DarksFIDO2

KO | EN

gitlite — search

#artificial-intelligence #ai #nlp #tensorflow #ruby #docker #claude-code #ui #self-hosted #react-native

(★ 9)

Open-source Windows 11 FIDO2/WebAuthn authenticator with TPM-backed keys, local passkeys, and TOTP.

파일 탐색기

ZIP 다운로드

- - bug_report.yml
  - compatibility.yml
  - config.yml
- - ci.yml
- - app-main-screen.png
  - app-profile-screen.png
  - social-preview.png
- ARCHITECTURE.md
- BUILDING.md
- COMPATIBILITY.md
- DEMO-SCRIPT.md
- googlef03bd4628e325de0.html
- index.html
- KNOWN-LIMITATIONS.md
- RELEASE-NOTES-0.6.1.md
- RELEASE-NOTES-0.6.2.md
- RELEASE-NOTES-0.6.3.md
- RELEASE-NOTES-0.6.4.md
- robots.txt
- SECURITY-AUDIT-0.6.1.md
- SECURITY-AUDIT-0.6.2.md
- SECURITY-AUDIT-0.6.3.md
- SECURITY-AUDIT-0.6.4.md
- sitemap.xml
- THREAT-MODEL.md
- build-provider-package.ps1
- build-release.ps1
- generate-repository-assets.ps1
- - App.xaml
  - App.xaml.cs
  - AssemblyInfo.cs
  - AuthenticodeVerifier.cs
  - DarksFIDO2.App.csproj
  - MainWindow.xaml
  - MainWindow.xaml.cs
  - packages.lock.json
  - ThemeManager.cs
- - DarksFIDO2.Cli.csproj
  - packages.lock.json
  - Program.cs
- - AppPaths.cs
  - AssemblyInfo.cs
  - AuditExportService.cs
  - CliBridge.cs
  - DarksFIDO2.Core.csproj
  - Models.cs
  - packages.lock.json
  - TotpService.cs
  - VaultBackupService.cs
- - AssemblyInfo.cs
  - DarksFIDO2.Provider.csproj
  - NativeMethods.cs
  - Package.appxmanifest
  - packages.lock.json
  - PluginAuthenticator.cs
  - Program.cs
  - ProviderIds.cs
  - ProviderLog.cs
- - app.manifest
  - AssemblyInfo.cs
  - DarksFIDO2.Setup.csproj
  - packages.lock.json
  - Program.cs
  - SetupWindow.cs
- - DarksFIDO2.BrowserTests.csproj
  - packages.lock.json
  - Program.cs
- - DarksFIDO2.Tests.csproj
  - packages.lock.json
  - Program.cs
.gitignore
CHANGELOG.md
CITATION.cff
CONTRIBUTING.md
CONTRIBUTORS.md
DarksFIDO2.slnx
Directory.Build.props
global.json
LICENSE
NOTICE
NuGet.Config
README.md
SECURITY.md

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

**Windows 11 FIDO2 / WebAuthn Authenticator, Hardware-Backed Passkey Provider, and TOTP Manager.**

[![Build and test](https://github.com/darkbyte-JS/DarksFIDO2/actions/workflows/ci.yml/badge.svg)](https://github.com/darkbyte-JS/DarksFIDO2/actions/workflows/ci.yml)
[![Release v0.6.4](https://img.shields.io/github/v/release/darkbyte-JS/DarksFIDO2?include_prereleases&label=release%20v0.6.4)](https://github.com/darkbyte-JS/DarksFIDO2/releases)
[![License](https://img.shields.io/github/license/darkbyte-JS/DarksFIDO2)](https://raw.githubusercontent.com/darkbyte-JS/DarksFIDO2/main/LICENSE)
[![Windows 11](https://img.shields.io/badge/Windows%2011-24H2%2B%20%7C%20Win%2010-0078D4)](https://raw.githubusercontent.com/darkbyte-JS/DarksFIDO2/main/docs/COMPATIBILITY.md)
[![TPM 2.0](https://img.shields.io/badge/TPM%202.0-Silicon%20Enclave-00C7B7)](https://raw.githubusercontent.com/darkbyte-JS/DarksFIDO2/main/docs/ARCHITECTURE.md)

> **Note:** Binaries are signed using the project development certificate (`CN=Darkbyte. INC`). Verify SHA-256 checksums before installing.

