Bug 296468 - Firefox/Chromium or USB/HID: WebAuthn/FIDO2 authentication and registration fail with YubiKey 5C NFC on FreeBSD 15.0 (Firefox and Chromium), but succeed on macOS
Summary: Firefox/Chromium or USB/HID: WebAuthn/FIDO2 authentication and registration...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: amd64 Any
: --- Affects Many People
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-02 18:27 UTC by Alex Matei
Modified: 2026-07-05 04:32 UTC (History)
0 users

See Also:


Attachments
output of dmesg (12.32 KB, text/plain)
2026-07-02 18:27 UTC, Alex Matei
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Matei 2026-07-02 18:27:57 UTC
Created attachment 272406 [details]
output of dmesg

$ freebsd-version
15.0-RELEASE-p11
$ pkg info | g firefox
firefox-152.0.4,2              Web browser based on the browser portion of Mozilla
$ pkg info | g chromium
chromium-149.0.7827.196        Google web browser based on WebKit
$
Xfce version: 4.20

The output of dmesg is attached.

Security Key

    YubiKey 5C NFC
    Firmware: 5.7.4

I purchased two new YubiKey 5C NFC devices (primary and backup, from yubico.com).
Both exhibit identical behavior.

WebAuthn credential registration and authentication fail on FreeBSD in both Firefox and Chromium.
The same YubiKey works correctly on a MacBook Pro using the same websites.

Steps to Reproduce
    Insert the YubiKey.
    Open https://webauthn.io.
    Enter a username.
    Click Register.
    Browser displays: "Touch your security key to continue with webauthn.io".
    Touch the YubiKey.

Expected Result: Registration completes successfully.

Actual Result: Registration fails.

webauthn.io reports: "Registration ceremony was sent an abort signal"

If the key is first registered on macOS and then used on FreeBSD for authentication, authentication also fails with:
"Authentication ceremony was sent an abort signal"

The same behavior occurs on:
    webauthn.io
    mail.yahoo.com
    fastmail.com
    
Browser Results
Firefox:
    Security key prompt appears.
    After touching the key, registration fails.
    
Chromium:
    Same failure.


Cross-platform Comparison
Using the same YubiKey on a MacBook Pro:
    Registration succeeds.
    Authentication succeeds.

Therefore the YubiKey hardware and firmware appear to be functioning correctly.

YubiKey Information
ykman info reports:

    Device: YubiKey 5C NFC
    Firmware: 5.7.4
    USB interfaces: OTP, FIDO, CCID
    FIDO2 enabled
    FIDO U2F enabled

$ sudo ykman info
WARNING: PC/SC not available. Smart card (CCID) protocols will not function.
ERROR: Unable to list devices for connection
Device type: YubiKey 5C NFC
Serial number: 38301425
Firmware version: 5.7.4
Form factor: Keychain (USB-C)
Enabled USB interfaces: OTP, FIDO, CCID
NFC transport is enabled

Applications	USB    	NFC    
Yubico OTP  	Enabled	Enabled
FIDO U2F    	Enabled	Enabled
FIDO2       	Enabled	Enabled
OATH        	Enabled	Enabled
PIV         	Enabled	Enabled
OpenPGP     	Enabled	Enabled
YubiHSM Auth	Enabled	Enabled
$ 

'ykman fido info' successfully communicates with the authenticator:
$ sudo ykman fido info
WARNING: PC/SC not available. Smart card (CCID) protocols will not function.
ERROR: Unable to list devices for connection
AAGUID:                       d7781e5d-e353-46aa-afe2-3ca49f13332a
PIN:                          Not set
Minimum PIN length:           4
Always Require UV:            Off
Credential storage remaining: 99
swift@hawk:~ $ 


'ykman fido reset' reaches the confirmation prompt.
$ sudo ykman fido reset
WARNING: PC/SC not available. Smart card (CCID) protocols will not function.
ERROR: Unable to list devices for connection
WARNING! This will delete all FIDO credentials, including FIDO U2F credentials, and restore factory settings. Proceed? [y/N]: N
Aborted!
$

USB Information
usbconfig identifies the device correctly as:
Vendor ID: 0x1050 (Yubico)
Product ID: 0x0407
Interfaces:
    HID
    HID (Authenticator)
    CCID Smart Card

The kernel creates: /dev/uhid0 -> /dev/u2f/0
No new messages appear in dmesg when the WebAuthn operation fails.

