• caglararli@hotmail.com
  • 05386281520

Why is Windows Hello still using RS1 for signing instead of the stronger alternatives?

Çağlar Arlı      -    6 Views

Why is Windows Hello still using RS1 for signing instead of the stronger alternatives?

I have built an application with the FIDO2 webauthn protocol, to perform the webauthn registration and authentication ceremonies.

I am facing some issues in one of registration scenarios listed below:

  1. If attestation value is None , and I use windows hello, the registration works.
  2. If attestation value is Direct ,and I use external hardware key such as Yubikey ,the registration works.
  3. If attestation value is Direct ,and I use Google Password Manager (Android),the registration works.
  4. If attestation value is Direct ,and I use windows hello, it fails. By debugging more, I came to know that Windows Hello is using RS1 algorithm for signature which is deprecated in Rocky Linux 9 for security reason.

I am using Windows 11 with TPM 2.0 enabled.

Why is Windows Hello still using RS1 for signing instead of the stronger alternatives, such as RSA256?

For more info about attestation value, please refer to this