---
name: "fido_assert_set_authdata"
section: "3"
platform: "linux"
package: "libfido2"
version: "1.17.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/fido_assert_set_authdata"
---

# fido\_assert\_set\_authdata(3)

set parameters of a FIDO2 assertion

## NAME

**fido\_assert\_set\_authdata**, **fido\_assert\_set\_authdata\_raw**, **fido\_assert\_set\_clientdata**, **fido\_assert\_set\_clientdata\_hash**, **fido\_assert\_set\_count**, **fido\_assert\_set\_extensions**, **fido\_assert\_set\_hmac\_salt**, **fido\_assert\_set\_hmac\_secret**, **fido\_assert\_set\_up**, **fido\_assert\_set\_uv**, **fido\_assert\_set\_rp**, **fido\_assert\_set\_sig**, **fido\_assert\_set\_winhello\_appid** – set parameters of a FIDO2 assertion

## SYNOPSIS

**#include \<fido.h\>**

```
typedef enum {
	FIDO_OPT_OMIT = 0, /* use authenticator's default */
	FIDO_OPT_FALSE,    /* explicitly set option to false */
        FIDO_OPT_TRUE,     /* explicitly set option to true */
} fido_opt_t;
```

*int*\

**fido\_assert\_set\_authdata**(*fido\_assert\_t \*assert*, *size\_t idx*, *const unsigned char \*ptr*, *size\_t len*);

*int*\

**fido\_assert\_set\_authdata\_raw**(*fido\_assert\_t \*assert*, *size\_t idx*, *const unsigned char \*ptr*, *size\_t len*);

*int*\

**fido\_assert\_set\_clientdata**(*fido\_assert\_t \*assert*, *const unsigned char \*ptr*, *size\_t len*);

*int*\

**fido\_assert\_set\_clientdata\_hash**(*fido\_assert\_t \*assert*, *const unsigned char \*ptr*, *size\_t len*);

*int*\

**fido\_assert\_set\_count**(*fido\_assert\_t \*assert*, *size\_t n*);

*int*\

**fido\_assert\_set\_extensions**(*fido\_assert\_t \*assert*, *int flags*);

*int*\

**fido\_assert\_set\_hmac\_salt**(*fido\_assert\_t \*assert*, *const unsigned char \*ptr*, *size\_t len*);

*int*\

**fido\_assert\_set\_hmac\_secret**(*fido\_assert\_t \*assert*, *size\_t idx*, *const unsigned char \*ptr*, *size\_t len*);

*int*\

**fido\_assert\_set\_up**(*fido\_assert\_t \*assert*, *fido\_opt\_t up*);

*int*\

**fido\_assert\_set\_uv**(*fido\_assert\_t \*assert*, *fido\_opt\_t uv*);

*int*\

**fido\_assert\_set\_rp**(*fido\_assert\_t \*assert*, *const char \*id*);

*int*\

**fido\_assert\_set\_sig**(*fido\_assert\_t \*assert*, *size\_t idx*, *const unsigned char \*ptr*, *size\_t len*);

*int*\

**fido\_assert\_set\_winhello\_appid**(*fido\_assert\_t \*assert*, *const char \*id*);

## DESCRIPTION

The **fido\_assert\_set\_authdata** set of functions define the various parameters of a FIDO2 assertion, allowing a *fido\_assert\_t* type to be prepared for a subsequent call to [fido\_dev\_get\_assert(3)](/fido_dev_get_assert/3.md) or [fido\_assert\_verify(3)](/fido_assert_verify/3.md). For the complete specification of a FIDO2 assertion and the format of its constituent parts, please refer to the Web Authentication (webauthn) standard.

The **fido\_assert\_set\_count**() function sets the number of assertion statements in *assert* to *n*.

The **fido\_assert\_set\_authdata**() and **fido\_assert\_set\_sig**() functions set the authenticator data and signature parts of the statement with index *idx* of *assert* to *ptr*, where *ptr* points to *len* bytes. A copy of *ptr* is made, and no references to the passed pointer are kept. Please note that the first assertion statement of *assert* has an *idx* of *0*. The authenticator data passed to **fido\_assert\_set\_authdata**() must be a CBOR-encoded byte string, as obtained from **fido\_assert\_authdata\_ptr**(). Alternatively, a raw binary blob may be passed to **fido\_assert\_set\_authdata\_raw**().

The **fido\_assert\_set\_clientdata\_hash**() function sets the client data hash of *assert* to *ptr*, where *ptr* points to *len* bytes. A copy of *ptr* is made, and no references to the passed pointer are kept.

