171–180 of 215 posts
Are the schematic files and PCB/Gerber files available? I understand that they only claim to be Open-Source and not Open Source Hardware but it would still be nice to see and have the hardware schematics.
Earlier quoted context omitted.
I understand the Arduino model is different than other projects but we proudly use Arduino as it's open source and has lots of great features. As we use the Arduino model you can find that our source consists of the .ino you mentioned here https://github.com/trustcrypto/OnlyKey-Firmware as well as libraries here https://github.com/trustcrypto/libraries . Our code is reviewed by Codacy and yes, it does receive a grade…
It seems you're confused as to what Codacy is reviewing. Look at their dashboard for the OnlyKey-Firmware repo. They are not reviewing your .ino file at all, because they do not consider that file extension as code. Only the toplevel C files are covered.
All libraries are included and also receive a grade of A.
Earlier quoted context omitted.
Like literally the first post issue is completely incorrect, thats one of the issues in reading a post like this in an online thread, literally that user copied part of but not all of the function that is used for RNG. The part they copied uses analog input as one of the sources of entropy, they failed to also include the 6 capacitive touch inputs that are also inputs to the RNG. Those touch inputs literally change e…
Your "delay 0-6 ms" only delays 0-4 ms. Not to mention the fact that the only obvious effect of that delay is to expose entropy information to timing analysis.
Earlier quoted context omitted.
The 7000 lines don't bother me as much as the complete lack of refactoring, heavy use of magic numbers repeated throughout, and logical expressions that duplicate logic over and over again. Some examples... Compare these two blocks of assignments and memcpy calls: https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04... https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04... Yes, they are as identical…
> None of this inspires confidence that the code can be trusted. It's a shame this code isn't so good out of the box, but for all we know there are proprietary devices purporting to do the same job which also have poor code. The difference between the devices is we can review, edit/improve, share, and run the improved code for this device. The software freedom is a feature unto itself. So one is still better off with…
Earlier quoted context omitted.
You might want to check out this - https://docs.crp.to/security.html#cryptographically-secure-r... If you read further into the source you will see that analog read is only one of the sources of entropy, it uses capacitive touch from a user's skin and this TRNG passed dieharder tests - https://webhome.phy.duke.edu/~rgb/General/dieharder.php
Passing dieharder doesn't mean anything at all with respect to cryptographic security. It's trivial to define a random bit generator that passes randomness tests and has no real security.
Technically, doesn't not passing dieharder mean something with respect to cryptographic security, though?
Earlier quoted context omitted.
Any chance that key can be used for windows login? I'm searching for a key that also works as a smartcard for winows on prem active directory authentication, as well as FIDO2 support. Or a key that has software which allows this. edit: changes should be chance
One of the nice things about OnlyKey is you have options. - You can use OnlyKey to store a password up to 56 characters long for Windows login. You don't remember this password OnlyKey types it for you. - You can use OnlyKey as a FIDO2 security key to login to Windows with Azure AD.
So it basically registers itself as a keyboard?
Even if the Windows PC is locked?
How does it know which password to type?
Unfortunately everything that is more complicated than "take that stick and stick it in the usb port" is gonna be difficult.
I know about the FIDO2 with azure AD, but I need it for on prem AD, which doesn't support fido2.
Earlier quoted context omitted.
Any chance that key can be used for windows login? I'm searching for a key that also works as a smartcard for winows on prem active directory authentication, as well as FIDO2 support. Or a key that has software which allows this. edit: changes should be chance
Feitian advertises one here https://www.ftsafe.com/Products/FIDO/NFC and they say you can request a dev version so you can install your own applets, but I can't vouch for it yet personally.
Earlier quoted context omitted.
Flash readout protection on most microcontrollers is a joke. They are almost always vulnerable to attacks ranging from power/clock glitching to asking nicely with the right combination of flash management commands (I'm looking at you, some PICs from the PIC18 series with blockwise erasable Flash including protection bits). I've seen some things disable their read protection by accident because the power supply wasn't…
I've signed a ot of these NDAs. Dirty little secret, most of them are DUAL_ED_DRBG which is backdoored. None of them have any meaningful protection, and usually they have sidehcannels the size of mountains. There's none of the secure element chips I would consider to be stronger than cryptography in software. They're the same as passing certifications, good to corporate management but a joke to anybody who knows what…
OnlyKey's ability to type passwords differentiates it for my use cases. I can use OnlyKey to type long BIOS, disc, user and root passwords without worrying about people around or security cameras.
YubiKey can also do this: https://www.engineerbetter.com/blog/yubikey-static-secret/
This seems to predate FIDO2. https://solokeys.com/ would be a better option if you prefer separate keys for each site (via FIDO2) and open source hardware.