@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.17 → 1.0.0-canary.18

package/.releaserc

@@ -11,6 +11,12 @@
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
     "@semantic-release/changelog",
+    [
+      "@semantic-release/exec",
+      {
+        "prepareCmd": "pnpm fmt"
+      }
+    ],
     "@semantic-release/npm",
     [
       "@semantic-release/git",

package/CHANGELOG.md

@@ -1,17 +1,21 @@
-# [1.0.0-canary.17](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.16...v1.0.0-canary.17) (2026-05-28)
+# [1.0.0-canary.18](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.17...v1.0.0-canary.18) (2026-06-09)
 
+### Features
 
-### Bug Fixes
+- PRF extension support for deterministically derived secrets ([4b5b05a](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/4b5b05ab146e39b191855ccb01fd4aca5ed32819))
 
-* allow configurable AAGUID ([d5a8176](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/d5a81765ba150e9873e18875f0ac9f7bc4aede93))
-* **Android:** add NoOp methods for iOS-specific functionality ([e2c64db](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/e2c64db479cda70c7c61b7ab3021b70db949a15b))
-* compile issue ([16b939c](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/16b939cb555e75bd052ce57a41a838810a2770cd))
+# [1.0.0-canary.17](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.16...v1.0.0-canary.17) (2026-05-28)
+
+### Bug Fixes
 
+- allow configurable AAGUID ([d5a8176](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/d5a81765ba150e9873e18875f0ac9f7bc4aede93))
+- **Android:** add NoOp methods for iOS-specific functionality ([e2c64db](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/e2c64db479cda70c7c61b7ab3021b70db949a15b))
+- compile issue ([16b939c](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/16b939cb555e75bd052ce57a41a838810a2770cd))
 
 ### Features
 
-* configurable credential requirement ([dc09916](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/dc09916d1ee5c8c9d33e53b57f00171472f4f665))
-* record lastUsedAt/count and fix error handling ([47b40ab](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/47b40abf692c0f7cffee6f2266c66f61f8006a65))
+- configurable credential requirement ([dc09916](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/dc09916d1ee5c8c9d33e53b57f00171472f4f665))
+- record lastUsedAt/count and fix error handling ([47b40ab](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/47b40abf692c0f7cffee6f2266c66f61f8006a65))
 
 # [1.0.0-canary.16](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.15...v1.0.0-canary.16) (2026-05-15)
 

package/android/src/main/java/co/algorand/passkeyautofill/CreatePasskeyActivity.kt

@@ -434,6 +434,22 @@ class CreatePasskeyActivity : AppCompatActivity() {
                 }
             }
 
+            // WebAuthn `prf` extension (hmac-secret).
+            // On registration we advertise `enabled = true` whenever the RP
+            // asked for the extension, signalling that the credential can be
+            // used as a PRF source on subsequent assertions. We deliberately
+            // do not evaluate salts on create — this matches the behaviour of
+            // most platform authenticators.
+            val requestExtensions = requestJson.optJSONObject("publicKey")?.optJSONObject("extensions")
+                ?: requestJson.optJSONObject("extensions")
+            if (requestExtensions?.has("prf") == true || requestExtensions?.has("prfAlreadyHashed") == true) {
+                val clientExtensionResults = fullJson.optJSONObject("clientExtensionResults") ?: JSONObject()
+                val prfResult = JSONObject().put("enabled", true)
+                clientExtensionResults.put("prf", prfResult)
+                fullJson.put("clientExtensionResults", clientExtensionResults)
+                Log.d(TAG, "Advertised PRF support on registration")
+            }
+
             val createResponse = CreatePublicKeyCredentialResponse(fullJson.toString())
             Log.d(TAG, "CreatePublicKeyCredentialResponse: ${fullJson.toString()}")
             

