Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
1–10 of 94 posts
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#2Very cool! Has anyone published any work on using sidechannel information to extract keys from U2F tokens?
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#3Linux users should use cross-vendor U2F support rather than hardcoding device ids into the udev rules:
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#4Haven't tried it yet, but there is this for smartcards. Not sure if it will work with blank java cards, I mean they provide the cap file and source.
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#5This is neat!
Is there also source for the firmware that runs on the secure element?
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#6This is neat! Is there also source for the firmware that runs on the secure element?
No it is purely a hardware peripheral that just has configuration options.
http://www.atmel.com/Images/Atmel-8923S-CryptoAuth-ATECC508A...
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#7Very cool! Has anyone published any work on using sidechannel information to extract keys from U2F tokens?
Yes. There is [1] which is on Yubikey OTP specifically.
And on a lot more that focus on general embedded platforms running common cryptographic algorithms. U2F uses elliptic curve cryptography (ECC) internally -- check out this source for DPA on ECC [2].
[1] http://link.springer.com/chapter/10.1007/978-3-642-41284-4_1...
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#8My barrier to entry with a lot of DIY hardware projects was an incorrect assumption that it was difficult/expensive to get PCBs made. Looking into this, I found the blog of the guy running this project and he had some experience with various cheap PCB vendors, with stencils going as low as $18. [1]
[1]: https://conorpp.com/2016/03/13/my-experience-with-dirtypcbsc...
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#9My barrier to entry with a lot of DIY hardware projects was an incorrect assumption that it was difficult/expensive to get PCBs made. Looking into this, I found the blog of the guy running this project and he had some experience with various cheap PCB vendors, with stencils going as low as $18. [1] [1]: https://conorpp.com/2016/03/13/my-experience-with-dirtypcbsc...
In addition to the vendors you mention via that link, OSH Park[1] is great option for hobbyists (or very small-volume production). This is the same source listed in OP. It's a board pooling group that puts many small-run orders on the same panel to economize on setup costs. OSH Park uses high-quality US manufacturers to produce the boards (with tight tolerances, silkscreen, soldermask, gold-flashed pads, etc.) I believe they used to use Amitron outside Chicago, but I'm not sure if that's still the case. I've had probably 300 boards made by them, and they've all been great.
In open source designs you can usually spot OSH Park boards by the distinctive purple color. Seeed Studio and the other Asian budget board houses are a decent economy option if you can get away with looser tolerances. OSH Park is nice for compact designs because the gold-flashed pads are better for surface-mount parts, since they aren't raised like traditional solder-painted pads. Unlike most quickturn PCB fabs they don't bury you with options; the standard options give you everything you need (ENIG, double mask+silk screen, either 2/4 layer, etc.). The OSH Park ordering wizard is a case study in how PCB orders should be done (upload and a couple clicks, with a graphical preview), and for the quality the price can't be beat. Because orders are pooled and then separated before shipping out, it is slower.
You can use the free and open KiCad[2] software (again, what was used in OP; tutorials[3,4]) to do schematic capture and board layout, have it generate some gerber and drill files, and then order the boards for a few bucks from OSH Park. KiCad won't do simulations like Altium or some of the other commercial packages, but if you just want to take a schematic and make a board it works fine. Definitely learn its hotkeys.
Re: Show HN: A secure, open source U2F token you can make with $4.5 worth of parts
#10This project is awesome, but I'd be worried about my hand brushing up against all that lead every day for years. Or am I being too paranoid? In any case, easily solved with some casting epoxy.