Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

tillitis.se

Post reply on HN
Print view View original

61–70 of 123 posts

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#61

Post by cinntaile »

croon wrote: post #58
kfreds wrote: post #55

Earlier quoted context omitted.

Thanks! The other news of today is that we've started a second sister company - Glasklar Teknik AB - which will focus on maintenance and development of System Transparency and Sigsum. System Transparency: Mullvad's security architecture we'll use to eventually make our running VPN systems transparent. Sigsum: A transparency log design with distributed trust assumptions (witness cosigning).

Glad to hear it! Both valiant efforts, and good naming here too. For non-speakers; "Glasklar" means literally "glass clear", but makes more sense to explain as the phrase in Swedish equivalent to "clear as day".

You can say crystal clear in English, it's a bit closer to the original version.

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#62

Post by throwoutway »

kfreds wrote: post #35
Havoc wrote: post #4

Am I right in thinking that this is basically like a yubikey except with openness as key differentiator? Or is it’s function something else ?

The Tillitis Key is a new kind of USB security key inspired by measured boot and DICE. Tillitis Key’s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky for end-users. It offers both security and flexibility by being end-user programmable while also preventing applications loaded onto the device from knowing each other’s secrets.…

What is DICE? I’m searching but the only results are the company and not whatever you’re referring to

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#64

Post by mwcampbell »

throwoutway wrote: post #62
kfreds wrote: post #35

Earlier quoted context omitted.

The Tillitis Key is a new kind of USB security key inspired by measured boot and DICE. Tillitis Key’s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky for end-users. It offers both security and flexibility by being end-user programmable while also preventing applications loaded onto the device from knowing each other’s secrets.…

What is DICE? I’m searching but the only results are the company and not whatever you’re referring to

From elsewhere in the thread: https://www.microsoft.com/en-us/research/project/dice-device...

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#65

Post by zimbatm »

JoachimS wrote: post #21
ldng wrote: post #17

Earlier quoted context omitted.

It is an FPGA, fully open both at software and hardware level. So quite a bit more futurproof, inspectable and upgradable than a yubikey.

(For full disclosure I am the primary FPGA designer of TillitisKey.) It also perform a measurement of the application being loaded. And the measurement together with the Unique Device Secret (UDS) will generate the primary secret applications can use to derive keys etc it needs. This means that you can verify the application integrity. This is very close to, inspired by DICE: https://www.microsoft.com/en-us/research/…

Does this mean that a software upgrade will change the keys?

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#66

Post by JoachimS »

layer8 wrote: post #47
JoachimS wrote: post #21

Earlier quoted context omitted.

(For full disclosure I am the primary FPGA designer of TillitisKey.) It also perform a measurement of the application being loaded. And the measurement together with the Unique Device Secret (UDS) will generate the primary secret applications can use to derive keys etc it needs. This means that you can verify the application integrity. This is very close to, inspired by DICE: https://www.microsoft.com/en-us/research/…

What exactly is the “measurement”? A hash of the application code?

Yes. The hash of the application code and the 256 bit Unique Device Secret is hashed to generate a primary secret, which then the application can use to derive the secrets it needs.

You can additionally supply a secret from the host (the User Supplied Secret). This means that the keys generated are tied to the specific device (the UDS), that the integrity of the application is correct, and to you as a user.

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#67

Post by WaitWaitWha »

kfreds wrote: post #35
Havoc wrote: post #4

Am I right in thinking that this is basically like a yubikey except with openness as key differentiator? Or is it’s function something else ?

The Tillitis Key is a new kind of USB security key inspired by measured boot and DICE. Tillitis Key’s design encourages developers to experiment with new security key applications and models in a way that makes adoption easier and less risky for end-users. It offers both security and flexibility by being end-user programmable while also preventing applications loaded onto the device from knowing each other’s secrets.…

@kfreds thank you for the response, and the commitment you have for this project.

>> ... this is basically like a yubikey ...

> ... new kind of USB security key ...

The things you have listed are indeed very nice, but they are not new kind, as they are available elsewhere.

Can you give a bit more compare and contrast to the original question?

Again, thank you.

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#68

Post by zx85wes »

JoachimS wrote: post #30
tinco wrote: post #24

Earlier quoted context omitted.

Did you design the board? It looks sick, such high density of components on the top layer.

No, the board design is done by the wizard Matt Mets at https://blinkinlabs.com/

OMG. Just saw the Thinking Machines CM-2 replica on their homepage. What an awesome idea.

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#69

Post by vinay_ys »

irusensei wrote: post #63

Quick question about such devices: can I use stuff like Yubikey or similar to luksOpen a crypt device during boot or operation? Thanks in advance.

Do you mean something like this: https://github.com/agherzan/yubikey-full-disk-encryption

Re: Tillitis Key – Mullvad spin-off inspired by measured boot and DICE

#70

Post by JoachimS »

ptman wrote: post #43
FredFS456 wrote: post #10

Earlier quoted context omitted.

My understanding is that it's both a more general platform (targeting more than 2FA) and also uses an FPGA running open-source code, so that the "secure enclave" functionality can be inspected and found to be secure, rather than just trusting NXP/ARM's chip as SoloKeys have done.

FTR SoloKeys targets FIDO2, not just U2F

The TillitisKey should be able to be used for FIDO2, as a TOTP generator etc. Right now there is a SSH agent application, which allows you to sign in by touching the device.

Personally I'm very excited to see what applications will be developed at the hackathon at the OSFC conference, and onwards. We have had people at the conference showing interest in trying to write applications in Rust. I will try and implement an application of my own tomorrow.

Post reply on HN