Refactor FIDO2 PRF to use Telesma CTAP libraries and enhance credential generation

README.md

@@ -274,8 +274,16 @@ EOF
 ```
 
 Credentials can be generated from the command line with `age-plugin-fido2prf
--generate RPID`. Note that they will be usable inside the browser only if the
-relying party ID matches the website's origin.
+-generate RPID`. The plugin uses USB when available and falls back to PC/SC,
+detecting contactless cards as `nfc` and contact cards as `smart-card`. Pass
+`-transport usb`, `-transport nfc`, or `-transport smart-card` to override
+automatic selection; `nfc` and `smart-card` select only readers with the
+matching physical interface. Note that credentials will be usable inside the
+browser only if the relying party ID matches the website's origin.
+
+If multiple matching PC/SC readers contain FIDO2 cards, select one by its exact
+name with `-reader`. Reader names are used only during credential generation and
+are not stored in the identity.
 
 All the features of the plugin are also available as a Go library at
 [filippo.io/typage/fido2prf](https://pkg.go.dev/filippo.io/typage/fido2prf).

fido2prf/cmd/age-plugin-fido2prf/main.go

@@ -22,10 +22,20 @@ func main() {
 	}
 
 	generate := flag.String("generate", "", "Generate a new credential for the given relying party ID.")
+	transport := flag.String("transport", "auto", "Transport to use when generating a credential: auto, usb, nfc, or smart-card.")
+	reader := flag.String("reader", "", "PC/SC reader name to use when generating a credential.")
 	p.RegisterFlags(nil)
 	flag.Parse()
 
 	if *generate != "" {
+		if *transport != "auto" && *transport != "usb" && *transport != "nfc" && *transport != "smart-card" {
+			fmt.Printf("Error: unsupported transport %q\n", *transport)
+			os.Exit(1)
+		}
+		if *reader != "" && *transport == "usb" {
+			fmt.Println("Error: -reader can't be used with -transport usb")
+			os.Exit(1)
+		}
 		fmt.Fprintf(os.Stderr, "Enter the security key PIN: ")
 		pin, err := term.ReadPassword(int(os.Stdin.Fd()))
 		if err != nil {
@@ -34,7 +44,7 @@ func main() {
 		}
 		fmt.Fprintf(os.Stderr, "\r\033[K") // Clear the line.
 
-		identity, err := fido2prf.NewCredential(*generate, string(pin))
+		identity, err := fido2prf.NewCredentialOnReader(*generate, string(pin), *reader, *transport)
 		if err != nil {
 			fmt.Printf("Error: %s\n", err)
 			os.Exit(1)