Skip to content

Commit 2900a86

Browse files
StarGate01StarGate01
committed
Update docs
1 parent 9ead28c commit 2900a86

File tree

2 files changed

+129
-3
lines changed

2 files changed

+129
-3
lines changed

‎docs/applets/5-fido.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,9 @@ Use git to clone the sources recursively, and change into the directory. To comp
4646

4747
You can not use the U2F applet at the same time as the FIDO2 one because they use the same AID.
4848

49-
Loading the attestation certificate requires manual steps as of now, but Vivokey and I are planning to release tools for U2F and FIDO2 attestation certificate loading sometime in the future.
50-
5149
### Generate Attestation Certificate
5250

53-
You can also generate your own attestation certificate. This makes your token unique, which is maybe not something you want - but then again, I recon the number of tokens using the default key can be counted on maybe two hands maximum.
51+
You can generate your own attestation certificate. This makes your token unique, which is maybe not something you want.
5452

5553
In the future, Vivokey plans offer signed certificates using their own certificate authority in some way. It is unclear if or how these would be coming to the FlexSecure, as they require the more protected environment of the Apex Flex in order to not leak.
5654

‎docs/applets/6-ledger.md

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Cryptocurrency Wallet using Ledger Unplugged
2+
3+
**Ledger Unplugged** is an open-source cryptocurrency wallet implementation by Ledger, Inc. and supported by various mobile apps.
4+
5+
The applet optionally accepts an attestation certificate. This certificate can be generated by you, or an official one signed by a company like Vivokey or Ledger.
6+
7+
The attestation certificate can be used to establish an encrypted channel during setup. The token manufacturer (e.g. Vivokey) can also use this certificate (which they sign using their certificate authority) to validate the authenticity and model of the token and applet.
8+
9+
The **Eligibility Applet** can be used to check whether your token supports als the needed cryptographic algorithms.
10+
11+
## Applet Information
12+
13+
### Ledger Unplugged
14+
15+
- Repository: https://github.com/VivoKey/apex-ledger-unplugged
16+
- Binary name: `Ledger-wallet.cap`
17+
- Download: https://github.com/DangerousThings/flexsecure-applets/releases
18+
- AID: `a0:00:00:06:17:00:54:bf:6a:a9:49:01`, Package: `a0:00:00:06:17:00:54:bf:6a:a9:49`
19+
- Storage requirements:
20+
- Persistent: `TBA` bytes
21+
- Transient reset: `TBA` bytes
22+
- Transient deselect: `TBA` bytes
23+
24+
### Ledger Unplugged Eligibility
25+
26+
- Repository: https://github.com/LedgerHQ/ledger-javacard-eligibility
27+
- Binary name: `Ledger-eligibility.cap`
28+
- Download: https://github.com/DangerousThings/flexsecure-applets/releases
29+
- AID: `FF:4C:45:47:52:2E:45:4C:49:47:30:31:2E:49:30:31`, Package: `FF:4C:45:47:52:2E:45:4C:49:47:30:31`
30+
- Storage requirements:
31+
- Persistent: `TBA` bytes
32+
- Transient reset: `TBA` bytes
33+
- Transient deselect: `TBA` bytes
34+
35+
## Compiling the Applet Yourself
36+
37+
Setup your environment as described in *JavaCard Development Setup* .
38+
39+
Use git to clone the sources recursively, and change into the directory. To compile, run `JC_HOME=<sdks>/jc304_kit ant`, replacing `<sdks>` with the path to your JavaCard SDKs.
40+
41+
## Installing the Applet
42+
43+
### Generate Attestation Certificate
44+
45+
You can generate your own attestation certificate.
46+
47+
Refer to the *FIDO applet documentation* to install the tool from https://github.com/DangerousThings/fido-attestation-loader and to generate a certificate authority.
48+
49+
Next, generate an attestation certificate and sign it using the CA. You have to create another passphrase to protect the private key of the attestation certificate.
50+
51+
```
52+
./attestation.py cert create -m ledger
53+
```
54+
55+
Then, you can derive the applet installation parameter by running:
56+
57+
```
58+
./attestation.py cert show -m ledger
59+
```
60+
61+
For more options see the *FIDO applet documentation* or read the tool README file.
62+
63+
Use GlobalPlatformPro (GPP) from https://github.com/martinpaljak/GlobalPlatformPro/releases to install the applet:
64+
65+
```
66+
gp -install Ledger-wallet.cap --params INSTALLPARAM
67+
```
68+
69+
The parameter data (`INSTALLPARAM`) contains the attestation certificate private key and signature. You can copy it from the last line of the output of `./attestation.py cert show -m ledger`.
70+
71+
Listing the applets using `gp --list` should print something like this:
72+
73+
```
74+
APP: A0000006170054BF6AA94901 (SELECTABLE)
75+
Parent: A000000151000000
76+
From: A0000006170054BF6AA949
77+
Privs:
78+
79+
PKG: A0000006170054BF6AA949 (LOADED)
80+
Parent: A000000151000000
81+
Version: 1.0
82+
Applet: A0000006170054BF6AA94901
83+
```
84+
85+
Next, you have to load the public attestation certificate by sending a few APDUs. Before sending the certificate, selecting the applet is required.
86+
87+
This task is covered by the attestation script as well:
88+
89+
```
90+
./attestation.py cert upload -m ledger
91+
```
92+
93+
You might have to specify your PCSC reader index using `-r`, use `-l` to list all readers.
94+
95+
### Generate and Install Seeds
96+
97+
The applet requires two seeds, a keycard seed and a mnemonic seed. I have written a small tool to simplify the process. Install Python3, and the `cryptography`, `asn1`, `pyscard`, and `bip-utils` modules (e.g. using Pip). Then, clone or download https://github.com/DangerousThings/ledger-unplugged-setup .
98+
99+
To initialize your Ledger token:
100+
101+
```
102+
./ledger.py setup
103+
```
104+
105+
You can also specify the keycard seed and PIN using command line flags or files, see the tool README for more options.
106+
107+
You can also recover the token if you have a backup of your keycard and mnemonic seeds, e.g.:
108+
109+
```
110+
./ledger.py setup -m "demand soup present horn child flat meat quality smoke flavor toe method govern winter spot west lock tell sunny spoil cage topic shoe card" -p 1234 -s 1234567890abcdef1234567890abcdef
111+
```
112+
113+
You might have to specify your PCSC reader index using `-r`, use `-l` to list all readers.
114+
115+
## Using the Applet
116+
117+
Once the applet is setup correctly, you can use the Mycelium App (https://play.google.com/store/apps/details?id=com.mycelium.wallet) on Android to interface it.
118+
119+
## Sources and Further Reading
120+
121+
- https://raw.githubusercontent.com/LedgerHQ/btchip-doc/master/bitcoin-technical.asc
122+
- https://ledgerhq.github.io/btchip-doc/bitcoin-javacard.html
123+
- https://github.com/DangerousThings/ledger-unplugged-setup
124+
- https://github.com/DangerousThings/fido-attestation-loader
125+
- https://play.google.com/store/apps/details?id=com.mycelium.wallet
126+
- https://shop.ledger.com/
127+
128+
Improve this document: https://github.com/DangerousThings/flexsecure-applets/tree/master/docs

0 commit comments

Comments
 (0)