Add U2f Login Support (#787)

* init u2f

* ux fixes

* Cleanup Manage Controller

* final changes

* remove logs

* remove console log

* fix text for u2f

* Use Is Secure instead of IsHttps

* add some basic u2f tests

* move loaders to before title

* missing commit

* refactor after nicolas wtf moment

BTCPayServer.Tests/TestAccount.cs

@@ -113,15 +113,18 @@ namespace BTCPayServer.Tests
         private async Task RegisterAsync()
         {
             var account = parent.PayTester.GetController<AccountController>();
-            await account.Register(new RegisterViewModel()
+            RegisterDetails = new RegisterViewModel()
             {
                 Email = Guid.NewGuid() + "@toto.com",
                 ConfirmPassword = "Kitten0@",
                 Password = "Kitten0@",
-            });
+            };
+            await account.Register(RegisterDetails);
             UserId = account.RegisteredUserId;
         }
 
+        public RegisterViewModel RegisterDetails{ get; set; }
+
         public Bitpay BitPay
         {
             get; set;

BTCPayServer.Tests/UnitTest1.cs

@@ -56,6 +56,8 @@ using BTCPayServer.Configuration;
 using System.Security;
 using System.Runtime.CompilerServices;
 using System.Net;
+using BTCPayServer.Models.AccountViewModels;
+using BTCPayServer.Services.U2F.Models;
 
 namespace BTCPayServer.Tests
 {
@@ -2608,6 +2610,78 @@ donation:
 
         }
 
+        
+         [Fact]
+        [Trait("Integration", "Integration")]
+        public async Task CanLoginWithNoSecondaryAuthSystemsOrRequestItWhenAdded()
+        {
+            using (var tester = ServerTester.Create())
+            {
+                tester.Start();
+                var user = tester.NewAccount();
+                user.GrantAccess();
+
+               var accountController = tester.PayTester.GetController<AccountController>();
+
+               //no 2fa or u2f enabled, login should work
+               Assert.Equal(nameof(HomeController.Index), Assert.IsType<RedirectToActionResult>(await accountController.Login(new LoginViewModel()
+               {
+                   Email = user.RegisterDetails.Email,
+                   Password = user.RegisterDetails.Password
+               })).ActionName);
+
+               var manageController = user.GetController<ManageController>();
+               
+               //by default no u2f devices available
+               Assert.Empty(Assert.IsType<U2FAuthenticationViewModel>(Assert.IsType<ViewResult>(await manageController.U2FAuthentication()).Model).Devices);
+               var addRequest = Assert.IsType<AddU2FDeviceViewModel>(Assert.IsType<ViewResult>(manageController.AddU2FDevice("label")).Model);
+               //name should match the one provided in beginning
+               Assert.Equal("label",addRequest.Name);
+               
+               //sending an invalid response model back to server, should error out
+               var statusMessage = Assert
+                   .IsType<RedirectToActionResult>(await manageController.AddU2FDevice(addRequest))
+                   .RouteValues["StatusMessage"].ToString();
+               Assert.NotNull(statusMessage);
+               Assert.Equal(StatusMessageModel.StatusSeverity.Error, new StatusMessageModel(statusMessage).Severity);
+
+               var contextFactory = tester.PayTester.GetService<ApplicationDbContextFactory>();
+
+               //add a fake u2f device in db directly since emulating a u2f device is hard and annoying
+               using (var context = contextFactory.CreateContext())
+               {
+                   var newDevice = new U2FDevice()
+                   {
+                       Name = "fake",
+                       Counter = 0,
+                       KeyHandle = UTF8Encoding.UTF8.GetBytes("fake"),
+                       PublicKey= UTF8Encoding.UTF8.GetBytes("fake"),
+                       AttestationCert= UTF8Encoding.UTF8.GetBytes("fake"),
+                       ApplicationUserId= user.UserId
+                   };
+                   await context.U2FDevices.AddAsync(newDevice);
+                   await context.SaveChangesAsync();
+                   
+                   Assert.NotNull(newDevice.Id);
+                   Assert.NotEmpty(Assert.IsType<U2FAuthenticationViewModel>(Assert.IsType<ViewResult>(await manageController.U2FAuthentication()).Model).Devices);
+                   
+               }
+
+               //check if we are showing the u2f login screen now
+               var secondLoginResult = Assert.IsType<ViewResult>(await accountController.Login(new LoginViewModel()
+               {
+                   Email = user.RegisterDetails.Email,
+                   Password = user.RegisterDetails.Password
+               }));
+
+               Assert.Equal("SecondaryLogin", secondLoginResult.ViewName);
+               var vm = Assert.IsType<SecondaryLoginViewModel>(secondLoginResult.Model);
+               //2fa was never enabled for user so this should be empty
+               Assert.Null(vm.LoginWith2FaViewModel);
+               Assert.NotNull(vm.LoginWithU2FViewModel);               
+            }
+        }
+        
         private static bool IsMapped(Invoice invoice, ApplicationDbContext ctx)
         {
             var h = BitcoinAddress.Create(invoice.BitcoinAddress, Network.RegTest).ScriptPubKey.Hash.ToString();

BTCPayServer/BTCPayServer.csproj

@@ -74,6 +74,7 @@
     <PackageReference Include="TwentyTwenty.Storage.Azure" Version="2.10.1" />
     <PackageReference Include="TwentyTwenty.Storage.Google" Version="2.10.1" />
     <PackageReference Include="TwentyTwenty.Storage.Local" Version="2.10.1" />
+    <PackageReference Include="U2F.Core" Version="2.0.1" />
 		<PackageReference Include="YamlDotNet" Version="5.2.1" />
 	</ItemGroup>
 
@@ -129,9 +130,11 @@
 
 	<ItemGroup>
 	  <Folder Include="Build\" />
+	  <Folder Include="U2F\Services" />
 	  <Folder Include="wwwroot\vendor\clipboard.js\" />
 	  <Folder Include="wwwroot\vendor\highlightjs\" />
 	  <Folder Include="wwwroot\vendor\summernote" />
+	  <Folder Include="wwwroot\vendor\u2f" />
 	</ItemGroup>
 
 	<ItemGroup>

BTCPayServer/Controllers/AccountController.cs

@@ -18,6 +18,9 @@ using BTCPayServer.Services.Stores;
 using BTCPayServer.Logging;
 using BTCPayServer.Security;
 using System.Globalization;
+using BTCPayServer.Services.U2F;
+using BTCPayServer.Services.U2F.Models;
+using Newtonsoft.Json;
 using NicolasDorier.RateLimits;
 
 namespace BTCPayServer.Controllers
@@ -33,6 +36,8 @@ namespace BTCPayServer.Controllers
         RoleManager<IdentityRole> _RoleManager;
         SettingsRepository _SettingsRepository;
         Configuration.BTCPayServerOptions _Options;
+        private readonly BTCPayServerEnvironment _btcPayServerEnvironment;
+        private readonly U2FService _u2FService;
         ILogger _logger;
 
         public AccountController(
@@ -42,7 +47,9 @@ namespace BTCPayServer.Controllers
             SignInManager<ApplicationUser> signInManager,
             EmailSenderFactory emailSenderFactory,
             SettingsRepository settingsRepository,
-            Configuration.BTCPayServerOptions options)
+            Configuration.BTCPayServerOptions options,
+            BTCPayServerEnvironment btcPayServerEnvironment,
+            U2FService u2FService)
         {
             this.storeRepository = storeRepository;
             _userManager = userManager;
@@ -51,6 +58,8 @@ namespace BTCPayServer.Controllers
             _RoleManager = roleManager;
             _SettingsRepository = settingsRepository;
             _Options = options;
+            _btcPayServerEnvironment = btcPayServerEnvironment;
+            _u2FService = u2FService;
             _logger = Logs.PayServer;
         }
 
@@ -91,8 +100,39 @@ namespace BTCPayServer.Controllers
                         return View(model);
                     }
                 }
-                // This doesn't count login failures towards account lockout
-                // To enable password failures to trigger account lockout, set lockoutOnFailure: true
+
+                if (!await _userManager.IsLockedOutAsync(user) && await _u2FService.HasDevices(user.Id))
+                {
+                    if (await _userManager.CheckPasswordAsync(user, model.Password))
+                    {
+                        LoginWith2faViewModel twoFModel = null;
+                        
+                        if (user.TwoFactorEnabled)
+                        {
+                            // we need to do an actual sign in attempt so that 2fa can function in next step
+                            await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: true);
+                            twoFModel = new LoginWith2faViewModel
+                            {
+                                RememberMe = model.RememberMe
+                            };
+                        }
+
+                        return View("SecondaryLogin", new SecondaryLoginViewModel()
+                        {
+                            LoginWith2FaViewModel = twoFModel,
+                            LoginWithU2FViewModel = await BuildU2FViewModel(model.RememberMe, user)
+                        });
+                    }
+                    else
+                    {
+                      var incrementAccessFailedResult = await  _userManager.AccessFailedAsync(user);
+                      ModelState.AddModelError(string.Empty, "Invalid login attempt.");
+                      return View(model);
+                      
+                    }
+                }
+                
+               
                 var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: true);
                 if (result.Succeeded)
                 {
@@ -101,10 +141,12 @@ namespace BTCPayServer.Controllers
                 }
                 if (result.RequiresTwoFactor)
                 {
-                    return RedirectToAction(nameof(LoginWith2fa), new
+                    return View("SecondaryLogin", new SecondaryLoginViewModel()
                     {
-                        returnUrl,
-                        model.RememberMe
+                        LoginWith2FaViewModel = new LoginWith2faViewModel()
+                        {
+                            RememberMe = model.RememberMe
+                        }
                     });
                 }
                 if (result.IsLockedOut)
@@ -123,6 +165,71 @@ namespace BTCPayServer.Controllers
             return View(model);
         }
 
+        private async Task<LoginWithU2FViewModel> BuildU2FViewModel(bool rememberMe, ApplicationUser user)
+        {
+            if (_btcPayServerEnvironment.IsSecure)
+            {
+                var u2fChallenge = await _u2FService.GenerateDeviceChallenges(user.Id,
+                    Request.GetAbsoluteUriNoPathBase().ToString().TrimEnd('/'));
+
+                return new LoginWithU2FViewModel()
+                {
+                    Version = u2fChallenge[0].version,
+                    Challenge = u2fChallenge[0].challenge,
+                    Challenges = JsonConvert.SerializeObject(u2fChallenge),
+                    AppId = u2fChallenge[0].appId,
+                    UserId = user.Id,
+                    RememberMe = rememberMe
+                };
+            }
+
+            return null;
+        }
+
+        [HttpPost]
+        [AllowAnonymous]
+        [ValidateAntiForgeryToken]
+        public async Task<IActionResult> LoginWithU2F(LoginWithU2FViewModel viewModel, string returnUrl = null)
+        {
+            ViewData["ReturnUrl"] = returnUrl;
+            var user = await _userManager.FindByIdAsync(viewModel.UserId);
+
+            if (user == null)
+            {
+                return NotFound();
+            }
+
+            var errorMessage = string.Empty;
+            try
+            {
+                if (await _u2FService.AuthenticateUser(viewModel.UserId, viewModel.DeviceResponse))
+                {
+                    await _signInManager.SignInAsync(user, viewModel.RememberMe, "U2F");
+                    _logger.LogInformation("User logged in.");
+                    return RedirectToLocal(returnUrl);
+                }
+
+                errorMessage = "Invalid login attempt.";
+            }
+            catch (Exception e)
+            {
+
+                errorMessage = e.Message;
+            }
+
+            ModelState.AddModelError(string.Empty, errorMessage);
+            return View("SecondaryLogin", new SecondaryLoginViewModel()
+            {
+                LoginWithU2FViewModel = viewModel,
+                LoginWith2FaViewModel = !user.TwoFactorEnabled
+                    ? null
+                    : new LoginWith2faViewModel()
+                    {
+                        RememberMe = viewModel.RememberMe
+                    }
+            });
+        }
+
         [HttpGet]
         [AllowAnonymous]
         public async Task<IActionResult> LoginWith2fa(bool rememberMe, string returnUrl = null)
@@ -135,10 +242,13 @@ namespace BTCPayServer.Controllers
                 throw new ApplicationException($"Unable to load two-factor authentication user.");
             }
 
