Skip to content

FIDO2 (WebAuthn) and FIDO U2F platform library for Linux written in Rust; includes a proposal for a new D-Bus Portal interface for FIDO2, accessible from Flatpak apps and Snaps πŸ”‘

License

Notifications You must be signed in to change notification settings

AlfioEmanueleFresta/xdg-credentials-portal

Folders and files

NameName
Last commit message
Last commit date

Latest commit

Β 

History

94 Commits
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 

Repository files navigation

xdg-credentials-portal

This is a standalone service which aims to offer FIDO2 platform functionality (FIDO U2F, and WebAuthn) on Linux, over a D-Bus Portal interface.

The project is composed of multiple crates:

  • libwebauthn: Linux native implementation of FIDO2 and FIDO U2F Platform APIs.
    • Fully written in Rust.
    • No longer relies on Mozilla's authenticator-rs.
    • Supporting multiple transports (currently USB HID and BLE). The library is designed to have pluggable transport implementations, making it easy to add transport backends (planned: NFC, caBLEv2).
  • xdg-credentials-portal: API proposal and reference implementation for a service which will expose FIDO2 and FIDO U2F Platform APIs via a D-Bus interface, for desktop applications to use - including conteinerized apps such as Flatpaks.

libwebauthn

Platform functionality

  • FIDO U2F
    • 🟒 Registration (U2F_REGISTER)
    • 🟒 Authentication (U2F_AUTHENTICATE)
    • 🟒 Version (U2F_VERSION)
  • FIDO2
    • 🟒 Create credential
    • 🟒 Verify assertion
    • 🟒 Biometric user verification
    • 🟒 Discoverable credentials (resident keys)
  • FIDO2 to FIDO U2F downgrade
    • 🟒 Basic functionality
    • 🟒 Support for excludeList and pre-flight requests
  • PIN/UV Protocols
    • 🟒 PIN/UV Auth Protocol One
    • 🟒 PIN/UV Auth Protocol Two
  • PIN/UV Operations
    • 🟒 GetPinToken
    • 🟒 GetPinUvAuthTokenUsingPinWithPermissions
    • 🟒 GetPinUvAuthTokenUsingUvWithPermissions
  • Passkey Authentication
    • 🟒 Discoverable credentials (resident keys)
    • πŸ”΄ Cloud-Assisted BLE (caBLE) transport (#31 blocked: spec not yet published)

Transports

USB (HID) Bluetooth Low Energy (BLE) NFC TPM 2.0 (Platform)
FIDO U2F 🟒 Supported (via hidapi) 🟒 Supported (via bluez) 🟠 Planned (#5) 🟠 Planned (#4)
WebAuthn (FIDO2) 🟒 Supported (via hidapi) 🟒 Supported (via bluez) 🟠 Planned (#5) 🟠 Planned (#4)

xdg-credential-platform

This is a very early stage idea, no proposed spec exists yet.

Here is an high-level architecture diagram of the proposed service and how it will interact with its clients:

High-Level Architecture

Footnotes:

  • *: Better alternatives for UI should be considered, e.g. native UI implementations via xdg-credentials-portal-{gnome, kde}.
  • Ξ”: See Roadmap section below

Motivation

Other platforms

Here is a list of related APIs available on other platforms, which offer similar functionality:

Further references:

Contributing

If you'd like to contribute but you don't know where to start, take a look at available tasks in the Issues tab.

Alternatively, any investigation or expertise on the following would be very helpful. Please reach out!

  • Platform Authenticator support. Similarly to Android devices, and Windows Hello. In order to implement this (and request FIDO2 certification), support for the following is needed:

    • Trusted Platform Modules (TPMs)
    • User-verification devices (e.g. fingerprint readers)
  • Unprivileged access. FIDO2 credentials are scoped to an origin (e.g. https://example.org). The proposed API allows applications to specify any origin (as needed by browsers). Hence, it requires an additional user confirmation step for security purposes. This extra step may not be needed if the request sender could be verified, as the legitimate owner of the specified origin.

  • PAM, and passwordless login (long-term goal). A PAM module would allow using FIDO2 for user login purposes, e.g. using the platform authenticator (similar to Windows Hello).

  • D-Bus Portal API design

  • Proposal and contribution processes (Flatpak, GNOME, etc.)

  • UI/UX

About

FIDO2 (WebAuthn) and FIDO U2F platform library for Linux written in Rust; includes a proposal for a new D-Bus Portal interface for FIDO2, accessible from Flatpak apps and Snaps πŸ”‘

Topics

Resources

License

Stars

Watchers

Forks

Contributors 4

  •  
  •  
  •  
  •  

Languages