Is it really necessary to use external ATECC508A with ESP32? I would not be surprised if software implementation on ESP32 is actually faster.
Arduino FIDO2 Authenticator
31–40 of 90 posts
Re: Arduino FIDO2 Authenticator
#32Can anyone explain or further expand on this statement > plain C and ESP IDF are too difficult for the broad audience My intuition is that most folks who hack on EPS32 and other microcontrollers have no problem with these things.
From my experience - most people say "Arduino is ok" but struggle working with plain C.
As well keep in mind number of ready-made libraries for Arduino that can be reused here almost out of the box.
Re: Arduino FIDO2 Authenticator
#33This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).
Weld it into an anvil to prevent tampering while you are away!
Re: Arduino FIDO2 Authenticator
#34This is pretty cool, and being able to make a FIDO2 device that I can just keep at home next to the PC is pretty appealing. I already have a Yubikey in my keychain for carrying with me, but the keychain isn't at my desk, so having a second one would be pretty great. It would be amazing if this supported FIDO2 resident mode, it could store thousands of credentials (Yubikeys can only do 25 non-thousand credentials).
Weld it into an anvil to prevent tampering while you are away!
Haha, I was thinking of a 50lb block of epoxy resin cast around the device, with metal rods protruding down to the touch sensors.
Re: Arduino FIDO2 Authenticator
#35Earlier quoted context omitted.
That's surprisingly cheap, less than $10 for a token. Any downsides?
No FIDO2 so it won't work with everything. No NFC.
Oh, it's just U2F? You want FIDO2 with resident key support to get the really nice OpenSSH workflow (plug the key in to a new computer, run ssh-add -k, now you can SSH to all your computers).
Re: Arduino FIDO2 Authenticator
#36Earlier quoted context omitted.
Yubico has said from the very beginning that they will stick to NFC because Bluetooth is not secure. Bluetooth is a 3000+ pages spec that's a mess and will likely always remain a mess. Maybe it's time for something better?
I'm using a bluetooth keyboard and I type my passwords in plain text. I don't think that public key sent over bluetooth is less secure. So it's a very tricky topic and I think it's more about corporate insterests that actual security.
Is Bluetooth not encrypted? It would be disastrous if just anyone could read what your Bluetooth keyboard is sending.
Re: Arduino FIDO2 Authenticator
#37Earlier quoted context omitted.
I'm using a bluetooth keyboard and I type my passwords in plain text. I don't think that public key sent over bluetooth is less secure. So it's a very tricky topic and I think it's more about corporate insterests that actual security.
Is Bluetooth not encrypted? It would be disastrous if just anyone could read what your Bluetooth keyboard is sending.
It is encrypted with MITM protection. That's why I do not believe in severe security issues in BLE. There can be problems with particular implementations, but in general it should not be less secure that typing password on a keyboard.
Re: Arduino FIDO2 Authenticator
#38Earlier quoted context omitted.
Is Bluetooth not encrypted? It would be disastrous if just anyone could read what your Bluetooth keyboard is sending.
It is encrypted with MITM protection. That's why I do not believe in severe security issues in BLE. There can be problems with particular implementations, but in general it should not be less secure that typing password on a keyboard.
That's what I thought, thank you.
Re: Arduino FIDO2 Authenticator
#39Is it really necessary to use external ATECC508A with ESP32? I would not be surprised if software implementation on ESP32 is actually faster.
You can not extract private key from ATECC508A while it can be an issue with custom key storage built on Arduino. The chip itself costs around one dollar so why not?
Re: Arduino FIDO2 Authenticator
#40Earlier quoted context omitted.
No FIDO2 so it won't work with everything. No NFC.
Oh, it's just U2F? You want FIDO2 with resident key support to get the really nice OpenSSH workflow (plug the key in to a new computer, run ssh-add -k, now you can SSH to all your computers).
Can I do this with a Yubikey?
Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything?
I think I was using PIV last time.