Softfido

Softfido is a software implementation of a FIDO2/U2F authenticator. Most FIDO2 authenticators are based on hardware like USB sticks or TPM-like chips in smartphones. Softfido instead implements a virtual USB device (via USBIP) so that webbrowsers can talk to it.

The cryptographic operations are delegated to SoftHSM. In theory other PKCS11 modules could be used, but I only tested with SoftHSM.

Build

cargo build

Some USBIP related kernel headers must be installed during the build.

Use

Set up SoftHSM

Create a SoftHSM token with the following command:

softhsm2-util --init-token --free --label softfido

Start Softfido

softfido --token-label softfido

This should print something like

softfido::crypto: Generating secret key...
softfido::crypto: Generating token counter...
Softfido server running.

You may need to specify the --pkcs11-module argument if libsofthsm2.so is not installed in /usr/lib/softhsm/libsofthsm2.so.

Kernel module

Insert the vhci-hcd module with: modprobe vhci-hcd

Connect the kernel module to the server: usbip attach -r 127.0.0.1 -d 1-1

After that lsusb -d 0:0 -v should describe the virtual USB device. ls -l /sys/class/hidraw/ should also list a link to a vhci_hcd device.

Device permissions

To allow non-root users to open the virtual hidraw device, its permissions must be setup accordingly. This can be done manually with chmod or with an udev rule like so:

SUBSYSTEM=="hidraw", ATTRS{manufacturer}=="Fakecompany", \
,ATTRS{product}=="Softproduct", TAG+="uaccess", GROUP="plugdev", MODE="0660"

Testing

The python/ directory contains some (interactive) tests. You can run them with python3 softfido_tests.py. The tests require the fido2 Python module.

Test in browser

You can test the authenticator on Yubico's test page or webauthn.io.

At the time of writing, Firefox supports U2F but not FIDO2. Chromium supports both. In my experience, the only website that uses FIDO2 when available is github.com; all others use U2F even if the device and the browser would support FIDO2.

Webauthn with a TPM

Some time after I had started Softfido, I found James Bottomley's Webauthn on TPM project. He describes the technical issues pretty well. He uses the HID Gadget machinery, which would probably have been a bit easier than USBIP. OTOH, with USBIP the authenticator can run on a different machine than the kernel module which is useful to sidestep kernel bugs. During development I had a few kernel crashes/lockups. After debugging my code, the only kernel related issue that I'm aware off is that the kernel cannot properly hibernate as long as the virtual device is connected. Removing the kernel module rmmod vhci-hcd before hibernating is advisable.

Caution

Softfido is just a hobby project of mine to learn a bit about Rust, USB, FIDO2, and cryptography. The code is potentially insecure. Use it at your own risk.