Darks FIDO2

Open-source Windows 11 FIDO2/WebAuthn authenticator with TPM-backed keys, local passkeys, and TOTP.

Windows 11 passkey manager and software FIDO2/WebAuthn authenticator. Darks FIDO2 is a local-first virtual passkey provider for passwordless sign-in and TOTP/2FA, using TPM 2.0-backed keys when available.

Warning

Experimental beta. Current downloads are self-signed, have no SmartScreen reputation, and have not received an independent security audit. Use disposable test accounts, verify SHA-256 checksums, and read the known limitations before trusting a real account.

Download beta · Quick start · Security model · Compatibility · Report a vulnerability

What it does

• Acts as a Windows 11 virtual passkey provider (software authenticator) for browser/app WebAuthn navigator.credentials.create() and get() requests.
• Creates a separate non-exportable ES256 key per virtual passkey, preferring TPM 2.0 and falling back to Microsoft Software KSP.
• Keeps local passkey records, TOTP seeds, TPM-key metadata, backups, and signed audit history inside independent encrypted profiles.
• Supports Windows Hello and external USB/NFC/BLE authenticators through the Windows WebAuthn API.

Why it is different

• Profile-bound credentials: the provider fails closed without a live unlocked profile and cannot reuse another profile's credential.
• Local-first: no account, cloud sync, telemetry, update call, or secret-bearing network path.
• Windows-native integration: Windows launches the packaged provider only for WebAuthn requests and Windows Hello remains mandatory for user verification.
• Transparent security limits: self-signed status, software fallbacks, pending website confirmation, and incomplete test coverage are shown rather than hidden.

Quick start

Requirements: Windows 11 24H2 or later, x64, and Windows Hello configured. TPM 2.0 is recommended but not mandatory.

1. Open the latest pre-release and verify the matching entry in SHA256SUMS.txt.
2. For the full provider path, deliberately trust the attached public development certificate in the current user's Trusted People store, then run DarksFIDO2-Setup.exe. Setup never changes certificate trust itself.
3. Open Settings > Accounts > Passkeys > Advanced options and enable Darks FIDO2 once.
4. Create and unlock a profile. Use a keyfile only if you can keep both it and the recovery code safely.
5. On a disposable test account, register a passkey and select Darks FIDO2 when Windows asks where to save it.
6. Confirm the website saved the passkey. If the website failed, remove the pending local credential only after verifying it is absent from the account.

The portable ZIP runs the manager but cannot install the packaged Windows provider by itself. It also lacks Program Files write protection.

Trust and verification

Document	Purpose
Threat model	Assets, boundaries, attacker actions, and residual risks
Compatibility	Windows, TPM, browser, and hardware test matrix
Known limitations	Distribution, provider, key-management, and test gaps
Architecture	Component/data-flow overview
Security policy	Private reporting and supported versions
Security audit	Focused maintainer review of CTAP CBOR and Windows WebAuthn
Checksums and SBOM	Per-release SHA-256 file and SPDX dependency inventory

Security-sensitive behavior includes profile-bound HKDF/AES-GCM protection, PBKDF2-HMAC-SHA-256 at 600,000 iterations, DPAPI/TPM wrapping, canonical bounded CTAP2 CBOR, strict native-buffer validation, required UP/UV, local ES256 assertion verification, zeroing of unlocked key arrays, durable protected-file replacement, and transactional keyfile/install flows. See the threat model for what these controls do not protect.

Current validation

• Release solution builds with zero warnings and errors.
• 22 hardware/security regression tests pass locally on an Infineon TPM 2.0.
• The Edge browser suite completes navigator.credentials.create() and get() using CTAP2, resident credentials, and required user verification.
• Locked NuGet dependencies are scanned for known direct and transitive vulnerabilities in CI.

The browser smoke test uses Chromium's virtual authenticator; it does not replace clean-machine MSIX/provider, UI, or multi-vendor hardware testing. Those gaps are tracked in Compatibility.

Build and test

Requirements: Windows 11 x64 and the .NET 10 SDK selected by global.json.

dotnet restore DarksFIDO2.slnx --locked-mode
dotnet build DarksFIDO2.slnx -c Release --no-restore
dotnet run --project tests\DarksFIDO2.Tests\DarksFIDO2.Tests.csproj -c Release --no-build
dotnet run --project tests\DarksFIDO2.BrowserTests\DarksFIDO2.BrowserTests.csproj -c Release --no-build

Signed release builds additionally require Windows SDK makeappx.exe, signtool.exe, and a code-signing key already protected in a Windows certificate store. See BUILDING.md.

Contributing

The most useful early contributions are compatibility reports, installer/provider testing, accessibility work, reproducible builds, documentation, and focused security review. Start with CONTRIBUTING.md, the good first issues, or Discussions.

Created and maintained by darkbyte-JS. See CONTRIBUTORS.md.

Release history and license

Release history is maintained in CHANGELOG.md.

Copyright 2026 darkbyte-JS and contributors. Licensed under the Apache License, Version 2.0, including its contributor patent grant and warranty/liability terms.