[Download v0.6.4](https://github.com/darkbyte-JS/DarksFIDO2/releases) Â· [What's New in v0.6.4](#whats-new-in-v064) Â· [Features](#features) Â· [Getting Started](#getting-started) Â· [Security & Contributors](#security--contributors)

---

---

## Design Principles

1. **Local-First / Zero Telemetry:** No accounts, no cloud sync, and zero outbound network calls. Keys, credentials, and seeds stay exclusively on the local machine.
2. **Hardware Key Isolation:** Master wrapping and passkey private keys use discrete/firmware TPM 2.0 (`Microsoft Platform Crypto Provider`) with non-exportable hardware flags (`NCRYPT_EXPORT_POLICY_PROPERTY = 0`).
3. **Dedicated Neumorphic UI:** Built with custom dark neumorphic styling, vector controls, and native WPF layouts without relying on standard system dialogs.
 
 <img src="docs/assets/app-profile-screen.png" alt="Darks FIDO2 Secure Gate Screen" width="800">
 
4. **Operational Visibility:** Inspect raw Credential IDs, COSE public keys, AAGUIDs, signature counters, and ECDSA-signed audit records.

---

## What's New in v0.6.4

### Password Generator
- **Selectable Character Sets:** Independently toggle digits (`0-9`), lowercase (`a-z`), uppercase (`A-Z`), special symbols (`!@#$%^&*...`), and extended ASCII (`Â¡, Â¿, Â©, Â®, Â±...`).
- **Cryptographic Shuffling:** Uses `RandomNumberGenerator.GetInt32` with an unbiased Fisher-Yates shuffle.
- **Memory-Only Operation:** Generated passwords stay strictly in memory; they are never written to disk or configuration files.
- **Clipboard Security:** Sets Windows clipboard privacy flags (`CanIncludeInClipboardHistory = 0`, `CanUploadToClipboardCloud = 0`) and clears clipboard contents automatically after 10 seconds.

### 6-Character Master PIN
- Standardized minimum master PIN / passphrase requirement to 6 characters across profile creation, change PIN, and validation services.

### Vault Discovery & Auto-Sync
- `VaultRepository.LoadIndex()` scans `%LOCALAPPDATA%\DarksFIDO2\profiles\` on launch to detect unindexed profile directories.
- Unindexed vaults are automatically recovered from their DPAPI-protected `profile.meta` and re-added to `profiles.index`.

### TPM Hardware Key Deletion
- Delete TPM-derived hardware keys directly from the Hardware tab.
- Includes confirmation prompt, hardware removal via `NCryptDeleteKey`, and audit log tracking.

### Credential Secret Masking
- Sensitive fields in the inspector drawer (Credential ID and Public Key) are masked by default (`â - â - â - â - â - â - â - â - `).
- Revealing secrets requires Master PIN entry authenticated against `IVaultSession.VerifyCurrentPin(pin)`. Auto-reseals on navigation or lock.

### UI Improvements
- Standardized 20px padding and 44px row heights in Audit and Hardware tables.
- Wrapped toolbar buttons to handle smaller windows smoothly.
- Standardized status capsule sizing (`VAULT`, `TPM Status`, `LOCK IN`).

---

## Security & Contributors

Darks FIDO2 relies on responsible security disclosure and community review:

- **[@EQSTLab](https://github.com/EQSTLab)**  -  Responsible disclosure of **VULN-001** and security research:
  * **Search-Order & Binary-Planting Hardening:** Enforced fully qualified, trusted paths for helper invocations during setup/uninstall.
  * **Installer Trust Isolation:** Removed certificate store writes from Setup. The public certificate is distributed separately.
  * **Profile-Bound Vault Envelopes (DFV2):** Bound vault encryption directly to `ProfileId` using HKDF salts and AES-256-GCM authenticated associated data.
  * **Algorithm Restrictions:** CNG operation signature verification restricted to ECDSA key groups.
  * **Memory Scrubbing:** Unlocked audit private keys and master key buffers are cleared via `CryptographicOperations.ZeroMemory()` upon lock or disposal.
  * **Log Throttling:** Provider logging is rate-limited to 120 entries/min to prevent disk flood vectors.
  * **Keyfile Rotation Safety:** Atomically writes and verifies new keyfiles before applying vault changes.
  * **Cascading Key Cleanup:** Deleting a profile cascades cleanup across stored credentials, TPM keys, and CNG keys.
- **[darkbyte-JS](https://github.com/darkbyte-JS)**  -  Project creator, architecture, Windows 11 passkey provider, UI design, and releases.

