[{"data":1,"prerenderedAt":104},["ShallowReactive",2],{"i-heroicons:building-office-2":3,"i-heroicons:computer-desktop":8,"i-heroicons:cloud":10,"i-heroicons:server":12,"i-heroicons:folder":14,"i-heroicons:chart-bar":16,"i-heroicons:lock-closed":18,"i-heroicons:rectangle-stack":20,"i-heroicons:scale":22,"i-heroicons:key":24,"i-heroicons:finger-print":26,"i-heroicons:cpu-chip":28,"i-heroicons:document-text":30,"i-heroicons:shield-exclamation":32,"i-heroicons:shield-check":34,"blog-en-implementing-fido-u2f-ctap":36,"i-heroicons:user":102},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 21h19.5m-18-18v18m10.5-18v18m6-13.5V21M6.75 6.75h.75m-.75 3h.75m-.75 3h.75m3-6h.75m-.75 3h.75m-.75 3h.75M6.75 21v-3.375c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125V21M3 3h12m-.75 4.5H21m-3.75 3.75h.008v.008h-.008zm0 3h.008v.008h-.008zm0 3h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 17.25v1.007a3 3 0 0 1-.879 2.122L7.5 21h9l-.621-.621A3 3 0 0 1 15 18.257V17.25m6-12V15a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 15V5.25m18 0A2.25 2.25 0 0 0 18.75 3H5.25A2.25 2.25 0 0 0 3 5.25m18 0V12a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 12V5.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 15a4.5 4.5 0 0 0 4.5 4.5H18a3.75 3.75 0 0 0 1.332-7.257a3 3 0 0 0-3.758-3.848a5.25 5.25 0 0 0-10.233 2.33A4.5 4.5 0 0 0 2.25 15\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M21.75 17.25v-.228a4.5 4.5 0 0 0-.12-1.03l-2.268-9.64a3.375 3.375 0 0 0-3.285-2.602H7.923a3.375 3.375 0 0 0-3.285 2.602l-2.268 9.64a4.5 4.5 0 0 0-.12 1.03v.228m19.5 0a3 3 0 0 1-3 3H5.25a3 3 0 0 1-3-3m19.5 0a3 3 0 0 0-3-3H5.25a3 3 0 0 0-3 3m16.5 0h.008v.008h-.008zm-3 0h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 12.75V12A2.25 2.25 0 0 1 4.5 9.75h15A2.25 2.25 0 0 1 21.75 12v.75m-8.69-6.44l-2.12-2.12a1.5 1.5 0 0 0-1.061-.44H4.5A2.25 2.25 0 0 0 2.25 6v12a2.25 2.25 0 0 0 2.25 2.25h15A2.25 2.25 0 0 0 21.75 18V9a2.25 2.25 0 0 0-2.25-2.25h-5.379a1.5 1.5 0 0 1-1.06-.44\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M3 13.125C3 12.504 3.504 12 4.125 12h2.25c.621 0 1.125.504 1.125 1.125v6.75C7.5 20.496 6.996 21 6.375 21h-2.25A1.125 1.125 0 0 1 3 19.875zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125v11.25c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25C20.496 3 21 3.504 21 4.125v15.75c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M16.5 10.5V6.75a4.5 4.5 0 1 0-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 0 0 2.25-2.25v-6.75a2.25 2.25 0 0 0-2.25-2.25H6.75a2.25 2.25 0 0 0-2.25 2.25v6.75a2.25 2.25 0 0 0 2.25 2.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M6 6.878V6a2.25 2.25 0 0 1 2.25-2.25h7.5A2.25 2.25 0 0 1 18 6v.878m-12 0q.354-.126.75-.128h10.5q.396.002.75.128m-12 0A2.25 2.25 0 0 0 4.5 9v.878m13.5-3A2.25 2.25 0 0 1 19.5 9v.878m0 0a2.3 2.3 0 0 0-.75-.128H5.25q-.396.002-.75.128m15 0A2.25 2.25 0 0 1 21 12v6a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 18v-6c0-.98.626-1.813 1.5-2.122\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":23},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 3v17.25m0 0c-1.472 0-2.882.265-4.185.75M12 20.25c1.472 0 2.882.265 4.185.75M18.75 4.97A48 48 0 0 0 12 4.5c-2.291 0-4.545.16-6.75.47m13.5 0q1.515.215 3 .52m-3-.52l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202zm-16.5.52q1.485-.305 3-.52m0 0l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":25},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":27},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M7.864 4.243A7.5 7.5 0 0 1 19.5 10.5c0 2.92-.556 5.709-1.568 8.269M5.742 6.364A7.47 7.47 0 0 0 4.5 10.5a7.46 7.46 0 0 1-1.15 3.993m1.989 3.559A11.2 11.2 0 0 0 8.25 10.5a3.75 3.75 0 1 1 7.5 0q0 .79-.064 1.565M12 10.5a14.94 14.94 0 0 1-3.6 9.75m6.633-4.596a18.7 18.7 0 0 1-2.485 5.33\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":29},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M8.25 3v1.5M4.5 8.25H3m18 0h-1.5M4.5 12H3m18 0h-1.5m-15 3.75H3m18 0h-1.5M8.25 19.5V21M12 3v1.5m0 15V21m3.75-18v1.5m0 15V21m-9-1.5h10.5a2.25 2.25 0 0 0 2.25-2.25V6.75a2.25 2.25 0 0 0-2.25-2.25H6.75A2.25 2.25 0 0 0 4.5 6.75v10.5a2.25 2.25 0 0 0 2.25 2.25m.75-12h9v9h-9z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M19.5 14.25v-2.625a3.375 3.375 0 0 0-3.375-3.375h-1.5A1.125 1.125 0 0 1 13.5 7.125v-1.5a3.375 3.375 0 0 0-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 0 0-9-9\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 9v3.75m0-10.