feat: Add FIDO2 session support for SCP03 and SCP11 secure channels by DennisDyallo · Pull Request #428 · Yubico/Yubico.NET.SDK

DennisDyallo · 2026-03-17T21:28:39Z

This pull request adds support for establishing Secure Channel Protocol (SCP03, SCP11) for FIDO2 sessions. On firmware 5.8+, this works over both USB CCID (SmartCard) and NFC. On pre-5.8 firmware, NFC is required.

Summary

Updated the Fido2Session constructor to accept an optional ScpKeyParameters argument, enabling encrypted/authenticated communication using SCP protocols (SCP03 or SCP11)
Added YubiKeyCapabilities.Fido2 to the SCP03 feature gate in YubiKeyFeatureExtensions
Added integration tests for FIDO2 over SCP03 and SCP11b covering both NFC and USB CCID transports
Tests include firmware-version-aware skip conditions (USB CCID requires 5.8+)
Full end-to-end MakeCredential (PIN + touch + attestation) verified over SCP03 + USB CCID on 5.8+

Transport support

Transport	Firmware	FIDO2+SCP
USB (no SCP)	All	Works (HID)
USB + SCP	Pre-5.8	Fails — FIDO2 AID not on CCID
USB + SCP	5.8+	Works — FIDO2 AID registered on CCID
NFC + SCP	All	Works — NFC exposes all applets

Changes

FIDO2 Session:

Fido2Session constructor accepts optional ScpKeyParameters for SCP channel establishment
Updated XML documentation with firmware-version-aware transport notes
Adjusted FidoIntegrationTestBase to use named parameter for persistentPinUvAuthToken

Feature Detection:

Added YubiKeyCapabilities.Fido2 to YubiKeyFeature.Scp03 capability check

Integration Tests (SCP03):

Scp03_Fido2Session_GetAuthenticatorInfo_Succeeds — NFC and USB CCID (5.8+)
Scp03_Fido2Session_MakeCredential_Over_UsbCcid_Succeeds — full credential creation over SCP03
Scp03_Fido2Session_Pre58_UsbCcid_Skips_Gracefully — validates skip behavior on pre-5.8

Integration Tests (SCP11):

Scp11b_App_Fido2Session_GetAuthenticatorInfo_Succeeds — NFC and USB CCID (5.8+)

Fixes: YESDK-1558

Type of change

Refactor (non-breaking change which improves code quality or performance)
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

How has this been tested?

Test configuration:

OS version: Linux
Firmware version: 5.8+ (serial 125)
YubiKey model: USB A
Transports tested: USB CCID (SmartCard), NFC

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have run dotnet format to format my code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

Enable Fido2Session to accept ScpKeyParameters for encrypted communication over NFC. Add FIDO2 to the SCP03 feature gate, integration tests for both SCP03 and SCP11b with NFC transport, and skip conditions for devices that don't expose FIDO2 over SmartCard. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document that FIDO2 over SCP requires NFC since USB FIDO2 uses HID which is incompatible with SCP's SmartCard-layer protocol. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-03-17T21:34:51Z

Test Results: Windows

2 files 2 suites 15s ⏱️
4 052 tests 4 033 ✅ 19 💤 0 ❌
4 054 runs 4 035 ✅ 19 💤 0 ❌

Results for commit 1abf558.

♻️ This comment has been updated with latest results.

github-actions · 2026-03-17T21:35:01Z

Test Results: Ubuntu

2 files 2 suites 54s ⏱️
4 044 tests 4 025 ✅ 19 💤 0 ❌
4 046 runs 4 027 ✅ 19 💤 0 ❌

Results for commit 1abf558.

♻️ This comment has been updated with latest results.

github-actions · 2026-03-17T21:35:12Z

Test Results: MacOS

4 files 4 suites 28s ⏱️
4 026 tests 4 026 ✅ 0 💤 0 ❌
4 028 runs 4 028 ✅ 0 💤 0 ❌

Results for commit 1abf558.

♻️ This comment has been updated with latest results.

Copilot

Pull request overview

Adds Secure Channel Protocol (SCP03/SCP11) support to Fido2Session so FIDO2 operations can run over an encrypted/authenticated SmartCard (NFC) channel, and introduces integration tests covering FIDO2-over-SCP scenarios.

Changes:

Updated Fido2Session constructor to accept optional ScpKeyParameters for SCP03/SCP11-protected sessions and expanded XML docs accordingly.
Updated feature detection to treat FIDO2 as a valid application when evaluating SCP03 support.
Added SCP03/SCP11 integration tests that attempt to create a Fido2Session over SCP and read authenticator info.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`Yubico.YubiKey/src/Yubico/YubiKey/Fido2/Fido2Session.cs`	Public API updated to accept SCP parameters and documented FIDO2-over-SCP usage/constraints.
`Yubico.YubiKey/src/Yubico/YubiKey/YubiKeyFeatureExtensions.cs`	Feature detection updated so SCP03 checks can include FIDO2 as a supported application.
`Yubico.YubiKey/tests/integration/Yubico/YubiKey/Fido2/FidoIntegrationTestBase.cs`	Updated test session creation to use a named argument after constructor signature change.
`Yubico.YubiKey/tests/integration/Yubico/YubiKey/Scp/Scp03Tests.cs`	Added an NFC-focused integration test for FIDO2 over SCP03.
`Yubico.YubiKey/tests/integration/Yubico/YubiKey/Scp/Scp11Tests.cs`	Added an integration test for FIDO2 over SCP11b.