-            var model = new LoginWith2faViewModel { RememberMe = rememberMe };
             ViewData["ReturnUrl"] = returnUrl;
 
-            return View(model);
+            return View("SecondaryLogin", new SecondaryLoginViewModel()
+            {
+                LoginWith2FaViewModel = new LoginWith2faViewModel { RememberMe = rememberMe },
+                LoginWithU2FViewModel =  (await _u2FService.HasDevices(user.Id))? await BuildU2FViewModel(rememberMe, user): null
+            });
         }
 
         [HttpPost]
@@ -175,7 +285,11 @@ namespace BTCPayServer.Controllers
             {
                 _logger.LogWarning("Invalid authenticator code entered for user with ID {UserId}.", user.Id);
                 ModelState.AddModelError(string.Empty, "Invalid authenticator code.");
-                return View();
+                return View("SecondaryLogin", new SecondaryLoginViewModel()
+                {
+                    LoginWith2FaViewModel = model,
+                    LoginWithU2FViewModel =  (await _u2FService.HasDevices(user.Id))? await BuildU2FViewModel(rememberMe, user): null
+                });
             }
         }
 

BTCPayServer/Controllers/ManageController.2FA.cs

@@ -0,0 +1,205 @@
+using System;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using BTCPayServer.Models.ManageViewModels;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+
+namespace BTCPayServer.Controllers
+{
+    public partial class ManageController
+    {
+        private const string AuthenicatorUriFormat = "otpauth://totp/{0}:{1}?secret={2}&issuer={0}&digits=6";
+
+        [HttpGet]
+        public async Task<IActionResult> TwoFactorAuthentication()
+        {
+            var user = await _userManager.GetUserAsync(User);
+            if (user == null)
+            {
+                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+            }
+
+            var model = new TwoFactorAuthenticationViewModel
+            {
+                HasAuthenticator = await _userManager.GetAuthenticatorKeyAsync(user) != null,
+                Is2faEnabled = user.TwoFactorEnabled,
+                RecoveryCodesLeft = await _userManager.CountRecoveryCodesAsync(user),
+            };
+
+            return View(model);
+        }
+
+        [HttpGet]
+        public async Task<IActionResult> Disable2faWarning()
+        {
+            var user = await _userManager.GetUserAsync(User);
+            if (user == null)
+            {
+                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+            }
+
+            if (!user.TwoFactorEnabled)
+            {
+                throw new ApplicationException(
+                    $"Unexpected error occurred disabling 2FA for user with ID '{user.Id}'.");
+            }
+
+            return View(nameof(Disable2fa));
+        }
+
+        [HttpPost]
+        [ValidateAntiForgeryToken]
+        public async Task<IActionResult> Disable2fa()
+        {
+            var user = await _userManager.GetUserAsync(User);
+            if (user == null)
+            {
+                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+            }
+
+            var disable2faResult = await _userManager.SetTwoFactorEnabledAsync(user, false);
+            if (!disable2faResult.Succeeded)
+            {
+                throw new ApplicationException(
+                    $"Unexpected error occurred disabling 2FA for user with ID '{user.Id}'.");
+            }
+
+            _logger.LogInformation("User with ID {UserId} has disabled 2fa.", user.Id);
+            return RedirectToAction(nameof(TwoFactorAuthentication));
+        }
+
+        [HttpGet]
+        public async Task<IActionResult> EnableAuthenticator()
+        {
+            var user = await _userManager.GetUserAsync(User);
+            if (user == null)
+            {
+                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+            }
+
+            var unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
+            if (string.IsNullOrEmpty(unformattedKey))
+            {
+                await _userManager.ResetAuthenticatorKeyAsync(user);
+                unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
+            }
+
+            var model = new EnableAuthenticatorViewModel
+            {
+                SharedKey = FormatKey(unformattedKey),
+                AuthenticatorUri = GenerateQrCodeUri(user.Email, unformattedKey)
+            };
+
+            return View(model);
+        }
+
+        [HttpPost]
+        [ValidateAntiForgeryToken]
+        public async Task<IActionResult> EnableAuthenticator(EnableAuthenticatorViewModel model)
+        {
+            if (!ModelState.IsValid)
+            {
+                return View(model);
+            }
+
+            var user = await _userManager.GetUserAsync(User);
+            if (user == null)
+            {
+                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+            }
+
+            // Strip spaces and hypens
+            var verificationCode = model.Code.Replace(" ", string.Empty, StringComparison.InvariantCulture)
+                .Replace("-", string.Empty, StringComparison.InvariantCulture);
+
+            var is2faTokenValid = await _userManager.VerifyTwoFactorTokenAsync(
+                user, _userManager.Options.Tokens.AuthenticatorTokenProvider, verificationCode);
+
+            if (!is2faTokenValid)
+            {
+                ModelState.AddModelError(nameof(model.Code), "Verification code is invalid.");
+                return View(model);
+            }
+
+            await _userManager.SetTwoFactorEnabledAsync(user, true);
+            _logger.LogInformation("User with ID {UserId} has enabled 2FA with an authenticator app.", user.Id);
+            return RedirectToAction(nameof(GenerateRecoveryCodes));
+        }
+
+        [HttpGet]
+        public IActionResult ResetAuthenticatorWarning()
+        {
+            return View(nameof(ResetAuthenticator));
+        }
+
+        [HttpPost]
+        [ValidateAntiForgeryToken]
+        public async Task<IActionResult> ResetAuthenticator()
+        {
+            var user = await _userManager.GetUserAsync(User);
+            if (user == null)
+            {
+                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+            }
+
+            await _userManager.SetTwoFactorEnabledAsync(user, false);
+            await _userManager.ResetAuthenticatorKeyAsync(user);
+            _logger.LogInformation("User with id '{UserId}' has reset their authentication app key.", user.Id);
+
+            return RedirectToAction(nameof(EnableAuthenticator));
+        }
+
+        [HttpGet]
+        public async Task<IActionResult> GenerateRecoveryCodes()
+        {
+            var user = await _userManager.GetUserAsync(User);
+            if (user == null)
+            {
+                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+            }
+
+            if (!user.TwoFactorEnabled)
+            {
+                throw new ApplicationException(
+                    $"Cannot generate recovery codes for user with ID '{user.Id}' as they do not have 2FA enabled.");
+            }
+
+            var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);
+            var model = new GenerateRecoveryCodesViewModel {RecoveryCodes = recoveryCodes.ToArray()};
+
+            _logger.LogInformation("User with ID {UserId} has generated new 2FA recovery codes.", user.Id);
+
+            return View(model);
+        }
+
+        private string GenerateQrCodeUri(string email, string unformattedKey)
+        {
+            return string.Format(CultureInfo.InvariantCulture,
+                AuthenicatorUriFormat,
+                _urlEncoder.Encode("BTCPayServer"),
+                _urlEncoder.Encode(email),
+                unformattedKey);
+        }
+
+        private string FormatKey(string unformattedKey)
+        {
+            var result = new StringBuilder();
+            int currentPosition = 0;
+            while (currentPosition + 4 < unformattedKey.Length)
+            {
+                result.Append(unformattedKey.Substring(currentPosition, 4)).Append(" ");
+                currentPosition += 4;
+            }
+
+            if (currentPosition < unformattedKey.Length)
+            {
+                result.Append(unformattedKey.Substring(currentPosition));
+            }
+
+            return result.ToString().ToLowerInvariant();
+        }
+    }
+}

BTCPayServer/Controllers/ManageController.U2F.cs

@@ -0,0 +1,87 @@
+using System;
+using System.Threading.Tasks;
+using BTCPayServer.Models;
+using BTCPayServer.Services.U2F.Models;
+using Microsoft.AspNetCore.Mvc;
+
+namespace BTCPayServer.Controllers
+{
+    public partial class ManageController
+    {
+        [HttpGet]
+        public async Task<IActionResult> U2FAuthentication(string statusMessage = null)
+        {
+            return View(new U2FAuthenticationViewModel()
+            {
+                StatusMessage = statusMessage,
+                Devices = await _u2FService.GetDevices(_userManager.GetUserId(User))
+            });
+        }
+
+        [HttpGet]
+        public async Task<IActionResult> RemoveU2FDevice(string id)
+        {
+            await _u2FService.RemoveDevice(id, _userManager.GetUserId(User));
+            return RedirectToAction("U2FAuthentication", new
+            {
+                StatusMessage = "Device removed"
+            });
+        }
+
+        [HttpGet]
+        public IActionResult AddU2FDevice(string name)
+        {
+            if (!_btcPayServerEnvironment.IsSecure)
+            {
+                return RedirectToAction("U2FAuthentication", new
+                {
+                    StatusMessage = new StatusMessageModel()
+                    {
+                        Severity = StatusMessageModel.StatusSeverity.Error,
+                        Message = "Cannot register U2F device while not on https or tor"
+                    }
+                });
+            }
+
+            var serverRegisterResponse = _u2FService.StartDeviceRegistration(_userManager.GetUserId(User),
+                Request.GetAbsoluteUriNoPathBase().ToString().TrimEnd('/'));
+
+            return View(new AddU2FDeviceViewModel()
+            {
+                AppId = serverRegisterResponse.AppId,
+                Challenge = serverRegisterResponse.Challenge,
+                Version = serverRegisterResponse.Version,
+                Name = name
+            });
+        }
+
+        [HttpPost]
+        public async Task<IActionResult> AddU2FDevice(AddU2FDeviceViewModel viewModel)
+        {
+            try
+            {
+                if (await _u2FService.CompleteRegistration(_userManager.GetUserId(User), viewModel.DeviceResponse,
+                    string.IsNullOrEmpty(viewModel.Name) ? "Unlabelled U2F Device" : viewModel.Name))
+                {
+                    return RedirectToAction("U2FAuthentication", new
+                    {
+                        StatusMessage = "Device added!"
+                    });
+                }
+
+                throw new Exception("Could not add device.");
+            }
+            catch (Exception e)
+            {
+                return RedirectToAction("U2FAuthentication", new
+                {
+                    StatusMessage = new StatusMessageModel()
+                    {
+                        Severity = StatusMessageModel.StatusSeverity.Error,
+                        Message = e.Message
+                    }
+                });
+            }
+        }
+    }
+}

BTCPayServer/Controllers/ManageController.cs

@@ -1,5 +1,4 @@
 using System;
-using System.Collections.Generic;
 using System.Linq;
 using System.Text;
 using System.Text.Encodings.Web;
@@ -9,25 +8,23 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Options;
 using BTCPayServer.Models;
 using BTCPayServer.Models.ManageViewModels;
 using BTCPayServer.Services;
 using BTCPayServer.Authentication;
 using Microsoft.AspNetCore.Hosting;
-using NBitpayClient;
-using NBitcoin;
 using BTCPayServer.Services.Stores;
 using BTCPayServer.Services.Wallets;
 using BTCPayServer.Services.Mails;
 using System.Globalization;
 using BTCPayServer.Security;
+using BTCPayServer.Services.U2F;
 
 namespace BTCPayServer.Controllers
 {
     [Authorize(AuthenticationSchemes = Policies.CookieAuthentication)]
     [Route("[controller]/[action]")]
-    public class ManageController : Controller
+    public partial class ManageController : Controller
     {
         private readonly UserManager<ApplicationUser> _userManager;
         private readonly SignInManager<ApplicationUser> _signInManager;
@@ -36,10 +33,11 @@ namespace BTCPayServer.Controllers
         private readonly UrlEncoder _urlEncoder;
         TokenRepository _TokenRepository;
         IHostingEnvironment _Env;
+        private readonly U2FService _u2FService;
+        private readonly BTCPayServerEnvironment _btcPayServerEnvironment;
         StoreRepository _StoreRepository;
 