The **fido\_assert\_set\_clientdata**() function allows an application to set the client data hash of *assert* by specifying the assertion's unhashed client data. This is required by Windows Hello, which calculates the client data hash internally. For compatibility with Windows Hello, applications should use **fido\_assert\_set\_clientdata**() instead of **fido\_assert\_set\_clientdata\_hash**().

The **fido\_assert\_set\_rp**() function sets the relying party *id* of *assert*, where *id* is a NUL-terminated UTF-8 string. The content of *id* is copied, and no references to the passed pointer are kept.

The **fido\_assert\_set\_extensions**() function sets the extensions of *assert* to the bitmask *flags*. At the moment, only the FIDO\_EXT\_CRED\_BLOB, FIDO\_EXT\_HMAC\_SECRET, FIDO\_EXT\_LARGEBLOB\_KEY, and FIDO\_EXT\_PAYMENT extensions are supported. If *flags* is zero, the extensions of *assert* are cleared. Enabling FIDO\_EXT\_PAYMENT does not affect how [fido\_assert\_verify(3)](/fido_assert_verify/3.md) verifies the RP ID; the platform is responsible for determining what constitutes a payment authentication.

The **fido\_assert\_set\_hmac\_salt**() and **fido\_assert\_set\_hmac\_secret**() functions set the hmac-salt and hmac-secret parts of *assert* to *ptr*, where *ptr* points to *len* bytes. A copy of *ptr* is made, and no references to the passed pointer are kept. The HMAC Secret (hmac-secret) Extension is a CTAP 2.0 extension. Note that the resulting hmac-secret varies according to whether user verification was performed by the authenticator. The **fido\_assert\_set\_hmac\_secret**() function is normally only useful when writing tests.

The **fido\_assert\_set\_up**() and **fido\_assert\_set\_uv**() functions set the *up* (user presence) and *uv* (user verification) attributes of *assert*. Both are FIDO\_OPT\_OMIT by default, allowing the authenticator to use its default settings.

The **fido\_assert\_set\_winhello\_appid**() function sets the U2F application *id* (“U2F AppID”) of *assert*, where *id* is a NUL-terminated UTF-8 string. The content of *id* is copied, and no references to the passed pointer are kept. The **fido\_assert\_set\_winhello\_appid**() function is a no-op unless *assert* is passed to [fido\_dev\_get\_assert(3)](/fido_dev_get_assert/3.md) with a device *dev* on which [fido\_dev\_is\_winhello(3)](/fido_dev_is_winhello/3.md) holds true. In this case, *libfido2* will instruct Windows Hello to try the assertion twice, first with the *id* passed to **fido\_assert\_set\_rp**(), and a second time with the *id* passed to **fido\_assert\_set\_winhello\_appid**(). If the second assertion succeeds, [fido\_assert\_rp\_id(3)](/fido_assert_rp_id/3.md) will point to the U2F AppID once [fido\_dev\_get\_assert(3)](/fido_dev_get_assert/3.md) completes. This mechanism exists in Windows Hello to ensure U2F backwards compatibility without the application inadvertently prompting the user twice. Note that **fido\_assert\_set\_winhello\_appid**() is not needed on platforms offering CTAP primitives, since the authenticator can be silently probed for the existence of U2F credentials.

Use of the **fido\_assert\_set\_authdata** set of functions may happen in two distinct situations: when asking a FIDO2 device to produce a series of assertion statements, prior to [fido\_dev\_get\_assert(3)](/fido_dev_get_assert/3.md) (i.e, in the context of a FIDO2 client), or when verifying assertion statements using [fido\_assert\_verify(3)](/fido_assert_verify/3.md) (i.e, in the context of a FIDO2 server).

For a complete description of the generation of a FIDO2 assertion and its verification, please refer to the FIDO2 specification. An example of how to use the **fido\_assert\_set\_authdata** set of functions can be found in the *examples/assert.c* file shipped with *libfido2*.

## RETURN VALUES

The **fido\_assert\_set\_authdata** functions return FIDO\_OK on success. The error codes returned by the **fido\_assert\_set\_authdata** set of functions are defined in ⟨fido/err.h⟩.

## SEE ALSO

[fido\_assert\_allow\_cred(3)](/fido_assert_allow_cred/3.md), [fido\_assert\_verify(3)](/fido_assert_verify/3.md), [fido\_dev\_get\_assert(3)](/fido_dev_get_assert/3.md), [fido\_dev\_is\_winhello(3)](/fido_dev_is_winhello/3.md)