{"record":{"id":"612bf9563a0a1dd4","repo":"gravitational/teleport","slug":"cannot-fulfill-credential-parameters-only-es256-a","errorCode":null,"errorMessage":"cannot fulfill credential parameters, only ES256 are supported","messagePattern":"cannot fulfill credential parameters, only ES256 are supported","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/touchid/api.go","lineNumber":262,"sourceCode":"\t// - CredentialExcludeList - we always allow re-registering (for various\n\t//   reasons).\n\t// - Extensions - none supported\n\t// - Attestation - we always to our best (packed/self-attestation).\n\t//   The server is free to ignore/reject.\n\n\tif cc.Response.AuthenticatorSelection.AuthenticatorAttachment == protocol.CrossPlatform {\n\t\treturn nil, fmt.Errorf(\"cannot fulfill authenticator attachment %q\", cc.Response.AuthenticatorSelection.AuthenticatorAttachment)\n\t}\n\tok := false\n\tfor _, param := range cc.Response.Parameters {\n\t\t// ES256 is all we can do.\n\t\tif param.Type == protocol.PublicKeyCredentialType && param.Algorithm == webauthncose.AlgES256 {\n\t\t\tok = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !ok {\n\t\treturn nil, errors.New(\"cannot fulfill credential parameters, only ES256 are supported\")\n\t}\n\n\trpID := cc.Response.RelyingParty.ID\n\tuser := cc.Response.User.Name\n\tuserHandle := cc.Response.User.ID\n\n\t// TODO(codingllama): Handle double registrations and failures after key\n\t//  creation.\n\tresp, err := native.Register(rpID, user, userHandle)\n\tif err != nil {\n\t\treturn nil, trace.Wrap(err)\n\t}\n\tcredentialID := resp.CredentialID\n\tpubKeyRaw := resp.publicKeyRaw\n\n\t// Parse public key and transform to the required CBOR object.\n\tpubKey, err := darwin.ECDSAPublicKeyFromRaw(pubKeyRaw)\n\tif err != nil {","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/touchid/api.go#L244-L280","documentation":"During Register, the touchid package inspects cc.Response.PubKeyCredParams and fails if none of the requested algorithms is ES256 (AlgES256). Touch ID as a platform authenticator only produces ES256 (P-256) credentials, so it cannot fulfill requests asking for RS256 or other algorithms.","triggerScenarios":"Register (api.go:262) with a CredentialCreation whose pubKeyCredParams list lacks {type: 'public-key', alg: -7 (ES256)}, e.g. created for a server requiring RS256 or with a typo in the alg value.","commonSituations":"Auth server WebAuthn config or upstream RelyingParty defaults emitting non-ES256 parameters; hand-built CredentialCreation in tests/tools using wrong algorithm IDs; WebAuthn version mismatch between server and client.","solutions":["Include the ES256 parameter (type \"public-key\", algorithm -7) in cc.Response.PubKeyCredParams.","Prefer pubKeyCredParams that list ES256 first, or only ES256, when targeting platform authenticators.","Check the auth server's WebAuthn configuration/RelyingParty creation params for restricted algorithms.","Update teleport so server-side credential parameters match what Touch ID supports."],"exampleFix":"// before\ncc.Response.PubKeyCredParams = []wantypes.CredentialParameter{{Type: \"public-key\", Algorithm: -257}} // RS256\n// after\ncc.Response.PubKeyCredParams = []wantypes.CredentialParameter{{Type: \"public-key\", Algorithm: -7}} // ES256","handlingStrategy":"validation","validationCode":"ok := false\nfor _, p := range cc.Response.PubKeyCredParams {\n\tif p.Type == protocol.PublicKeyCredentialType && p.Algorithm == webauthncose.AlgES256 {\n\t\tok = true\n\t\tbreak\n\t}\n}\nif !ok { /* fix params before calling Register */ }","typeGuard":"func supportsES256(cc *wantypes.CredentialCreation) bool {\n\tfor _, p := range cc.Response.PubKeyCredParams {\n\t\tif p.Algorithm == webauthncose.AlgES256 {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}","tryCatchPattern":"reg, err := touchid.Register(origin, cc)\nif err != nil && strings.Contains(err.Error(), \"only ES256 are supported\") {\n\t// re-build credential creation params with ES256 and retry\n}","preventionTips":["Always include ES256 (alg -7) in pubKeyCredParams for platform authenticators.","Derive credential params from the server's WebAuthn config instead of hardcoding.","Add a unit test asserting the params used with touchid include ES256."],"tags":["touchid","webauthn","es256","credential-parameters"],"backgroundTag":"unsupported-webauthn-algorithm","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}