 
-        private const string AuthenicatorUriFormat = "otpauth://totp/{0}:{1}?secret={2}&issuer={0}&digits=6";
 
         public ManageController(
           UserManager<ApplicationUser> userManager,
@@ -50,7 +48,9 @@ namespace BTCPayServer.Controllers
           TokenRepository tokenRepository,
           BTCPayWalletProvider walletProvider,
           StoreRepository storeRepository,
-          IHostingEnvironment env)
+          IHostingEnvironment env, 
+          U2FService  u2FService,
+          BTCPayServerEnvironment btcPayServerEnvironment)
         {
             _userManager = userManager;
             _signInManager = signInManager;
@@ -59,6 +59,8 @@ namespace BTCPayServer.Controllers
             _urlEncoder = urlEncoder;
             _TokenRepository = tokenRepository;
             _Env = env;
+            _u2FService = u2FService;
+            _btcPayServerEnvironment = btcPayServerEnvironment;
             _StoreRepository = storeRepository;
         }
 
@@ -339,163 +341,6 @@ namespace BTCPayServer.Controllers
             return RedirectToAction(nameof(ExternalLogins));
         }
 
-        [HttpGet]
-        public async Task<IActionResult> TwoFactorAuthentication()
-        {
-            var user = await _userManager.GetUserAsync(User);
-            if (user == null)
-            {
-                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
-            }
-
-            var model = new TwoFactorAuthenticationViewModel
-            {
-                HasAuthenticator = await _userManager.GetAuthenticatorKeyAsync(user) != null,
-                Is2faEnabled = user.TwoFactorEnabled,
-                RecoveryCodesLeft = await _userManager.CountRecoveryCodesAsync(user),
-            };
-
-            return View(model);
-        }
-
-        [HttpGet]
-        public async Task<IActionResult> Disable2faWarning()
-        {
-            var user = await _userManager.GetUserAsync(User);
-            if (user == null)
-            {
-                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
-            }
-
-            if (!user.TwoFactorEnabled)
-            {
-                throw new ApplicationException($"Unexpected error occurred disabling 2FA for user with ID '{user.Id}'.");
-            }
-
-            return View(nameof(Disable2fa));
-        }
-
-        [HttpPost]
-        [ValidateAntiForgeryToken]
-        public async Task<IActionResult> Disable2fa()
-        {
-            var user = await _userManager.GetUserAsync(User);
-            if (user == null)
-            {
-                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
-            }
-
-            var disable2faResult = await _userManager.SetTwoFactorEnabledAsync(user, false);
-            if (!disable2faResult.Succeeded)
-            {
-                throw new ApplicationException($"Unexpected error occurred disabling 2FA for user with ID '{user.Id}'.");
-            }
-
-            _logger.LogInformation("User with ID {UserId} has disabled 2fa.", user.Id);
-            return RedirectToAction(nameof(TwoFactorAuthentication));
-        }
-
-        [HttpGet]
-        public async Task<IActionResult> EnableAuthenticator()
-        {
-            var user = await _userManager.GetUserAsync(User);
-            if (user == null)
-            {
-                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
-            }
-
-            var unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
-            if (string.IsNullOrEmpty(unformattedKey))
-            {
-                await _userManager.ResetAuthenticatorKeyAsync(user);
-                unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
-            }
-
-            var model = new EnableAuthenticatorViewModel
-            {
-                SharedKey = FormatKey(unformattedKey),
-                AuthenticatorUri = GenerateQrCodeUri(user.Email, unformattedKey)
-            };
-
-            return View(model);
-        }
-
-        [HttpPost]
-        [ValidateAntiForgeryToken]
-        public async Task<IActionResult> EnableAuthenticator(EnableAuthenticatorViewModel model)
-        {
-            if (!ModelState.IsValid)
-            {
-                return View(model);
-            }
-
-            var user = await _userManager.GetUserAsync(User);
-            if (user == null)
-            {
-                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
-            }
-
-            // Strip spaces and hypens
-            var verificationCode = model.Code.Replace(" ", string.Empty, StringComparison.InvariantCulture).Replace("-", string.Empty, StringComparison.InvariantCulture);
-
-            var is2faTokenValid = await _userManager.VerifyTwoFactorTokenAsync(
-                user, _userManager.Options.Tokens.AuthenticatorTokenProvider, verificationCode);
-
-            if (!is2faTokenValid)
-            {
-                ModelState.AddModelError(nameof(model.Code), "Verification code is invalid.");
-                return View(model);
-            }
-
-            await _userManager.SetTwoFactorEnabledAsync(user, true);
-            _logger.LogInformation("User with ID {UserId} has enabled 2FA with an authenticator app.", user.Id);
-            return RedirectToAction(nameof(GenerateRecoveryCodes));
-        }
-
-        [HttpGet]
-        public IActionResult ResetAuthenticatorWarning()
-        {
-            return View(nameof(ResetAuthenticator));
-        }
-
-        [HttpPost]
-        [ValidateAntiForgeryToken]
-        public async Task<IActionResult> ResetAuthenticator()
-        {
-            var user = await _userManager.GetUserAsync(User);
-            if (user == null)
-            {
-                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
-            }
-
-            await _userManager.SetTwoFactorEnabledAsync(user, false);
-            await _userManager.ResetAuthenticatorKeyAsync(user);
-            _logger.LogInformation("User with id '{UserId}' has reset their authentication app key.", user.Id);
-
-            return RedirectToAction(nameof(EnableAuthenticator));
-        }
-
-        [HttpGet]
-        public async Task<IActionResult> GenerateRecoveryCodes()
-        {
-            var user = await _userManager.GetUserAsync(User);
-            if (user == null)
-            {
-                throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
-            }
-
-            if (!user.TwoFactorEnabled)
-            {
-                throw new ApplicationException($"Cannot generate recovery codes for user with ID '{user.Id}' as they do not have 2FA enabled.");
-            }
-
-            var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);
-            var model = new GenerateRecoveryCodesViewModel { RecoveryCodes = recoveryCodes.ToArray() };
-
-            _logger.LogInformation("User with ID {UserId} has generated new 2FA recovery codes.", user.Id);
-
-            return View(model);
-        }
 
         #region Helpers
 
@@ -506,33 +351,6 @@ namespace BTCPayServer.Controllers
                 ModelState.AddModelError(string.Empty, error.Description);
             }
         }
-
-        private string FormatKey(string unformattedKey)
-        {
-            var result = new StringBuilder();
-            int currentPosition = 0;
-            while (currentPosition + 4 < unformattedKey.Length)
-            {
-                result.Append(unformattedKey.Substring(currentPosition, 4)).Append(" ");
-                currentPosition += 4;
-            }
-            if (currentPosition < unformattedKey.Length)
-            {
-                result.Append(unformattedKey.Substring(currentPosition));
-            }
-
-            return result.ToString().ToLowerInvariant();
-        }
-
-        private string GenerateQrCodeUri(string email, string unformattedKey)
-        {
-            return string.Format(CultureInfo.InvariantCulture,
-                AuthenicatorUriFormat,
-                _urlEncoder.Encode("BTCPayServer"),
-                _urlEncoder.Encode(email),
-                unformattedKey);
-        }
-
         #endregion
     }
 }

BTCPayServer/Data/ApplicationDbContext.cs

@@ -3,6 +3,7 @@ using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore;
 using BTCPayServer.Models;
 using BTCPayServer.Services.PaymentRequests;
+using BTCPayServer.Services.U2F.Models;
 using BTCPayServer.Storage.Models;
 using Microsoft.EntityFrameworkCore.Infrastructure;
 
@@ -98,7 +99,10 @@ namespace BTCPayServer.Data
         {
             get; set;
         }
+       
 
+        public DbSet<U2FDevice> U2FDevices { get; set; }   
+        
         protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
         {
             var isConfigured = optionsBuilder.Options.Extensions.OfType<RelationalOptionsExtension>().Any();
@@ -223,4 +227,5 @@ namespace BTCPayServer.Data
                 .HasIndex(o => o.Status);
         }
     }
+
 }

BTCPayServer/Hosting/BTCPayServerServices.cs

@@ -47,6 +47,7 @@ using NBXplorer.DerivationStrategy;
 using NicolasDorier.RateLimits;
 using Npgsql;
 using BTCPayServer.Services.Apps;
+using BTCPayServer.Services.U2F;
 using BundlerMinifier.TagHelpers;
 
 namespace BTCPayServer.Hosting
@@ -80,6 +81,7 @@ namespace BTCPayServer.Hosting
             services.TryAddSingleton<TokenRepository>();
             services.TryAddSingleton<EventAggregator>();
             services.TryAddSingleton<PaymentRequestService>();
+            services.TryAddSingleton<U2FService>();
             services.TryAddSingleton<CoinAverageSettings>();
             services.TryAddSingleton<ApplicationDbContextFactory>(o => 
             {

