Authen::U2F(3pm)

💖 Authen::U2F 💖

okay so bestie, meet Authen-U2F — a FIDO U2F library, and she is literally here to make your app do the cool key-tap security thing ✨ (she lives in the 3pm section of your manuals, she's a whole Perl module, she's iconic, no notes).

---

🎀 SYNOPSIS

use Authen::U2F qw(
  u2f_challenge
  u2f_registration_verify
  u2f_signature_verify);

# Create a challenge to send to the U2F host
my $challenge = u2f_challenge;

# Process a registration response from the U2F host
my ($key_handle, $key) = u2f_registration_verify(
  challenge         => $challenge,
  app_id            => $app_id,
  origin            => $origin,
  registration_data => $registration_data,
  client_data       => $client_data,
);

# Process a signing (authentication) response from the U2F host
u2f_signature_verify(
  challenge      => $challenge,
  app_id         => $app_id,
  origin         => $origin,
  key_handle     => $key_handle,
  key            => $key,
  signature_data => $signature_data,
  client_data    => $client_data,
);

# Or, if you don't like to clutter up your namespace
my $challenge = Authen::U2F->challenge;
my ($key_handle, $key) = Authen::U2F->registration_verify(...);
Authen::U2F->signature_verify(...);

like, look at her go 🫶 two whole interfaces, zero drama.

---

🌸 DESCRIPTION

This module hands you the tools you need to add U2F support to your application. that's the whole job, she does it well 💅

She does expect you to already know the basics of U2F though. If you need a refresher, the lore lives at Yubico (https://www.yubico.com/about/background/fido/) and FIDO (https://fidoalliance.org/specifications/overview/) ✨

Now the important bit — and this is not a vibe, it's a fact — this module does not handle the wire encoding of U2F challenges and responses, because that encoding is different depending on which U2F host you're using and the style of your application. nope, not her job, not her problem 🙈 but don't worry, in the examples dir there are scripts that implement the 1.0 wire format, the one used by Yubico's libu2f-host (https://developers.yubico.com/libu2f-host/), plus a Plack application that works with Google's JavaScript module (https://github.com/google/u2f-ref-code/blob/master/u2f-gae-demo/war/js/u2f-api.js). slay 🎀

and ngl, the documentation around U2F is rather more confusing than it should be, and this short description is probably not making things better 😭 so please improve this, or write something about U2F, so we can improve application security everywhere. do it for the girls, do it for the internet 🫶

---

✨ FUNCTIONS ✨

There are three functions, bestie: one for generating challenges for the host to sign, and one each for processing the responses from the two types of signing requests U2F supports. it's giving minimalism, it's giving range 👑

There's a straight function interface and a class method interface. Both do exactly the same thing — which one you reach for just depends on how much verbosity you like vs. how much namespace clutter you like 🦋 Only the functional interface gets mentioned in this section; the SYNOPSIS has the class-method details.

🌟 u2f_challenge

my $challenge = u2f_challenge;

Creates a challenge. A challenge is 256 cryptographically-secure random bits. that's it, that's the function, she's short and she's perfect ⭐

🌟 u2f_registration_verify

Verify a registration response from the host against the challenge. If the verification is successful, you get back the key handle and public key of the device that signed the challenge. If it fails, this function croaks with an error 💀

Takes the following options, all required:

• challenge — The challenge originally given to the host.
• app_id — The application ID.
• origin — The browser location origin. This is typically the same as the application ID.
• registration_data — The registration data blob from the host.
• client_data — The client data blob from the host.

🌟 u2f_signature_verify

Verify a signature (authentication) response from the host against the challenge. If the verification is successful, the user has presented a valid device and is now authenticated 🎉 If the verification fails, this function croaks with an error 💀

Takes the following options, all required.

• challenge — The challenge originally given to the host.
• app_id — The application ID.
• origin — The browser location origin. This is typically the same as the application ID.
• key_handle — The handle of the key that was used to sign the challenge.
• key — The stored public key associated with the handle.
• signature_data — The signature data blob from the host.
• client_data — The client data blob from the host.

---

🫶 SUPPORT

🐛 Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/robn/Authen-U2F/issues. You will be notified automatically of any progress on your issue. we love a notification, we love being kept in the loop 💜

📦 Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/robn/Authen-U2F

git clone https://github.com/robn/Authen-U2F.git

go on, clone her, she's yours now ✨

---

👑 AUTHORS

• Robert Norris <rob@eatenbyagrue.org>

---

📜 COPYRIGHT AND LICENSE

This software is copyright (c) 2016 by Robert Norris.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. periodt 💅

---

and that's the whole page, bestie!! this gem was brought to you by perl v5.36.0, dated 2022-12-12, and she ate every single time 🎀✨ bye mwah 💖