RSA Announces Firmware Update for DS100 Hardware Authenticator
2 years ago
The 1.0.2.0058 firmware update for the RSA DS100 Hardware Authenticator is now available for download here.

The firmware update includes the following improvements and fixes:
  • When the DS100 is plugged into a USB port, pressing its button causes it to act like a keyboard and automatically enter the One Time Password (OTP) in the computing device (the RSA logo is the button).
    Previously, the automatic entry was triggered when the button was pressed then released, so that if a user pressed and held the button down for an extended period of time, the automatic OTP entry would never be performed.
    This behavior has been improved, so that pressing the button triggers the automatic OTP entry, rather than pressing and releasing.
  • When the DS100 is plugged into a USB port, its button is used to confirm User Presence during FIDO operations, such as passkey registration or passkey authentication.
    Previously, confirmation was triggered when the button was pressed then released, so that if a user pressed and held the button down for an extended period of time, the FIDO event would time out and fail.
    This behavior has been improved, so that pressing the button triggers User Presence confirmation, rather than pressing and releasing.
  • This firmware update slightly decreases power usage of the DS100 when it is in hibernate mode (anytime the display is off while unplugged from a USB port) to extend its battery life.
  • There is a bug in both iOS and macOS that prevents the DS100 from being used for FIDO passkey registration and/or authentication. In this update, RSA has implemented a solution to enable FIDO operations on the DS100 for iOS and macOS devices.
    Apple considers the DS100 a FIDO CTAP 2.1 authenticator, but the DS100 actually uses the FIDO CTAP 2.0 protocol. The DS100 now returns a COSE key type of -25 to mimic a CTAP 2.1 authenticator, so that it can function on iOS and macOS.
  • The ability to request an OTP using an API over USB was removed. This prevents malware on a computing device from requesting OTPs without the user's knowledge.
Announcement
Don't see what you're looking for?