Skip to content

A privacy-focused Java Card U2F Authenticator based on ledger-u2f-javacard

License

Notifications You must be signed in to change notification settings

darconeous/u2f-javacard

 
 

Repository files navigation

Customized U2F Applet

This is a fork of the Ledger U2F Applet that is focused on privacy and compatability. It has several unique features:

This fork also fixes some problems with Extended APDUs that is present in the upstream version.

If you want to just get a CAP file and install it, you can find it in the releases section. Check the assets for the release, there should be a U2FApplet.cap and a U2FApplet.cap.gpg. The cap file is signed with my public gpg key.

Once you have a CAP file, you can use this script to install using GlobalPlatformPro.

What follows below is from the original project README, with a few edits for things that have clearly changed.


Overview

This applet is a Java Card implementation of the FIDO Alliance U2F standard

It uses no proprietary vendor API and is freely available on Ledger Unplugged and for a small fee on other Fidesmo devices through Fidesmo store

Building

Installing

Either load the CAP file using your favorite third party software or refer to Fidesmo Gradle Plugin to use on the Fidesmo platform

The following install parameters are expected :

  • 1 byte flag : provide 01 to pass the current Fido NFC interoperability tests, or 00 (You almost certainly want to pass in 00)
  • 2 bytes length (big endian encoded) : length of the attestation certificate to load, supposed to be using a private key on the P-256 curve
  • 32 bytes : private key of the attestation certificate

Before using the applet, the attestation certificate shall be loaded using a proprietary APDU

CLA INS P1 P2 Data
80 01 offset (high) offset (low) Certificate data chunk

Testing on Android

Certification

This implementation has been certified FIDO U2F compliant on December 17, 2015 (U2F100020151217001). See tag u2f-certif-171215

License

This application is licensed under Apache 2.0

Contact

Please contact [email protected] for any question

About

A privacy-focused Java Card U2F Authenticator based on ledger-u2f-javacard

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Java 100.0%