, 0x0b, 0x00, 0x00, 0x20 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28 | 0xfe, 0x00, 0x04, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x30 | 0xff, 0xff, 0x00, 0x00, 0x00, 0x01 Endpoint 0 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0002 <OUT> bmAttributes = 0x0002 <BULK> wMaxPacketSize = 0x0040 bInterval = 0x0000 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 1 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0082 <IN> bmAttributes = 0x0002 <BULK> wMaxPacketSize = 0x0040 bInterval = 0x0000 bRefresh = 0x0000 bSynchAddress = 0x0000 Endpoint 2 bLength = 0x0007 bDescriptorType = 0x0005 bEndpointAddress = 0x0083 <IN> bmAttributes = 0x0003 <INTERRUPT> wMaxPacketSize = 0x0008 bInterval = 0x0020 bRefresh = 0x0000 bSynchAddress = 0x0000 $ Additional Testing Performed the following tests: Two different YubiKey 5C NFC devices. Firefox and Chromium. Multiple WebAuthn sites. Different USB ports. USB-A to USB-C adapter. Native Xfce session. Upgraded from FreeBSD 15.0-RELEASE-p5 to 15.0-RELEASE-p11. All FreeBSD tests fail identically. The same hardware works immediately on macOS. Conclusion The evidence suggests a FreeBSD-specific issue affecting WebAuthn/FIDO2 in browsers rather than a hardware problem with the YubiKey. If additional diagnostics, browser logs, or test patches would be helpful, I would be happy to test them.
It's not a bug. It's a lack of documentation. Fixed by installing the package u2f-devd-1.1.10_9 in addition to libfido2-1.16.0 and py311-yubikey-manager-5.7.2_1. After installing u2f-devd-1.1.10_9: # service devd restart # pw group mod u2f -m <user>
and reboot.