BTCPayServer/Migrations/20190425081749_AddU2fDevices.Designer.cs

@@ -0,0 +1,667 @@
+// <auto-generated />
+using System;
+using BTCPayServer.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+namespace BTCPayServer.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20190425081749_AddU2fDevices")]
+    partial class AddU2fDevices
+    {
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "2.1.8-servicing-32085");
+
+            modelBuilder.Entity("BTCPayServer.Data.AddressInvoiceData", b =>
+                {
+                    b.Property<string>("Address")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<DateTimeOffset?>("CreatedTime");
+
+                    b.Property<string>("InvoiceDataId");
+
+                    b.HasKey("Address");
+
+                    b.HasIndex("InvoiceDataId");
+
+                    b.ToTable("AddressInvoices");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.APIKeyData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasMaxLength(50);
+
+                    b.Property<string>("StoreId")
+                        .HasMaxLength(50);
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("StoreId");
+
+                    b.ToTable("ApiKeys");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.AppData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("AppType");
+
+                    b.Property<DateTimeOffset>("Created");
+
+                    b.Property<string>("Name");
+
+                    b.Property<string>("Settings");
+
+                    b.Property<string>("StoreDataId");
+
+                    b.Property<bool>("TagAllInvoices");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("StoreDataId");
+
+                    b.ToTable("Apps");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.HistoricalAddressInvoiceData", b =>
+                {
+                    b.Property<string>("InvoiceDataId");
+
+                    b.Property<string>("Address");
+
+                    b.Property<DateTimeOffset>("Assigned");
+
+                    b.Property<string>("CryptoCode");
+
+                    b.Property<DateTimeOffset?>("UnAssigned");
+
+                    b.HasKey("InvoiceDataId", "Address");
+
+                    b.ToTable("HistoricalAddressInvoices");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.InvoiceData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<byte[]>("Blob");
+
+                    b.Property<DateTimeOffset>("Created");
+
+                    b.Property<string>("CustomerEmail");
+
+                    b.Property<string>("ExceptionStatus");
+
+                    b.Property<string>("ItemCode");
+
+                    b.Property<string>("OrderId");
+
+                    b.Property<string>("Status");
+
+                    b.Property<string>("StoreDataId");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("StoreDataId");
+
+                    b.ToTable("Invoices");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.InvoiceEventData", b =>
+                {
+                    b.Property<string>("InvoiceDataId");
+
+                    b.Property<string>("UniqueId");
+
+                    b.Property<string>("Message");
+
+                    b.Property<DateTimeOffset>("Timestamp");
+
+                    b.HasKey("InvoiceDataId", "UniqueId");
+
+                    b.ToTable("InvoiceEvents");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.PairedSINData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("Label");
+
+                    b.Property<DateTimeOffset>("PairingTime");
+
+                    b.Property<string>("SIN");
+
+                    b.Property<string>("StoreDataId");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("SIN");
+
+                    b.HasIndex("StoreDataId");
+
+                    b.ToTable("PairedSINData");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.PairingCodeData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<DateTime>("DateCreated");
+
+                    b.Property<DateTimeOffset>("Expiration");
+
+                    b.Property<string>("Facade");
+
+                    b.Property<string>("Label");
+
+                    b.Property<string>("SIN");
+
+                    b.Property<string>("StoreDataId");
+
+                    b.Property<string>("TokenValue");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("PairingCodes");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.PaymentData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<bool>("Accounted");
+
+                    b.Property<byte[]>("Blob");
+
+                    b.Property<string>("InvoiceDataId");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InvoiceDataId");
+
+                    b.ToTable("Payments");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.PendingInvoiceData", b =>
+                {
+                    b.Property<string>("Id");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("PendingInvoices");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.RefundAddressesData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<byte[]>("Blob");
+
+                    b.Property<string>("InvoiceDataId");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InvoiceDataId");
+
+                    b.ToTable("RefundAddresses");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.SettingData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("Value");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("Settings");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.StoreData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("DefaultCrypto");
+
+                    b.Property<string>("DerivationStrategies");
+
+                    b.Property<string>("DerivationStrategy");
+
+                    b.Property<int>("SpeedPolicy");
+
+                    b.Property<byte[]>("StoreBlob");
+
+                    b.Property<byte[]>("StoreCertificate");
+
+                    b.Property<string>("StoreName");
+
+                    b.Property<string>("StoreWebsite");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("Stores");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.UserStore", b =>
+                {
+                    b.Property<string>("ApplicationUserId");
+
+                    b.Property<string>("StoreDataId");
+
+                    b.Property<string>("Role");
+
+                    b.HasKey("ApplicationUserId", "StoreDataId");
+
+                    b.HasIndex("StoreDataId");
+
+                    b.ToTable("UserStore");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Models.ApplicationUser", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<int>("AccessFailedCount");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken();
+
+                    b.Property<string>("Email")
+                        .HasMaxLength(256);
+
+                    b.Property<bool>("EmailConfirmed");
+
+                    b.Property<bool>("LockoutEnabled");
+
+                    b.Property<DateTimeOffset?>("LockoutEnd");
+
+                    b.Property<string>("NormalizedEmail")
+                        .HasMaxLength(256);
+
+                    b.Property<string>("NormalizedUserName")
+                        .HasMaxLength(256);
+
+                    b.Property<string>("PasswordHash");
+
+                    b.Property<string>("PhoneNumber");
+
+                    b.Property<bool>("PhoneNumberConfirmed");
+
+                    b.Property<bool>("RequiresEmailConfirmation");
+
+                    b.Property<string>("SecurityStamp");
+
+                    b.Property<bool>("TwoFactorEnabled");
+
+                    b.Property<string>("UserName")
+                        .HasMaxLength(256);
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedEmail")
+                        .HasName("EmailIndex");
+
+                    b.HasIndex("NormalizedUserName")
+                        .IsUnique()
+                        .HasName("UserNameIndex");
+
+                    b.ToTable("AspNetUsers");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Services.PaymentRequests.PaymentRequestData", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<byte[]>("Blob");
+
+                    b.Property<int>("Status");
+
+                    b.Property<string>("StoreDataId");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("StoreDataId");
+
+                    b.ToTable("PaymentRequests");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Services.U2F.Models.U2FDevice", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("ApplicationUserId");
+
+                    b.Property<byte[]>("AttestationCert")
+                        .IsRequired();
+
+                    b.Property<int>("Counter");
+
+                    b.Property<byte[]>("KeyHandle")
+                        .IsRequired();
+
+                    b.Property<string>("Name");
+
+                    b.Property<byte[]>("PublicKey")
+                        .IsRequired();
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApplicationUserId");
+
+                    b.ToTable("U2FDevices");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Storage.Models.StoredFile", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("ApplicationUserId");
+
+                    b.Property<string>("FileName");
+
+                    b.Property<string>("StorageFileName");
+
+                    b.Property<DateTime>("Timestamp");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApplicationUserId");
+
+                    b.ToTable("Files");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken();
+
+                    b.Property<string>("Name")
+                        .HasMaxLength(256);
+
+                    b.Property<string>("NormalizedName")
+                        .HasMaxLength(256);
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedName")
+                        .IsUnique()
+                        .HasName("RoleNameIndex");
+
+                    b.ToTable("AspNetRoles");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("ClaimType");
+
+                    b.Property<string>("ClaimValue");
+
+                    b.Property<string>("RoleId")
+                        .IsRequired();
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetRoleClaims");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("ClaimType");
+
+                    b.Property<string>("ClaimValue");
+
+                    b.Property<string>("UserId")
+                        .IsRequired();
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserClaims");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.Property<string>("LoginProvider");
+
+                    b.Property<string>("ProviderKey");
+
+                    b.Property<string>("ProviderDisplayName");
+
+                    b.Property<string>("UserId")
+                        .IsRequired();
+
+                    b.HasKey("LoginProvider", "ProviderKey");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserLogins");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.Property<string>("UserId");
+
+                    b.Property<string>("RoleId");
+
+                    b.HasKey("UserId", "RoleId");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetUserRoles");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.Property<string>("UserId");
+
+                    b.Property<string>("LoginProvider");
+
+                    b.Property<string>("Name");
+
+                    b.Property<string>("Value");
+
+                    b.HasKey("UserId", "LoginProvider", "Name");
+
+                    b.ToTable("AspNetUserTokens");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.AddressInvoiceData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.InvoiceData", "InvoiceData")
+                        .WithMany("AddressInvoices")
+                        .HasForeignKey("InvoiceDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.APIKeyData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.StoreData", "StoreData")
+                        .WithMany("APIKeys")
+                        .HasForeignKey("StoreId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.AppData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.StoreData", "StoreData")
+                        .WithMany("Apps")
+                        .HasForeignKey("StoreDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.HistoricalAddressInvoiceData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.InvoiceData", "InvoiceData")
+                        .WithMany("HistoricalAddressInvoices")
+                        .HasForeignKey("InvoiceDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.InvoiceData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.StoreData", "StoreData")
+                        .WithMany("Invoices")
+                        .HasForeignKey("StoreDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.InvoiceEventData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.InvoiceData", "InvoiceData")
+                        .WithMany("Events")
+                        .HasForeignKey("InvoiceDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.PairedSINData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.StoreData", "StoreData")
+                        .WithMany("PairedSINs")
+                        .HasForeignKey("StoreDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.PaymentData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.InvoiceData", "InvoiceData")
+                        .WithMany("Payments")
+                        .HasForeignKey("InvoiceDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.PendingInvoiceData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.InvoiceData", "InvoiceData")
+                        .WithMany("PendingInvoices")
+                        .HasForeignKey("Id")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.RefundAddressesData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.InvoiceData", "InvoiceData")
+                        .WithMany("RefundAddresses")
+                        .HasForeignKey("InvoiceDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Data.UserStore", b =>
+                {
+                    b.HasOne("BTCPayServer.Models.ApplicationUser", "ApplicationUser")
+                        .WithMany("UserStores")
+                        .HasForeignKey("ApplicationUserId")
+                        .OnDelete(DeleteBehavior.Cascade);
+
+                    b.HasOne("BTCPayServer.Data.StoreData", "StoreData")
+                        .WithMany("UserStores")
+                        .HasForeignKey("StoreDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Services.PaymentRequests.PaymentRequestData", b =>
+                {
+                    b.HasOne("BTCPayServer.Data.StoreData", "StoreData")
+                        .WithMany("PaymentRequests")
+                        .HasForeignKey("StoreDataId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("BTCPayServer.Services.U2F.Models.U2FDevice", b =>
+                {
+                    b.HasOne("BTCPayServer.Models.ApplicationUser", "ApplicationUser")
+                        .WithMany("U2FDevices")
+                        .HasForeignKey("ApplicationUserId");
+                });
+
+            modelBuilder.Entity("BTCPayServer.Storage.Models.StoredFile", b =>
+                {
+                    b.HasOne("BTCPayServer.Models.ApplicationUser", "ApplicationUser")
+                        .WithMany("StoredFiles")
+                        .HasForeignKey("ApplicationUserId");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole")
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.HasOne("BTCPayServer.Models.ApplicationUser")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.HasOne("BTCPayServer.Models.ApplicationUser")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole")
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade);
+
+                    b.HasOne("BTCPayServer.Models.ApplicationUser")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.HasOne("BTCPayServer.Models.ApplicationUser")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

BTCPayServer/Migrations/20190425081749_AddU2fDevices.cs

@@ -0,0 +1,54 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+namespace BTCPayServer.Migrations
+{
+    public partial class AddU2fDevices : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Facade",
+                table: "PairedSINData");
+
+            migrationBuilder.CreateTable(
+                name: "U2FDevices",
+                columns: table => new
+                {
+                    Id = table.Column<string>(nullable: false),
+                    Name = table.Column<string>(nullable: true),
+                    KeyHandle = table.Column<byte[]>(nullable: false),
+                    PublicKey = table.Column<byte[]>(nullable: false),
+                    AttestationCert = table.Column<byte[]>(nullable: false),
+                    Counter = table.Column<int>(nullable: false),
+                    ApplicationUserId = table.Column<string>(nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_U2FDevices", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_U2FDevices_AspNetUsers_ApplicationUserId",
+                        column: x => x.ApplicationUserId,
+                        principalTable: "AspNetUsers",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Restrict);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_U2FDevices_ApplicationUserId",
+                table: "U2FDevices",
+                column: "ApplicationUserId");
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "U2FDevices");
+
+            migrationBuilder.AddColumn<string>(
+                name: "Facade",
+                table: "PairedSINData",
+                nullable: true);
+        }
+    }
+}

BTCPayServer/Migrations/ApplicationDbContextModelSnapshot.cs

@@ -137,8 +137,6 @@ namespace BTCPayServer.Migrations
                     b.Property<string>("Id")
                         .ValueGeneratedOnAdd();
 
-                    b.Property<string>("Facade");
-
                     b.Property<string>("Label");
 
                     b.Property<DateTimeOffset>("PairingTime");
@@ -348,6 +346,33 @@ namespace BTCPayServer.Migrations
                     b.ToTable("PaymentRequests");
                 });
 
+            modelBuilder.Entity("BTCPayServer.Services.U2F.Models.U2FDevice", b =>
+                {
+                    b.Property<string>("Id")
+                        .ValueGeneratedOnAdd();
+
+                    b.Property<string>("ApplicationUserId");
+
+                    b.Property<byte[]>("AttestationCert")
+                        .IsRequired();
+
+                    b.Property<int>("Counter");
+
+                    b.Property<byte[]>("KeyHandle")
+                        .IsRequired();
+
+                    b.Property<string>("Name");
+
+                    b.Property<byte[]>("PublicKey")
+                        .IsRequired();
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApplicationUserId");
+
+                    b.ToTable("U2FDevices");
+                });
+
             modelBuilder.Entity("BTCPayServer.Storage.Models.StoredFile", b =>
                 {
                     b.Property<string>("Id")
@@ -576,6 +601,13 @@ namespace BTCPayServer.Migrations
                         .OnDelete(DeleteBehavior.Cascade);
                 });
 
+            modelBuilder.Entity("BTCPayServer.Services.U2F.Models.U2FDevice", b =>
+                {
+                    b.HasOne("BTCPayServer.Models.ApplicationUser", "ApplicationUser")
+                        .WithMany("U2FDevices")
+                        .HasForeignKey("ApplicationUserId");
+                });
+
             modelBuilder.Entity("BTCPayServer.Storage.Models.StoredFile", b =>
                 {
                     b.HasOne("BTCPayServer.Models.ApplicationUser", "ApplicationUser")

BTCPayServer/Models/AccountViewModels/SecondaryLoginViewModel.cs

@@ -0,0 +1,10 @@
+using BTCPayServer.Services.U2F.Models;
+
+namespace BTCPayServer.Models.AccountViewModels
+{
+    public class SecondaryLoginViewModel
+    {
+        public LoginWith2faViewModel LoginWith2FaViewModel { get; set; }
+        public LoginWithU2FViewModel LoginWithU2FViewModel { get; set; }
+    }
+}

BTCPayServer/Models/ApplicationUser.cs

@@ -4,6 +4,7 @@ using System.Linq;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Identity;
 using BTCPayServer.Data;
+using BTCPayServer.Services.U2F.Models;
 using BTCPayServer.Storage.Models;
 
 namespace BTCPayServer.Models
@@ -27,5 +28,7 @@ namespace BTCPayServer.Models
             get;
             set;
         }
+        
+        public List<U2FDevice> U2FDevices { get; set; }
     }
 }

BTCPayServer/U2F/Models/AddU2FDeviceViewModel.cs

@@ -0,0 +1,12 @@
+namespace BTCPayServer.Services.U2F.Models
+{
+    public class AddU2FDeviceViewModel
+    {
+        public string AppId{ get; set; }
+        public string Challenge { get; set; }
+        public string Version { get; set; }
+        public string DeviceResponse { get; set; }
+
+        public string Name { get; set; }
+    }
+}

