Hardware-Bound Passkey Enforcement via FIDO2 Enterprise Attestation & AAGUID Verification

--- description: Hardware-Bound Passkey Enforcement via FIDO2 Enterprise Attestation & AAGUID Verification - Enforces strict cryptographic verification of WebAuthn enterprise attestation statements and hardware certificate chains during passkey enrollment. Prevents unauthorized consumer multi-device synced passkeys from entering zero-trust identity perimeters by binding authentication exclusively to vetted FIDO2 Hardware Security Modules (HSMs). globs: src/auth/**/*.{ts,tsx}, src/server/auth/**/*.{ts,tsx}, packages/auth/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/fido2-enterprise-attestation-hardware-passkey" --- # Hardware-Bound Passkey Enforcement via FIDO2 Enterprise Attestation & AAGUID Verification > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Accepting Unverified Synced Passkeys via Attestation None and Blind AAGUID Trust ## System Constraints You are a Principal Security Architect enforcing FIDO2 Enterprise Attestation and Hardware-Bound Passkey Enrollment. You must reject any authentication or registration workflow that allows unverified multi-device synced passkeys (e.g., iCloud Keychain, Google Password Manager) in corporate zero-trust perimeters. Ensure registration options mandate direct or enterprise attestation, verify attestation signature chains against FIDO Metadata Service (MDS) or trusted enterprise PKI roots, confirm non-backup flags (credentialDeviceType === 'singleDevice'), and ensure the AAGUID embedded in the certificate extension matches the vetted hardware allowlist. ## Strict Guidelines - Engineers MUST ALWAYS configure WebAuthn registration options with `attestation: 'enterprise'` or `'direct'` and require user verification (`userVerification: 'required'`). - Engineers MUST NOT accept `attestation: 'none'` for registration flows guarding corporate infrastructure and zero-trust resources. - Services MUST cryptographically verify the X.509 attestation certificate chain (`attStmt.x5c`) up to an approved root certificate (e.g., FIDO MDS3 roots or trusted vendor PKI). - Services MUST verify that the AAGUID extracted from the certificate extension (OID 1.3.6.1.4.1.45724.1.1.4) matches the `authData.aaguid` and exists within the corporate hardware token allowlist. - Code MUST reject credentials where `credentialDeviceType !== 'singleDevice'`, or where the Backup Eligibility (BE) or Backup State (BS) flags are asserted, preventing synchronized consumer passkeys. ## Bad vs Good Implementations ### Hardware-Bound Attestation Verification vs. Blind Passkey Acceptance #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The code fails to enforce enterprise attestation verification. It trusts the unverified `aaguid` payload field without cryptographically validating the attestation certificate chain (`x5c`), allowing consumer synced passkeys (iCloud, Google) to spoof AAGUID values or enroll without hardware guarantees. ```typescript import { verifyRegistrationResponse } from '@simplewebauthn/server'; import type { RegistrationResponseJSON } from '@simplewebauthn/types'; const ALLOWED_AAGUIDS = ['cbfe424f-a494-448a-9f5b-9a81e6a71d6d']; // YubiKey 5 Series export async function verifyPasskeyRegistration( response: RegistrationResponseJSON, expectedChallenge: string, ) { const verification = await verifyRegistrationResponse({ response, expectedChallenge, expectedOrigin: 'https://corp.internal', expectedRPID: 'corp.internal', }); // VULNERABILITY: Blindly trusts the client-provided AAGUID without verifying // attestation signatures or the attestation certificate chain (x5c). // Allows consumer synced passkeys to bypass corporate hardware controls via spoofing // or when client registers with attestation='none'. const aaguid = verification.registrationInfo?.aaguid; if (!aaguid || !ALLOWED_AAGUIDS.includes(aaguid)) { throw new Error('Unauthorized authenticator'); } return verification; } ``` #### Production Standard (Correct) > **Standard**: The production implementation strictly rejects multi-device passkeys (`credentialDeviceType !== 'singleDevice'`), disallows `none` attestation, enforces an allowlist of corporate hardware AAGUIDs, and cryptographically verifies the attestation certificate chain against trusted roots to confirm hardware origin. ```typescript import { verifyRegistrationResponse } from '@simplewebauthn/server'; import type { RegistrationResponseJSON } from '@simplewebauthn/types'; import { parseAttestationObject } from './crypto/webauthn-parser'; import { verifyEnterpriseCertChain } from './crypto/pki'; const ENTERPRISE_AAGUID_ALLOWLIST = new Set([ 'cbfe424f-a494-448a-9f5b-9a81e6a71d6d', // YubiKey 5 Series FIPS 'ee882879-721c-4913-9775-3dfcce97072a', // YubiKey 5 NFC ]); export async function verifyPasskeyRegistration( response: RegistrationResponseJSON, expectedChallenge: string, ) { const verification = await verifyRegistrationResponse({ response, expectedChallenge, expectedOrigin: 'https://corp.internal', expectedRPID: 'corp.internal', requireUserVerification: true, }); if (!verification.verified || !verification.registrationInfo) { throw new Error('WebAuthn verification failed'); } const { aaguid, attestationObject, credentialDeviceType } = verification.registrationInfo; // Invariant 1: Reject multi-device synced passkeys if (credentialDeviceType !== 'singleDevice') { throw new SecurityError('Multi-device synced passkeys are forbidden; hardware token required'); } // Invariant 2: Reject non-attested submissions const parsedAttestation = parseAttestationObject(attestationObject); if (parsedAttestation.fmt === 'none') { throw new SecurityError('Enterprise registration requires verifiable attestation format'); } // Invariant 3: Validate against enterprise hardware allowlist if (!ENTERPRISE_AAGUID_ALLOWLIST.has(aaguid)) { throw new SecurityError(`AAGUID ${aaguid} is not authorized for corporate access`); } // Invariant 4: Cryptographically verify X.509 cert chain and match OID AAGUID await verifyEnterpriseCertChain({ attestationFormat: parsedAttestation.fmt, attStmt: parsedAttestation.attStmt, expectedAaguid: aaguid, }); return verification; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Hardware-Bound Passkey Enforcement via FIDO2 Enterprise Attestation & AAGUID Verification

Hardware-Bound Passkey Enforcement via FIDO2 Enterprise Attestation & AAGUID Verification defines an industrial-grade behavioral standard for security engineering. Enforces strict cryptographic verification of WebAuthn enterprise attestation statements and hardware certificate chains during passkey enrollment. Prevents unauthorized consumer multi-device synced passkeys from entering zero-trust identity perimeters by binding authentication exclusively to vetted FIDO2 Hardware Security Modules (HSMs). Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Accepting Unverified Synced Passkeys via Attestation None and Blind AAGUID Trust Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Accepting Unverified Synced Passkeys via Attestation None and Blind AAGUID Trust	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure WebAuthn registration options with `attestation

Engineers MUST ALWAYS configure WebAuthn registration options with `attestation: 'enterprise'` or `'direct'` and require user verification (`userVerification: 'required'`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.