package/android/src/main/java/co/algorand/passkeyautofill/GetPasskeyActivity.kt

@@ -572,6 +572,44 @@ class GetPasskeyActivity : AppCompatActivity() {
             val credProps = JSONObject()
             credProps.put("rk", true)
             clientExtensionResults.put("credProps", credProps)
+
+            // WebAuthn `prf` extension (hmac-secret). If the RP requested PRF
+            // evaluation for this assertion, derive the per-credential
+            // `credRandom` from the wallet HD root secret and compute
+            // HMAC-SHA256-based outputs for the supplied salt(s).
+            try {
+                val credentialIdB64Url = AndroidBase64.encodeToString(
+                    credId,
+                    AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING,
+                )
+                val prfInput = Prf.parseInput(passkeyRequestJsonObj, credentialIdB64Url)
+                if (prfInput != null) {
+                    val hdRootSecret = credentialRepository.getHdRootSecret(this@GetPasskeyActivity)
+                    if (hdRootSecret == null) {
+                        Log.w(TAG, "PRF input present but HD root secret unavailable; skipping PRF output")
+                    } else {
+                        val credRandom = Prf.credRandom(
+                            hdRootSecret = hdRootSecret,
+                            relyingPartyIdentifier = displayOrigin,
+                            userHandle = dbCred.userHandle,
+                        )
+                        val first = Prf.evaluate(credRandom, prfInput.first, prfInput.alreadyHashed)
+                        val second = prfInput.second?.let { Prf.evaluate(credRandom, it, prfInput.alreadyHashed) }
+
+                        val prfResults = JSONObject().put("first", Prf.encodeOutput(first))
+                        if (second != null) {
+                            prfResults.put("second", Prf.encodeOutput(second))
+                        }
+                        clientExtensionResults.put("prf", JSONObject().put("results", prfResults))
+                        Log.d(TAG, "Computed PRF assertion output (second present=${second != null})")
+                    }
+                }
+            } catch (e: Exception) {
+                // Never fail the assertion because of a PRF error; just log
+                // and omit the extension result.
+                Log.w(TAG, "Failed to compute PRF assertion output", e)
+            }
+
             fullJson.put("clientExtensionResults", clientExtensionResults)
 
             val credentialJson = fullJson.toString()

