Ledger App Security Key

Ledger App Security Key for Ledger devices.

This application implements a U2F and CTAP2 Authenticator for Ledger devices.

A great introduction to WebAuthn can be found here. You can also use this demo to test this app, or use this debugger to do some advanced testing.

Specifications

• FIDO U2F 1.2

  • Universal 2nd Factor (U2F) Overview, 11 April 2017 ✅
  • FIDO U2F Raw Message Formats, 11 April 2017 ✅

• FIDO2

  • CTAP
    • Client to Authenticator Protocol (CTAP 2.0), Proposed Standard, January 30, 2019 ✅
    • Client to Authenticator Protocol (CTAP 2.1), Proposed Standard, June 21, 2022
    • Client to Authenticator Protocol (CTAP 2.2), Proposed Standard, July 14, 2025
    • Client to Authenticator Protocol (CTAP 2.3), Proposed Standard, February 26, 2026
  • WebAuthn
    • Web Authentication: An API for accessing Public Key Credentials Level 2, W3C Recommendation, 8 April 2021
    • Web Authentication: An API for accessing Public Key Credentials Level 3, W3C Candidate Recommendation, 26 May 2026

Building

With VSCode

You can quickly setup a convenient environment to build and test your application by using Ledger's VSCode developer tools extension which leverages the ledger-app-dev-tools docker image.

With a terminal

The ledger-app-dev-tools docker image contains all the required tools and libraries to build, test and load an application.

Acronyms

See doc/acronyms.md.

Testing the app

See dedicated README.md in the tests/ directory.

Known limitations

• Discoverable / Resident credentials are currently disabled. The underlying constraint is that they are stored on a part of the device flash that gets wiped upon app deletion (on uninstall, app update, or OS update). Properly supporting this feature therefore requires a full backup and restore infrastructure spanning multiple components of the stack. Work is ongoing. See ENABLE_RK_CONFIG and ENABLE_RK_CONFIG_UI_SETTING in the Makefile for implementation details.
• Following FIDO2 spec, there should be a way to revoke credentials. A revocation mechanism has been implemented based on a counter that - just like discoverable credentials - will be wiped upon app deletion. Therefore, in order to avoid unexpected issues on the user side, this counter has been disabled. See HAVE_NO_RESET_GENERATION_INCREMENT in the Makefile for more details.

For more details, see the blog post and the Ledger support article.

Other Use Cases

Beyond website and app authentication, the Security Key app can be used as a hardware factor in several workflows:

• Git SSH authentication — hardware-bound SSH key for GitHub, GitLab, and remote servers. See doc/usecase-git-auth.md.
• Git commit signing — SSH-based commit and tag signatures, requiring a physical tap per commit. See doc/usecase-git-signing.md.
• LUKS2 volume encryption — unlock an encrypted image file or partition by tapping the device, using the hmac-secret FIDO2 extension. See doc/usecase-luks.md.