BTCPayServer/U2F/Models/LoginWithU2FViewModel.cs

@@ -0,0 +1,28 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace BTCPayServer.Services.U2F.Models
+{
+    public class LoginWithU2FViewModel
+    {
+        public string UserId { get; set; }
+        [Required]
+        [Display(Name = "App id")]
+        public string AppId { get; set; }
+
+        [Required]
+        [Display(Name = "Version")]
+        public string Version { get; set; }
+
+        [Required]
+        [Display(Name = "Device Response")]
+        public string DeviceResponse { get; set; }
+
+        [Display(Name = "Challenges")]
+        public string Challenges { get; set; }
+
+        [Display(Name = "Challenge")]
+        public string Challenge { get; set; }
+
+        public bool RememberMe { get; set; }
+    }
+}

BTCPayServer/U2F/Models/ServerChallenge.cs

@@ -0,0 +1,10 @@
+namespace BTCPayServer.Services.U2F.Models
+{
+    public class ServerChallenge
+    {
+        public string challenge { get; set; }
+        public string version { get; set; }
+        public string appId { get; set; }
+        public string keyHandle { get; set; }
+    }
+}

BTCPayServer/U2F/Models/ServerRegisterResponse.cs

@@ -0,0 +1,9 @@
+namespace BTCPayServer.Services.U2F.Models
+{
+    public class ServerRegisterResponse
+    {
+        public string AppId { get; set; }
+        public string Challenge { get; set; }
+        public string Version { get; set; }
+    }
+}

BTCPayServer/U2F/Models/U2FAuthenticationViewModel.cs

@@ -0,0 +1,10 @@
+using System.Collections.Generic;
+
+namespace BTCPayServer.Services.U2F.Models
+{
+    public class U2FAuthenticationViewModel
+    {
+        public string StatusMessage { get; set; }
+        public List<U2FDevice> Devices { get; set; }
+    }
+}

BTCPayServer/U2F/Models/U2FDevice.cs

@@ -0,0 +1,24 @@
+using System;
+using System.ComponentModel.DataAnnotations;
+using BTCPayServer.Models;
+
+namespace BTCPayServer.Services.U2F.Models
+{
+    public class U2FDevice
+    {
+        public string Id { get; set; }
+
+        public string Name { get; set; }
+
+        [Required] public byte[] KeyHandle { get; set; }
+
+        [Required] public byte[] PublicKey { get; set; }
+
+        [Required] public byte[] AttestationCert { get; set; }
+
+        [Required] public int Counter { get; set; }
+
+        public string ApplicationUserId { get; set; }
+        public ApplicationUser ApplicationUser { get; set; }
+    }
+}

BTCPayServer/U2F/Models/U2FDeviceAuthenticationRequest.cs

@@ -0,0 +1,15 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace BTCPayServer.Services.U2F.Models
+{
+    public class U2FDeviceAuthenticationRequest
+    {
+        public string KeyHandle { get; set; }
+
+        [Required] public string Challenge { get; set; }
+
+        [Required] [StringLength(200)] public string AppId { get; set; }
+
+        [Required] [StringLength(50)] public string Version { get; set; }
+    }
+}

BTCPayServer/U2F/U2FService.cs

@@ -0,0 +1,218 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using BTCPayServer.Data;
+using BTCPayServer.Models;
+using BTCPayServer.Services.U2F.Models;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.EntityFrameworkCore;
+using NBitcoin;
+using U2F.Core.Models;
+using U2F.Core.Utils;
+
+namespace BTCPayServer.Services.U2F
+{
+    public class U2FService
+    {
+        private readonly ApplicationDbContextFactory _contextFactory;
+
+        private ConcurrentDictionary<string, List<U2FDeviceAuthenticationRequest>> UserAuthenticationRequests
+        {
+            get;
+            set;
+        }
+            = new ConcurrentDictionary<string, List<U2FDeviceAuthenticationRequest>>();
+
+        public U2FService(ApplicationDbContextFactory contextFactory)
+        {
+            _contextFactory = contextFactory;
+        }
+
+        public async Task<List<U2FDevice>> GetDevices(string userId)
+        {
+            using (var context = _contextFactory.CreateContext())
+            {
+                return await context.U2FDevices
+                    .Where(device => device.ApplicationUserId.Equals(userId, StringComparison.InvariantCulture))
+                    .ToListAsync();
+            }
+        }
+
+        public async Task RemoveDevice(string id, string userId)
+        {
+            using (var context = _contextFactory.CreateContext())
+            {
+                var device = await context.U2FDevices.FindAsync(id);
+                if (device == null || !device.ApplicationUserId.Equals(userId, StringComparison.InvariantCulture))
+                {
+                    return;
+                }
+
+                context.U2FDevices.Remove(device);
+                await context.SaveChangesAsync();
+            }
+        }
+        
+        public async Task<bool> HasDevices(string userId)
+        {
+            using (var context = _contextFactory.CreateContext())
+            {
+                return await context.U2FDevices.AnyAsync(fDevice => fDevice.ApplicationUserId.Equals(userId, StringComparison.InvariantCulture));
+            }
+        }
+        
+
+        public ServerRegisterResponse StartDeviceRegistration(string userId, string appId)
+        {
+            var startedRegistration = global::U2F.Core.Crypto.U2F.StartRegistration(appId);
+
+            UserAuthenticationRequests.AddOrReplace(userId, new List<U2FDeviceAuthenticationRequest>()
+            {
+                new U2FDeviceAuthenticationRequest()
+                {
+                    AppId = startedRegistration.AppId,
+                    Challenge = startedRegistration.Challenge,
+                    Version = global::U2F.Core.Crypto.U2F.U2FVersion,
+                }
+            });
+
+            return new ServerRegisterResponse
+            {
+                AppId = startedRegistration.AppId,
+                Challenge = startedRegistration.Challenge,
+                Version = startedRegistration.Version
+            };
+        }
+
+        public async Task<bool> CompleteRegistration(string userId, string deviceResponse, string name)
+        {
+            if (string.IsNullOrWhiteSpace(deviceResponse))
+                return false;
+
+            if (!UserAuthenticationRequests.ContainsKey(userId) || !UserAuthenticationRequests[userId].Any())
+            {
+                return false;
+            }
+
+            var registerResponse = RegisterResponse.FromJson<RegisterResponse>(deviceResponse);
+
+            //There is only 1 request when registering device
+            var authenticationRequest = UserAuthenticationRequests[userId].First();
+
+            var startedRegistration =
+                new StartedRegistration(authenticationRequest.Challenge, authenticationRequest.AppId);
+            var registration = global::U2F.Core.Crypto.U2F.FinishRegistration(startedRegistration, registerResponse);
+
+            UserAuthenticationRequests.AddOrReplace(userId, new List<U2FDeviceAuthenticationRequest>());
+            using (var context = _contextFactory.CreateContext())
+            {
+                var duplicate = context.U2FDevices.Any(device =>
+                    device.ApplicationUserId.Equals(userId, StringComparison.InvariantCulture) &&
+                    device.KeyHandle.Equals(registration.KeyHandle) &&
+                    device.PublicKey.Equals(registration.PublicKey));
+
+                if (duplicate)
+                {
+                    throw new InvalidOperationException("The U2F Device has already been registered with this user");
+                }
+                
+                await context.U2FDevices.AddAsync(new U2FDevice()
+                {
+                    AttestationCert = registration.AttestationCert,
+                    Counter = Convert.ToInt32(registration.Counter),
+                    Name = name,
+                    KeyHandle = registration.KeyHandle,
+                    PublicKey = registration.PublicKey,
+                    ApplicationUserId = userId
+                });
+
+                await context.SaveChangesAsync();
+            }
+
+            return true;
+        }
+
+        public async Task<bool> AuthenticateUser(string userId, string deviceResponse)
+        {
+            if (string.IsNullOrWhiteSpace(userId) || string.IsNullOrWhiteSpace(deviceResponse))
+                return false;
+
+            var authenticateResponse =
+                AuthenticateResponse.FromJson<AuthenticateResponse>(deviceResponse);
+
+            using (var context = _contextFactory.CreateContext())
+            {
+                var device = await context.U2FDevices.SingleOrDefaultAsync(fDevice =>
+                    fDevice.ApplicationUserId.Equals(userId, StringComparison.InvariantCulture) &&
+                    fDevice.KeyHandle.SequenceEqual(authenticateResponse.KeyHandle.Base64StringToByteArray()));
+
+                if (device == null)
+                    return false;
+
+                // User will have a authentication request for each device they have registered so get the one that matches the device key handle
+
+                var authenticationRequest =
+                    UserAuthenticationRequests[userId].First(f =>
+                        f.KeyHandle.Equals(authenticateResponse.KeyHandle, StringComparison.InvariantCulture));
+                var registration = new DeviceRegistration(device.KeyHandle, device.PublicKey,
+                    device.AttestationCert, Convert.ToUInt32(device.Counter));
+
+                var authentication = new StartedAuthentication(authenticationRequest.Challenge,
+                    authenticationRequest.AppId, authenticationRequest.KeyHandle);
+
+                global::U2F.Core.Crypto.U2F.FinishAuthentication(authentication, authenticateResponse, registration);
+
+
+                UserAuthenticationRequests.AddOrReplace(userId, new List<U2FDeviceAuthenticationRequest>());
+
+                device.Counter = Convert.ToInt32(registration.Counter);
+                await context.SaveChangesAsync();
+            }
+
+            return true;
+        }
+
+        public async Task<List<ServerChallenge>> GenerateDeviceChallenges(string userId, string appId)
+        {
+            using (var context = _contextFactory.CreateContext())
+            {
+                var devices = await context.U2FDevices.Where(fDevice =>
+                    fDevice.ApplicationUserId.Equals(userId, StringComparison.InvariantCulture)).ToListAsync();
+
+                if (devices.Count == 0)
+                    return null;
+
+                var requests = new List<U2FDeviceAuthenticationRequest>();
+
+
+                var challenge = global::U2F.Core.Crypto.U2F.GenerateChallenge();
+
+                var serverChallenges = new List<ServerChallenge>();
+                foreach (var registeredDevice in devices)
+                {
+                    serverChallenges.Add(new ServerChallenge
+                    {
+                        appId = appId,
+                        challenge = challenge,
+                        keyHandle = registeredDevice.KeyHandle.ByteArrayToBase64String(),
+                        version = global::U2F.Core.Crypto.U2F.U2FVersion,
+                    });
+
+                    requests.Add(
+                        new U2FDeviceAuthenticationRequest()
+                        {
+                            AppId = appId,
+                            Challenge = challenge,
+                            KeyHandle = registeredDevice.KeyHandle.ByteArrayToBase64String(),
+                            Version = global::U2F.Core.Crypto.U2F.U2FVersion
+                        });
+                }
+
+                UserAuthenticationRequests.AddOrReplace(userId, requests);
+                return serverChallenges;
+            }
+        }
+    }
+}

BTCPayServer/Views/Account/LoginWith2fa.cshtml

@@ -1,45 +1,37 @@
 @model LoginWith2faViewModel
-@{
-    ViewData["Title"] = "Two-factor authentication";
-}
 
