Feedback

[TheMaxMur]

Hi!

I'd like to get some feedback on the key: how you use it, are you having any issues with it, and how is it working overall with the latest release 0.4.4?

@lockedmutex @cresseelia @netll @mannp @Curious-r @ncmro7 @lpiob @JDestiny

[Curious-r]

I currently use the RS‑Key in two main areas: on some accounts as a passkey or second‑factor key, and on my NixOS machines as a secret‑management key (you can see this in my configuration repository). Both use cases work well.

In particular, when using it with NixOS, I've run into a few toolchain‑related usability issues—but I've either worked around them via configuration or fixed them with my own patches. For the most part, these were common to the original Yubikey as well, rather than being specific to the RS‑Key.

[TheMaxMur]

Can you tell us more about these issues and share any patches?

[Curious-r]

Can you tell us more about these issues and share any patches?

Those are toolchain patches for specific use cases—most of them have already been merged or resolved upstream, so users with the same setup can simply track upstream and be good to go. For example：
milieuim/vaultix#62
https://codeberg.org/r-vdp/polkit-stdin-agent/issues/23
https://codeberg.org/r-vdp/pam-fido-remote/issues/29

[ncmro7]

Actually, I just wanted to find some cheap hardware that can use a passkey 😂, and I'm not ready to use it officially yet, so I'm just checking if it works based on its possible uses.

The default firmware can't detect the device using pcsc_scan on Linux, and rsk-tui as well as other PCSC-based services like OpenPGP don't work properly, but it works fine on Windows. Using Yubikey VIDPID works too. Also, is it possible to include an LED GRB build in the release version?

[TheMaxMur]

Could you share some commands/screenshots so I can try to fix pcsc_scan's behavior on Linux? Are there any conflicts with pcscd/CCID?

[Curious-r]

Regarding the Linux detection issue: As far as I know, pcscd on Linux relies on libccid, which uses a strict VID/PID whitelist. RS-Key's default VID/PID (1209:0001) is unlikely to be in this preset list, which is why spoofing a YubiKey works.

If you want to stick with the default firmware, you can easily fix this by manually adding the default VID/PID to the Info.plist file on Linux (usually located in /usr/lib/pcsc/drivers/ifd-ccid.bundle/Contents/Info.plist for FHS distribution).

CC @TheMaxMur

[ncmro7]

you are right

[lockedmutex]

@TheMaxMur Would it be possible to have most of the config that can be done via pcscd on linux be also done via fido. Since fido will not face the same whitelist issue as pcscd, so users can still configure the key via picoforge without changing the whitelist.

[ncmro7]

Just remembered, it seems like WebAuthn can't correctly get device information. For example, the aaguid is always 00000000-0000-0000-0000-000000000000, and webauthn.io doesn't show the device name either. What's the reason for this?

[ncmro7]

I tried the existing Firefox on my Ubuntu VM, and it's still the same. I also found an issue: the default VIDPID seems unable to use WebAuthn properly on Ubuntu. The standard process with a YubiKey is to touch it after entering the PIN, but with the default VIDPID, Firefox directly prompts for a touch, skipping the PIN input step, and the device doesn't appear to require a touch.

I wonder if it might be because of my virtual machine.

[Curious-r]

Not all websites and configurations request this information. For example, on webauthn.io, you should adjust Attestation to Direct in the advanced settings.

[ncmro7]

Okay, it's my fault😂

[ncmro7]

As for the issue with the default VIDPID behaving oddly, it seems to be a problem with my Ubuntu; it works fine on NixOS. Weird.

[ncmro7]

Looks like that's Firefox's own problem，chrome is normal，But Firefox on NixOS works 😂

[lockedmutex]

Currently using it as passkey for 2 factor auth on some of the websites. Still using it as a testing device. I have personally not encountered any issues while using it on Fedora 44.

Will keep you updated if I find any issues with the firmware, or request a feature if required.

[cresseelia]

Currently I use it without any issue, but still under my test (with different website).

Overall it's great!

[mannp]

Due to InPost UK losing the delivery from China, I haven't got any hardware to use it yet.

Spent some tokens and got the device I do have working for the moment 😁

Will certainly report back when I get some hardware, as it seems a great project.

