Possible to reduce number of dependencies?

[maxnet]

I am looking for a simple way to add U2F support to a web application.
And it seems this project is capable of doing that, however I am a bit put off by the amount of dependencies pulled in.

Currently one seems to need:

• mcrypt PHP extension
• GMP PHP extension
• OpenSSL PHP extension (currently only used to generate random numbers)
• mdanter/ecc library
• PHPseclib library.

I know one can use Composer to simplify dependency management, however I would really prefer to just have a single PHP file solution instead.
Was wondering that since you are requiring OpenSSL anyway, if it wouldn't be possible to use OpenSSL for the ECDSA validation as well, and get rid of all the other dependencies.

As in:

• Add some code to convert the public ECC key provided by token to PEM format.
• Call openssl_verify($data_to_be_hashed, $sig, $pem_public_key, OPENSSL_ALGO_SHA256) instead of the $key->verifies() code to perform ECDSA validation in doAuthenticate()

Is there any reason that wouldn't work, and the existing approach is used?
(haven't tried it yet, as I don't have an U2F token to test with yet)

[klali]

Hello,

I agree with the general feel that the dependencies should be as few as possible, however:

Currently (on ubuntu 14.04) the php openssl extension does not support ecc at all, a patch for that went in in the beginning of the year (https://bugs.php.net/bug.php?id=66501) which means that using openssl for the EC operations is a non-option. Unfortunately phpseclib does not support EC either, so right now that dependency could be dropped in favour of using openssl for the certificate checks.

The selftests should have enough coverage that it's possible to test around with the code what parts work where.

/klas

[maxnet]

Currently (on ubuntu 14.04) the php openssl extension does not support ecc at all, a patch for that went in in
the beginning of the year (https://bugs.php.net/bug.php?id=66501) which means that using openssl for the
EC operations is a non-option.

Looking at the pull request linked in that bug, that concerned a bug in php_openssl_is_private_key() which caused openssl_sign() to output a warning when EC keys are used.

Not sure if we are affected by is_private_key() not working properly when verifying signatures with openssl_verify().

[maxnet]

Played a bit more with it, and it only breaks when passing a key resource to openssl_verify()
Works fine under Ubuntu when passing a key as PEM formatted text string.

Proof of concept that only depends on OpenSSL + phpseclib, and no longer on mdanter/ecc and GMP:
https://github.com/maxnet/php-u2flib-server-cutdown/commit/92e208310a0528f1a921c26d451d5f1e130813c7
Still have to test it with a real token, but it passes your phpunit tests.
Next step would be te remove the dependency on phpseclib.

[klali]

Very interesting!
Please submit a pull request..

/klas