Allow use as FIDO authenticator

[bitgamma]

We could implement, as a separate applet, a FIDO U2F authenticator. Ideally, if the formats are compatible, one would be able to use one of the derived keys as identity for authentification.

[guylouis]

I agree this would be a very natural extra feature of the card. And quite easy to add. Are there any good open source implementation for this ?

I wouldn't either put it on top priority of the to-do-list, unless we identify some usages of U2F linked with adoption of ethereum, dapps, and wallet space. What do you think ?

[bitgamma]

There are open source implementations, but I want to explore the possibility of not using separate identity keys for FIDO and instead integrate it with our key tree (using the non-wallet subtree). Of course this would mean doing our own implementation. I also do not consider this to be top priority for now.

[mulles]

#79 related issue, which I closed now as it is double

[rileyg98]

For something like this, that's kind of outside the scope of this applet. If you're after a FIDO2 compliant spec, you can freely fork my implementation of this (https://github.com/VivoKey/vk-u2f).

[rkreutz]

Hey there. Any plans on supporting this? I'd say even just supporting a very basic implementation with no connection with the main applet keys would already be very helpful and might drive adoption of keycard for other things (not only tied to cryptocurrencies).

[rkreutz]

For future reference, I've managed to use this as an U2F authenticator on my Keycard https://github.com/darconeous/u2f-javacard. Just downloading the CAP from the releases and following the script on the README was enough to have it working on my iOS device.

[willianpaixao]

Hey @bitgamma, any chances to use the above mentioned implementation?

[bitgamma]

we keep the card open so that you can install any applet on it. We might look into preinstalling it in future batches but there is nothing preventing you to install it using the venerable https://github.com/martinpaljak/GlobalPlatformPro. Just make sure you use the correct globalplatform key which is c212e073ff8b4bbfaff4de8ab655221f

[willianpaixao]

I'll try to install it, but my question is whether this feature could be brought as a official/supported Keycard feature.

[lwinch2006]

Do I understand correctly that on production Keycards that are sold via keycard.tech website ENC, MAC and DEC keys are set to c212e073ff8b4bbfaff4de8ab655221f?

[bitgamma]

Do I understand correctly that on production Keycards that are sold via keycard.tech website ENC, MAC and DEC keys are set to c212e073ff8b4bbfaff4de8ab655221f?

those cards are for end users and have random ENC, MAC, DEK keys so are effectively locked. Our development cards have the keys you mentioned. Note however than you can use any compatible card (for example JCOP4) and install Keycard on it

[guylouis]

we will soon sell our development card on keycard.tech to help anyone who want to develop on javacard, but in the meanwhile if you need one you can just get in touch with us
for instance you can reach us here: get@keycard.tech

[lwinch2006]

@guylouis
Thank you for this offer.
At home I have quite a few J3R180 that support JC 3.0.5 that I suppose will suit for compiling and installation of keycard applet from source.
I just have got some misunderstanding and thought that you use that constant key on production cards.
Or otherwise I have pre-ordered Keycard Shell and looking forward to get that beauty. 😍

[lwinch2006]

@guylouis
FYI. There are wrong applets AID in compiled (at least latest) CAP file in Releases and in build.gradle file in the repository. (See attached picture)
Because of this keycard applet is not found and card is not recognized as Keycard.