# Validity90: reverse engineering a Validity/Synaptics fingerprint-reader protocol

> Reverse engineers the USB protocol of the Validity/Synaptics laptop fingerprint readers 138a:0090, 138a:0094, 138a:0097, 06cb:0081 and 06cb:009a, aiming at a written specification and a free libfprint driver. The repository holds a draft specification of the initialization sequence and of the modified TLS 1.2 handshake the readers use, a Wireshark Lua dissector that decrypts traffic after the key exchange, and a standalone C prototype that talks to a reader over libusb. The README calls the prototype extremely ugly code to be rewritten for the driver, and marks the integrated libfprint driver as not ready.

- Type: Case study
- Targets: Protocol
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/nmikhailov/Validity90>
- Primary source: <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/README.md>
- Catalog page: <https://awesomerea.org/resources/validity90-fingerprint-protocol-case/>
- Record JSON: <https://awesomerea.org/resources/validity90-fingerprint-protocol-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/validity90-fingerprint-protocol-case/index.md)

## Requirements & limits

- The README reports prototype scanning and image output for 138a:0090, scanning for 138a:0097, and initialization and LEDs without scanning for 06cb:009a. The integrated libfprint driver is not ready; configuration, pre-TLS key exchange, device operations and image format remain in progress.
- The prototype needs a listed USB reader and read access to the machine DMI product serial for its session key. Its Makefile permissions target uses sudo. On Linux it builds against NSS, OpenSSL, libgcrypt, libusb-1.0, libpng and GLib. The dissector needs Wireshark Lua and lua-lockbox.
- make test checks utility functions and one initialization-response parse. Device results are recorded in the README status table and prototype logs.
- License: LGPL-2.1-or-later for the project code; the libfprint copy and submodule retain their own notices. The published specification and prototype contain recovered keys and byte sequences.

## Primary sources

1. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/README.md>
2. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/spec.md>
3. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/prototype/README.md>
4. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/prototype/Makefile>
5. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/prototype/main.c>
6. <https://github.com/nmikhailov/Validity90/tree/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/prototype/test>
7. <https://github.com/nmikhailov/Validity90/tree/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/prototype/logs>
8. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/dissector.lua>
9. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/dbg/attach.sh>
10. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/.gitmodules>
11. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/libfprint/.gitrepo>
12. <https://github.com/nmikhailov/Validity90/blob/8b80cfeae15487d5e13ff5ff3ab4f282eac765be/COPYING>

## More in Protocols

- [Ember Mug: reverse-engineered Bluetooth LE characteristics](https://awesomerea.org/resources/ember-mug-ble-protocol-case/index.md) · Case study
- [BM2 Battery Monitor: reconstructing an encrypted BLE voltage protocol](https://awesomerea.org/resources/bm2-battery-monitor-ble-case/index.md) · Case study
- [Smart ring protocol: documenting the Oura Ring BLE protocol and event format](https://awesomerea.org/resources/ringverse-oura-ring-protocol-case/index.md) · Case study
- [openrsync: an ISC implementation of rsync protocol 27](https://awesomerea.org/resources/openrsync-protocol-case/index.md) · Case study
- [Thermal Master P3: a browser client for the vendor USB protocol](https://awesomerea.org/resources/thermal-master-p3-protocol-case/index.md) · Case study
- [SNX-VPN: reconstructing Check Point browser login for SNX](https://awesomerea.org/resources/snxvpn-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.