10afa8e06SEd Maste= Examples 20afa8e06SEd Maste 30afa8e06SEd Maste=== Definitions 40afa8e06SEd Maste 50afa8e06SEd MasteThe following definitions are used in the description below: 60afa8e06SEd Maste 70afa8e06SEd Maste- <device> 80afa8e06SEd Maste 90afa8e06SEd Maste The file system path or subsystem-specific identification string of a 100afa8e06SEd Maste FIDO device. 110afa8e06SEd Maste 120afa8e06SEd Maste- <pin>, [oldpin] 130afa8e06SEd Maste 140afa8e06SEd Maste Strings passed directly in the executed command's argument vector. 150afa8e06SEd Maste 160afa8e06SEd Maste- <cred_id> 170afa8e06SEd Maste 180afa8e06SEd Maste The file system path of a file containing a FIDO credential ID in 190afa8e06SEd Maste binary representation. 200afa8e06SEd Maste 210afa8e06SEd Maste- <pubkey> 220afa8e06SEd Maste 232ccfa855SEd Maste The file system path of a file containing a public key in PEM format. 240afa8e06SEd Maste 250afa8e06SEd Maste- <blobkey> 260afa8e06SEd Maste 273e696dfbSEd Maste A credential's associated CTAP 2.1 "largeBlob" symmetric key. 280afa8e06SEd Maste 290afa8e06SEd Maste=== Description 300afa8e06SEd Maste 310afa8e06SEd MasteThe following examples are provided: 320afa8e06SEd Maste 330afa8e06SEd Maste- manifest 340afa8e06SEd Maste 350afa8e06SEd Maste Prints a list of configured FIDO devices. 360afa8e06SEd Maste 370afa8e06SEd Maste- info <device> 380afa8e06SEd Maste 390afa8e06SEd Maste Prints information about <device>. 400afa8e06SEd Maste 410afa8e06SEd Maste- reset <device> 420afa8e06SEd Maste 430afa8e06SEd Maste Performs a factory reset on <device>. 440afa8e06SEd Maste 450afa8e06SEd Maste- setpin <pin> [oldpin] <device> 460afa8e06SEd Maste 470afa8e06SEd Maste Configures <pin> as the new PIN of <device>. If [oldpin] is provided, 480afa8e06SEd Maste the device's PIN is changed from [oldpin] to <pin>. 490afa8e06SEd Maste 502ccfa855SEd Maste- cred [-t es256|es384|rs256|eddsa] [-k pubkey] [-ei cred_id] [-P pin] 51*60a517b6SEd Maste [-T seconds] [-b blobkey] [-hruv] [-c cred_protect] <device> 520afa8e06SEd Maste 530afa8e06SEd Maste Creates a new credential on <device> and verify that the credential 540afa8e06SEd Maste was signed by the authenticator. The device's attestation certificate 550afa8e06SEd Maste is not verified. If option -k is specified, the credential's public 560afa8e06SEd Maste key is stored in <pubkey>. If option -i is specified, the credential 570afa8e06SEd Maste ID is stored in <cred_id>. The -e option may be used to add <cred_id> 580afa8e06SEd Maste to the list of excluded credentials. If option -h is specified, 590afa8e06SEd Maste the hmac-secret FIDO2 extension is enabled on the generated 600afa8e06SEd Maste credential. If option -r is specified, the generated credential 610afa8e06SEd Maste will involve a resident key. User verification may be requested 620afa8e06SEd Maste through the -v option. If option -u is specified, the credential 630afa8e06SEd Maste is generated using U2F (CTAP1) instead of FIDO2 (CTAP2) commands. 640afa8e06SEd Maste The -T option may be used to enforce a timeout of <seconds>. If the 650afa8e06SEd Maste option -b is specified, the credential's "largeBlob" key is stored in 66*60a517b6SEd Maste <blobkey>. If the option -c is specified the the generated credential 67*60a517b6SEd Maste will be bound by the specified protection policy. 680afa8e06SEd Maste 692ccfa855SEd Maste- assert [-t es256|es384|rs256|eddsa] [-a cred_id] [-h hmac_secret] [-P pin] 702ccfa855SEd Maste [-s hmac_salt] [-T seconds] [-b blobkey] [-puv] <pubkey> <device> 710afa8e06SEd Maste 720afa8e06SEd Maste Asks <device> for a FIDO2 assertion corresponding to [cred_id], 730afa8e06SEd Maste which may be omitted for resident keys. The obtained assertion 740afa8e06SEd Maste is verified using <pubkey>. The -p option requests that the user 752ccfa855SEd Maste be present and checks whether the user presence bit was signed by the 762ccfa855SEd Maste authenticator. The -v option requests user verification and checks 772ccfa855SEd Maste whether the user verification bit was signed by the authenticator. 782ccfa855SEd Maste If option -u is specified, the assertion is generated using 790afa8e06SEd Maste U2F (CTAP1) instead of FIDO2 (CTAP2) commands. If option -s is 800afa8e06SEd Maste specified, a FIDO2 hmac-secret is requested from the authenticator, 810afa8e06SEd Maste and the contents of <hmac_salt> are used as the salt. If option -h 820afa8e06SEd Maste is specified, the resulting hmac-secret is stored in <hmac_secret>. 830afa8e06SEd Maste The -T option may be used to enforce a timeout of <seconds>. If the 840afa8e06SEd Maste option -b specified, the credential's "largeBlob" key is stored in 850afa8e06SEd Maste <blobkey>. 860afa8e06SEd Maste 870afa8e06SEd Maste- retries <device> 880afa8e06SEd Maste Get the number of PIN attempts left on <device> before lockout. 890afa8e06SEd Maste 900afa8e06SEd Maste- select 910afa8e06SEd Maste 920afa8e06SEd Maste Enumerates available FIDO devices and, if more than one is present, 930afa8e06SEd Maste simultaneously requests touch on all of them, printing information 940afa8e06SEd Maste about the device touched. 950afa8e06SEd Maste 960afa8e06SEd MasteDebugging is possible through the use of the FIDO_DEBUG environment variable. 970afa8e06SEd MasteIf set, libfido2 will produce a log of its transactions with the authenticator. 980afa8e06SEd Maste 990afa8e06SEd MasteAdditionally, an example of a WebAuthn client using libfido2 is available at 1000afa8e06SEd Mastehttps://github.com/martelletto/fido2-webauthn-client. 101