Create a CTAP Qrexec service to allow administration of security keys

[ben-grande]

How to file a helpful issue

The problem you're addressing (if any)

chrome://security/passkeys is a web browser interface to interact with security keys.

More importantly:

Create a PIN
Protect your security key with a PIN (Personal Identification Number)

Sign-in data
Manage sign-in data stored on your security key

Fingerprints
Add and delete fingerprints saved on your security key

Reset your security key
This will delete all data on the security key, including its PIN

Even if not using chrome, other tools might implement the same management of keys chrome does, so could benefit other implementations.

What I currently use is an offline qube to manager the security keys with USB passtrough.

The solution you'd like

Create a service that allows administration commands to be executed on the key.

The value to a user, and who that user might be

Would be nice to do administration without USB passtrough to the client.

Completion criteria checklist

(This section is for developer use only. Please do not modify it.)

[ben-grande]

That issue is not related to CTAP. CTAP obligatorily uses USB on the server, the intended product of that issue is to have a passkey virtualized in software and a way to interact with it, with Demi choosing a browser extension.

This issue is related to the existing Qubes CTAP proxy and allowing more services to be implemented for administration.

[piotrbartman]

The purpose of the CTAP proxy is to provide controlled access to the hardware key. Key administration requires full access, so I'm not sure what role the proxy would play there. The current solution, which involves directly attaching the key to the management VM, has several advantages:

• We have to explicitly attach the device to manage it, reducing the risk of a policy mistake that could result in an untrusted VM gaining full access to the key.
• We don't increase the number of functions in Qubes -> KISS.
• It doesn't require maintaining additional code.