This is the base for a U2F compliant receiver for CrySIL. It needs to be extended to build an actual receiver for CrySIL.
This receiver expects one of two forms of requests:
- Messages containing proper CrySIL commands, e.g. when converted beforehand by a U2F client containing a CrySIL bridge (e.g. Windows credential provider or Chrome extension). These requests are simply forwarded to the connected module.
- Proper U2F commands for registration and authentication, e.g. send directly by a U2F relying party. These commands are converted accordingly.
A U2F registration commands looks like this:
{
"appId": "https://example.com",
"version": "U2F_V2",
"challenge": <32-byte-random>
}
That single U2F command is converted into two CrySIL commands, one to generate a wrapped U2F/ECC key, and one to calculate the signature:
payload = {
"type" : "generateU2FKeyRequest",
"certificateSubject" : "CN=CrySIL",
"appParam" : <appParam>,
"clientParam" : <clientParam>,
"encodedRandom" : NULL
}
payload = {
"type" : "signRequest",
"algorithm" : "SHA256withECDSA",
"hashesToBeSigned" : [
<appParam,clientParam,keyHandle,publicKey>
],
"signatureKey" : {
"type" : "wrappedKey",
"encodedWrappedKey" : <wrappedU2FKey>
}
}
A U2F authentication command looks like this:
{
"appId": "https://example.com",
"version": "U2F_V2",
"challenge": <32-byte-random>,
"keyHandle": <keyhandle>
}
That single U2F command is converted into two CrySIL commands, one to generate a wrapped U2F/ECC key, and one to calculate the signature:
payload = {
"type" : "generateU2FKeyRequest",
"certificateSubject" : "CN=CrySIL",
"appParam" : <appParam>,
"clientParam" : NULL,
"encodedRandom" : <keyhandle>
}
payload = {
"type" : "signRequest",
"algorithm" : "SHA256withECDSA",
"hashesToBeSigned" : [
<appParam,counter,clientParam>
],
"signatureKey" : {
"type" : "wrappedKey",
"encodedWrappedKey" : <wrappedU2FKey>
}
}
The counter needed to calculate the signature is managed by the actor (may be stored securely). it is passed in a special header with type u2fheader
and inserted by the receiver into signature input.