#picokeys — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #picokeys, aggregated by home.social.
-
Passkey без Apple, Google и облаков: делаем собственный аппаратный ключ за 4 евро
Несколько лет назад я озаботился покупкой YubiKey 5 NFC в надежде, что он станет для меня своеобразным ключом от всех дверей. Ожидания оправдались, он успешно трудится каждый день в роли 2FA и снабжает меня одноразовыми кодами TOTP. Но под некоторые задачи мне хотелось иметь отдельные ключи, вот только жаба душила отдавать по 70-80 евро за штуку. Однажды я наткнулся на проект Pico Keys, который позволяет превратить Raspberry Pi Pico или ESP32-S3 в персональный security key, некую альтернативу Yubikey. С учетом стоимости и доступности, это выглядело как неплохой вариант, а в реальности оказалось еще интереснее. Так что наливайте кофейку и приятного чтения.
-
Personal Secure Key with open hardware and software
RP2040, RP2350, ESP32-S3- Hardware Secure Module
- Fido2 Passkey
- OpenPGP & PIV
UPD: похоже, сейчас лучше смотреть на форк LibreKeys.
-
Personal Secure Key with open hardware and software
RP2040, RP2350, ESP32-S3- Hardware Secure Module
- Fido2 Passkey
- OpenPGP & PIV
UPD: похоже, сейчас лучше смотреть на форк LibreKeys.
-
I got a Rasperry Pi Pico 2 delievered recently, and I've spent today playing around with the #Picokeys project.
Specifically, I put both pico-hsm and pico-fido on it to play around with, and it's a really cool project. Back in the Pico 1 days it wasn't really any more secure than a software HSM, but the #RP2350 has enough security features that its actually interesting as a security project.
I wouldn't use it for anything serious at this stage, the code is unaudited, and the Pico 2's recent hacking challenge (https://github.com/raspberrypi/rp2350_hacking_challenge) revealed ways of breaking the security that wont be fixed until there's another hardware revision. However, if I was building my #homelab CA at the moment, I'd probably use this, because a) its much cooler than using a Yubikey, b) and my homelab's threat model doesn't include people breaking in with electroncis tools to extract my CA keys :P
The bigger issue is that the documentation for the project is... poor. The guides to get up and running are fine, but the docs for using it as a HSM are full of outdated information, and its not clear which of the security discussions are talking about the RP2040, and which refer to the 2350. I wish I knew enough about cryptography to be able to help with the docs, but I just don't.
Once the new hardware stepping is out, and the docs are updated there's got to be some use for a HSM that cost under a tenner, even if its not as audited as the more expensive Hardware Security devices, but I'm not yet certain what they are.
-
I got a Rasperry Pi Pico 2 delievered recently, and I've spent today playing around with the #Picokeys project.
Specifically, I put both pico-hsm and pico-fido on it to play around with, and it's a really cool project. Back in the Pico 1 days it wasn't really any more secure than a software HSM, but the #RP2350 has enough security features that its actually interesting as a security project.
I wouldn't use it for anything serious at this stage, the code is unaudited, and the Pico 2's recent hacking challenge (https://github.com/raspberrypi/rp2350_hacking_challenge) revealed ways of breaking the security that wont be fixed until there's another hardware revision. However, if I was building my #homelab CA at the moment, I'd probably use this, because a) its much cooler than using a Yubikey, b) and my homelab's threat model doesn't include people breaking in with electroncis tools to extract my CA keys :P
The bigger issue is that the documentation for the project is... poor. The guides to get up and running are fine, but the docs for using it as a HSM are full of outdated information, and its not clear which of the security discussions are talking about the RP2040, and which refer to the 2350. I wish I knew enough about cryptography to be able to help with the docs, but I just don't.
Once the new hardware stepping is out, and the docs are updated there's got to be some use for a HSM that cost under a tenner, even if its not as audited as the more expensive Hardware Security devices, but I'm not yet certain what they are.