package/android/src/main/java/co/algorand/passkeyautofill/Prf.kt

@@ -0,0 +1,184 @@
+package co.algorand.passkeyautofill
+
+import android.util.Base64 as AndroidBase64
+import java.security.MessageDigest
+import javax.crypto.Mac
+import javax.crypto.spec.SecretKeySpec
+import org.json.JSONObject
+
+/**
+ * WebAuthn PRF (`prf`) extension helpers, backed by the authenticator
+ * `hmac-secret` mechanism (CTAP2.1).
+ *
+ * Output formula per the WebAuthn spec:
+ *
+ *     output = HMAC-SHA256(credRandom, SHA256("WebAuthn PRF" || 0x00 || salt))
+ *
+ * `credRandom` is a per-credential 32-byte secret. We derive it
+ * deterministically (HKDF-SHA256) from the wallet HD root secret, the
+ * relying-party identifier, and the user handle — the same inputs that
+ * produce the deterministic signing key. This avoids a storage migration
+ * and ensures restoring the wallet seed reproduces the same PRF outputs
+ * on another device.
+ */
+object Prf {
+  private const val CRED_RANDOM_INFO = "WebAuthn-PRF-credRandom"
+  private val SALT_PREFIX: ByteArray = "WebAuthn PRF".toByteArray(Charsets.UTF_8) + byteArrayOf(0x00)
+
+  /**
+   * Derive a 32-byte per-credential PRF secret from the HD root secret.
+   * Deterministic over `(hdRootSecret, rpId, userHandle)`.
+   */
+  fun credRandom(
+    hdRootSecret: ByteArray,
+    relyingPartyIdentifier: String,
+    userHandle: String,
+  ): ByteArray {
+    val salt = relyingPartyIdentifier.lowercase().toByteArray(Charsets.UTF_8) +
+      byteArrayOf(0x00) +
+      userHandle.lowercase().toByteArray(Charsets.UTF_8)
+    return hkdfSha256(
+      ikm = hdRootSecret,
+      salt = salt,
+      info = CRED_RANDOM_INFO.toByteArray(Charsets.UTF_8),
+      length = 32,
+    )
+  }
+
+  /**
+   * Evaluate the PRF for a single salt. Returns 32 bytes of output material.
+   *
+   * Per the WebAuthn spec the value the authenticator HMACs is
+   * `SHA-256("WebAuthn PRF" || 0x00 || rpSalt)`. The Chromium-on-Android
+   * client manager performs this hashing on behalf of the RP and passes the
+   * result through the `prfAlreadyHashed` extension; in that case the
+   * `salt` is already the inner hash and we must NOT hash again. Standard
+   * `prf` requests send the raw RP salt and require hashing.
+   */
+  fun evaluate(credRandom: ByteArray, salt: ByteArray, alreadyHashed: Boolean = true): ByteArray {
+    val macInput = if (alreadyHashed) {
+      salt
+    } else {
+      MessageDigest.getInstance("SHA-256").digest(SALT_PREFIX + salt)
+    }
+    val mac = Mac.getInstance("HmacSHA256").apply {
+      init(SecretKeySpec(credRandom, "HmacSHA256"))
+    }
+    return mac.doFinal(macInput)
+  }
+
+  /**
+   * Parsed PRF inputs from the relying party. Reduced to at most two salts
+   * (first + optional second) — already resolved against `evalByCredential`
+   * for the credential the user is asserting with.
+   *
+   * @property alreadyHashed `true` when the salts have already been passed
+   *   through `SHA-256("WebAuthn PRF" || 0x00 || ...)` by the platform (the
+   *   case for both the Chromium `prfAlreadyHashed` extension on Android
+   *   and Apple's `ASAuthorizationPublicKeyCredentialPRFAssertionInput`).
+   */
+  data class Input(val first: ByteArray, val second: ByteArray?, val alreadyHashed: Boolean)
+
+  /**
+   * Parse PRF eval salts out of a WebAuthn request JSON.
+   *
+   * Recognises:
+   *  - `extensions.prf.eval` / `extensions.prf.evalByCredential[<credId>]`
+   *    — raw RP-supplied salts that still need to be hashed before HMAC.
+   *  - `extensions.prfAlreadyHashed.eval` /
+   *    `extensions.prfAlreadyHashed.evalByCredential[<credId>]` — Chromium
+   *    on Android emits this when forwarding a `prf` request to a credential
+   *    provider so the provider doesn't need to know the spec-mandated hash
+   *    prefix. The salts here are already 32-byte SHA-256 outputs and must
+   *    not be re-hashed.
+   *
+   * @param requestJson the inner `publicKey` request JSON object.
+   * @param credentialIdB64Url base64url-encoded credentialId we're asserting
+   *   with (used to look up the per-credential salts).
+   */
+  fun parseInput(requestJson: JSONObject, credentialIdB64Url: String?): Input? {
+    val extensions = requestJson.optJSONObject("extensions") ?: return null
+
+    // Pre-hashed form wins — when Chromium sends both for compatibility,
+    // honour the already-hashed values to match what the browser expects.
+    extensions.optJSONObject("prfAlreadyHashed")?.let { node ->
+      parseExtensionNode(node, credentialIdB64Url, alreadyHashed = true)?.let { return it }
+    }
+    extensions.optJSONObject("prf")?.let { node ->
+      parseExtensionNode(node, credentialIdB64Url, alreadyHashed = false)?.let { return it }
+    }
+    return null
+  }
+
+  private fun parseExtensionNode(
+    node: JSONObject,
+    credentialIdB64Url: String?,
+    alreadyHashed: Boolean,
+  ): Input? {
+    // Per-credential salts win over the global `eval` block.
+    if (credentialIdB64Url != null) {
+      val byCred = node.optJSONObject("evalByCredential")
+      if (byCred != null) {
+        for (key in byCred.keys()) {
+          if (normalizeBase64Url(key) == normalizeBase64Url(credentialIdB64Url)) {
+            byCred.optJSONObject(key)?.let { return parseSalts(it, alreadyHashed) }
+          }
+        }
+      }
+    }
+    return node.optJSONObject("eval")?.let { parseSalts(it, alreadyHashed) }
+  }
+
+  private fun parseSalts(obj: JSONObject, alreadyHashed: Boolean): Input? {
+    val first = obj.optString("first", "").takeIf { it.isNotEmpty() } ?: return null
+    val firstBytes = decodeBase64UrlOrBase64(first)
+    val secondBytes = obj.optString("second", "")
+      .takeIf { it.isNotEmpty() }
+      ?.let { decodeBase64UrlOrBase64(it) }
+    return Input(firstBytes, secondBytes, alreadyHashed)
+  }
+
+  private fun normalizeBase64Url(value: String): String =
+    value.trim().trimEnd('=').replace('+', '-').replace('/', '_')
+
+  private fun decodeBase64UrlOrBase64(value: String): ByteArray {
+    val flags = AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING
+    return try {
+      AndroidBase64.decode(value, flags)
+    } catch (e: IllegalArgumentException) {
+      AndroidBase64.decode(value, AndroidBase64.NO_WRAP)
+    }
+  }
+
+  /** Encode a 32-byte PRF output for inclusion in a WebAuthn response JSON. */
+  fun encodeOutput(bytes: ByteArray): String =
+    AndroidBase64.encodeToString(bytes, AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING)
+
+  // RFC 5869 HKDF-SHA256.
+  private fun hkdfSha256(ikm: ByteArray, salt: ByteArray, info: ByteArray, length: Int): ByteArray {
+    val mac = Mac.getInstance("HmacSHA256")
+    val effectiveSalt = if (salt.isEmpty()) ByteArray(32) else salt
+    // Extract.
+    mac.init(SecretKeySpec(effectiveSalt, "HmacSHA256"))
+    val prk = mac.doFinal(ikm)
+    // Expand.
+    mac.init(SecretKeySpec(prk, "HmacSHA256"))
+    val output = ByteArray(length)
+    var t = ByteArray(0)
+    var offset = 0
+    var counter: Byte = 1
+    while (offset < length) {
+      mac.reset()
+      mac.init(SecretKeySpec(prk, "HmacSHA256"))
+      mac.update(t)
+      mac.update(info)
+      mac.update(counter)
+      t = mac.doFinal()
+      val take = minOf(t.size, length - offset)
+      System.arraycopy(t, 0, output, offset, take)
+      offset += take
+      counter++
+    }
+    return output
+  }
+}

package/android/src/main/java/co/algorand/passkeyautofill/credentials/CredentialRepository.kt

