The name sounds like a disease.
Probably a play on words in Swedish, "tillit" means trust / confidence.
Move over, IKEA.
Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
51–60 of 123 posts
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#52Am I right in thinking that this is basically like a yubikey except with openness as key differentiator? Or is it’s function something else ?
The Tillitis Key is a new kind of USB security key inspired by measured boot and DICE. Tillitis Key’s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky for end-users. It offers both security and flexibility by being end-user programmable while also preventing applications loaded onto the device from knowing each other’s secrets.…
IIUC, popular security key devices like the YubiKey securely store a private key, but only allow it to be used for specific authentication applications (e.g. OTP or U2F). Would the Tillitis Key be able to securely store a private key, then with appropriate authentication from the host, use that key for encryption and decryption?
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#53I'm not sure what problem this solves. I see per-application keys based on the hash of the application, but wouldn't this prevent updates of those applications without key loss? It's clear to me that this device can be used for _some_ kind of cryptographic operation/verification mechanism, but I'm at a loss for what problem this is actually designed to solve. What's the practical application of this key?
The app key would need to stay the same, but I can't think of a mechanism that would deny one app trying to pretend it's another. Also the fact it doesn't emulate smartcard means every single software supporting it would have to make a special client so yeah, that's a problem. "Just" smartcard allows for at the very least GPG signing and SSH agent without much fuss, and also HTTPS client cert auth
I believe the only thing needed is someone writing a PKCS #11 driver for it, then it should be interoperable.
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#54Am I right in thinking that this is basically like a yubikey except with openness as key differentiator? Or is it’s function something else ?
The Tillitis Key is a new kind of USB security key inspired by measured boot and DICE. Tillitis Key’s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky for end-users. It offers both security and flexibility by being end-user programmable while also preventing applications loaded onto the device from knowing each other’s secrets.…
[deleted]
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#55Unimportant trivia from a Swedish speaker: Mullvad means mole (for the tunnelling more than planted spy connotations, hopefully), and the "Tillit" part of the name means trust. They're working on some IKEA style naming, which I enjoy.
Thanks! The other news of today is that we've started a second sister company - Glasklar Teknik AB - which will focus on maintenance and development of System Transparency and Sigsum.
System Transparency: Mullvad's security architecture we'll use to eventually make our running VPN systems transparent.
Sigsum: A transparency log design with distributed trust assumptions (witness cosigning).
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#56The name sounds like a disease.
It’s tillitating.
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#57It strikes me that open source hardware should be more common. It's surely much easier to monetise than open source software: you just sell the hardware, because noone wants to build one themselves. Why isn't it?
Because hardware is, well, hard. There is a huge upfront investment that isn't even remotely comparable to the amount of money you can spend on software development, and equally huge incentives for third parties to undercut you by taking your designs, manufacturing them for cheap and offloading support onto you (as already pointed out Arduino is a great example of this happening in real life). Even if everything is open source you have to build an entire business and marketing department around selling the hardware, while with pure software you can just put it up on GitHub and call it a day.
Not to mention that in this day and age every piece of hardware has software at its core, so open source hardware does not save you from also writing the code that runs on it. If anything developing open source firmware is actually harder, because most chip vendors expect your product to be closed source and want you to sign countless NDAs before you can access a datasheet or even just buy the chips. You are restricted to using older and/or more expensive parts whose documentation is freely available; it's the exact opposite of the software world, where the latest and greatest is one npm install away.
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#58Unimportant trivia from a Swedish speaker: Mullvad means mole (for the tunnelling more than planted spy connotations, hopefully), and the "Tillit" part of the name means trust. They're working on some IKEA style naming, which I enjoy.
Thanks! The other news of today is that we've started a second sister company - Glasklar Teknik AB - which will focus on maintenance and development of System Transparency and Sigsum. System Transparency: Mullvad's security architecture we'll use to eventually make our running VPN systems transparent. Sigsum: A transparency log design with distributed trust assumptions (witness cosigning).
Glad to hear it! Both valiant efforts, and good naming here too.
For non-speakers; "Glasklar" means literally "glass clear", but makes more sense to explain as the phrase in Swedish equivalent to "clear as day".
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#59Earlier quoted context omitted.
The Tillitis Key is a new kind of USB security key inspired by measured boot and DICE. Tillitis Key’s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky for end-users. It offers both security and flexibility by being end-user programmable while also preventing applications loaded onto the device from knowing each other’s secrets.…
IIUC, popular security key devices like the YubiKey securely store a private key, but only allow it to be used for specific authentication applications (e.g. OTP or U2F). Would the Tillitis Key be able to securely store a private key, then with appropriate authentication from the host, use that key for encryption and decryption?
> Would the Tillitis Key be able to securely store a private key, then with appropriate authentication from the host, use that key for encryption and decryption?
Yes. I don't think that would be very hard to do.
Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE
#60Earlier quoted context omitted.
My understanding is that it's both a more general platform (targeting more than 2FA) and also uses an FPGA running open-source code, so that the "secure enclave" functionality can be inspected and found to be secure, rather than just trusting NXP/ARM's chip as SoloKeys have done.
FTR SoloKeys targets FIDO2, not just U2F
I think what they mean is that this can be reprogrammed for more use cases than FIDO2 and U2F, it can say be programmed to support my own homegrown thing that I've made up just now or even a more general concept than just getting into things perhaps.