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.75c0 5.592 3.824 10.29 9 11.622c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.57-.598-3.75h-.152c-3.196 0-6.1-1.25-8.25-3.286m0 13.036h.008v.008H12z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 12.75L11.25 15L15 9.75m-3-7.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.749c0 5.592 3.824 10.29 9 11.623c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.571-.598-3.751h-.152c-3.196 0-6.1-1.248-8.25-3.285\"\u002F>",{"id":37,"documentId":38,"title":39,"content":40,"slug":41,"published":42,"createdAt":43,"updatedAt":43,"publishedAt":44,"locale":45,"authorManual":46,"cover":47,"tags":98,"seo":99,"author":51},51,"y8ofuu6crv59349si4v6ioqm","Implementing FIDO U2F CTAP","\u003Cp>\u003Cstrong>Introduction\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>This article will summarize various aspects of creating a U2F Host Library regarding the U2F specifications.\u003C\u002Fp>\n\u003Cp>The Host library is the part that communicates between the so-called FIDO Client (web browser) and Authenticator (YubiKey, etc.). However, if a web browser is not available, U2F communication is not necessary.\u003C\u002Fp>\n\u003Cp>However, if one wants to use FIDO authentication in a native application where a web browser is unavailable, they will need to create a Host library, as shown here. (This will no longer be necessary if the platform API supports it, such as Windows Hello.)\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Table of Contents\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cul>\n\u003Cli>\u003Cp>Sequence\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\u003Cp>What the host library does\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\u003Cp>Communication with U2F devices\u003C\u002Fp>\n\u003Cul>\n\u003Cli>JavaScript API\u003C\u002Fli>\n\u003Cli>Raw Message Format\u003C\u002Fli>\n\u003Cli>APDU Format\u003C\u002Fli>\n\u003Cli>HID Protocol\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Cp>About FIDO2\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Sequence\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>First, begin by checking the entire sequence of U2F.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>At the time of registration\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_implementing_fido_u2f_ctap_1_b1ce1a97e0.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>\u003Cstrong>At the time of authentication\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_implementing_fido_u2f_ctap_2_6167c66e2c.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>This is the U2F Challenge & Response diagram often seen, and this communication part between the Client and YubiKey is called CTAP.\u003C\u002Fp>\n\u003Cp>Compared to the CTAP2 specification in FIDO2, it is also called CTAP1.\u003C\u002Fp>\n\u003Cp>The client is usually a browser, but only Chrome implements it as U2F. (Firefox60 and later are also supported as WebAuthN)\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>What the host library does\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>The host library works behind the scenes with APIs such as the U2F JavaScript API. For example, at the time of registration.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Enumerate USB devices\u003C\u002Fli>\n\u003Cli>Search for U2F devices\u003C\u002Fli>\n\u003Cli>Write the registration request to the device\u003C\u002Fli>\n\u003Cli>Read the response from the device\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_implementing_fido_u2f_ctap_3_55a8e082b6.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Next, an explanation of the operation after “3) Registration Request” during the implementation of FIDO U2F will be discussed.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Communication with U2F Device\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>The U2F specifications include\u003Ca href=\"https:\u002F\u002Ffidoalliance.org\u002Fspecs\u002Ffido-u2f-v1.2-ps-20170411\u002Ffido-u2f-javascript-api-v1.2-ps-20170411.html\">U2F JavascriptAPI U2F\u003C\u002Fa>,  \u003Ca href=\"https:\u002F\u002Ffidoalliance.org\u002Fspecs\u002Ffido-u2f-v1.2-ps-20170411\u002Ffido-u2f-raw-message-formats-v1.2-ps-20170411.html\">U2F Raw Message Formats\u003C\u002Fa>, and \u003Ca href=\"https:\u002F\u002Ffidoalliance.org\u002Fspecs\u002Ffido-u2f-v1.2-ps-20170411\u002Ffido-u2f-hid-protocol-v1.2-ps-20170411.html\">U2F HID Protocol\u003C\u002Fa> which are the low-level protocols of the device from the Client-side in order from Javascript API.\u003C\u002Fp>\n\u003Cp>In regards to the specifications, there are three main points.