Possible to reduce number of dependencies?

[yubico]

Possible to reduce number of dependencies?

[klali]

Hello,

I agree with the general feel that the dependencies should be as few as possible, however:

Currently (on ubuntu 14.04) the php openssl extension does not support ecc at all, a patch for that went in in the beginning of the year (https://bugs.php.net/bug.php?id=66501) which means that using openssl for the EC operations is a non-option. Unfortunately phpseclib does not support EC either, so right now that dependency could be dropped in favour of using openssl for the certificate checks.

The selftests should have enough coverage that it's possible to test around with the code what parts work where.

/klas

[maxnet]

Currently (on ubuntu 14.04) the php openssl extension does not support ecc at all, a patch for that went in in
the beginning of the year (https://bugs.php.net/bug.php?id=66501) which means that using openssl for the
EC operations is a non-option.

Looking at the pull request linked in that bug, that concerned a bug in php_openssl_is_private_key() which caused openssl_sign() to output a warning when EC keys are used.

Not sure if we are affected by is_private_key() not working properly when verifying signatures with openssl_verify().

[maxnet]

Played a bit more with it, and it only breaks when passing a key resource to openssl_verify()
Works fine under Ubuntu when passing a key as PEM formatted text string.

Proof of concept that only depends on OpenSSL + phpseclib, and no longer on mdanter/ecc and GMP:
https://github.com/maxnet/php-u2flib-server-cutdown/commit/92e208310a0528f1a921c26d451d5f1e130813c7
Still have to test it with a real token, but it passes your phpunit tests.
Next step would be te remove the dependency on phpseclib.

[klali]

Very interesting!
Please submit a pull request..

/klas