gravitational/teleport · error

cannot fulfill credential parameters, only ES256 are support

Error message

cannot fulfill credential parameters, only ES256 are supported

What it means

During Register, the touchid package inspects cc.Response.PubKeyCredParams and fails if none of the requested algorithms is ES256 (AlgES256). Touch ID as a platform authenticator only produces ES256 (P-256) credentials, so it cannot fulfill requests asking for RS256 or other algorithms.

Source

Thrown at lib/auth/touchid/api.go:262

	// - CredentialExcludeList - we always allow re-registering (for various
	//   reasons).
	// - Extensions - none supported
	// - Attestation - we always to our best (packed/self-attestation).
	//   The server is free to ignore/reject.

	if cc.Response.AuthenticatorSelection.AuthenticatorAttachment == protocol.CrossPlatform {
		return nil, fmt.Errorf("cannot fulfill authenticator attachment %q", cc.Response.AuthenticatorSelection.AuthenticatorAttachment)
	}
	ok := false
	for _, param := range cc.Response.Parameters {
		// ES256 is all we can do.
		if param.Type == protocol.PublicKeyCredentialType && param.Algorithm == webauthncose.AlgES256 {
			ok = true
			break
		}
	}
	if !ok {
		return nil, errors.New("cannot fulfill credential parameters, only ES256 are supported")
	}

	rpID := cc.Response.RelyingParty.ID
	user := cc.Response.User.Name
	userHandle := cc.Response.User.ID

	// TODO(codingllama): Handle double registrations and failures after key
	//  creation.
	resp, err := native.Register(rpID, user, userHandle)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	credentialID := resp.CredentialID
	pubKeyRaw := resp.publicKeyRaw

	// Parse public key and transform to the required CBOR object.
	pubKey, err := darwin.ECDSAPublicKeyFromRaw(pubKeyRaw)
	if err != nil {

View on GitHub (pinned to 1283425b60)

Solutions

1. Include the ES256 parameter (type "public-key", algorithm -7) in cc.Response.PubKeyCredParams.
2. Prefer pubKeyCredParams that list ES256 first, or only ES256, when targeting platform authenticators.
3. Check the auth server's WebAuthn configuration/RelyingParty creation params for restricted algorithms.
4. Update teleport so server-side credential parameters match what Touch ID supports.

Example fix

// before
cc.Response.PubKeyCredParams = []wantypes.CredentialParameter{{Type: "public-key", Algorithm: -257}} // RS256
// after
cc.Response.PubKeyCredParams = []wantypes.CredentialParameter{{Type: "public-key", Algorithm: -7}} // ES256

ok := false
for _, p := range cc.Response.PubKeyCredParams {
	if p.Type == protocol.PublicKeyCredentialType && p.Algorithm == webauthncose.AlgES256 {
		ok = true
		break
	}
}
if !ok { /* fix params before calling Register */ }

func supportsES256(cc *wantypes.CredentialCreation) bool {
	for _, p := range cc.Response.PubKeyCredParams {
		if p.Algorithm == webauthncose.AlgES256 {
			return true
		}
	}
	return false
}

reg, err := touchid.Register(origin, cc)
if err != nil && strings.Contains(err.Error(), "only ES256 are supported") {
	// re-build credential creation params with ES256 and retry
}

When it happens

Trigger: Register (api.go:262) with a CredentialCreation whose pubKeyCredParams list lacks {type: 'public-key', alg: -7 (ES256)}, e.g. created for a server requiring RS256 or with a typo in the alg value.

Common situations: Auth server WebAuthn config or upstream RelyingParty defaults emitting non-ES256 parameters; hand-built CredentialCreation in tests/tools using wrong algorithm IDs; WebAuthn version mismatch between server and client.

Related errors

• credential not found
• touch ID not available
• cannot fulfill authenticator attachment %q
• cred required for %q ceremony
• user has only invalid WebAuthn registrations, consider a use

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/612bf9563a0a1dd4. Report an issue: GitHub.