/ 
Authen-U2F-0.003
River stage one • 1 direct dependent • 2 total dependents
/ Authen::U2F

NAME

Authen-U2F - FIDO U2F library

SYNOPSIS

use Authen::U2F qw(
  u2f_challenge
  u2f_registration_verify
  u2f_signature_verify);

# Create a challenge to send to the U2F host
my $challenge = u2f_challenge;

# Process a registration response from the U2F host
my ($key_handle, $key) = u2f_registration_verify(
  challenge         => $challenge,
  app_id            => $app_id,
  origin            => $origin,
  registration_data => $registration_data,
  client_data       => $client_data,
);

# Process a signing (authentication) response from the U2F host
u2f_signature_verify(
  challenge      => $challenge,
  app_id         => $app_id,
  origin         => $origin,
  key_handle     => $key_handle,
  key            => $key,
  signature_data => $signature_data,
  client_data    => $client_data,
);

# Or, if you don't like to clutter up your namespace
my $challenge = Authen::U2F->challenge;
my ($key_handle, $key) = Authen::U2F->registration_verify(...);
Authen::U2F->signature_verify(...);

DESCRIPTION

This module provides the tools you need to add support for U2F in your application.

It's expected that you know the basics of U2F. More information about this can be found at Yubico and FIDO.

This module does not handle the wire encoding of U2F challenges and response, as these are different depending on the U2F host you're using and the style of your application. In the examples dir there are scripts that implement the 1.0 wire format, used by Yubico's libu2f-host, and a Plack application that works with Google's JavaScript module.

Sadly, the documentation around U2F is rather more confusing than it should be, and this short description is probably not making things better. Please improve this or write something about U2F so we can improve application security everywhere.

FUNCTIONS

There are three functions: One for generating challenges for the host to sign, and one for processing the responses from the two types of signing requests U2F supports.

There's straight function interface and a class method interface. Both do exactly the same thing; which you use depends onhow much verbosity you like vs how much namespace clutter you like. Only the functional interface is mentioned in this section; see the SYNOPSIS for the details.

u2f_challenge

my $challenge = u2f_challenge;

Creates a challenge. A challenge is 256 cryptographically-secure random bits.

u2f_registration_verify

Verify a registration response from the host against the challenge. If the verification is successful, returns the key handle and public key of the device that signed the challenge. If it fails, this function croaks with an error.

Takes the following options, all required:

challenge

The challenge originally given to the host.

app_id

The application ID.

origin

The browser location origin. This is typically the same as the application ID.

registration_data

The registration data blob from the host.

client_data

The client data blob from the host.

u2f_signature_verify

Verify a signature (authentication) response from the host against the challenge. If the verification is successful, the user has presented a valid device and is now authenticated. If the verification fails, this function croaks with an error.

Takes the following options, all required.

challenge

The challenge originally given to the host.

app_id

The application ID.

origin

The browser location origin. This is typically the same as the application ID.

key_handle

The handle of the key that was used to sign the challenge.

key

The stored public key associated with the handle.

signature_data

The signature data blob from the host.

client_data

The client data blob from the host.

SUPPORT

Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/robn/Authen-U2F/issues. You will be notified automatically of any progress on your issue.

Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/robn/Authen-U2F

git clone https://github.com/robn/Authen-U2F.git

AUTHORS

  • Robert Norris <rob@eatenbyagrue.org>

COPYRIGHT AND LICENSE

This software is copyright (c) 2016 by Robert Norris.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.