How to remove WebAuthN credentials from onboard-TPM on Win10 device?

Question

Latest builds of Windows 10 allow browsers (at least Edge and Chrome) to use on-board TPM device for WebAuthN passwordless authentication.

It does work for me and on test sandbox sites - I can generate private-public key pairs, store private key in TPM and send public key to server for futher authentication.

The issue is that I cannot find a way to clear the saved keys. I haven't tried erasing the whole TPM yet since I don't want to mess with BitLocker.

The question is how can I clear WebAuthN credentials (keys) stored in platform TPM running on Windows 10.

Is it even possible?

Answer 1

The Microsoft command line tool certutil can be used to view and delete these WebAuthN keys.

Disclaimer: it's very easy to delete the wrong key, so make sure that you are happy to accept the risk that you might delete the wrong key; there is no undo.

To view your WebAuthN keys, from a command prompt, run:

certutil -csp NGC -key

WebAuthN keys have names that look like <sid>/<guid>/FIDO_AUTHENTICATOR//<rpIdHash>_<user id>

You need to identify the key that you want to delete, and then to delete a WebAuthN key, from an administrator command prompt, run:

certutil -csp NGC -delkey <name>

Answer 2

Windows don't have a UI for this which is very irritating when you work with Webauthn.

So I built a small tool that helps with this, it's on github: https://github.com/passwordless/webauthn-fido2-key-remover.

It's using certutil under the hoods but makes it a bit safer and easier to operate.

Answer 3

I recorded the authentication process with Process Monitor and discovered several operations on several files in %SystemRoot%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc that looked suspicious. A bit of googling suggests that is indeed where Windows Hello credentials are stored.

There are answers (e.g., this one on this site) that suggest you can simply delete this directory’s content to remove all your Windows Hello credentials.

I tried renaming this folder (as SYSTEM by using PsExec), and while it did remove my WebAuthn credentials, it also left me unable to create a new PIN in the “Sign-in options” UI. I’m not sure if rebooting will help.

---

Edit: After several reboots I got a prompt saying there was something wrong with my Microsoft account. (I use a local account, but am signed into a Microsoft account.) After I signed in again, NGC was restored to the initial state and working properly again.

Answer 4

TPM, like most certificate repositories, does not seem to support the delete operation.

I base this observation on the Microsoft article TrustedPlatformModule, describing itself as:

This reference provides cmdlet descriptions and syntax for all TPM cmdlets.

The list does not include any PowerShell cmdlet for deleting certificates.

You could try to create a revocation certificate and import it into the TPM, which might nullify the existing certificate. If it works, this will not delete it, just add a revocation record (that is if TPM works like any other certificate repository).

The only option I could find to delete anything is by clearing totally the TPM. As you are using BitLocker, see the post Will clearing the TPM make BitLocker encrypted data unavailable?

Quoting from the post:

If you clear the TPM, the encrypted drive will only be accessible using the recovery key.

So in your case it should be ok to clear the TPM chip. Afterwards, reboot and enter the recovery key. Once inside Windows, you can re-enable the TPM chip and set a new PIN.

I would suggest, just in case, to backup the BitLocked disk (and perhaps even disabling BitLocker) before such operations.

Answer 5

This is a quick and dirty Node.js script to help anyone using windows quickly and easily remove ALL FIDO CERTS.

Its extremely rough, and could use error-handling / logging. Modify to suit your own needs.

PROCEED WITH CAUTION!:

const util = require('node:util');
const exec = util.promisify(require('node:child_process').exec);

async function NUKE_ALL_CERTS() {
  const { stdout, stderr } = await exec('certutil -csp NGC -key');
  let output = stdout.split("\r\n")
  .filter((element) => {
    return /FIDO_AUTHENTICATOR/.test(element);
  })
  .map((element) => {
    return `certutil -csp NGC -delkey ${element}`;
  });

  await Promise.all(output.map((element) => {return exec(element)}));

  console.log(output);

}
NUKE_ALL_CERTS();