@@ -52,6 +52,13 @@ interface CredentialRepository {
     fun getBiometricCipherForEncryption(context: Context, requirement: BiometricRequirement): Cipher
     fun getBiometricCipherForDecryption(context: Context, iv: ByteArray, requirement: BiometricRequirement): Cipher
 
+    /**
+     * Returns the raw HD root secret (seed bytes) that is used to derive
+     * domain-specific signing keys. Required by the PRF extension to
+     * deterministically derive the per-credential `credRandom` secret.
+     */
+    fun getHdRootSecret(context: Context): ByteArray?
+
     companion object {
         const val TAG = "CredentialRepository"
         const val PASSKEYS_MMKV_ID = "keystore"
@@ -325,47 +332,51 @@ class Repository() : CredentialRepository {
         biometricCipher: Cipher?
     ): KeyPair {
         Log.d(CredentialRepository.TAG, "createDeterministicKeyPair for origin: $origin, userHandle: $userHandle")
-        val masterKey = getMasterKey(context) ?: throw IllegalStateException("Master key not found in Keystore. Ensure you have called setMasterKey(key) from JavaScript.")
-        
+        val derivedParentSecret = getHdRootSecret(context)
+            ?: throw IllegalStateException("HD Root Key not available. Ensure setMasterKey(key) and setHdRootKeyId(id) have been called.")
+        return dP256.genDomainSpecificKeypair(derivedParentSecret, origin, userHandle.lowercase())
+    }
+
+    override fun getHdRootSecret(context: Context): ByteArray? {
+        val masterKey = getMasterKey(context) ?: return null
         val mmkvAutofill = getAutofillMMKV(context)
-        val hdRootKeyId = mmkvAutofill.decodeString(CredentialRepository.HD_ROOT_KEY_ID_KEY) ?: throw IllegalStateException("HD Root Key ID not found. Ensure you have called setHdRootKeyId(id) from JavaScript.")
-        
+        val hdRootKeyId = mmkvAutofill.decodeString(CredentialRepository.HD_ROOT_KEY_ID_KEY) ?: return null
         val mmkvKeystore = getPasskeysMMKV(context)
-        val hdRootKeyPayload = mmkvKeystore.decodeString(hdRootKeyId) ?: throw IllegalStateException("HD Root Key not found in keystore for ID: $hdRootKeyId")
-        
-        val hdRootKeyData = decodeKeyData(hdRootKeyPayload, masterKey)
-        
+        val hdRootKeyPayload = mmkvKeystore.decodeString(hdRootKeyId) ?: return null
+        val hdRootKeyData = try {
+            decodeKeyData(hdRootKeyPayload, masterKey)
+        } catch (e: Exception) {
+            Log.w(CredentialRepository.TAG, "Failed to decode HD root key", e)
+            return null
+        }
+
         // In react-native-keystore, the private key/seed are stored as arrays of numbers in JSON
         // due to how JSON.stringify handles Uint8Array.
-        // Our decode method in decryptHdRootKey might have already handled it if it matched react-native-keystore's decode.
-        
         val seedArray = hdRootKeyData.optJSONArray("seed") ?: hdRootKeyData.optJSONArray("privateKey")
-        val derivedParentSecret = if (seedArray != null) {
-            Log.d(CredentialRepository.TAG, "Found seedArray in hdRootKeyData")
+        if (seedArray != null) {
             val bytes = ByteArray(seedArray.length())
             for (i in 0 until seedArray.length()) {
                 bytes[i] = seedArray.getInt(i).toByte()
             }
-            bytes
+            return bytes
+        }
+
+        val seed = (if (hdRootKeyData.has("seed")) hdRootKeyData.getString("seed") else null)
+            ?: (if (hdRootKeyData.has("privateKey")) hdRootKeyData.getString("privateKey") else null)
+            ?: return null
+        return if (seed.startsWith("0x")) {
+            hexToBytes(seed.substring(2))
         } else {
-            val seed = (if (hdRootKeyData.has("seed")) hdRootKeyData.getString("seed") else null)
-                ?: (if (hdRootKeyData.has("privateKey")) hdRootKeyData.getString("privateKey") else null)
-                ?: throw IllegalStateException("HD Root Key does not contain a seed or privateKey")
-            
-            Log.d(CredentialRepository.TAG, "Found seed string in hdRootKeyData")
-            if (seed.startsWith("0x")) {
-                hexToBytes(seed.substring(2))
-            } else {
-                // It might be base64url encoded or just hex
+            try {
+                hexToBytes(seed)
+            } catch (e: Exception) {
                 try {
-                    hexToBytes(seed)
-                } catch (e: Exception) {
                     AndroidBase64.decode(seed, AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP)
+                } catch (e2: Exception) {
+                    null
                 }
             }
         }
-
-        return dP256.genDomainSpecificKeypair(derivedParentSecret, origin, userHandle.lowercase())
     }
 
