From 8b29e901d5dc1a623a5989d47e91c984f4c2088d Mon Sep 17 00:00:00 2001 From: hkdb Date: Sun, 6 Sep 2026 19:24:15 -0700 Subject: [PATCH] v0.1.3 --- CHANGELOG.md | 6 ++++++ README.md | 16 +++++++++++++++- go.mod | 2 +- go.sum | 3 +++ hardware/chalresp/README.md | 3 +++ hardware/chalresp/chalresp.go | 7 ++++++- hardware/chalresp/chalresp_mobile.go | 6 ++++-- hardware/fido2/fido2.go | 2 +- hardware/fido2/fido2_mobile.go | 6 ++++-- 9 files changed, 43 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2fa081c..76ae728 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,12 @@ # CHANGELOG +**v0.1.3 - 09-07-2026** + +- Bumped go-libfido2 +- Added build tags for hardware keys opt-out + + **v0.1.2 - 09-07-2026** - Passphrases and ChalResp hardening diff --git a/README.md b/README.md index c315e75..96507d1 100644 --- a/README.md +++ b/README.md @@ -63,6 +63,14 @@ A Go library providing post-quantum ready encryption, signing, key management, a --- - Go 1.26.6+ +- **Hardware-key support is optional and can be switched off at build time.** `hardware/chalresp` (YubiKey) and + `hardware/fido2` (FIDO2/WebAuthn) pull in the cgo C libraries listed below. If you use icfx only for encryption, + build with **`-tags nohw`** to stub them out — no cgo, no C libraries required: + ``` + CGO_ENABLED=0 go build -tags nohw ./... + ``` + (On macOS the OS keychain still uses the system Security.framework; use file-based key storage for a fully + cgo-free build there.) - OS keychain (optional — falls back to file-based storage) - libykpers-1 (optional — required only if you import `hardware/chalresp` for hardware-key support) - Linux (Debian/Ubuntu): `sudo apt install libykpers-1-dev` @@ -75,7 +83,13 @@ A Go library providing post-quantum ready encryption, signing, key management, a - Linux (Debian/Ubuntu): `sudo apt install libfido2-dev` - Linux (Arch): `sudo pacman -S libfido2` - Linux (Fedora): `sudo dnf install libfido2-devel` - - macOS: `brew install libfido2` + - macOS: `brew install pkg-config libfido2 openssl@3` — go-libfido2 links openssl statically, so export the + keg-only paths so cgo can find them: + ``` + export PKG_CONFIG_PATH="$(brew --prefix openssl@3)/lib/pkgconfig:$PKG_CONFIG_PATH" + export CGO_CFLAGS="-I$(brew --prefix openssl@3)/include" + export CGO_LDFLAGS="-L$(brew --prefix openssl@3)/lib" + ``` - Windows: install libfido2; link via mingw or vcpkg [ykpers-win]: https://developers.yubico.com/yubikey-personalization/Releases/ diff --git a/go.mod b/go.mod index 1700346..2ae1752 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/fxamacker/cbor/v2 v2.9.2 github.com/google/uuid v1.6.0 github.com/keybase/go-keychain v0.0.1 - github.com/keys-pub/go-libfido2 v1.5.3 + github.com/keys-pub/go-libfido2 v1.5.4-0.20251021061633-bf2d0535e75c github.com/makiuchi-d/gozxing v0.1.1 github.com/pquerna/otp v1.5.0 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e diff --git a/go.sum b/go.sum index 1496dba..34d8bc4 100644 --- a/go.sum +++ b/go.sum @@ -35,6 +35,8 @@ github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRt github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/keys-pub/go-libfido2 v1.5.3 h1:vtgHxlSB43u6lj0TSuA3VvT6z3E7VI+L1a2hvMFdECk= github.com/keys-pub/go-libfido2 v1.5.3/go.mod h1:P0V19qHwJNY0htZwZDe9Ilvs/nokGhdFX7faKFyZ6+U= +github.com/keys-pub/go-libfido2 v1.5.4-0.20251021061633-bf2d0535e75c h1:KqxSEYvMTbdiv7KvnXMl83kfGBWfkcOr7jt+cRhwzlc= +github.com/keys-pub/go-libfido2 v1.5.4-0.20251021061633-bf2d0535e75c/go.mod h1:92J9LtSBl0UyUWljElJpTbMMNhC6VeY8dshsu40qjjo= github.com/makiuchi-d/gozxing v0.1.1 h1:xxqijhoedi+/lZlhINteGbywIrewVdVv2wl9r5O9S1I= github.com/makiuchi-d/gozxing v0.1.1/go.mod h1:eRIHbOjX7QWxLIDJoQuMLhuXg9LAuw6znsUtRkNw9DU= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -67,5 +69,6 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1N golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/hardware/chalresp/README.md b/hardware/chalresp/README.md index cc2053b..51365a1 100644 --- a/hardware/chalresp/README.md +++ b/hardware/chalresp/README.md @@ -24,6 +24,9 @@ can use it. The `#cgo pkg-config: ykpers-1` directive in `chalresp.go` resolves the include path and link flags from there. +**Don't need hardware keys?