Using the CTAP hid gadget
=========================

After compiling the programmes, the fido binary is used to write the
binary report descriptor to the necessary place in configfs.

The script fido_configfs.sh can be used to set up both ends of the
gadget.  To be used, the /dev/hidrawX end of the gadget *must* be
accessible by ordinary users meaning you either give the gadget an ID
matching the one udev will append the uaccess tag, which gives a
current user ACL.  Alternatively you can simply chmod 666 the new
hidrawX device.

Ideally, you should also run the hidgd as non-root, so you'll have to
change the permissions on /dev/hidgX to allow that to happen.  Once
the permissions are sorted out, you need to create an attestation
certificate and key.  In theory FIDO relying entities use the
attestation certificate to verify the authenticity of the token, but
in practice a self signed certificate works.  The certificate must
represent the public part of a NIST P-256 elliptic curve key becuase
the standard requires it.

To create the key do

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -pkeyopt ec_param_enc:named_curve -out reg_key.key

After which you can create the self signed certificate as

openssl req -new -x509 -subj '/CN=My Fido Token/' -key reg_key.key -out reg_key.der -outform DER

And finally run hidgd as

hidgd /dev/hidg0 reg_key.der reg_key.key

And it should respond to the firefox browser using U2F sites.