078e565ac1
* Add basic setup for multi-PIN
- Reserve the storage keys for maximum of 8 user slots.
- Modify the storage functions to take a slot_id parameter.
- Add the slot_count() customization.
- Assume slot_id as a parameter when needed except these places:
- Entrance functions of command processing that directly takes the
command parameter structure. slot_id is set as 0, and will be
parsed from the parameters when we enable the feature.
- MakeCredential/GetAssertion/AuthenticatorConfig will take the
slot_id from active token state when we enable the feature,
resulting in an `Option<usize>`. Below code will act on the option
value correctly. When the feature isn't enabled, we're always
referring to the only PIN slot so set slot_id as Some(0).
- GetInfo returns verdict of whether PIN is supported and enabled, and
whether PIN needs to be forced changed. There will be new fields to
represent those values when the feature is enabled, and the old
fields will not be populated. So when the feature isn't enabled, we
can treat slot_id as 0.
Not covered in this commit:
- Unittests for other slots. The existing tests all pass and I plan to
add unittests for multi-slot case after the codebase allows enabling
the feature.
- Persisting and checking the slot_id in credentials. This is planned to
come in the next commit.
* Fix storage and some other style
* Add support for concatenated values
* Switch some storage entries back to multi-entry
* Set bumpalo version for fuzzing (#532)
* maximum working bumpalo version
* explicit comment to explain version locking
* removes incorrect comment
* moves serde version lock to dev dependencies
* removes serde dependencies
* reverts serde removal in crypto library
* Make PIN_PROPERTIES use concatenated storage entry
* Fix bumpalo issue
* Use concatenated storage entry for force_pin_change too
* Fix cargofmt
Co-authored-by: Julien Cretin <cretin@google.com>
Co-authored-by: kaczmarczyck <43844792+kaczmarczyck@users.noreply.github.com>
OpenSK
This repository contains a Rust implementation of a FIDO2 authenticator. We developed OpenSK as a Tock OS application.
We intend to bring a full open source experience to security keys, from application to operating system. You can even 3D print your own open source enclosure! You can see OpenSK in action in this video on YouTube!
You are viewing the branch for developers. New features are developed here before they are stabilized. If you instead want to use the FIDO certified firmware, please go back to the stable branch.
FIDO2
The develop branch implements the CTAP2.1 specification. This branch is not FIDO certified. The implementation is backwards compatible to CTAP2.0. Additionally, OpenSK supports U2F, and non-discoverable credentials created with either protocol are compatible with the other.
⚠️ Disclaimer
This project is proof-of-concept and a research platform. It is NOT meant for a daily usage. It comes with a few limitations:
- This branch is under development, and therefore less rigorously tested than the stable branch.
- The cryptography implementations are not resistent against side-channel attacks.
We're still in the process of integrating the ARM® CryptoCell-310 embedded in the Nordic nRF52840 chip to enable hardware-accelerated cryptography. Our placeholder implementations of required cryptography algorithms (ECDSA, ECC secp256r1, HMAC-SHA256 and AES256) in Rust are research-quality code. They haven't been reviewed and don't provide constant-time guarantees.
Hardware
You will need one the following supported boards:
- Nordic nRF52840-DK development kit. This board is more convenient for development and debug scenarios as the JTAG probe is already on the board.
- Nordic nRF52840 Dongle to have a more practical form factor.
- Makerdiary nRF52840-MDK USB dongle.
- Feitian OpenSK dongle.
Installation
To install OpenSK,
- follow the general setup steps,
- then continue with the instructions for your specific hardware:
To test whether the installation was successful, visit a demo website and try to register and login. Please check our Troubleshooting and Debugging section if you have problems with the installation process or during development. To find out what else you can do with your OpenSK, see Customization.
Contributing
See Contributing.md.
Reporting a Vulnerability
See SECURITY.md.