hkdb · Sep 7, 2026 · Sep 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,12 @@
 # CHANGELOG
 
 
+**v0.1.3 - 09-07-2026**
+
+- Bumped go-libfido2
+- Added build tags for hardware keys opt-out
+
+
 **v0.1.2 - 09-07-2026**
 
 - Passphrases and ChalResp hardening

diff --git a/README.md b/README.md
@@ -63,6 +63,14 @@ A Go library providing post-quantum ready encryption, signing, key management, a
 ---
 
 - Go 1.26.6+
+- **Hardware-key support is optional and can be switched off at build time.** `hardware/chalresp` (YubiKey) and
+  `hardware/fido2` (FIDO2/WebAuthn) pull in the cgo C libraries listed below. If you use icfx only for encryption,
+  build with **`-tags nohw`** to stub them out — no cgo, no C libraries required:
+  ```
+  CGO_ENABLED=0 go build -tags nohw ./...
+  ```
+  (On macOS the OS keychain still uses the system Security.framework; use file-based key storage for a fully
+  cgo-free build there.)
 - OS keychain (optional — falls back to file-based storage)
 - libykpers-1 (optional — required only if you import `hardware/chalresp` for hardware-key support)
   - Linux (Debian/Ubuntu): `sudo apt install libykpers-1-dev`
@@ -75,7 +83,13 @@ A Go library providing post-quantum ready encryption, signing, key management, a
   - Linux (Debian/Ubuntu): `sudo apt install libfido2-dev`
   - Linux (Arch): `sudo pacman -S libfido2`
   - Linux (Fedora): `sudo dnf install libfido2-devel`
-  - macOS: `brew install libfido2`
+  - macOS: `brew install pkg-config libfido2 openssl@3` — go-libfido2 links openssl statically, so export the
+    keg-only paths so cgo can find them:
+    ```
+    export PKG_CONFIG_PATH="$(brew --prefix openssl@3)/lib/pkgconfig:$PKG_CONFIG_PATH"
+    export CGO_CFLAGS="-I$(brew --prefix openssl@3)/include"
+    export CGO_LDFLAGS="-L$(brew --prefix openssl@3)/lib"
+    ```
   - Windows: install libfido2; link via mingw or vcpkg
 
 [ykpers-win]: https://developers.yubico.com/yubikey-personalization/Releases/

diff --git a/go.mod b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/fxamacker/cbor/v2 v2.9.2
 	github.com/google/uuid v1.6.0
 	github.com/keybase/go-keychain v0.0.1
-	github.com/keys-pub/go-libfido2 v1.5.3
+	github.com/keys-pub/go-libfido2 v1.5.4-0.20251021061633-bf2d0535e75c
 	github.com/makiuchi-d/gozxing v0.1.1
 	github.com/pquerna/otp v1.5.0
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e

diff --git a/go.sum b/go.sum
@@ -35,6 +35,8 @@ github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRt
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
 github.com/keys-pub/go-libfido2 v1.5.3 h1:vtgHxlSB43u6lj0TSuA3VvT6z3E7VI+L1a2hvMFdECk=
 github.com/keys-pub/go-libfido2 v1.5.3/go.mod h1:P0V19qHwJNY0htZwZDe9Ilvs/nokGhdFX7faKFyZ6+U=
+github.com/keys-pub/go-libfido2 v1.5.4-0.20251021061633-bf2d0535e75c h1:KqxSEYvMTbdiv7KvnXMl83kfGBWfkcOr7jt+cRhwzlc=
+github.com/keys-pub/go-libfido2 v1.5.4-0.20251021061633-bf2d0535e75c/go.mod h1:92J9LtSBl0UyUWljElJpTbMMNhC6VeY8dshsu40qjjo=
 github.com/makiuchi-d/gozxing v0.1.1 h1:xxqijhoedi+/lZlhINteGbywIrewVdVv2wl9r5O9S1I=
 github.com/makiuchi-d/gozxing v0.1.1/go.mod h1:eRIHbOjX7QWxLIDJoQuMLhuXg9LAuw6znsUtRkNw9DU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -67,5 +69,6 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1N
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/hardware/chalresp/README.md b/hardware/chalresp/README.md
@@ -24,6 +24,9 @@ can use it.
 The `#cgo pkg-config: ykpers-1` directive in `chalresp.go` resolves the
 include path and link flags from there.
 
+**Don't need hardware keys?** Build the whole module with `-tags nohw` (see the top-level README) to compile the
+pure-Go stub instead — then libykpers-1 is not required and cgo can be disabled entirely.
+
 ## Single-device today
 
 `chalresp.List()` opens via libykpers' `yk_open_first_key`, which picks the

diff --git a/hardware/chalresp/chalresp.go b/hardware/chalresp/chalresp.go
@@ -1,4 +1,4 @@
-//go:build !android && !ios
+//go:build !android && !ios && !nohw
 
 // Package chalresp performs HMAC-SHA1 challenge-response against the OTP
 // slot 2 of a Yubikey (or compatible: NitroKey Pro/Storage, OnlyKey).
@@ -56,6 +56,11 @@ var (
 	ErrTouchTimeout = errors.New("chalresp: timeout waiting for device touch")
 	// ErrNoDevice is returned when no compatible hardware key is detected.
 	ErrNoDevice = errors.New("chalresp: no compatible hardware key detected")
+	// ErrNotSupported mirrors the stub build's symbol so callers can reference
+	// chalresp.ErrNotSupported in ANY build (cgo desktop, mobile, or -tags nohw).
+	// The desktop cgo path never returns it (hardware IS supported here); the
+	// mobile/nohw stub returns it from every operation.
+	ErrNotSupported = errors.New("chalresp: hardware key challenge-response is not supported in this build")
 )
 
 var (

diff --git a/hardware/chalresp/chalresp_mobile.go b/hardware/chalresp/chalresp_mobile.go
@@ -1,6 +1,8 @@
-//go:build android || ios
+//go:build android || ios || nohw
 
-// Package chalresp's mobile stub. The desktop implementation
+// Package chalresp's no-hardware stub — used on mobile (android/ios) AND on
+// desktop when built with `-tags nohw` (encryption-only consumers who don't
+// want the libykpers-1 cgo dependency). The desktop implementation
 // (chalresp.go) wraps libykpers via CGO, which is desktop-only — Android
 // and iOS can't link against ykpers-1. On mobile, ic-app's keystore
 // dispatch rejects HW-protected identities before any caller here is

diff --git a/hardware/fido2/fido2.go b/hardware/fido2/fido2.go
@@ -1,4 +1,4 @@
-//go:build !android && !ios
+//go:build !android && !ios && !nohw
 
 // Package fido2 drives a physical FIDO2 security key through the client half
 // of the WebAuthn ceremonies (registration attestation + login assertion),

diff --git a/hardware/fido2/fido2_mobile.go b/hardware/fido2/fido2_mobile.go
@@ -1,6 +1,8 @@
-//go:build android || ios
+//go:build android || ios || nohw
 
-// Mobile stub: libfido2 (CGO, USB HID) is desktop-only. Mobile hardware-key
+// No-hardware stub: used on mobile (android/ios) AND on desktop with
+// `-tags nohw` (encryption-only consumers who don't want the libfido2 cgo
+// dependency). libfido2 (CGO, USB HID) is desktop-only. Mobile hardware-key
 // support means platform passkey APIs (Play Services FIDO2 / ASAuthorization)
 // — a separate integration, deferred.
 package fido2