This repository contains sources for a FIDO2 CTAP2.1 compatible(-ish) applet targeting the Javacard Classic system, version 3.0.4. In a nutshell, this lets you take a smartcard, install an app onto it, and have it work as a FIDO2 authenticator device with a variety of features. You can generate and use OpenSSH ecdsa-sk type keys, including ones you carry with you on the key (-O resident). You can securely unlock a LUKS encrypted disk with systemd-cryptenroll. You can log in to a Linux system locally with pam-u2f.

This applet does not presently implement U2F support, for valid reasons. Note that pam-u2f, despite its name, actually uses libfido2 and will work fine.

In order to run this, you will need a compatible smartcard. Some smartcards which describe themselves as running Javacard 3.0.1 also work - see the detailed requirements.

You might be interested in reading about the security model.

You'll need to get a copy of:

• com.licel.jcardsim-3.0.5
• JavacardKit, version 3.0.4 (jckit_304): you can build with jckit_303 if you prefer

Drop the jcardsim jar into the root of the repository. Set the environment variable JC_HOME to point to your jckit folder.

Run ./gradlew buildJavaCard, which will produce a .cap file for installation.

While you can test on an actual smartcard, I prefer to use VSmartCard and run JCardSim connected to that. There are a few example JCardSim unit tests in the repository, but you'll get much better analysis of the behaviour by using real applications or other testing suites like SoloKey's fido2-tests, which you can run against the simulated application.

The VSim class might get you started.

If you want to, feel free!

I suggest reading the FAQ and perhaps the security model.