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Point 1.  U2F devices operate as HID devices\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>As stated in the specifications, the communication between the U2F device and the Client uses the HID (Human Interface Device) protocol, a common standard used in devices such as keyboards and mouses and can be used without a driver.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Point 2. The format for sending and receiving data is APDU Format\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Although the HID protocol is used for communication, actual messages are sent in a format called \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSmart_card_application_protocol_data_unit\">APDU Format\u003C\u002Fa>, a method of exchanging data for reading smart cards, etc. This APDU Format, which is the format in which the data is sent, consists of a header indicating the command, data length, and the data attached to it.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Point 3. Data is in the U2F Raw Message Formats\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Also, the data to be sent in APDU is sent in a format known as \u003Ca href=\"https:\u002F\u002Ffidoalliance.org\u002Fspecs\u002Ffido-u2f-v1.2-ps-20170411\u002Ffido-u2f-raw-message-formats-v1.2-ps-20170411.html\">U2F Raw Message Format\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Since the U2F Raw Message Format is a byte array data, if it is converted to a data format that JavaScript can handle, it can be handled in a data format such as JSON, like the API in Chrome.\u003C\u002Fp>\n\u003Cp>In summary, it looks like this.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_implementing_fido_u2f_ctap_4_b3e0542a8a.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Upon understanding these three points, it will be significantly easier to follow along with reading the specs and \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FYubico\u002Fpython-u2flib-host\">Yubico’s reference code\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>The following section will trace the registration phase and checking of the data.\u003C\u002Fp>\n\u003Cp>For example, the following Registration Request from \u003Ca href=\"https:\u002F\u002Fexample.com\">https:\u002F\u002Fexample.com\u003C\u002Fa> via the JavaScript API was received.\u003C\u002Fp>\n\u003Cp>First, to convert this data to Raw Message Formats, create a JSON String called ClientData.\u003C\u002Fp>\n\u003Cp>The members of ClientData are "type," "challenge," "origin," and "cid," but when registering a U2F device, use\u003C\u002Fp>\n\u003Cul>\n\u003Cli>type: "navigator.id.finishEnrollment" fixed\u003C\u002Fli>\n\u003Cli>challenge: Challenge string from the server.\u003C\u002Fli>\n\u003Cli>origin: If it is HTTP communication, the domain must be authenticated.\u003C\u002Fli>\n\u003Cli>cid: option. a JwkKey-style public key is used to sign a Token Binding called \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fid\u002Fdraft-balfanz-tls-channelid-01.html\">channel ID\u003C\u002Fa>. This time, it is omitted.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>On the Raw Message Formats side, a SHA256 hashed value of JSON is used, which is the Challenge Parameter. (Hexadecimal notation).\u003C\u002Fp>\n\u003Cp>Web Safe Base64 Encoded JSON is sent to the server as ClientData.\u003C\u002Fp>\n\u003Cp>The changing of "\u002F" to "_" and "+" to "-" are known as Web Safe Base64 or URL Safe Base64. However, the padding is removed (i.e., the trailing === is cleared).\u003C\u002Fp>\n\u003Cp>This parameter is only Base64 encoded for sending to the server and does not use this data for communication with the Authenticator.\u003C\u002Fp>\n\u003Cp>Another parameter is the Application Parameter, which is the sha256 hash of appId("\u003Ca href=\"https:\u002F\u002Fexample.com\">https:\u002F\u002Fexample.com\u003C\u002Fa>").\u003C\u002Fp>\n\u003Cp>The Registration Request Message is a combination of the two.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_implementing_fido_u2f_ctap_5_4523fc4476.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>※FIDO U2F Raw Message 4.1 Fig. 2 Registration Request Message\u003C\u002Fp>\n\u003Cp>\u003Cstrong>APDU Format\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Next, the U2F Raw Message format is sent to the HID device in APDU Format.\u003C\u002Fp>\n\u003Cp>In APDU Format, the data length and command parameters must be specified in the header section, and the command parameters at registration are as follows.