     private fun encryptData(key: ByteArray, data: String): String {

package/build/ReactNativePasskeyAutofill.types.d.ts

@@ -24,4 +24,19 @@ export type PasskeyAutofillCredentialIdentity = {
     lastUsedAt?: number;
     parentKeyId?: string;
 };
+/**
+ * Capabilities advertised by this credential provider. Exposed so the
+ * surrounding wallet UI / RP-side wallet can know which WebAuthn extensions
+ * are wired up natively before issuing a passkey request.
+ */
+export type PasskeyAutofillCapabilities = {
+    /**
+     * Whether the WebAuthn `prf` extension (a.k.a. `hmac-secret`) is supported
+     * by this credential provider. PRF outputs are derived deterministically
+     * from the wallet HD root secret so that restoring the wallet seed
+     * reproduces the same secrets on another device.
+     */
+    prf: boolean;
+};
+export declare const PASSKEY_AUTOFILL_CAPABILITIES: PasskeyAutofillCapabilities;
 //# sourceMappingURL=ReactNativePasskeyAutofill.types.d.ts.map

package/build/ReactNativePasskeyAutofill.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofill.types.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sCAAsC,GAAG;IACnD,cAAc,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACtD,sBAAsB,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtF,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC"}
+{"version":3,"file":"ReactNativePasskeyAutofill.types.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sCAAsC,GAAG;IACnD,cAAc,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACtD,sBAAsB,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtF,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC;;;;;OAKG;IACH,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,2BAE3C,CAAC"}

package/build/ReactNativePasskeyAutofill.types.js

@@ -1,2 +1,4 @@
-export {};
+export const PASSKEY_AUTOFILL_CAPABILITIES = {
+    prf: true,
+};
 //# sourceMappingURL=ReactNativePasskeyAutofill.types.js.map

package/build/ReactNativePasskeyAutofill.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofill.types.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"","sourcesContent":["export type ReactNativePasskeyAutofillModuleEvents = {\n  onPasskeyAdded: (event: { success: boolean }) => void;\n  onPasskeyAuthenticated: (event: { success: boolean; credentialId?: string }) => void;\n};\n\nexport type PasskeyAutofillCredentialIdentity = {\n  credentialId: string;\n  relyingPartyIdentifier?: string;\n  rpId?: string;\n  origin?: string;\n  userName?: string;\n  name?: string;\n  userHandle: string;\n  userId?: string;\n  privateKey?: string;\n  privateKeyBase64?: string;\n  publicKey?: string;\n  publicKeyBase64?: string;\n  createdAt?: number;\n  lastUsedAt?: number;\n  parentKeyId?: string;\n};\n"]}
+{"version":3,"file":"ReactNativePasskeyAutofill.types.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofill.types.ts"],"names":[],"mappings":"AAsCA,MAAM,CAAC,MAAM,6BAA6B,GAAgC;IACxE,GAAG,EAAE,IAAI;CACV,CAAC","sourcesContent":["export type ReactNativePasskeyAutofillModuleEvents = {\n  onPasskeyAdded: (event: { success: boolean }) => void;\n  onPasskeyAuthenticated: (event: { success: boolean; credentialId?: string }) => void;\n};\n\nexport type PasskeyAutofillCredentialIdentity = {\n  credentialId: string;\n  relyingPartyIdentifier?: string;\n  rpId?: string;\n  origin?: string;\n  userName?: string;\n  name?: string;\n  userHandle: string;\n  userId?: string;\n  privateKey?: string;\n  privateKeyBase64?: string;\n  publicKey?: string;\n  publicKeyBase64?: string;\n  createdAt?: number;\n  lastUsedAt?: number;\n  parentKeyId?: string;\n};\n\n/**\n * Capabilities advertised by this credential provider. Exposed so the\n * surrounding wallet UI / RP-side wallet can know which WebAuthn extensions\n * are wired up natively before issuing a passkey request.\n */\nexport type PasskeyAutofillCapabilities = {\n  /**\n   * Whether the WebAuthn `prf` extension (a.k.a. `hmac-secret`) is supported\n   * by this credential provider. PRF outputs are derived deterministically\n   * from the wallet HD root secret so that restoring the wallet seed\n   * reproduces the same secrets on another device.\n   */\n  prf: boolean;\n};\n\nexport const PASSKEY_AUTOFILL_CAPABILITIES: PasskeyAutofillCapabilities = {\n  prf: true,\n};\n"]}

