xref: /freebsd/contrib/libfido2/examples/README.adoc (revision 60a517b66a69b8c011b04063ef63a938738719bd)
10afa8e06SEd Maste= Examples
20afa8e06SEd Maste
30afa8e06SEd Maste=== Definitions
40afa8e06SEd Maste
50afa8e06SEd MasteThe following definitions are used in the description below:
60afa8e06SEd Maste
70afa8e06SEd Maste- <device>
80afa8e06SEd Maste
90afa8e06SEd Maste	The file system path or subsystem-specific identification string of a
100afa8e06SEd Maste	FIDO device.
110afa8e06SEd Maste
120afa8e06SEd Maste- <pin>, [oldpin]
130afa8e06SEd Maste
140afa8e06SEd Maste	Strings passed directly in the executed command's argument vector.
150afa8e06SEd Maste
160afa8e06SEd Maste- <cred_id>
170afa8e06SEd Maste
180afa8e06SEd Maste	The file system path of a file containing a FIDO credential ID in
190afa8e06SEd Maste	binary representation.
200afa8e06SEd Maste
210afa8e06SEd Maste- <pubkey>
220afa8e06SEd Maste
232ccfa855SEd Maste	The file system path of a file containing a public key in PEM format.
240afa8e06SEd Maste
250afa8e06SEd Maste- <blobkey>
260afa8e06SEd Maste
273e696dfbSEd Maste	A credential's associated CTAP 2.1 "largeBlob" symmetric key.
280afa8e06SEd Maste
290afa8e06SEd Maste=== Description
300afa8e06SEd Maste
310afa8e06SEd MasteThe following examples are provided:
320afa8e06SEd Maste
330afa8e06SEd Maste- manifest
340afa8e06SEd Maste
350afa8e06SEd Maste	Prints a list of configured FIDO devices.
360afa8e06SEd Maste
370afa8e06SEd Maste- info <device>
380afa8e06SEd Maste
390afa8e06SEd Maste	Prints information about <device>.
400afa8e06SEd Maste
410afa8e06SEd Maste- reset <device>
420afa8e06SEd Maste
430afa8e06SEd Maste	Performs a factory reset on <device>.
440afa8e06SEd Maste
450afa8e06SEd Maste- setpin <pin> [oldpin] <device>
460afa8e06SEd Maste
470afa8e06SEd Maste	Configures <pin> as the new PIN of <device>. If [oldpin] is provided,
480afa8e06SEd Maste	the device's PIN is changed from [oldpin] to <pin>.
490afa8e06SEd Maste
502ccfa855SEd Maste- cred [-t es256|es384|rs256|eddsa] [-k pubkey] [-ei cred_id] [-P pin]
51*60a517b6SEd Maste       [-T seconds] [-b blobkey] [-hruv] [-c cred_protect] <device>
520afa8e06SEd Maste
530afa8e06SEd Maste	Creates a new credential on <device> and verify that the credential
540afa8e06SEd Maste	was signed by the authenticator. The device's attestation certificate
550afa8e06SEd Maste	is not verified. If option -k is specified, the credential's public
560afa8e06SEd Maste	key is stored in <pubkey>. If option -i is specified, the credential
570afa8e06SEd Maste	ID is stored in <cred_id>. The -e option may be used to add <cred_id>
580afa8e06SEd Maste	to the list of excluded credentials. If option -h is specified,
590afa8e06SEd Maste	the hmac-secret FIDO2 extension is enabled on the generated
600afa8e06SEd Maste	credential. If option -r is specified, the generated credential
610afa8e06SEd Maste	will involve a resident key. User verification may be requested
620afa8e06SEd Maste	through the -v option. If option -u is specified, the credential
630afa8e06SEd Maste	is generated using U2F (CTAP1) instead of FIDO2 (CTAP2) commands.
640afa8e06SEd Maste	The -T option may be used to enforce a timeout of <seconds>. If the
650afa8e06SEd Maste	option -b is specified, the credential's "largeBlob" key is stored in
66*60a517b6SEd Maste	<blobkey>. If the option -c is specified the the generated credential
67*60a517b6SEd Maste	will be bound by the specified protection policy.
680afa8e06SEd Maste
692ccfa855SEd Maste- assert [-t es256|es384|rs256|eddsa] [-a cred_id] [-h hmac_secret] [-P pin]
702ccfa855SEd Maste         [-s hmac_salt] [-T seconds] [-b blobkey] [-puv] <pubkey> <device>
710afa8e06SEd Maste
720afa8e06SEd Maste	Asks <device> for a FIDO2 assertion corresponding to [cred_id],
730afa8e06SEd Maste	which may be omitted for resident keys. The obtained assertion
740afa8e06SEd Maste	is verified using <pubkey>. The -p option requests that the user
752ccfa855SEd Maste	be present and checks whether the user presence bit was signed by the
762ccfa855SEd Maste	authenticator. The -v option requests user verification and checks
772ccfa855SEd Maste	whether the user verification bit was signed by the authenticator.
782ccfa855SEd Maste	If option -u is specified, the assertion is generated using
790afa8e06SEd Maste	U2F (CTAP1) instead of FIDO2 (CTAP2) commands. If option -s is
800afa8e06SEd Maste	specified, a FIDO2 hmac-secret is requested from the authenticator,
810afa8e06SEd Maste	and the contents of <hmac_salt> are used as the salt. If option -h
820afa8e06SEd Maste	is specified, the resulting hmac-secret is stored in <hmac_secret>.
830afa8e06SEd Maste	The -T option may be used to enforce a timeout of <seconds>. If the
840afa8e06SEd Maste	option -b specified, the credential's "largeBlob" key is stored in
850afa8e06SEd Maste	<blobkey>.
860afa8e06SEd Maste
870afa8e06SEd Maste- retries <device>
880afa8e06SEd Maste	Get the number of PIN attempts left on <device> before lockout.
890afa8e06SEd Maste
900afa8e06SEd Maste- select
910afa8e06SEd Maste
920afa8e06SEd Maste	Enumerates available FIDO devices and, if more than one is present,
930afa8e06SEd Maste	simultaneously requests touch on all of them, printing information
940afa8e06SEd Maste	about the device touched.
950afa8e06SEd Maste
960afa8e06SEd MasteDebugging is possible through the use of the FIDO_DEBUG environment variable.
970afa8e06SEd MasteIf set, libfido2 will produce a log of its transactions with the authenticator.
980afa8e06SEd Maste
990afa8e06SEd MasteAdditionally, an example of a WebAuthn client using libfido2 is available at
1000afa8e06SEd Mastehttps://github.com/martelletto/fido2-webauthn-client.
101