\u003C\u002Fp>\n\u003Cp>There are two types of APDU data, Short Encoding, and Extended Length Encoding, and U2F uses Short Encoding.\u003C\u002Fp>\n\u003Cp>※Le defines the maximum size of the response data but is ignored if the maximum length is set to 256 bytes.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>HID Protocol\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>All that remains is sending the data to the HID device, but only 64 bytes can be written to the HID device simultaneously.\u003C\u002Fp>\n\u003Cp>As with the APDU format, a header is attached, as shown below, so the actual data to be sent looks like this.\u003C\u002Fp>\n\u003Cp>・※The channel ID is obtained when the device is initialized.\u003C\u002Fp>\n\u003Cp>・※The seventh bit of the command is always 1\u003C\u002Fp>\n\u003Cp>DATA is the APDU data mentioned earlier. While the total data size is 71 bytes (0x47), the HID packet is 64 bytes, so only 57 bytes can be sent, as 7 bytes are required for the header for HID Transport. The rest of the data is sent as sequence data in the following form.\u003C\u002Fp>\n\u003Cp>Now read the response from the device.\u003C\u002Fp>\n\u003Cp>In other words, this time, the process is reversed from HID protocol → APDU format → U2F Raw Message Format to get the response from the device.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>About FIDO2\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>The U2F host-side communication is the same protocol used in CTAP2 for FIDO2.\u003C\u002Fp>\n\u003Cp>CTAP2 has more PIN-related commands, more data to send, and a standardized format called CBOR.\u003C\u002Fp>\n","implementing-fido-u2f-ctap","2018-06-05","2026-04-28T06:39:17.519Z","2026-04-28T06:39:20.071Z","en","YubiOn",{"id":48,"documentId":49,"name":50,"alternativeText":51,"caption":51,"focalPoint":51,"width":52,"height":53,"formats":54,"hash":93,"ext":56,"mime":60,"size":94,"url":95,"previewUrl":51,"provider":96,"provider_metadata":51,"createdAt":97,"updatedAt":97,"publishedAt":97},573,"r4y6txei68gdyc4hnx2ilcek","blog-implementing-fido-u2f-ctap-1.png",null,1052,551,{"large":55,"small":66,"medium":75,"thumbnail":84},{"ext":56,"url":57,"etag":58,"hash":59,"mime":60,"name":61,"path":51,"size":62,"width":63,"height":64,"sizeInBytes":65},".png","https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Flarge_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0.png","268b7b9af21435858e6a6e79ef5730f7","large_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0","image\u002Fpng","large_blog-implementing-fido-u2f-ctap-1.png",98.28,1000,524,98282,{"ext":56,"url":67,"etag":68,"hash":69,"mime":60,"name":70,"path":51,"size":71,"width":72,"height":73,"sizeInBytes":74},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fsmall_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0.png","8842554524825a5262b2dd91b1d83106","small_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0","small_blog-implementing-fido-u2f-ctap-1.png",39.12,500,262,39121,{"ext":56,"url":76,"etag":77,"hash":78,"mime":60,"name":79,"path":51,"size":80,"width":81,"height":82,"sizeInBytes":83},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fmedium_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0.png","e838bb14a28f63e4c032e01815767095","medium_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0","medium_blog-implementing-fido-u2f-ctap-1.png",66.91,750,393,66913,{"ext":56,"url":85,"etag":86,"hash":87,"mime":60,"name":88,"path":51,"size":89,"width":90,"height":91,"sizeInBytes":92},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fthumbnail_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0.png","8a7fe4f9d17adb17167d81418536460d","thumbnail_blog_implementing_fido_u2f_ctap_1_b1ce1a97e0","thumbnail_blog-implementing-fido-u2f-ctap-1.png",15.28,245,128,15283,"blog_implementing_fido_u2f_ctap_1_b1ce1a97e0",15.24,"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_implementing_fido_u2f_ctap_1_b1ce1a97e0.png","aws-s3","2026-04-28T06:38:58.140Z",[],{"id":100,"metaDescription":101},285,"Learn how to create a FIDO U2F Host Library for native apps. This guide covers CTAP communication protocols and specs.",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":103},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 6a3.75 3.75 0 1 1-7.5 0a3.75 3.75 0 0 1 7.5 0M4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.9 17.9 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632\"\u002F>",1783406263147]