41780e9e33
* Common duration type for ctap library independent of TockOS * Implement Env-specific ctap-hid channels for I/O Common I/O Status, Error and Result types * Move common user presence checking code to ctap library * Move CtapHidChannel and UserPresence traits, with their accompanying types to separate API mods. Remove Default implementations of methods in these traits, to keep all implementation details inside of concrete Env types. Rename methods in UserPresence trait, for better readability. Remove duplicate code for finding appropriate HID channel for given transport. Rework check_user_presence() function so that there's no more need for quick_check() method in UserPresence trait. To short-circuit user presence check, Env implementation may use wait_with_timeout() method. * Fix button press wait with zero timeout for TockEnv * Fix formatting * Remove type for duration, use embedded_time::duration::Milliseconds directly, for better readability. Treat any unconfirmed result of user presence check as an error, which maps more naturally to CTAP spec status codes. Remove unneeded underscores in trait definition. Store usb endpoint directly, in TockEnv channels, to avoid unneeded conversions. * No need for separate error type for send_keepalive_up_needed() * Document UserPresence trait and types. Remove unused parameters in UserPresence trait's methods. Add conversion function from UserPresence errors to Ctap2 status codes. Do not check button status when tock user presence wait is called with zero timeout. * Make test environment always report success sending data * Rename CtapHidChannel to HidConnection, rename *_hid_channel -> *_hid_connection, for clarity. Use "Channel" to refer to the logical connection from authenticator to one client, and use "Connection" to refer to physical connection of authenticator to platform, on which clients run. Remove channel parameter from user presence API, it's not needed. * Remove duplicate comments. Co-authored-by: kaczmarczyck <43844792+kaczmarczyck@users.noreply.github.com>
OpenSK
This repository contains a Rust implementation of a FIDO2 authenticator. We developed OpenSK as a Tock OS application.
We intend to bring a full open source experience to security keys, from application to operating system. You can even 3D print your own open source enclosure! You can see OpenSK in action in this video on YouTube!
You are viewing the branch for developers. New features are developed here before they are stabilized. If you instead want to use the FIDO certified firmware, please go back to the stable branch.
FIDO2
The develop branch implements the CTAP2.1 specification. This branch is not FIDO certified. The implementation is backwards compatible to CTAP2.0. Additionally, OpenSK supports U2F, and non-discoverable credentials created with either protocol are compatible with the other.
⚠️ Disclaimer
This project is proof-of-concept and a research platform. It is NOT meant for a daily usage. It comes with a few limitations:
- This branch is under development, and therefore less rigorously tested than the stable branch.
- The cryptography implementations are not resistent against side-channel attacks.
We're still in the process of integrating the ARM® CryptoCell-310 embedded in the Nordic nRF52840 chip to enable hardware-accelerated cryptography. Our placeholder implementations of required cryptography algorithms (ECDSA, ECC secp256r1, HMAC-SHA256 and AES256) in Rust are research-quality code. They haven't been reviewed and don't provide constant-time guarantees.
Hardware
You will need one the following supported boards:
- Nordic nRF52840-DK development kit. This board is more convenient for development and debug scenarios as the JTAG probe is already on the board.
- Nordic nRF52840 Dongle to have a more practical form factor.
- Makerdiary nRF52840-MDK USB dongle.
- Feitian OpenSK dongle.
Installation
To install OpenSK,
- follow the general setup steps,
- then continue with the instructions for your specific hardware:
To test whether the installation was successful, visit a demo website and try to register and login. Please check our Troubleshooting and Debugging section if you have problems with the installation process or during development. To find out what else you can do with your OpenSK, see Customization.
Contributing
See Contributing.md.
Reporting a Vulnerability
See SECURITY.md.