package/ios/AutofillCredentialProvider/CredentialProviderViewController.swift

@@ -12,6 +12,8 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
   private var pendingAssertionCredential: StoredPasskeyCredential?
   private var pendingAssertionClientDataHash: Data?
   private var pendingAssertionRelyingPartyIdentifier: String?
+  private var pendingAssertionPrfInput: PrfInput?
+  private var pendingRegistrationPrfInput: PrfInput?
   private var isCompletingRegistration = false
   private var isCompletingAssertion = false
   private var hasPresentedInterface = false
@@ -62,7 +64,8 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
     prepareAssertion(
       credential: credential,
       clientDataHash: requestParameters.clientDataHash,
-      relyingPartyIdentifier: relyingPartyIdentifier
+      relyingPartyIdentifier: relyingPartyIdentifier,
+      prfInput: Self.prfInput(fromAssertion: requestParameters)
     )
   }
 
@@ -100,7 +103,8 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
     prepareAssertion(
       credential: credential,
       clientDataHash: request.clientDataHash,
-      relyingPartyIdentifier: identity.relyingPartyIdentifier
+      relyingPartyIdentifier: identity.relyingPartyIdentifier,
+      prfInput: Self.prfInput(fromAssertion: request)
     )
   }
 
@@ -116,6 +120,7 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
 
     pendingRegistrationRequest = request
     pendingRegistrationIdentity = identity
+    pendingRegistrationPrfInput = Self.prfInput(fromRegistration: request)
     showCheckingPasskeys()
 
     if hasPresentedInterface {
@@ -182,6 +187,13 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
         attestationObject: WebAuthn.attestationObject(authenticatorData: authData)
       )
 
+      attachPrfRegistrationOutput(
+        to: registrationCredential,
+        derivedParentSecret: derivedParentSecret,
+        relyingPartyIdentifier: identity.relyingPartyIdentifier,
+        userHandle: userHandle
+      )
+
       try store.save(storedCredential)
       store.appendDiagnostic("stored passkey credential")
 
@@ -223,6 +235,11 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
         authenticatorData: authenticatorData,
         credentialID: credential.credentialIdData
       )
+      attachPrfAssertionOutput(
+        to: assertionCredential,
+        credential: credential,
+        relyingPartyIdentifier: relyingPartyIdentifier
+      )
       extensionContext.completeAssertionRequest(using: assertionCredential) { [weak self] _ in
         self?.store?.recordCredentialUsage(id: credential.credentialId)
         self?.authContext = nil
@@ -230,6 +247,7 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
         self?.pendingAssertionCredential = nil
         self?.pendingAssertionClientDataHash = nil
         self?.pendingAssertionRelyingPartyIdentifier = nil
+        self?.pendingAssertionPrfInput = nil
       }
     } catch {
       isCompletingAssertion = false
@@ -240,11 +258,13 @@ final class CredentialProviderViewController: ASCredentialProviderViewController
   private func prepareAssertion(
     credential: StoredPasskeyCredential,
     clientDataHash: Data,
-    relyingPartyIdentifier: String
+    relyingPartyIdentifier: String,
+    prfInput: PrfInput?
   ) {
     pendingAssertionCredential = credential
     pendingAssertionClientDataHash = clientDataHash
     pendingAssertionRelyingPartyIdentifier = relyingPartyIdentifier
+    pendingAssertionPrfInput = prfInput
     showCheckingPasskeys()
 
