This is a cross-platform library for directly interacting with Security Key-type devices via Rust.
- Supported Platforms: FreeBSD, Linux, macOS1, NetBSD, OpenBSD, and Windows2.
- Supported Transports: USB HID.
- Supported Protocols: FIDO CTAP1 (U2F), CTAP 2.0, CTAP 2.1-PRE, CTAP 2.1.
This library is primarily intended for use by Firefox on platforms that do not provide WebAuthn APIs (as there are on Android, iOS, macOS and Windows). It implements a subset of the CTAP protocol that is useful for a web browser.
This library currently focuses on USB security keys, but is expected to be extended to support additional transports.
Proper usage should be to call into this library from something else - e.g., Firefox.
The ctap2 example will register and sign a non-discoverable credential
with a USB CTAP1 or CTAP2 authenticator, in a similar manner to a web browser that supports the
WebAuthn API:
cargo build --example ctap2
RUST_LOG=debug cargo run --example ctap2There are more examples in the examples directory.
The RUST_LOG environment variable controls logging.
There are some tests of the cross-platform runloop logic and the protocol decoder:
cargo testThere are fuzzers for the USB protocol reader, basically fuzzing inputs from the HID layer. There are not (yet) fuzzers for the C API used by callers (such as Gecko).
To fuzz, you will need cargo-fuzz (the latest version from GitHub) as well as Rust Nightly.
rustup install nightly
cargo install cargo-fuzz
cargo +nightly fuzz run u2f_read -- -max_len=512
cargo +nightly fuzz run u2f_read_write -- -max_len=512Footnotes
-
macOS has its own platform WebAuthn API (which also supports iCloud Keychain), but still allows direct, transport level communication with authenticators. ↩
-
Windows 10 v1903 and later block direct, transport level access to authenticators to applications not running as Administrator, breaking this library for most applications. Applications will need to use the platform APIs instead. ↩