** Build the whole module with `-tags nohw` (see the top-level README) to compile the +pure-Go stub instead — then libykpers-1 is not required and cgo can be disabled entirely. + ## Single-device today `chalresp.List()` opens via libykpers' `yk_open_first_key`, which picks the diff --git a/hardware/chalresp/chalresp.go b/hardware/chalresp/chalresp.go index 740b803..bd93491 100644 --- a/hardware/chalresp/chalresp.go +++ b/hardware/chalresp/chalresp.go @@ -1,4 +1,4 @@ -//go:build !android && !ios +//go:build !android && !ios && !nohw // Package chalresp performs HMAC-SHA1 challenge-response against the OTP // slot 2 of a Yubikey (or compatible: NitroKey Pro/Storage, OnlyKey). @@ -56,6 +56,11 @@ var ( ErrTouchTimeout = errors.New("chalresp: timeout waiting for device touch") // ErrNoDevice is returned when no compatible hardware key is detected. ErrNoDevice = errors.New("chalresp: no compatible hardware key detected") + // ErrNotSupported mirrors the stub build's symbol so callers can reference + // chalresp.ErrNotSupported in ANY build (cgo desktop, mobile, or -tags nohw). + // The desktop cgo path never returns it (hardware IS supported here); the + // mobile/nohw stub returns it from every operation. + ErrNotSupported = errors.New("chalresp: hardware key challenge-response is not supported in this build") ) var ( diff --git a/hardware/chalresp/chalresp_mobile.go b/hardware/chalresp/chalresp_mobile.go index 23cf465..4ee9224 100644 --- a/hardware/chalresp/chalresp_mobile.go +++ b/hardware/chalresp/chalresp_mobile.go @@ -1,6 +1,8 @@ -//go:build android || ios +//go:build android || ios || nohw -// Package chalresp's mobile stub. The desktop implementation +// Package chalresp's no-hardware stub — used on mobile (android/ios) AND on +// desktop when built with `-tags nohw` (encryption-only consumers who don't +// want the libykpers-1 cgo dependency). The desktop implementation // (chalresp.go) wraps libykpers via CGO, which is desktop-only — Android // and iOS can't link against ykpers-1. On mobile, ic-app's keystore // dispatch rejects HW-protected identities before any caller here is diff --git a/hardware/fido2/fido2.go b/hardware/fido2/fido2.go index 4e131a9..63ebf77 100644 --- a/hardware/fido2/fido2.go +++ b/hardware/fido2/fido2.go @@ -1,4 +1,4 @@ -//go:build !android && !ios +//go:build !android && !ios && !nohw // Package fido2 drives a physical FIDO2 security key through the client half // of the WebAuthn ceremonies (registration attestation + login assertion), diff --git a/hardware/fido2/fido2_mobile.go b/hardware/fido2/fido2_mobile.go index bdc4f9b..70b4625 100644 --- a/hardware/fido2/fido2_mobile.go +++ b/hardware/fido2/fido2_mobile.go @@ -1,6 +1,8 @@ -//go:build android || ios +//go:build android || ios || nohw -// Mobile stub: libfido2 (CGO, USB HID) is desktop-only. Mobile hardware-key +// No-hardware stub: used on mobile (android/ios) AND on desktop with +// `-tags nohw` (encryption-only consumers who don't want the libfido2 cgo +// dependency). libfido2 (CGO, USB HID) is desktop-only. Mobile hardware-key // support means platform passkey APIs (Play Services FIDO2 / ASAuthorization) // — a separate integration, deferred. package fido2