 <section>
-    <div class="container">
+    <div class="container-fluid">
         <div class="row">
             <div class="col-lg-12 text-center">
-                <h2 class="section-heading">@ViewData["Title"]</h2>
+                <h2 class="section-heading">Two-factor authentication</h2>
                 <hr class="primary">
             </div>
         </div>
         <div class="row">
-            <div class="col-md-4"></div>
-            <div class="col-md-4">
-                <form method="post" asp-route-returnUrl="@ViewData["ReturnUrl"]">
-                    <input asp-for="RememberMe" type="hidden" />
-                    <div asp-validation-summary="All" class="text-danger"></div>
-                    <div class="form-group">
-                        <label asp-for="TwoFactorCode"></label>
-                        <input asp-for="TwoFactorCode" class="form-control" autocomplete="off" />
-                        <span asp-validation-for="TwoFactorCode" class="text-danger"></span>
+            <form  class="col-12" method="post" asp-route-returnUrl="@ViewData["ReturnUrl"]" asp-action="LoginWith2fa">
+                <input asp-for="RememberMe" type="hidden"/>
+                <div class="form-group">
+                    <label asp-for="TwoFactorCode"></label>
+                    <input asp-for="TwoFactorCode" class="form-control" autocomplete="off"/>
+                    <span asp-validation-for="TwoFactorCode" class="text-danger"></span>
+                </div>
+                <div class="form-group">
+                    <div class="checkbox">
+                        <label asp-for="RememberMachine">
+                            <input asp-for="RememberMachine"/>
+                            @Html.DisplayNameFor(m => m.RememberMachine)
+                        </label>
                     </div>
-                    <div class="form-group">
-                        <div class="checkbox">
-                            <label asp-for="RememberMachine">
-                                <input asp-for="RememberMachine" />
-                                @Html.DisplayNameFor(m => m.RememberMachine)
-                            </label>
-                        </div>
-                    </div>
-                    <div class="form-group">
-                        <button type="submit" class="btn btn-primary">Log in</button>
-                    </div>
-                </form>
-            </div>
-            <div class="col-md-4"></div>
+                </div>
+                <div class="form-group">
+                    <button type="submit" class="btn btn-primary">Log in</button>
+                </div>
+                
+            </form>
         </div>
         <div class="row">
-            <div class="col-md-4"></div>
-            <div class="col-md-4">
+            <div class="col-12">
                 <p>
                     Don't have access to your authenticator device? You can
                     <a asp-action="LoginWithRecoveryCode" asp-route-returnUrl="@ViewData["ReturnUrl"]">log in with a recovery code</a>.
@@ -48,6 +40,7 @@
         </div>
     </div>
 </section>
+
 @section Scripts {
     @await Html.PartialAsync("_ValidationScriptsPartial")
 }

BTCPayServer/Views/Account/LoginWithRecoveryCode.cshtml

@@ -3,26 +3,35 @@
     ViewData["Title"] = "Recovery code verification";
 }
 
-<h2>@ViewData["Title"]</h2>
-<hr />
-<p>
-    You have requested to login with a recovery code. This login will not be remembered until you provide
-    an authenticator app code at login or disable 2FA and login again.
-</p>
-<div class="row">
-    <div class="col-md-4">
-        <form method="post">
-            <div asp-validation-summary="All" class="text-danger"></div>
-            <div class="form-group">
-                <label asp-for="RecoveryCode"></label>
-                <input asp-for="RecoveryCode" class="form-control" autocomplete="off" />
-                <span asp-validation-for="RecoveryCode" class="text-danger"></span>
+
+
+<section>
+    <div class="container">
+        <div class="row">
+            <div class="col-lg-12 text-center">
+                <h2 class="section-heading">@ViewData["Title"]</h2>
+                <hr class="primary">
+                <p>
+                    You have requested to login with a recovery code. This login will not be remembered until you provide
+                    an authenticator app code at login or disable 2FA and login again.
+                </p>
             </div>
-            <button type="submit" class="btn btn-primary">Log in</button>
-        </form>
+        </div>
+        <div class="row">
+            <form method="post" class="col-12">
+                <div asp-validation-summary="All" class="text-danger"></div>
+                <div class="form-group">
+                    <label asp-for="RecoveryCode"></label>
+                    <input asp-for="RecoveryCode" class="form-control" autocomplete="off" />
+                    <span asp-validation-for="RecoveryCode" class="text-danger"></span>
+                </div>
+                <button type="submit" class="btn btn-primary">Log in</button>
+            </form>
+        </div>
     </div>
-</div>
+</section>
+
 
 @section Scripts {
     @await Html.PartialAsync("_ValidationScriptsPartial")
-}
+}

BTCPayServer/Views/Account/LoginWithU2F.cshtml

@@ -0,0 +1,53 @@
+@model BTCPayServer.Services.U2F.Models.LoginWithU2FViewModel
+
+<form id="u2fForm" asp-action="LoginWithU2F" method="post" asp-route-returnUrl="@ViewData["ReturnUrl"]">
+    <input type="hidden" asp-for="Version" />
+    <input type="hidden" asp-for="Challenge" />
+    <input type="hidden" asp-for="AppId" />
+    <input type="hidden" asp-for="DeviceResponse" />
+    <input type="hidden" asp-for="Challenges" />
+    <input type="hidden" asp-for="UserId" />
+    <input type="hidden" asp-for="RememberMe" />
+</form>
+
+<section>
+    <div class="container-fluid">
+        <div class="row">
+            <div class="col-lg-12 text-center">
+                <h2 class="section-heading"><span class="fa fa-spinner fa-spin"></span>U2F Authentication</h2>
+                <hr class="primary">
+                
+                <p>Insert your U2F device or a hardware wallet into your computer's USB port. If it has a button, tap on it.</p>
+            </div>
+        </div>
+        <div class="row">
+            <a id="error-response" class="text-danger" href="javascript:window.location.reload()"> </a>
+        </div>
+    </div>
+</section>
+
+<script src="~/vendor/u2f/u2f-api-1.1.js"></script>
+<script type="text/javascript">
+    var errorMap = {
+        1: 'Unknown error, try again',
+        2: "Bad request error, try again",
+        3: "This key isn't supported, please try another one",
+        4: 'The device is already registered, please login',
+        5: 'Authentication timed out. Please reload to try again.'
+    };
+    setTimeout(function() {
+        window.u2f.sign(
+            "@Model.AppId",
+            "@Model.Challenge",
+            @Html.Raw(@Model.Challenges), function (data) {
+                if (data.errorCode) {
+                    $("#error-response").text(errorMap[data.errorCode]);
+                    return;
+                }
+                $('#DeviceResponse').val(JSON.stringify(data));
+                $('#u2fForm').submit();
+
+                return "";
+            });
+    }, 1000);
+</script>

BTCPayServer/Views/Account/SecondaryLogin.cshtml

@@ -0,0 +1,47 @@
+@model SecondaryLoginViewModel
+@{
+    ViewData["Title"] = "Two-factor/U2F authentication";
+}
+
+<section>
+    <div class="container">
+        @if (Model.LoginWith2FaViewModel != null && Model.LoginWithU2FViewModel != null)
+        {
+            <div class="row">
+                <div class="col-lg-12 text-center">
+                    <h2 class="section-heading">@ViewData["Title"]</h2>
+                    <hr class="primary">
+                    
+                    <div asp-validation-summary="ModelOnly" class="text-danger"></div>
+                </div>
+            </div>
+        }else if (Model.LoginWith2FaViewModel == null && Model.LoginWithU2FViewModel == null)
+        {
+            <div class="row">
+                <div class="col-lg-12 text-center">
+                    <h2 class="section-heading bg-danger">Both 2FA and U2F Authentication Methods are not available. Please go to the https endpoint</h2>
+                    <hr class="danger">
+                </div>
+            </div>
+        }
+        
+        
+        <div class="row justify-content-center">
+            @if (Model.LoginWith2FaViewModel != null)
+            {
+                <div class="col-sm-12 col-md-6">
+                    <partial name="Loginwith2fa" model="@Model.LoginWith2FaViewModel"/>
+                </div>
+            }
+            @if (Model.LoginWithU2FViewModel != null)
+            {
+                <div class="col-sm-12 col-md-6">
+                    <partial name="LoginWithU2F" model="@Model.LoginWithU2FViewModel"/>
+                </div>
+            }
+        </div>
+    </div>
+</section>
+@section Scripts {
+    @await Html.PartialAsync("_ValidationScriptsPartial")
+}

BTCPayServer/Views/Manage/AddU2FDevice.cshtml

@@ -0,0 +1,58 @@
+@model BTCPayServer.Services.U2F.Models.AddU2FDeviceViewModel
+@{
+    ViewData.SetActivePageAndTitle(ManageNavPages.U2F, "Add U2F device");
+}
+
+<form asp-action="AddU2FDevice" method="post" id="registerForm" class="hidden">
+    
+    <input type="hidden" asp-for="AppId"/>
+    <input type="hidden" asp-for="Version"/>
+    <input type="hidden" asp-for="Challenge"/>
+    <input type="hidden" asp-for="Name"/>
+    <input type="hidden" asp-for="DeviceResponse"/>
+</form>
+
+
+<div class="card">
+    <h3 class="card-title px-1"><span class="fa fa-spinner fa-spin"></span>Registering U2F Device</h3>
+    <div class="card-body">
+        <p>Insert your U2F device or a hardware wallet into your computer's USB port. If it has a button, tap on it.</p>
+        
+        <a id="error-response" class="text-danger" href="javascript:window.location.reload()"> </a>
+    </div>
+    
+    <div class="card-footer">
+        <a class="btn btn-secondary" asp-action="U2FAuthentication" id="btn-back">Abort</a>
+    </div>
+</div>
+
+@section Scripts {
+
+    <script src="~/vendor/u2f/u2f-api-1.1.js"></script>
+    <script type="text/javascript">
+        var errorMap = {
+            1: 'Unknown error, try again',
+            2: "Bad request error, try again",
+            3: "This key isn't supported, please try another one",
+            4: 'The device is already registered, please login',
+            5: 'Authentication timed out. Please reload to try again.'
+        };
+
+        setTimeout(function() {
+                var request = { "challenge": "@Model.Challenge", "version": "@Model.Version", "appId": "@Model.AppId" };
+                var registerRequests = [{version: request.version, challenge: request.challenge}];
+                u2f.register(request.appId, registerRequests, [],
+                    function(data) {
+                        if (data.errorCode) {
+                            $("#error-response").text(errorMap[data.errorCode]);
+                            return;
+                        }
+                        $('#DeviceResponse').val(JSON.stringify(data));
+                        $('#registerForm').submit();
+
+                        return false;
+                    });
+            },
+            1000);
+    </script>
+}

BTCPayServer/Views/Manage/ManageNavPages.cs

@@ -7,6 +7,6 @@ namespace BTCPayServer.Views.Manage
 {
     public enum ManageNavPages
     {
-        Index, ChangePassword, ExternalLogins, TwoFactorAuthentication, Tokens
+        Index, ChangePassword, ExternalLogins, TwoFactorAuthentication, U2F
     }
 }

BTCPayServer/Views/Manage/U2FAuthentication.cshtml

@@ -0,0 +1,47 @@
+@model BTCPayServer.Services.U2F.Models.U2FAuthenticationViewModel
+@{
+    ViewData.SetActivePageAndTitle(ManageNavPages.U2F, "Manage your registered U2F devices");
+}
+
+<partial name="_StatusMessage" for="StatusMessage"/>
+<h4>Registered U2F Devices</h4>
+<form asp-action="AddU2FDevice" method="get">
+    <table class="table table-lg">
+        <thead>
+        <tr>
+            <th >Name</th>
+            <th class="text-right">Actions</th>
+        </tr>
+        </thead>
+        <tbody>
+        @foreach (var device in Model.Devices)
+        {
+            <tr>
+                <td>@device.Name</td>
+                <td class="text-right" >
+                        <a asp-action="RemoveU2FDevice" asp-route-id="@device.Id">Remove</a>
+               
+                </td>
+            </tr>
+        }
+        @if (!Model.Devices.Any())
+        {
+            <tr>
+                <td colspan="2" class="text-center h5 py-2">
+                    No registered devices
+                </td>
+            </tr>
+        }
+        <tr class="bg-gray">
+            <td>
+                <input type="text" class="form-control" name="Name" placeholder="New Device Name"/>
+            </td>
+            <td>
+                <div class="pull-right">
+                    <button type="submit" class="btn btn-primary">Add New Device</button>
+                </div>
+            </td>
+        </tr>
+        </tbody>
+    </table>
+</form>

BTCPayServer/Views/Manage/_Nav.cshtml

@@ -11,5 +11,6 @@
         <a class="nav-link @ViewData.IsActivePage(ManageNavPages.ExternalLogins)" asp-action="ExternalLogins">External logins</a>
     }
     <a class="nav-link @ViewData.IsActivePage(ManageNavPages.TwoFactorAuthentication)" asp-action="TwoFactorAuthentication">Two-factor authentication</a>
+    <a class="nav-link @ViewData.IsActivePage(ManageNavPages.U2F)" asp-action="U2FAuthentication">U2F Authentication</a>
 </div>
 

