The protocol is open, so you can create open source lib and server. You do not need to certify the open source libraries. There is already a lot of code out-the

The protocol is open, so you can create open source lib and server. You do not need to certify the open source libraries. There is already a lot of code out-there. The browser have to implement it as well, chrome does, others should follow soon. See this example Java library: https://github.com/Yubico/java-u2flib-server https://github.com/Yubico/java-u2flib-server But in general they seem to be doing a very good job of forcing hardware to be standards complaint. They are putting quite a bit of effort into standards testing suites that you can use to validate your code as well. A good thing about it is that on the server it only saves site-specific public keys, so small websites that get hacked leak important information.