     if hasPresentedInterface {
@@ -437,3 +457,112 @@ private extension ASPasskeyCredentialIdentity {
     String(data: userHandle, encoding: .utf8) ?? userHandle.base64URLEncodedString()
   }
 }
+
+// MARK: - PRF extension helpers
+
+extension CredentialProviderViewController {
+  /// Extract PRF inputs from a passkey assertion request. The platform passes
+  /// the RP-supplied salts down to credential providers via `extensionInput`
+  /// (iOS 17.4+ for the type itself, iOS 18+ for the `prf` property).
+  static func prfInput(fromAssertion request: ASPasskeyCredentialRequest) -> PrfInput? {
+    if #available(iOSApplicationExtension 18.0, *) {
+      guard let prf = request.extensionInput?.prf else { return nil }
+      return prfInput(fromAssertionInput: prf)
+    }
+    return nil
+  }
+
+  /// Variant for the `prepareCredentialList` flow which gives us the
+  /// `ASPasskeyCredentialRequestParameters` directly.
+  static func prfInput(fromAssertion parameters: ASPasskeyCredentialRequestParameters) -> PrfInput? {
+    if #available(iOSApplicationExtension 18.0, *) {
+      guard let prf = parameters.extensionInput?.prf else { return nil }
+      return prfInput(fromAssertionInput: prf)
+    }
+    return nil
+  }
+
+  /// Extract PRF inputs from a passkey registration request. Most relying
+  /// parties only set `prf.enabled` on create, but a few also pass eval salts
+  /// to immediately derive a secret.
+  static func prfInput(fromRegistration request: ASPasskeyCredentialRequest) -> PrfInput? {
+    if #available(iOSApplicationExtension 18.0, *) {
+      guard let prf = request.extensionInput?.prf else { return nil }
+      return prfInput(fromRegistrationInput: prf)
+    }
+    return nil
+  }
+
+  @available(iOSApplicationExtension 18.0, *)
+  private static func prfInput(
+    fromAssertionInput prf: ASAuthorizationPublicKeyCredentialPRFAssertionInput
+  ) -> PrfInput? {
+    // `inputValues` (when present) overrides `saltInput1/2` per WebAuthn's
+    // `evalByCredential` semantics. The platform exposes whichever is
+    // applicable to the credential the user actually picked.
+    if let values = prf.inputValues {
+      return PrfInput(first: values.saltInput1, second: values.saltInput2)
+    }
+    return nil
+  }
+
+  @available(iOSApplicationExtension 18.0, *)
+  private static func prfInput(
+    fromRegistrationInput prf: ASAuthorizationPublicKeyCredentialPRFRegistrationInput
+  ) -> PrfInput? {
+    if let values = prf.inputValues {
+      return PrfInput(first: values.saltInput1, second: values.saltInput2)
+    }
+    return nil
+  }
+
+  /// Compute and attach PRF outputs to an assertion credential. No-op on
+  /// pre-iOS 18 systems, and a no-op when the RP did not supply PRF inputs.
+  func attachPrfAssertionOutput(
+    to assertionCredential: ASPasskeyAssertionCredential,
+    credential: StoredPasskeyCredential,
+    relyingPartyIdentifier: String
+  ) {
+    guard #available(iOSApplicationExtension 18.0, *),
+          let input = pendingAssertionPrfInput else { return }
+
+    do {
+      guard let store else { return }
+      let derivedParentSecret = try store.hdRootKeySecret()
+      let userHandle = credential.userHandle
+      let credRandom = Prf.credRandom(
+        hdRootSecret: derivedParentSecret,
+        relyingPartyIdentifier: relyingPartyIdentifier,
+        userHandle: userHandle
+      )
+      let first = Prf.evaluate(credRandom: credRandom, salt: input.first)
+      let second = input.second.map { Prf.evaluate(credRandom: credRandom, salt: $0) }
+      let prfOutput = ASAuthorizationPublicKeyCredentialPRFAssertionOutput(
+        first: first,
+        second: second
+      )
+      assertionCredential.extensionOutput = ASPasskeyAssertionCredentialExtensionOutput(prf: prfOutput)
+      store.appendDiagnostic("attached PRF assertion output")
+    } catch {
+      store?.appendDiagnostic("failed to attach PRF assertion output: \(error.localizedDescription)")
+    }
+  }
+
+  /// Attach PRF output to a registration credential.
+  ///
+  /// Per the agreed scope, we always advertise `prf.enabled = true` on
+  /// registration to signal the credential supports PRF. If the RP also sent
+  /// eval salts we still defer the actual evaluation to a follow-up assertion
+  /// (matching the behaviour of most platform authenticators).
+  func attachPrfRegistrationOutput(
+    to registrationCredential: ASPasskeyRegistrationCredential,
+    derivedParentSecret: Data,
+    relyingPartyIdentifier: String,
+    userHandle: String
+  ) {
+    guard #available(iOSApplicationExtension 18.0, *) else { return }
+    let prfOutput = ASAuthorizationPublicKeyCredentialPRFRegistrationOutput.supported()
+    registrationCredential.extensionOutput = ASPasskeyRegistrationCredentialExtensionOutput(prf: prfOutput)
+    store?.appendDiagnostic("attached PRF registration output (enabled)")
+  }
+}