$ sudo usbconfig | g Yubikey
ugen0.6: <Yubikey 4/5 OTP+U2F+CCID Yubico.com> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (30mA)

$ sudo usbconfig -d ugen0.6 dump_device_desc
ugen0.6: <Yubikey 4/5 OTP+U2F+CCID Yubico.com> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (30mA)

  bLength = 0x0012 
  bDescriptorType = 0x0001 
  bcdUSB = 0x0200 
  bDeviceClass = 0x0000  <Probed by interface class>
  bDeviceSubClass = 0x0000 
  bDeviceProtocol = 0x0000 
  bMaxPacketSize0 = 0x0040 
  idVendor = 0x1050 
  idProduct = 0x0407 
  bcdDevice = 0x0574 
  iManufacturer = 0x0001  <Yubico>
  iProduct = 0x0002  <YubiKey OTP+FIDO+CCID>
  iSerialNumber = 0x0000  <no string>
  bNumConfigurations = 0x0001 

$ 

$ sudo usbconfig -d ugen0.6 dump_all_desc
ugen0.6: <Yubikey 4/5 OTP+U2F+CCID Yubico.com> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (30mA)

  bLength = 0x0012 
  bDescriptorType = 0x0001 
  bcdUSB = 0x0200 
  bDeviceClass = 0x0000  <Probed by interface class>
  bDeviceSubClass = 0x0000 
  bDeviceProtocol = 0x0000 
  bMaxPacketSize0 = 0x0040 
  idVendor = 0x1050 
  idProduct = 0x0407 
  bcdDevice = 0x0574 
  iManufacturer = 0x0001  <Yubico>
  iProduct = 0x0002  <YubiKey OTP+FIDO+CCID>
  iSerialNumber = 0x0000  <no string>
  bNumConfigurations = 0x0001 

 Configuration index 0

    bLength = 0x0009 
    bDescriptorType = 0x0002 
    wTotalLength = 0x0096 
    bNumInterfaces = 0x0003 
    bConfigurationValue = 0x0001 
    iConfiguration = 0x0000  <no string>
    bmAttributes = 0x0080 
    bMaxPower = 0x000f 

    Interface 0
      bLength = 0x0009 
      bDescriptorType = 0x0004 
      bInterfaceNumber = 0x0000 
      bAlternateSetting = 0x0000 
      bNumEndpoints = 0x0001 
      bInterfaceClass = 0x0003  <HID device>
      bInterfaceSubClass = 0x0001 
      bInterfaceProtocol = 0x0001 
      iInterface = 0x0000  <no string>

      Additional Descriptor

      bLength = 0x09
      bDescriptorType = 0x21
      bDescriptorSubType = 0x10
       RAW dump: 
       0x00 | 0x09, 0x21, 0x10, 0x01, 0x00, 0x01, 0x22, 0x47, 
       0x08 | 0x00

     Endpoint 0
        bLength = 0x0007 
        bDescriptorType = 0x0005 
        bEndpointAddress = 0x0081  <IN>
        bmAttributes = 0x0003  <INTERRUPT>
        wMaxPacketSize = 0x0008 
        bInterval = 0x000a 
        bRefresh = 0x0000 
        bSynchAddress = 0x0000 


    Interface 1
      bLength = 0x0009 
      bDescriptorType = 0x0004 
      bInterfaceNumber = 0x0001 
      bAlternateSetting = 0x0000 
      bNumEndpoints = 0x0002 
      bInterfaceClass = 0x0003  <HID device>
      bInterfaceSubClass = 0x0000 
      bInterfaceProtocol = 0x0000 
      iInterface = 0x0000  <no string>

      Additional Descriptor

      bLength = 0x09
      bDescriptorType = 0x21
      bDescriptorSubType = 0x10
       RAW dump: 
       0x00 | 0x09, 0x21, 0x10, 0x01, 0x00, 0x01, 0x22, 0x22, 
       0x08 | 0x00