BTCPayServer/wwwroot/vendor/u2f/u2f-api-1.1.js

@@ -0,0 +1,749 @@
+//Copyright 2014-2015 Google Inc. All rights reserved.
+
+//Use of this source code is governed by a BSD-style
+//license that can be found in the LICENSE file or at
+//https://developers.google.com/open-source/licenses/bsd
+
+/**
+ * @fileoverview The U2F api.
+ */
+'use strict';
+
+
+/**
+ * Namespace for the U2F api.
+ * @type {Object}
+ */
+var u2f = u2f || {};
+
+/**
+ * FIDO U2F Javascript API Version
+ * @number
+ */
+var js_api_version;
+
+/**
+ * The U2F extension id
+ * @const {string}
+ */
+// The Chrome packaged app extension ID.
+// Uncomment this if you want to deploy a server instance that uses
+// the package Chrome app and does not require installing the U2F Chrome extension.
+ u2f.EXTENSION_ID = 'kmendfapggjehodndflmmgagdbamhnfd';
+// The U2F Chrome extension ID.
+// Uncomment this if you want to deploy a server instance that uses
+// the U2F Chrome extension to authenticate.
+// u2f.EXTENSION_ID = 'pfboblefjcgdjicmnffhdgionmgcdmne';
+
+
+/**
+ * Message types for messsages to/from the extension
+ * @const
+ * @enum {string}
+ */
+u2f.MessageTypes = {
+    'U2F_REGISTER_REQUEST': 'u2f_register_request',
+    'U2F_REGISTER_RESPONSE': 'u2f_register_response',
+    'U2F_SIGN_REQUEST': 'u2f_sign_request',
+    'U2F_SIGN_RESPONSE': 'u2f_sign_response',
+    'U2F_GET_API_VERSION_REQUEST': 'u2f_get_api_version_request',
+    'U2F_GET_API_VERSION_RESPONSE': 'u2f_get_api_version_response'
+};
+
+
+/**
+ * Response status codes
+ * @const
+ * @enum {number}
+ */
+u2f.ErrorCodes = {
+    'OK': 0,
+    'OTHER_ERROR': 1,
+    'BAD_REQUEST': 2,
+    'CONFIGURATION_UNSUPPORTED': 3,
+    'DEVICE_INELIGIBLE': 4,
+    'TIMEOUT': 5
+};
+
+
+/**
+ * A message for registration requests
+ * @typedef {{
+ *   type: u2f.MessageTypes,
+ *   appId: ?string,
+ *   timeoutSeconds: ?number,
+ *   requestId: ?number
+ * }}
+ */
+u2f.U2fRequest;
+
+
+/**
+ * A message for registration responses
+ * @typedef {{
+ *   type: u2f.MessageTypes,
+ *   responseData: (u2f.Error | u2f.RegisterResponse | u2f.SignResponse),
+ *   requestId: ?number
+ * }}
+ */
+u2f.U2fResponse;
+
+
+/**
+ * An error object for responses
+ * @typedef {{
+ *   errorCode: u2f.ErrorCodes,
+ *   errorMessage: ?string
+ * }}
+ */
+u2f.Error;
+
+/**
+ * Data object for a single sign request.
+ * @typedef {enum {BLUETOOTH_RADIO, BLUETOOTH_LOW_ENERGY, USB, NFC}}
+ */
+u2f.Transport;
+
+
+/**
+ * Data object for a single sign request.
+ * @typedef {Array<u2f.Transport>}
+ */
+u2f.Transports;
+
+/**
+ * Data object for a single sign request.
+ * @typedef {{
+ *   version: string,
+ *   challenge: string,
+ *   keyHandle: string,
+ *   appId: string
+ * }}
+ */
+u2f.SignRequest;
+
+
+/**
+ * Data object for a sign response.
+ * @typedef {{
+ *   keyHandle: string,
+ *   signatureData: string,
+ *   clientData: string
+ * }}
+ */
+u2f.SignResponse;
+
+
+/**
+ * Data object for a registration request.
+ * @typedef {{
+ *   version: string,
+ *   challenge: string
+ * }}
+ */
+u2f.RegisterRequest;
+
+
+/**
+ * Data object for a registration response.
+ * @typedef {{
+ *   version: string,
+ *   keyHandle: string,
+ *   transports: Transports,
+ *   appId: string
+ * }}
+ */
+u2f.RegisterResponse;
+
+
+/**
+ * Data object for a registered key.
+ * @typedef {{
+ *   version: string,
+ *   keyHandle: string,
+ *   transports: ?Transports,
+ *   appId: ?string
+ * }}
+ */
+u2f.RegisteredKey;
+
+
+/**
+ * Data object for a get API register response.
+ * @typedef {{
+ *   js_api_version: number
+ * }}
+ */
+u2f.GetJsApiVersionResponse;
+
+
+//Low level MessagePort API support
+
+/**
+ * Sets up a MessagePort to the U2F extension using the
+ * available mechanisms.
+ * @param {function((MessagePort|u2f.WrappedChromeRuntimePort_))} callback
+ */
+u2f.getMessagePort = function(callback) {
+  if (typeof chrome != 'undefined' && chrome.runtime) {
+    // The actual message here does not matter, but we need to get a reply
+    // for the callback to run. Thus, send an empty signature request
+    // in order to get a failure response.
+    var msg = {
+        type: u2f.MessageTypes.U2F_SIGN_REQUEST,
+        signRequests: []
+    };
+    chrome.runtime.sendMessage(u2f.EXTENSION_ID, msg, function() {
+      if (!chrome.runtime.lastError) {
+        // We are on a whitelisted origin and can talk directly
+        // with the extension.
+        u2f.getChromeRuntimePort_(callback);
+      } else {
+        // chrome.runtime was available, but we couldn't message
+        // the extension directly, use iframe
+        u2f.getIframePort_(callback);
+      }
+    });
+  } else if (u2f.isAndroidChrome_()) {
+    u2f.getAuthenticatorPort_(callback);
+  } else if (u2f.isIosChrome_()) {
+    u2f.getIosPort_(callback);
+  } else {
+    // chrome.runtime was not available at all, which is normal
+    // when this origin doesn't have access to any extensions.
+    u2f.getIframePort_(callback);
+  }
+};
+
+/**
+ * Detect chrome running on android based on the browser's useragent.
+ * @private
+ */
+u2f.isAndroidChrome_ = function() {
+  var userAgent = navigator.userAgent;
+  return userAgent.indexOf('Chrome') != -1 &&
+  userAgent.indexOf('Android') != -1;
+};
+
+/**
+ * Detect chrome running on iOS based on the browser's platform.
+ * @private
+ */
+u2f.isIosChrome_ = function() {
+  return ["iPhone", "iPad", "iPod"].indexOf(navigator.platform) > -1;
+};
+
+/**
+ * Connects directly to the extension via chrome.runtime.connect.
+ * @param {function(u2f.WrappedChromeRuntimePort_)} callback
+ * @private
+ */
+u2f.getChromeRuntimePort_ = function(callback) {
+  var port = chrome.runtime.connect(u2f.EXTENSION_ID,
+      {'includeTlsChannelId': true});
+  setTimeout(function() {
+    callback(new u2f.WrappedChromeRuntimePort_(port));
+  }, 0);
+};
+
+/**
+ * Return a 'port' abstraction to the Authenticator app.
+ * @param {function(u2f.WrappedAuthenticatorPort_)} callback
+ * @private
+ */
+u2f.getAuthenticatorPort_ = function(callback) {
+  setTimeout(function() {
+    callback(new u2f.WrappedAuthenticatorPort_());
+  }, 0);
+};
+
+/**
+ * Return a 'port' abstraction to the iOS client app.
+ * @param {function(u2f.WrappedIosPort_)} callback
+ * @private
+ */
+u2f.getIosPort_ = function(callback) {
+  setTimeout(function() {
+    callback(new u2f.WrappedIosPort_());
+  }, 0);
+};
+
+/**
+ * A wrapper for chrome.runtime.Port that is compatible with MessagePort.
+ * @param {Port} port
+ * @constructor
+ * @private
+ */
+u2f.WrappedChromeRuntimePort_ = function(port) {
+  this.port_ = port;
+};
+
+/**
+ * Format and return a sign request compliant with the JS API version supported by the extension.
+ * @param {Array<u2f.SignRequest>} signRequests
+ * @param {number} timeoutSeconds
+ * @param {number} reqId
+ * @return {Object}
+ */
+u2f.formatSignRequest_ =
+  function(appId, challenge, registeredKeys, timeoutSeconds, reqId) {
+  if (js_api_version === undefined || js_api_version < 1.1) {
+    // Adapt request to the 1.0 JS API
+    var signRequests = [];
+    for (var i = 0; i < registeredKeys.length; i++) {
+      signRequests[i] = {
+          version: registeredKeys[i].version,
+          challenge: challenge,
+          keyHandle: registeredKeys[i].keyHandle,
+          appId: appId
+      };
+    }
+    return {
+      type: u2f.MessageTypes.U2F_SIGN_REQUEST,
+      signRequests: signRequests,
+      timeoutSeconds: timeoutSeconds,
+      requestId: reqId
+    };
+  }
+  // JS 1.1 API
+  return {
+    type: u2f.MessageTypes.U2F_SIGN_REQUEST,
+    appId: appId,
+    challenge: challenge,
+    registeredKeys: registeredKeys,
+    timeoutSeconds: timeoutSeconds,
+    requestId: reqId
+  };
+};
+
+/**
+ * Format and return a register request compliant with the JS API version supported by the extension..
+ * @param {Array<u2f.SignRequest>} signRequests
+ * @param {Array<u2f.RegisterRequest>} signRequests
+ * @param {number} timeoutSeconds
+ * @param {number} reqId
+ * @return {Object}
+ */
+u2f.formatRegisterRequest_ =
+  function(appId, registeredKeys, registerRequests, timeoutSeconds, reqId) {
+  if (js_api_version === undefined || js_api_version < 1.1) {
+    // Adapt request to the 1.0 JS API
+    for (var i = 0; i < registerRequests.length; i++) {
+      registerRequests[i].appId = appId;
+    }
+    var signRequests = [];
+    for (var i = 0; i < registeredKeys.length; i++) {
+      signRequests[i] = {
+          version: registeredKeys[i].version,
+          challenge: registerRequests[0],
+          keyHandle: registeredKeys[i].keyHandle,
+          appId: appId
+      };
+    }
+    return {
+      type: u2f.MessageTypes.U2F_REGISTER_REQUEST,
+      signRequests: signRequests,
+      registerRequests: registerRequests,
+      timeoutSeconds: timeoutSeconds,
+      requestId: reqId
+    };
+  }
+  // JS 1.1 API
+  return {
+    type: u2f.MessageTypes.U2F_REGISTER_REQUEST,
+    appId: appId,
+    registerRequests: registerRequests,
+    registeredKeys: registeredKeys,
+    timeoutSeconds: timeoutSeconds,
+    requestId: reqId
+  };
+};
+
+
+/**
+ * Posts a message on the underlying channel.
+ * @param {Object} message
+ */
+u2f.WrappedChromeRuntimePort_.prototype.postMessage = function(message) {
+  this.port_.postMessage(message);
+};
+
+
+/**
+ * Emulates the HTML 5 addEventListener interface. Works only for the
+ * onmessage event, which is hooked up to the chrome.runtime.Port.onMessage.
+ * @param {string} eventName
+ * @param {function({data: Object})} handler
+ */
+u2f.WrappedChromeRuntimePort_.prototype.addEventListener =
+    function(eventName, handler) {
+  var name = eventName.toLowerCase();
+  if (name == 'message' || name == 'onmessage') {
+    this.port_.onMessage.addListener(function(message) {
+      // Emulate a minimal MessageEvent object
+      handler({'data': message});
+    });
+  } else {
+    console.error('WrappedChromeRuntimePort only supports onMessage');
+  }
+};
+
+/**
+ * Wrap the Authenticator app with a MessagePort interface.
+ * @constructor
+ * @private
+ */
+u2f.WrappedAuthenticatorPort_ = function() {
+  this.requestId_ = -1;
+  this.requestObject_ = null;
+}
+
+/**
+ * Launch the Authenticator intent.
+ * @param {Object} message
+ */
+u2f.WrappedAuthenticatorPort_.prototype.postMessage = function(message) {
+  var intentUrl =
+    u2f.WrappedAuthenticatorPort_.INTENT_URL_BASE_ +
+    ';S.request=' + encodeURIComponent(JSON.stringify(message)) +
+    ';end';
+  document.location = intentUrl;
+};
+
+/**
+ * Tells what type of port this is.
+ * @return {String} port type
+ */
+u2f.WrappedAuthenticatorPort_.prototype.getPortType = function() {
+  return "WrappedAuthenticatorPort_";
+};
+
+
+/**
+ * Emulates the HTML 5 addEventListener interface.
+ * @param {string} eventName
+ * @param {function({data: Object})} handler
+ */