package/ios/AutofillCredentialProvider/Prf.swift

@@ -0,0 +1,89 @@
+import CryptoKit
+import Foundation
+
+/// WebAuthn PRF (`prf`) extension helpers, backed by the authenticator
+/// `hmac-secret` mechanism (CTAP2.1).
+///
+/// Per the WebAuthn spec, for each input salt the authenticator computes:
+///
+///     output = HMAC-SHA256(credRandom, SHA256("WebAuthn PRF" || 0x00 || salt))
+///
+/// where `credRandom` is a 32-byte per-credential secret. To avoid a storage
+/// migration we derive `credRandom` deterministically from the wallet's HD
+/// root secret and the credential's (rpId, userHandle) — the same inputs that
+/// already produce the deterministic P-256 signing key. As a result, restoring
+/// the wallet seed on another device produces the same PRF outputs.
+enum Prf {
+  /// Domain separator used to derive `credRandom` from the HD root secret.
+  /// Kept under a distinct label from the P-256 key derivation to ensure
+  /// the credRandom value can never collide with private-key material.
+  static let credRandomInfo = "WebAuthn-PRF-credRandom"
+
+  /// WebAuthn-defined prefix for PRF salt hashing.
+  /// See: https://www.w3.org/TR/webauthn-3/#prf-extension
+  static let saltPrefix: [UInt8] = Array("WebAuthn PRF".utf8) + [0x00]
+
+  /// Derive a 32-byte per-credential PRF secret (`credRandom`) from the wallet
+  /// HD root secret. Deterministic over `(hdRootSecret, rpId, userHandle)`.
+  static func credRandom(
+    hdRootSecret: Data,
+    relyingPartyIdentifier: String,
+    userHandle: String
+  ) -> Data {
+    var salt = Data()
+    salt.append(contentsOf: relyingPartyIdentifier.lowercased().utf8)
+    salt.append(0x00)
+    salt.append(contentsOf: userHandle.lowercased().utf8)
+
+    let info = Data(credRandomInfo.utf8)
+    let key = SymmetricKey(data: hdRootSecret)
+    let derived = HKDF<SHA256>.deriveKey(
+      inputKeyMaterial: key,
+      salt: salt,
+      info: info,
+      outputByteCount: 32
+    )
+    return derived.withUnsafeBytes { Data($0) }
+  }
+
+  /// Evaluate the PRF for a single salt. Returns 32 bytes of output material.
+  ///
+  /// Per the WebAuthn spec the PRF input the authenticator sees is the
+  /// hash `SHA-256("WebAuthn PRF" || 0x00 || rpSalt)`. The platform layer
+  /// (Apple AuthenticationServices on iOS, the system credential manager on
+  /// Android with `prfAlreadyHashed`) performs this hashing before passing
+  /// the salt down to credential providers. Pass `alreadyHashed = true` in
+  /// that case so we don't hash twice.
+  static func evaluate(credRandom: Data, salt: Data, alreadyHashed: Bool = true) -> Data {
+    let macInput: Data
+    if alreadyHashed {
+      macInput = salt
+    } else {
+      var hashInput = Data(saltPrefix)
+      hashInput.append(salt)
+      macInput = Data(SHA256.hash(data: hashInput))
+    }
+    let mac = HMAC<SHA256>.authenticationCode(
+      for: macInput,
+      using: SymmetricKey(data: credRandom)
+    )
+    return Data(mac)
+  }
+}
+
+/// Parsed PRF extension input as supplied by the relying party.
+///
+/// At the WebAuthn layer the RP can either supply a single global pair of
+/// salts (`eval`) or a per-credential map (`evalByCredential`). We always
+/// reduce that down to at most two salts for the credential we are about to
+/// assert with, matching the platform behaviour on iOS 18 and Android.
+struct PrfInput {
+  let first: Data
+  let second: Data?
+}
+
+/// Computed PRF outputs ready to attach to a WebAuthn response.
+struct PrfOutput {
+  let first: Data
+  let second: Data?
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algorandfoundation/react-native-passkey-autofill",
-  "version": "1.0.0-canary.17",
+  "version": "1.0.0-canary.18",
   "description": "Passkey AutoFill React Native",
   "keywords": [
     "@algorandfoundation/react-native-passkey-autofill",
@@ -54,6 +54,7 @@
     "@expo/config-plugins": "~55.0.8",
     "@expo/npm-proofread": "^1.0.1",
     "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/github": "^12.0.6",
     "@semantic-release/npm": "^13.1.5",

package/src/ReactNativePasskeyAutofill.types.ts

@@ -20,3 +20,22 @@ export type PasskeyAutofillCredentialIdentity = {
   lastUsedAt?: number;
   parentKeyId?: string;
 };
+
+/**
+ * Capabilities advertised by this credential provider. Exposed so the
+ * surrounding wallet UI / RP-side wallet can know which WebAuthn extensions
+ * are wired up natively before issuing a passkey request.
+ */
+export type PasskeyAutofillCapabilities = {
+  /**
+   * Whether the WebAuthn `prf` extension (a.k.a. `hmac-secret`) is supported
+   * by this credential provider. PRF outputs are derived deterministically
+   * from the wallet HD root secret so that restoring the wallet seed
+   * reproduces the same secrets on another device.
+   */
+  prf: boolean;
+};
+
+export const PASSKEY_AUTOFILL_CAPABILITIES: PasskeyAutofillCapabilities = {
+  prf: true,
+};