     Endpoint 0
        bLength = 0x0007 
        bDescriptorType = 0x0005 
        bEndpointAddress = 0x0004  <OUT>
        bmAttributes = 0x0003  <INTERRUPT>
        wMaxPacketSize = 0x0040 
        bInterval = 0x0002 
        bRefresh = 0x0000 
        bSynchAddress = 0x0000 

     Endpoint 1
        bLength = 0x0007 
        bDescriptorType = 0x0005 
        bEndpointAddress = 0x0084  <IN>
        bmAttributes = 0x0003  <INTERRUPT>
        wMaxPacketSize = 0x0040 
        bInterval = 0x0002 
        bRefresh = 0x0000 
        bSynchAddress = 0x0000 


    Interface 2
      bLength = 0x0009 
      bDescriptorType = 0x0004 
      bInterfaceNumber = 0x0002 
      bAlternateSetting = 0x0000 
      bNumEndpoints = 0x0003 
      bInterfaceClass = 0x000b  <Smart card>
      bInterfaceSubClass = 0x0000 
      bInterfaceProtocol = 0x0000 
      iInterface = 0x0000  <no string>

      Additional Descriptor

      bLength = 0x36
      bDescriptorType = 0x21
      bDescriptorSubType = 0x00
       RAW dump: 
       0x00 | 0x36, 0x21, 0x00, 0x01, 0x00, 0x07, 0x02, 0x00, 
       0x08 | 0x00, 0x00, 0xa0, 0x0f, 0x00, 0x00, 0xa0, 0x0f, 
       0x10 | 0x00, 0x00, 0x00, 0x00, 0xb0, 0x04, 0x00, 0x00, 
       0x18 | 0xb0, 0x04, 0x00, 0x00, 0xf6, 0x0b, 0x00, 0x00, 
       0x20 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
       0x28 | 0xfe, 0x00, 0x04, 0x00, 0x00, 0x0c, 0x00, 0x00, 
       0x30 | 0xff, 0xff, 0x00, 0x00, 0x00, 0x01


     Endpoint 0
        bLength = 0x0007 
        bDescriptorType = 0x0005 
        bEndpointAddress = 0x0002  <OUT>
        bmAttributes = 0x0002  <BULK>
        wMaxPacketSize = 0x0040 
        bInterval = 0x0000 
        bRefresh = 0x0000 
        bSynchAddress = 0x0000 

     Endpoint 1
        bLength = 0x0007 
        bDescriptorType = 0x0005 
        bEndpointAddress = 0x0082  <IN>
        bmAttributes = 0x0002  <BULK>
        wMaxPacketSize = 0x0040 
        bInterval = 0x0000 
        bRefresh = 0x0000 
        bSynchAddress = 0x0000 

     Endpoint 2
        bLength = 0x0007 
        bDescriptorType = 0x0005 
        bEndpointAddress = 0x0083  <IN>
        bmAttributes = 0x0003  <INTERRUPT>
        wMaxPacketSize = 0x0008 
        bInterval = 0x0020 
        bRefresh = 0x0000 
        bSynchAddress = 0x0000 


$

 Additional Testing
Performed the following tests:

    Two different YubiKey 5C NFC devices.
    Firefox and Chromium.
    Multiple WebAuthn sites.
    Different USB ports.
    USB-A to USB-C adapter.
    Native Xfce session.
    Upgraded from FreeBSD 15.0-RELEASE-p5 to 15.0-RELEASE-p11.

All FreeBSD tests fail identically.
The same hardware works immediately on macOS.

Conclusion

The evidence suggests a FreeBSD-specific issue affecting WebAuthn/FIDO2 in browsers rather than a hardware problem with the YubiKey.

If additional diagnostics, browser logs, or test patches would be helpful, I would be happy to test them.
Comment 1 Alex Matei 2026-07-05 04:25:09 UTC
It's not a bug. It's a lack of documentation.
Fixed by installing the package u2f-devd-1.1.10_9 in addition to libfido2-1.16.0 and
py311-yubikey-manager-5.7.2_1.
After installing u2f-devd-1.1.10_9:
# service devd restart
# pw group mod u2f -m <user>
Comment 2 Alex Matei 2026-07-05 04:32:38 UTC
and reboot.