+u2f.WrappedAuthenticatorPort_.prototype.addEventListener = function(eventName, handler) {
+  var name = eventName.toLowerCase();
+  if (name == 'message') {
+    var self = this;
+    /* Register a callback to that executes when
+     * chrome injects the response. */
+    window.addEventListener(
+        'message', self.onRequestUpdate_.bind(self, handler), false);
+  } else {
+    console.error('WrappedAuthenticatorPort only supports message');
+  }
+};
+
+/**
+ * Callback invoked  when a response is received from the Authenticator.
+ * @param function({data: Object}) callback
+ * @param {Object} message message Object
+ */
+u2f.WrappedAuthenticatorPort_.prototype.onRequestUpdate_ =
+    function(callback, message) {
+  var messageObject = JSON.parse(message.data);
+  var intentUrl = messageObject['intentURL'];
+
+  var errorCode = messageObject['errorCode'];
+  var responseObject = null;
+  if (messageObject.hasOwnProperty('data')) {
+    responseObject = /** @type {Object} */ (
+        JSON.parse(messageObject['data']));
+  }
+
+  callback({'data': responseObject});
+};
+
+/**
+ * Base URL for intents to Authenticator.
+ * @const
+ * @private
+ */
+u2f.WrappedAuthenticatorPort_.INTENT_URL_BASE_ =
+  'intent:#Intent;action=com.google.android.apps.authenticator.AUTHENTICATE';
+
+/**
+ * Wrap the iOS client app with a MessagePort interface.
+ * @constructor
+ * @private
+ */
+u2f.WrappedIosPort_ = function() {};
+
+/**
+ * Launch the iOS client app request
+ * @param {Object} message
+ */
+u2f.WrappedIosPort_.prototype.postMessage = function(message) {
+  var str = JSON.stringify(message);
+  var url = "u2f://auth?" + encodeURI(str);
+  location.replace(url);
+};
+
+/**
+ * Tells what type of port this is.
+ * @return {String} port type
+ */
+u2f.WrappedIosPort_.prototype.getPortType = function() {
+  return "WrappedIosPort_";
+};
+
+/**
+ * Emulates the HTML 5 addEventListener interface.
+ * @param {string} eventName
+ * @param {function({data: Object})} handler
+ */
+u2f.WrappedIosPort_.prototype.addEventListener = function(eventName, handler) {
+  var name = eventName.toLowerCase();
+  if (name !== 'message') {
+    console.error('WrappedIosPort only supports message');
+  }
+};
+
+/**
+ * Sets up an embedded trampoline iframe, sourced from the extension.
+ * @param {function(MessagePort)} callback
+ * @private
+ */
+u2f.getIframePort_ = function(callback) {
+  // Create the iframe
+  var iframeOrigin = 'chrome-extension://' + u2f.EXTENSION_ID;
+  var iframe = document.createElement('iframe');
+  iframe.src = iframeOrigin + '/u2f-comms.html';
+  iframe.origin = iframeOrigin;
+  iframe.setAttribute('style', 'display:none');
+  document.body.appendChild(iframe);
+
+  var channel = new MessageChannel();
+  var ready = function(message) {
+    if (message.data == 'ready') {
+      channel.port1.removeEventListener('message', ready);
+      callback(channel.port1);
+    } else {
+      console.error('First event on iframe port was not "ready"');
+    }
+  };
+  channel.port1.addEventListener('message', ready);
+  channel.port1.start();
+
+  iframe.addEventListener('load', function() {
+    // Deliver the port to the iframe and initialize
+    iframe.contentWindow.postMessage('init', null, [channel.port2]);
+  });
+};
+
+
+//High-level JS API
+
+/**
+ * Default extension response timeout in seconds.
+ * @const
+ */
+u2f.EXTENSION_TIMEOUT_SEC = 30;
+
+/**
+ * A singleton instance for a MessagePort to the extension.
+ * @type {MessagePort|u2f.WrappedChromeRuntimePort_}
+ * @private
+ */
+u2f.port_ = null;
+
+/**
+ * Callbacks waiting for a port
+ * @type {Array<function((MessagePort|u2f.WrappedChromeRuntimePort_))>}
+ * @private
+ */
+u2f.waitingForPort_ = [];
+
+/**
+ * A counter for requestIds.
+ * @type {number}
+ * @private
+ */
+u2f.reqCounter_ = 0;
+
+/**
+ * A map from requestIds to client callbacks
+ * @type {Object.<number,(function((u2f.Error|u2f.RegisterResponse))
+ *                       |function((u2f.Error|u2f.SignResponse)))>}
+ * @private
+ */
+u2f.callbackMap_ = {};
+
+/**
+ * Creates or retrieves the MessagePort singleton to use.
+ * @param {function((MessagePort|u2f.WrappedChromeRuntimePort_))} callback
+ * @private
+ */
+u2f.getPortSingleton_ = function(callback) {
+  if (u2f.port_) {
+    callback(u2f.port_);
+  } else {
+    if (u2f.waitingForPort_.length == 0) {
+      u2f.getMessagePort(function(port) {
+        u2f.port_ = port;
+        u2f.port_.addEventListener('message',
+            /** @type {function(Event)} */ (u2f.responseHandler_));
+
+        // Careful, here be async callbacks. Maybe.
+        while (u2f.waitingForPort_.length)
+          u2f.waitingForPort_.shift()(u2f.port_);
+      });
+    }
+    u2f.waitingForPort_.push(callback);
+  }
+};
+
+/**
+ * Handles response messages from the extension.
+ * @param {MessageEvent.<u2f.Response>} message
+ * @private
+ */
+u2f.responseHandler_ = function(message) {
+  var response = message.data;
+  var reqId = response['requestId'];
+  if (!reqId || !u2f.callbackMap_[reqId]) {
+    console.error('Unknown or missing requestId in response.');
+    return;
+  }
+  var cb = u2f.callbackMap_[reqId];
+  delete u2f.callbackMap_[reqId];
+  cb(response['responseData']);
+};
+
+/**
+ * Dispatches an array of sign requests to available U2F tokens.
+ * If the JS API version supported by the extension is unknown, it first sends a
+ * message to the extension to find out the supported API version and then it sends
+ * the sign request.
+ * @param {string=} appId
+ * @param {string=} challenge
+ * @param {Array<u2f.RegisteredKey>} registeredKeys
+ * @param {function((u2f.Error|u2f.SignResponse))} callback
+ * @param {number=} opt_timeoutSeconds
+ */
+u2f.sign = function(appId, challenge, registeredKeys, callback, opt_timeoutSeconds) {
+  if (js_api_version === undefined) {
+    // Send a message to get the extension to JS API version, then send the actual sign request.
+    u2f.getApiVersion(
+        function (response) {
+          js_api_version = response['js_api_version'] === undefined ? 0 : response['js_api_version'];
+          console.log("Extension JS API Version: ", js_api_version);
+          u2f.sendSignRequest(appId, challenge, registeredKeys, callback, opt_timeoutSeconds);
+        });
+  } else {
+    // We know the JS API version. Send the actual sign request in the supported API version.
+    u2f.sendSignRequest(appId, challenge, registeredKeys, callback, opt_timeoutSeconds);
+  }
+};
+
+/**
+ * Dispatches an array of sign requests to available U2F tokens.
+ * @param {string=} appId
+ * @param {string=} challenge
+ * @param {Array<u2f.RegisteredKey>} registeredKeys
+ * @param {function((u2f.Error|u2f.SignResponse))} callback
+ * @param {number=} opt_timeoutSeconds
+ */
+u2f.sendSignRequest = function(appId, challenge, registeredKeys, callback, opt_timeoutSeconds) {
+  u2f.getPortSingleton_(function(port) {
+    var reqId = ++u2f.reqCounter_;
+    u2f.callbackMap_[reqId] = callback;
+    var timeoutSeconds = (typeof opt_timeoutSeconds !== 'undefined' ?
+        opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC);
+    var req = u2f.formatSignRequest_(appId, challenge, registeredKeys, timeoutSeconds, reqId);
+    port.postMessage(req);
+  });
+};
+
+/**
+ * Dispatches register requests to available U2F tokens. An array of sign
+ * requests identifies already registered tokens.
+ * If the JS API version supported by the extension is unknown, it first sends a
+ * message to the extension to find out the supported API version and then it sends
+ * the register request.
+ * @param {string=} appId
+ * @param {Array<u2f.RegisterRequest>} registerRequests
+ * @param {Array<u2f.RegisteredKey>} registeredKeys
+ * @param {function((u2f.Error|u2f.RegisterResponse))} callback
+ * @param {number=} opt_timeoutSeconds
+ */
+u2f.register = function(appId, registerRequests, registeredKeys, callback, opt_timeoutSeconds) {
+  if (js_api_version === undefined) {
+    // Send a message to get the extension to JS API version, then send the actual register request.
+    u2f.getApiVersion(
+        function (response) {
+          js_api_version = response['js_api_version'] === undefined ? 0: response['js_api_version'];
+          console.log("Extension JS API Version: ", js_api_version);
+          u2f.sendRegisterRequest(appId, registerRequests, registeredKeys,
+              callback, opt_timeoutSeconds);
+        });
+  } else {
+    // We know the JS API version. Send the actual register request in the supported API version.
+    u2f.sendRegisterRequest(appId, registerRequests, registeredKeys,
+        callback, opt_timeoutSeconds);
+  }
+};
+
+/**
+ * Dispatches register requests to available U2F tokens. An array of sign
+ * requests identifies already registered tokens.
+ * @param {string=} appId
+ * @param {Array<u2f.RegisterRequest>} registerRequests
+ * @param {Array<u2f.RegisteredKey>} registeredKeys
+ * @param {function((u2f.Error|u2f.RegisterResponse))} callback
+ * @param {number=} opt_timeoutSeconds
+ */
+u2f.sendRegisterRequest = function(appId, registerRequests, registeredKeys, callback, opt_timeoutSeconds) {
+  u2f.getPortSingleton_(function(port) {
+    var reqId = ++u2f.reqCounter_;
+    u2f.callbackMap_[reqId] = callback;
+    var timeoutSeconds = (typeof opt_timeoutSeconds !== 'undefined' ?
+        opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC);
+    var req = u2f.formatRegisterRequest_(
+        appId, registeredKeys, registerRequests, timeoutSeconds, reqId);
+    port.postMessage(req);
+  });
+};
+
+
+/**
+ * Dispatches a message to the extension to find out the supported
+ * JS API version.
+ * If the user is on a mobile phone and is thus using Google Authenticator instead
+ * of the Chrome extension, don't send the request and simply return 0.
+ * @param {function((u2f.Error|u2f.GetJsApiVersionResponse))} callback
+ * @param {number=} opt_timeoutSeconds
+ */
+u2f.getApiVersion = function(callback, opt_timeoutSeconds) {
+ u2f.getPortSingleton_(function(port) {
+   // If we are using Android Google Authenticator or iOS client app,
+   // do not fire an intent to ask which JS API version to use.
+   if (port.getPortType) {
+     var apiVersion;
+     switch (port.getPortType()) {
+       case 'WrappedIosPort_':
+       case 'WrappedAuthenticatorPort_':
+         apiVersion = 1.1;
+         break;
+
+       default:
+         apiVersion = 0;
+         break;
+     }
+     callback({ 'js_api_version': apiVersion });
+     return;
+   }
+    var reqId = ++u2f.reqCounter_;
+    u2f.callbackMap_[reqId] = callback;
+    var req = {
+      type: u2f.MessageTypes.U2F_GET_API_VERSION_REQUEST,
+      timeoutSeconds: (typeof opt_timeoutSeconds !== 'undefined' ?
+          opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC),
+      requestId: reqId
+    };
+    port.postMessage(req);
+  });
+};