---

## Features

### Encrypted Profiles
- Isolated vault partitions (e.g., Personal, Work).
- Each profile uses independent AES-256-GCM encryption derived via PBKDF2-HMAC-SHA-256 (600,000 rounds).
- Optional dual-factor 64-byte keyfile (`.dfkey`) and 40-character emergency recovery codes.

### Windows 11 Passkey Provider
- Implements `IPluginAuthenticator` COM server packaged via MSIX.
- Browsers (Edge, Chrome) invoke Darks FIDO2 through the native Windows 11 WebAuthn broker.
- Non-exportable P-256 keys generated inside the TPM 2.0 enclave.
- Fails closed if the vault is locked or unconfirmed.

### TPM 2.0 Hardware Enclave
- Hardware detection via Windows TPM Base Services (TBS).
- Diagnostic reporting: Manufacturer ID, Firmware Version, and Interface Specification.
- Non-exportable hardware key derivation with deletion controls.

### TOTP Engine & Screen Sniper
- Offline RFC 6238 Two-Factor Authentication engine.
- On-screen QR Sniper: captures and decodes TOTP enrollment QR codes directly from your display without a phone camera.
- Image importer supporting PNG, JPEG, and BMP barcode parsing.
- Sub-second live progress meters.

### Signed Audit Logging
- Credential creation, assertion, export, and TPM deletion events are recorded in an append-only log.
- Logs are cryptographically signed with ECDSA P-256 for independent verification.

---

## OS Compatibility

---

## Getting Started

### Installation via Setup
1. Download `DarksFIDO2-Setup.exe` and `Darkbyte-INC.cer` from [Releases](https://github.com/darkbyte-JS/DarksFIDO2/releases).
2. Verify the SHA-256 checksum against `SHA256SUMS.txt`.
3. Import `Darkbyte-INC.cer` into your **Current User > Trusted People** certificate store (required by Windows 11 to register the MSIX passkey provider plugin).
4. Run `DarksFIDO2-Setup.exe` to install the desktop suite and register the native provider.
5. In Windows 11, open **Settings > Accounts > Passkeys > Advanced options** and enable **Darks FIDO2**.

### Portable Usage
Download `DarksFIDO2-Portable.zip`, extract to any folder, and run `DarksFIDO2.exe`. Vault data is stored locally beside the executable in `DarksFIDO2-Data/`.

---

## Packages & Verification

---

## Building from Source

### Prerequisites
- Windows 11 or Windows 10 x64
- [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)

```powershell
# Restore locked dependencies
dotnet restore DarksFIDO2.slnx --locked-mode

# Build Release configuration
dotnet build DarksFIDO2.slnx -c Release --no-restore

# Run test suite
dotnet run --project tests\DarksFIDO2.Tests\DarksFIDO2.Tests.csproj -c Release --no-build
```

For release signing, MSIX packaging, and certificate setup, see [docs/BUILDING.md](docs/BUILDING.md).

---

## Contributors

- **[darkbyte-JS](https://github.com/darkbyte-JS)**  -  Project creator, architecture, passkey provider, Neumorphic UI, and release engineering.
- **[@EQSTLab](https://github.com/EQSTLab)**  -  Security research and responsible disclosure of VULN-001.

See [CONTRIBUTORS.md](CONTRIBUTORS.md) for contribution guidelines.

---

## License

Darks FIDO2 is licensed under the **Apache License, Version 2.0**. See [LICENSE](LICENSE) and [NOTICE](NOTICE) for full terms.

DarksFIDO2

파일 탐색기

# CDN으로 사용하기

Was this content helpful?

Recent Feedback

Download README