Yubico.YubiKey/src/Yubico/YubiKey/Fido2/Fido2Session.cs

Yubico.YubiKey/tests/integration/Yubico/YubiKey/Scp/Scp11Tests.cs

Yubico.YubiKey/tests/integration/Yubico/YubiKey/Scp/Scp03Tests.cs

… tests Move keyParameters to last position in Fido2Session constructor to preserve backwards compatibility with existing (device, token) callers. Fix FIDO2 SCP tests: force NFC transport, remove Fw5Fips+NFC conflict with GetDevice assertion, check AvailableNfcCapabilities instead of AvailableUsbCapabilities. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Adds the ability to establish SCP03/SCP11 secure channels for FIDO2 sessions over NFC (SmartCard), and introduces/updates integration coverage to validate FIDO2 operations over SCP.

Changes:

Extend Fido2Session construction to accept optional ScpKeyParameters for SCP03/SCP11-protected communication.
Update feature detection so SCP03 capability checks consider FIDO2 support.
Add integration tests validating authenticatorGetInfo works for FIDO2 sessions established over SCP03 and SCP11 on NFC (SmartCard).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
Yubico.YubiKey/src/Yubico/YubiKey/Fido2/Fido2Session.cs	Adds optional SCP key parameters to `Fido2Session` and updates constructor documentation.
Yubico.YubiKey/src/Yubico/YubiKey/YubiKeyFeatureExtensions.cs	Adjusts SCP03 feature detection to include FIDO2 as a relevant application capability.
Yubico.YubiKey/tests/integration/Yubico/YubiKey/Scp/Scp03Tests.cs	Adds an integration test covering FIDO2 `AuthenticatorInfo` retrieval over SCP03 on NFC (SmartCard).
Yubico.YubiKey/tests/integration/Yubico/YubiKey/Scp/Scp11Tests.cs	Adds an integration test covering FIDO2 `AuthenticatorInfo` retrieval over SCP11b on NFC (SmartCard).

Yubico.YubiKey/src/Yubico/YubiKey/Fido2/Fido2Session.cs

Yubico.YubiKey/src/Yubico/YubiKey/YubiKeyFeatureExtensions.cs

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

FIDO2+SCP now works over USB CCID on firmware 5.8+ in addition to NFC. Updates docs, integration tests (SCP03 MakeCredential, SCP11b), and adds sandbox probe plugin for USB CCID testing. Pre-5.8 keys gracefully skip with firmware version checks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-03-18T15:59:28Z

Package	Line Rate	Branch Rate	Complexity	Health
Yubico.Core	45%	35%	4557	➖
Yubico.YubiKey	50%	46%	21540	➖
Summary	49% (37353 / 76329)	44% (8990 / 20562)	26097	➖

Minimum allowed line rate is 40%

DennisDyallo

Ok!

DennisDyallo and others added 2 commits March 17, 2026 22:05

docs: Add NFC requirement and SCP usage example to Fido2Session

3534673

Document that FIDO2 over SCP requires NFC since USB FIDO2 uses HID which is incompatible with SCP's SmartCard-layer protocol. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

DennisDyallo requested a review from Copilot March 17, 2026 21:34

Copilot started reviewing on behalf of DennisDyallo March 17, 2026 21:34 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

DennisDyallo requested a review from Copilot March 17, 2026 22:00

Copilot started reviewing on behalf of DennisDyallo March 17, 2026 22:01 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

Yubico.YubiKey/src/Yubico/YubiKey/Fido2/Fido2Session.cs Outdated Show resolved Hide resolved

Yubico.YubiKey/src/Yubico/YubiKey/YubiKeyFeatureExtensions.cs Show resolved Hide resolved

DennisDyallo and others added 2 commits March 17, 2026 23:12

fix: Add permissions for contents and packages in build-artifacts job

f75234f

docs: fix positioning in docs

39c2117

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

jdmoreira approved these changes Mar 18, 2026

View reviewed changes

DennisDyallo changed the title ~~feat: Add FIDO2 session support for SCP03 and SCP11 over NFC (SmartCard)~~ feat: Add FIDO2 session support for SCP03 and SCP11 secure channels Mar 18, 2026

DennisDyallo and others added 2 commits March 18, 2026 16:47

chore: Remove internal docs not intended for the repository

1abf558

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

DennisDyallo commented Mar 19, 2026

View reviewed changes

DennisDyallo merged commit 318d292 into develop Mar 19, 2026
15 checks passed

DennisDyallo deleted the feature/fido2-scp-support branch March 19, 2026 13:53

DennisDyallo mentioned this pull request Mar 30, 2026

release: 1.16.0 #440

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add FIDO2 session support for SCP03 and SCP11 secure channels#428

feat: Add FIDO2 session support for SCP03 and SCP11 secure channels#428
DennisDyallo merged 7 commits intodevelopfrom
feature/fido2-scp-support

DennisDyallo commented Mar 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 18, 2026

Uh oh!

DennisDyallo left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

DennisDyallo commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Transport support

Changes

Type of change

How has this been tested?

Checklist:

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results: Windows

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results: Ubuntu

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results: MacOS

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 18, 2026

Uh oh!

DennisDyallo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

DennisDyallo commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading