11 ms·

Designing Solo, a new U2F/FIDO2 Token

144 points by ecesena 8y ago

xvector 8y ago
How vulnerable are these to differential power analysis? From my understanding, many FIDO keys are designed with resistance to these sort of side-channels in mind.
- radicaldreamer 8y ago
  What is the threat model that these keys are typically designed for?
  - conorpp 8y ago
    Typically these keys are designed to be secure against remote attacks (i.e. adverse software on PC can't extract any secrets). If the attacker physically steals the key, he can just use it directly, no need for DPA. So protecting from physical access typically isn't in threat model.
    - dagenix 8y ago
      The problem isn't someone stealing the physical key - yes, if someone does that, they can use it. But, if its your key, and you no longer have it, you'll notice that and can take action. A bigger problem is if someone briefly takes the physical key, clones the digital key, and then returns it to you. Then, you have no idea that its been compromised. If your use case is that you want them to be secure from a wealthy nation-state - well, thats probably a tall order. What you are probably most interested in is that the cleaning person in your hotel can't clone your key. The thing with digital security, though, is that it real hard / impossible to really define intermediate security levels - what is possible for a nation state to do, may be only a research paper or code leak away from everyone else being able to do. So, I'd really hope that any serious security key would be designed to defend against physical attacks.
      - ecesena 8y ago
        To echo on Conor's comment, our keys will protect you from online attacks. The one you describe is certainly a threat, but still pretty sophisticate and requires physical contact with the key. To protect from physical attacks you need stronger devices, for example Yubico now has an entire new line of FIPS certified products. Note that the cost is higher than the FIDO2 usb-a only key. As Conor mentioned in other places, to obtain stronger hardware we'd need to sign NDAs with vendors, and thus we couldn't make our key open source. Personally, I really hope that this first iteration will be a success, so we'll be able to push the industry for even more open hardware, and eventually we'll be able to address threats like the one you reported.
        jiveturkey 8y ago
        > to obtain stronger hardware we'd need to sign NDAs with vendors, and thus we couldn't make our key open source. That's not true. First, you won't even be eligible to sign an NDA with a secure chip vendor. Second, this won't limit you from having your application (running on their chip) subject to the NDA.
    - tudorconstantin 8y ago
      Ledger Nano S protects you against physical theft by having a 4 number pin code. If the pin code is entered wrong 3 times, the device resets itself.
      - ecesena 8y ago
        That's good for a wallet, because misuse would signify loosing money. As these keys are primarily designed for 2fa, the attacker would also need your password to break into your account. Things may change when 1fa will be more widely adopted, but for the time being we're going to keep it as simple as the "competition" is, i.e. just a button that you press to log in.
- oddeyed 8y ago
  Typically only one component of a device will be security hardened (e.g. a security element such as STSAFE-A100) and it will be designed to protect against side-channel attacks. You won't be able to find any information about the measures and resiliency online though - you'd need to chat with vendors for that kind of info (even then, unlikely). PCB assemblies are pretty impossible to secure in themselves so you have to confine security functions to a small portion of the system and work hard to make sure nothing leaks from there.
bsder 8y ago
This is neat, but my biggest problem isn't the key. My biggest problem is how many things I have to configure to even be able to start to use the key. There is a reason why Duo got bought for >2Gigabucks. 2FA is a PITA to administer.
- m-p-3 8y ago
  By using the key, I assume you mean how painful it is to implement it server-side?
- cowkingdeluxe 8y ago
  I'd really like to use FIDO for entire organization. For windows logins, .NET apps etc. But there is no easy solution. On the other hand TOTP is simple to add for .NET apps.
- pg_bot 8y ago
  Technically, nothing needs to be additionally configured for FIDO U2F to be implemented for an application. You just need to connect the key to your account and it should just prompt you to click the button when you need to sign in. If a company requires a phone number or some other byzantine process for registering a key that is their own design choice. I get that simple U2F key registration is not what's seen in a lot of time in the real world, but most implementations are needlessly complex IMO.
  - eropple 8y ago
    "You just need to connect the key to your account" is the onerous part, though. Google doesn't require a phone number or whatever, but you have to click through like four pages to get to it.
    - joshuamcginnis 8y ago
      Google Account -> Sign-in & Security -> 2-Step Verification Or just click: https://myaccount.google.com/signinoptions/two-step-verification https://myaccount.google.com/signinoptions/two-step-verifica...
fox8091 8y ago
Do these use any sort of security element to store the keys? Or just stored in firmware?
- ecesena 8y ago
  Firmware. In the blog post there's a section on this, and why.
badrabbit 8y ago
A personal hardware security device is useful not just for logins but signing messages and encrypting data. Imagine signing up to a site or service,all you need to do is allow it to generate a unique public/private key pair on your personal hsm. You would optionally associate a username with the public key,but that's it! No need to enter name,address,phone,email,etc.., Unless required for the service. You won't even need a password(!!) Lost the personal hsm? No worries,you wrote down a recovery key on paper and stored it next to your social security card and passport. Here is my thing, simpler security is better security. I use a yubi everyday and it's nice but I also use TOTP and SMS every day. If I am using a hardware security device,why do I need any other form of authentication? Why can't that same device be used for TLS client certificate storage for every site I visit,storing SSH private keys,trusted root CA store I can use with any device, message(email,signal,telegram,etc...) Encryption,message non-repudiation(think a twitter post or even this comment being signed by my hsm so I can't say 'the hackers did it'). You can use it for banking,voting,signing important documents online,etc... You can already see how much work goes into adopting something like a yubikey. Why not make it a general purpose hsm that solves all these security problems. You know what I like about this the most? Minimal user education required,just plug it in,click yes on the app's prompt and press the button on the hsm. Not only that,you can't phish or some other way social engineer the user to give up the private key. Users can keep it on their keychain or building access badge that would give physical attackers similar level of access(they can unlock your house keys and steal pii or get in the building with your badge and steal your laptop). A user friendly usbarmory for the lay-person!
- deleted 8y ago
  [deleted]
- tptacek 8y ago
  Because the parts you need to provide the functionality you want at the level of security Yubico is promising are expensive.
  - badrabbit 8y ago
    I don't buy that argument. I have purchased Blu phones for under $50,yubikey nano cost me ~50. Plus,it gets even cheaper with mass production. A cheap smartphone without radio,screen,large battery with a custom os and a usb connection would be an even cheaper phone. The only things a personal hsm would add might be nfc and hardware rng. I'm surprised yubikey hasn't gotten cheaper even with companies like google using it.
foxylad 8y ago
If it's got USB-C, does it need NFC given most phones have USB-C? Or is the phone USB port incompatible?
- paulie_a 8y ago
  Nfc is more convenient than having to plug it in. I like my yubikey for that reason.
- ecesena 8y ago
  NFC is just more convenient. Also, the support for fido over usb vs nfc vs ble depends on the apps/software implementation. To my knowledge Google supports all of them, but many apps may just choose to implement NFC as it's "easier"/more common.
thinkmassive 8y ago
If this device is reprogrammable so I can experiment with the 2-device solution proposed a week ago then I’ll order quite a few of these when the Kickstarter goes live. https://news.ycombinator.com/item?id=17765979 https://news.ycombinator.com/item?id=17765979
- conorpp 8y ago
  Yup it will be. I've actually been in touch with Dmitry, he came up with a nice backup solution. We were thinking about coming up with some sort of protocol so devices may initially be designated as this sort of backup.
  - colemickens 8y ago
    I was wondering if inspiration could be taken from the BIP32/BIP39 in the Bitcoin world. You can use a Trezor as a GPG-Agent, for example, with a key that's derived from the master key (BIP32) in the TREZOR (aka, already backed up via the BIP39 seed phrase). I haven't looked at u2f-on-trezor yet, but I'd assume it is implemented similarly. It seems like you could use existing tooling to generate the phrase and then use some existing code/processes to derive the key backing the token's u2f private key?
    - ecesena 8y ago
      Independently from the protocol you choose, the final result is that two (or more) devices will share the same private key for, e.g., your google account. The problem that we need to solve securely, is that you as a user must be sure you know all devices with that private key, i.e. no one else can trigger a backup without you knowing that, even with a temporary access to the key.
      - colemickens 8y ago
        I (think I) was just discussing a way to make the master key easy to backup. Isn't what you're discussing (prevent unknown backups) more a function of how the private key is held in the Solo itself (and in my example, how securely your seed phrase is stored)? Or is there an element of U2F that I'm missing here? (Does the token itself have an identity that you want to be unique while still preserving the same key for authentication, or is there some other detail I'm missing?)
ncmncm 8y ago
I don't understand why all these things have to be so huge and clumsy. The Tomu (tomu.im) fits almost entirely inside a USB slot, and has 64k of flash and a 32-bit ARM. If it does have to be big enough to be on a lanyard or something, I need it to be flexible, like a short cable dongle. A long skinny USB stick is an accident waiting to happen.
- eropple 8y ago
  The Yubikey Nano is about that size. I find it too small, though, and the NEO is perfect for me. It's the same size as my keys and I've put it through the washing machine with no problems.
  - tonfa 8y ago
    I think the point of a key like the nano is to permanently put it on your device, not carry it around.
    - organsnyder 8y ago
      If you're essentially attaching it permanently, why bother with an external key at all? Isn't the main point of these devices that they remain with your person?
      - tonfa 8y ago
        it's a non fish-able token, a password can be fished a security key can't. For most people I'd think the biggest risk are non physical attacks.
      - freeone3000 8y ago
        Yes, in part - another part is that it can't be remotely compromised or duplicated. Someone has to have physical control of the key. If you have a secured area your device is in, such as an office or a locked apartment, it's way better than password or SMS 2fa.
      - ecesena 8y ago
ac29 8y ago
What's the advantage here over the Yubikey equivalent? Open/hackable firmware? Price?
- anilakar 8y ago
  Just the existence of the project is important as it validates the openness of the FIDO/U2F standard and ecosystem.
- ecesena 8y ago
  Please let me start by saying that Yubico is NOT the closed/evil. Without Yubico, we wouldn't have security keys, and we probably wouldn't have these standards. They're working since 10+ years on this problem, and they released a great amount of open source. Some short term advantages of Solo: open firmware that can be verified by the community. Somehow a reference implementation maybe. Prices will be slightly lower, yes, but not a massive advantage imo. I also hope we can build an open documentation system, to make it easier for people to start using fido2 devices. Long term dreams. 1) Open hardware will allow for experimentation. I'm personally hacking security keys into jewels, and I hope that people will take Solo design, alter it, and embed security keys into other objects and shapes. Keys are getting obsolete. 2) Pushing the industry. Again Yubico is not the "closed one" here. Security coprocessors/chips are. Hopefully, by having more and more open hardware, there'll be a market for even more open chips.
prohor 8y ago
What I miss in the U2F tokens is a small display that would show transaction details which is approved. Imagine you have a malware on your PC; it can send another transaction than the one you see in the browser, while the URL would still match. Having transaction summary on the token would be the last verification point where can still spot something is wrong.
- consp 8y ago
  The screen has to be run by the crypto chip if you want it to be properly 'secure' and most can't do that. At least not the ones who you can buy of the shelf unfortunately.
- zorked 8y ago
  If you have malware on the PC you can still be MITM'd when you actually, say, access your bank.
  - consp 8y ago
    Not if the encrypted data is displayed by the crypto chip, via a round trip between the bank and the chip (encrypted). Yes, technically it can be done, but this requires physical access to the device.
- def_true_false 8y ago
  Ledger and Trezor have a display, though I don't know whether their U2F UX is any good.
- moduspwnens14 8y ago
  I have a Ledger Nano S that I use for cryptocurrency and it does basically this. It won't sign transactions unless you approve them from the device, and the little screen on the device shows the address(es) to which you're sending. https://www.ledger.com/products/ledger-nano-s https://www.ledger.com/products/ledger-nano-s It's $100, which is probably too much for your average user, but cheap enough that it's got to be feasible for a U2F kind of thing in a few years. I guess even the addition of the screen, though, kind of necessitates using a cord so you can see that screen, which makes it less clean than my Yubikey Nano (which is far less obtrusive). But I think we're getting closer.
newhere420 8y ago
Is there any reason why these devices can't have a USB-C connector on one side, and a USB-A connector on the other? Being able to keep just one single token around and knowing I can always use it without an adaptor is the holy grail of these devices for me.
- JustSomeNobody 8y ago
  Cost. That's really the only reason. This would be a really good stop gap until the industry has transitioned everyone over to usb-c.
zaarn 8y ago
My wishlist for this includes some RSA GPG usage but it'll probably remain on my wishlist. The Yubikey tokens are still rather expensive at 50$ and soldering my own and maybe selling extra copies (thanks MOQ) to friends. Otherwise, this looks great, I'll definitely sign up for the newsletter later on...
- ecesena 8y ago
  We're considering this and similar features (gpg/ssh keys). One minor issue is the memory requirement, as our current chip only has 128KB of flash available. The bigger issue is certainly our time :), we're really pushing to have Solo keys available before Xmas, and thus we're prioritizing hardware and fido2. We also want to get fido2 certification, which of course means a lot more work that just making it work.
  - zaarn 8y ago
    Of course, yeah, getting a product out can be more important. Good luck :)
ssebastianj 8y ago
Just wondering, is there any reason why the Yubico FIDO2 Python API[0] talks to a USB device by using custom code to handle the USB protocol instead of using a module like PyUSB[1]? [0] https://github.com/Yubico/python-fido2 https://github.com/Yubico/python-fido2 [1] https://pyusb.github.io/pyusb/ https://pyusb.github.io/pyusb/
jiveturkey 8y ago
> But since U2F/FIDO2 devices need to derive secret keys at runtime to be able to work with an unlimited number of services, the ATECC508A doesn’t work out well. This is because to derive a key at runtime, you typically need to compute an HMAC that’s keyed with a master secret, and store the result as the runtime key. This needs multiple interactions with the ATECC508A and requires the runtime key be stored temporarily on the MCU, which tarnishes the idea of key isolation. This is incorrect. The atec family can derive keys using a static master seed and variable nonce. Such keys are derived internally and kept internally, never leaving the chip. By storing a single derivation master secret, you can use the hashed u2f appid as the nonce. I would additionally have a 2nd hmac secret to apply to the nonce, and use that as the key derivation nonce rather than the appid directly.
jiveturkey 8y ago
why didn't you use a cap touch sensor? pretty easy to do. the problem with the mechanical button is that it will torque the usb port. this is more of a problem with your design, where the usb contacts are just contact area on the pcb, as opposed to a fully enclosed usb-a "connector". admittedly, a small problem, but since cap touch would have been easy, it seems a problem that would have been worth tackling maybe?

144 points by ecesena 8y ago

How vulnerable are these to differential power analysis? From my understanding, many FIDO keys are designed with resistance to these sort of side-channels in mind.

radicaldreamer 8y ago
What is the threat model that these keys are typically designed for?
- conorpp 8y ago
  Typically these keys are designed to be secure against remote attacks (i.e. adverse software on PC can't extract any secrets). If the attacker physically steals the key, he can just use it directly, no need for DPA. So protecting from physical access typically isn't in threat model.
  - dagenix 8y ago
    The problem isn't someone stealing the physical key - yes, if someone does that, they can use it. But, if its your key, and you no longer have it, you'll notice that and can take action. A bigger problem is if someone briefly takes the physical key, clones the digital key, and then returns it to you. Then, you have no idea that its been compromised. If your use case is that you want them to be secure from a wealthy nation-state - well, thats probably a tall order. What you are probably most interested in is that the cleaning person in your hotel can't clone your key. The thing with digital security, though, is that it real hard / impossible to really define intermediate security levels - what is possible for a nation state to do, may be only a research paper or code leak away from everyone else being able to do. So, I'd really hope that any serious security key would be designed to defend against physical attacks.
    - ecesena 8y ago
      To echo on Conor's comment, our keys will protect you from online attacks. The one you describe is certainly a threat, but still pretty sophisticate and requires physical contact with the key. To protect from physical attacks you need stronger devices, for example Yubico now has an entire new line of FIPS certified products. Note that the cost is higher than the FIDO2 usb-a only key. As Conor mentioned in other places, to obtain stronger hardware we'd need to sign NDAs with vendors, and thus we couldn't make our key open source. Personally, I really hope that this first iteration will be a success, so we'll be able to push the industry for even more open hardware, and eventually we'll be able to address threats like the one you reported.
      - jiveturkey 8y ago
        > to obtain stronger hardware we'd need to sign NDAs with vendors, and thus we couldn't make our key open source. That's not true. First, you won't even be eligible to sign an NDA with a secure chip vendor. Second, this won't limit you from having your application (running on their chip) subject to the NDA.
  - tudorconstantin 8y ago
    Ledger Nano S protects you against physical theft by having a 4 number pin code. If the pin code is entered wrong 3 times, the device resets itself.
    - ecesena 8y ago
      That's good for a wallet, because misuse would signify loosing money. As these keys are primarily designed for 2fa, the attacker would also need your password to break into your account. Things may change when 1fa will be more widely adopted, but for the time being we're going to keep it as simple as the "competition" is, i.e. just a button that you press to log in.
oddeyed 8y ago
Typically only one component of a device will be security hardened (e.g. a security element such as STSAFE-A100) and it will be designed to protect against side-channel attacks. You won't be able to find any information about the measures and resiliency online though - you'd need to chat with vendors for that kind of info (even then, unlikely). PCB assemblies are pretty impossible to secure in themselves so you have to confine security functions to a small portion of the system and work hard to make sure nothing leaks from there.

bsder 8y ago

This is neat, but my biggest problem isn't the key. My biggest problem is how many things I have to configure to even be able to start to use the key. There is a reason why Duo got bought for >2Gigabucks. 2FA is a PITA to administer.

m-p-3 8y ago
By using the key, I assume you mean how painful it is to implement it server-side?
cowkingdeluxe 8y ago
I'd really like to use FIDO for entire organization. For windows logins, .NET apps etc. But there is no easy solution. On the other hand TOTP is simple to add for .NET apps.
pg_bot 8y ago
Technically, nothing needs to be additionally configured for FIDO U2F to be implemented for an application. You just need to connect the key to your account and it should just prompt you to click the button when you need to sign in. If a company requires a phone number or some other byzantine process for registering a key that is their own design choice. I get that simple U2F key registration is not what's seen in a lot of time in the real world, but most implementations are needlessly complex IMO.
- eropple 8y ago
  "You just need to connect the key to your account" is the onerous part, though. Google doesn't require a phone number or whatever, but you have to click through like four pages to get to it.
  - joshuamcginnis 8y ago
    Google Account -> Sign-in & Security -> 2-Step Verification Or just click: https://myaccount.google.com/signinoptions/two-step-verification https://myaccount.google.com/signinoptions/two-step-verifica...

fox8091 8y ago

Do these use any sort of security element to store the keys? Or just stored in firmware?

ecesena 8y ago
Firmware. In the blog post there's a section on this, and why.

badrabbit 8y ago

A personal hardware security device is useful not just for logins but signing messages and encrypting data. Imagine signing up to a site or service,all you need to do is allow it to generate a unique public/private key pair on your personal hsm. You would optionally associate a username with the public key,but that's it! No need to enter name,address,phone,email,etc.., Unless required for the service. You won't even need a password(!!) Lost the personal hsm? No worries,you wrote down a recovery key on paper and stored it next to your social security card and passport. Here is my thing, simpler security is better security. I use a yubi everyday and it's nice but I also use TOTP and SMS every day. If I am using a hardware security device,why do I need any other form of authentication? Why can't that same device be used for TLS client certificate storage for every site I visit,storing SSH private keys,trusted root CA store I can use with any device, message(email,signal,telegram,etc...) Encryption,message non-repudiation(think a twitter post or even this comment being signed by my hsm so I can't say 'the hackers did it'). You can use it for banking,voting,signing important documents online,etc... You can already see how much work goes into adopting something like a yubikey. Why not make it a general purpose hsm that solves all these security problems. You know what I like about this the most? Minimal user education required,just plug it in,click yes on the app's prompt and press the button on the hsm. Not only that,you can't phish or some other way social engineer the user to give up the private key. Users can keep it on their keychain or building access badge that would give physical attackers similar level of access(they can unlock your house keys and steal pii or get in the building with your badge and steal your laptop). A user friendly usbarmory for the lay-person!

deleted 8y ago
[deleted]
tptacek 8y ago
Because the parts you need to provide the functionality you want at the level of security Yubico is promising are expensive.
- badrabbit 8y ago
  I don't buy that argument. I have purchased Blu phones for under $50,yubikey nano cost me ~50. Plus,it gets even cheaper with mass production. A cheap smartphone without radio,screen,large battery with a custom os and a usb connection would be an even cheaper phone. The only things a personal hsm would add might be nfc and hardware rng. I'm surprised yubikey hasn't gotten cheaper even with companies like google using it.

foxylad 8y ago

If it's got USB-C, does it need NFC given most phones have USB-C? Or is the phone USB port incompatible?

paulie_a 8y ago
Nfc is more convenient than having to plug it in. I like my yubikey for that reason.
ecesena 8y ago
NFC is just more convenient. Also, the support for fido over usb vs nfc vs ble depends on the apps/software implementation. To my knowledge Google supports all of them, but many apps may just choose to implement NFC as it's "easier"/more common.

thinkmassive 8y ago

If this device is reprogrammable so I can experiment with the 2-device solution proposed a week ago then I’ll order quite a few of these when the Kickstarter goes live. https://news.ycombinator.com/item?id=17765979 https://news.ycombinator.com/item?id=17765979

conorpp 8y ago
Yup it will be. I've actually been in touch with Dmitry, he came up with a nice backup solution. We were thinking about coming up with some sort of protocol so devices may initially be designated as this sort of backup.
- colemickens 8y ago
  I was wondering if inspiration could be taken from the BIP32/BIP39 in the Bitcoin world. You can use a Trezor as a GPG-Agent, for example, with a key that's derived from the master key (BIP32) in the TREZOR (aka, already backed up via the BIP39 seed phrase). I haven't looked at u2f-on-trezor yet, but I'd assume it is implemented similarly. It seems like you could use existing tooling to generate the phrase and then use some existing code/processes to derive the key backing the token's u2f private key?
  - ecesena 8y ago
    Independently from the protocol you choose, the final result is that two (or more) devices will share the same private key for, e.g., your google account. The problem that we need to solve securely, is that you as a user must be sure you know all devices with that private key, i.e. no one else can trigger a backup without you knowing that, even with a temporary access to the key.
    - colemickens 8y ago
      I (think I) was just discussing a way to make the master key easy to backup. Isn't what you're discussing (prevent unknown backups) more a function of how the private key is held in the Solo itself (and in my example, how securely your seed phrase is stored)? Or is there an element of U2F that I'm missing here? (Does the token itself have an identity that you want to be unique while still preserving the same key for authentication, or is there some other detail I'm missing?)

ncmncm 8y ago

I don't understand why all these things have to be so huge and clumsy. The Tomu (tomu.im) fits almost entirely inside a USB slot, and has 64k of flash and a 32-bit ARM. If it does have to be big enough to be on a lanyard or something, I need it to be flexible, like a short cable dongle. A long skinny USB stick is an accident waiting to happen.

eropple 8y ago
The Yubikey Nano is about that size. I find it too small, though, and the NEO is perfect for me. It's the same size as my keys and I've put it through the washing machine with no problems.
- tonfa 8y ago
  I think the point of a key like the nano is to permanently put it on your device, not carry it around.
  - organsnyder 8y ago
    If you're essentially attaching it permanently, why bother with an external key at all? Isn't the main point of these devices that they remain with your person?
    - tonfa 8y ago
      it's a non fish-able token, a password can be fished a security key can't. For most people I'd think the biggest risk are non physical attacks.
    - freeone3000 8y ago
      Yes, in part - another part is that it can't be remotely compromised or duplicated. Someone has to have physical control of the key. If you have a secured area your device is in, such as an office or a locked apartment, it's way better than password or SMS 2fa.
    - ecesena 8y ago

ac29 8y ago

What's the advantage here over the Yubikey equivalent? Open/hackable firmware? Price?

anilakar 8y ago
Just the existence of the project is important as it validates the openness of the FIDO/U2F standard and ecosystem.
ecesena 8y ago
Please let me start by saying that Yubico is NOT the closed/evil. Without Yubico, we wouldn't have security keys, and we probably wouldn't have these standards. They're working since 10+ years on this problem, and they released a great amount of open source. Some short term advantages of Solo: open firmware that can be verified by the community. Somehow a reference implementation maybe. Prices will be slightly lower, yes, but not a massive advantage imo. I also hope we can build an open documentation system, to make it easier for people to start using fido2 devices. Long term dreams. 1) Open hardware will allow for experimentation. I'm personally hacking security keys into jewels, and I hope that people will take Solo design, alter it, and embed security keys into other objects and shapes. Keys are getting obsolete. 2) Pushing the industry. Again Yubico is not the "closed one" here. Security coprocessors/chips are. Hopefully, by having more and more open hardware, there'll be a market for even more open chips.

prohor 8y ago

What I miss in the U2F tokens is a small display that would show transaction details which is approved. Imagine you have a malware on your PC; it can send another transaction than the one you see in the browser, while the URL would still match. Having transaction summary on the token would be the last verification point where can still spot something is wrong.

consp 8y ago
The screen has to be run by the crypto chip if you want it to be properly 'secure' and most can't do that. At least not the ones who you can buy of the shelf unfortunately.
zorked 8y ago
If you have malware on the PC you can still be MITM'd when you actually, say, access your bank.
- consp 8y ago
  Not if the encrypted data is displayed by the crypto chip, via a round trip between the bank and the chip (encrypted). Yes, technically it can be done, but this requires physical access to the device.
def_true_false 8y ago
Ledger and Trezor have a display, though I don't know whether their U2F UX is any good.
moduspwnens14 8y ago
I have a Ledger Nano S that I use for cryptocurrency and it does basically this. It won't sign transactions unless you approve them from the device, and the little screen on the device shows the address(es) to which you're sending. https://www.ledger.com/products/ledger-nano-s https://www.ledger.com/products/ledger-nano-s It's $100, which is probably too much for your average user, but cheap enough that it's got to be feasible for a U2F kind of thing in a few years. I guess even the addition of the screen, though, kind of necessitates using a cord so you can see that screen, which makes it less clean than my Yubikey Nano (which is far less obtrusive). But I think we're getting closer.

newhere420 8y ago

Is there any reason why these devices can't have a USB-C connector on one side, and a USB-A connector on the other? Being able to keep just one single token around and knowing I can always use it without an adaptor is the holy grail of these devices for me.

JustSomeNobody 8y ago
Cost. That's really the only reason. This would be a really good stop gap until the industry has transitioned everyone over to usb-c.

zaarn 8y ago

My wishlist for this includes some RSA GPG usage but it'll probably remain on my wishlist. The Yubikey tokens are still rather expensive at 50$ and soldering my own and maybe selling extra copies (thanks MOQ) to friends. Otherwise, this looks great, I'll definitely sign up for the newsletter later on...

ecesena 8y ago
We're considering this and similar features (gpg/ssh keys). One minor issue is the memory requirement, as our current chip only has 128KB of flash available. The bigger issue is certainly our time :), we're really pushing to have Solo keys available before Xmas, and thus we're prioritizing hardware and fido2. We also want to get fido2 certification, which of course means a lot more work that just making it work.
- zaarn 8y ago
  Of course, yeah, getting a product out can be more important. Good luck :)

ssebastianj 8y ago

Just wondering, is there any reason why the Yubico FIDO2 Python API[0] talks to a USB device by using custom code to handle the USB protocol instead of using a module like PyUSB[1]? [0] https://github.com/Yubico/python-fido2 https://github.com/Yubico/python-fido2 [1] https://pyusb.github.io/pyusb/ https://pyusb.github.io/pyusb/

jiveturkey 8y ago

> But since U2F/FIDO2 devices need to derive secret keys at runtime to be able to work with an unlimited number of services, the ATECC508A doesn’t work out well. This is because to derive a key at runtime, you typically need to compute an HMAC that’s keyed with a master secret, and store the result as the runtime key. This needs multiple interactions with the ATECC508A and requires the runtime key be stored temporarily on the MCU, which tarnishes the idea of key isolation. This is incorrect. The atec family can derive keys using a static master seed and variable nonce. Such keys are derived internally and kept internally, never leaving the chip. By storing a single derivation master secret, you can use the hashed u2f appid as the nonce. I would additionally have a 2nd hmac secret to apply to the nonce, and use that as the key derivation nonce rather than the appid directly.

jiveturkey 8y ago

why didn't you use a cap touch sensor? pretty easy to do. the problem with the mechanical button is that it will torque the usb port. this is more of a problem with your design, where the usb contacts are just contact area on the pcb, as opposed to a fully enclosed usb-a "connector". admittedly, a small problem, but since cap touch would have been easy, it seems a problem that would have been worth tackling maybe?