[TheMaxMur]

Guys, I seriously need your help.

pico-fido has a lot of stars and external mentions; we need to somehow break through and surpass Pol's popularity.

I tried submitting my repository to relevant sites, but it was eventually deleted due to self-promotion/vibecoding.

I think the best option would be articles like this one -- https://unmovedcentre.com/posts/improving-qol-on-nixos-with-yubikey/. They cover technical aspects, usage scenarios with different software and in different environments. Plus, for beginners and regular users, you could show them how to use picoforge and how they can configure everything through it.

[mannp]

I'd already bought my ESP32 S3 Super mini before finding this link https://github.com/ViZiD/picokeys-nix.
I didn't know about rs-key before that, but as soon as I followed the link there I was super happy.
Perhaps just a matter of time.
The more people find it, try it and like it the more word spreads.
They can't deny rust, open source, picoforge etc are not a really sound base for things to progress.
Keep up the good work :) please 👍🏻

After reading your reply above, I think you can simply go for Token2’s RP2350-based security key. It supports flashing any custom firmware, so you can flash the RS-Key firmware onto it. It ships from Europe — I ordered three units myself and received them two days later. Link:Token2 Pico

Hey @netll they look super cool and a decent price for Europe. I have never heard of them, but will certainly have a look, thanks.

Edit, Holy cr, they have an android companion app :)

https://github.com/token2/librekeycompanion/releases/tag/1.0.1

[ncmro7]

After reading your reply above, I think you can simply go for Token2’s RP2350-based security key. It supports flashing any custom firmware, so you can flash the RS-Key firmware onto it. It ships from Europe — I ordered three units myself and received them two days later. Link:Token2 Pico

7欧啊一买买三个，这个有啥好的吗

[Curious-r]

jfyi about token2 pico

https://x.com/TokenTwo/status/2080566443586785437?s=20

I have dozens of RP2354A0A4 chips; perhaps I could manufacture a batch of boards myself, but that's just a possibility, since surface mounting is a bit of a hassle.

[ncmro7]

jfyi about token2 pico
https://x.com/TokenTwo/status/2080566443586785437?s=20

I have dozens of RP2354A0A4 chips; perhaps I could manufacture a batch of boards myself, but that's just a possibility, since surface mounting is a bit of a hassle.

单面的板子，上嘉立创薅几个，50买个小加热台自己贴🤓👆🏻

[token2]

Guys, I seriously need your help.

pico-fido has a lot of stars and external mentions; we need to somehow break through and surpass Pol's popularity.

I tried submitting my repository to relevant sites, but it was eventually deleted due to self-promotion/vibecoding.

I think the best option would be articles like this one -- https://unmovedcentre.com/posts/improving-qol-on-nixos-with-yubikey/. They cover technical aspects, usage scenarios with different software and in different environments. Plus, for beginners and regular users, you could show them how to use picoforge and how they can configure everything through it.

Token2 Pico

[ncmro7]

@TheMaxMur
Could a web-based configuration tool similar to Picofido and Canokey be developed? Currently, rsk-cli/tui cannot be used directly on Windows systems, while WSL is unavailable for users who need to run virtual machines. Furthermore, rsk-cli/tui runs via Python on Windows systems, which can cause connectivity issues. A web-based tool would allow users to configure their systems more conveniently on computers and mobile devices.

[ncmro7]

In this current testing-focused phase, its use on mobile devices is also noteworthy. It allows for convenient data modification on mobile devices to test the original version and the stability of the Yubikey build on mobile devices.

[Curious-r]

try picoforge https://github.com/librekeys/picoforge

[ncmro7]

try picoforge https://github.com/librekeys/picoforge

Oh, I hadn't realized it had so many new features.

[ncmro7]

It's a pity there's no Android application yet. Yubico and Token2 already have them, and some others are using web applications. @lockedmutex Are there any plans to create an Android application in the near future?

[lockedmutex]

It's a pity there's no Android application yet. Yubico and Token2 already have them, and some others are using web applications. @lockedmutex Are there any plans to create an Android application in the near future?

I did have one planned, but got delayed because of my college exams. I will not be starting work on an android application till picoforge reaches V1. However if someone is interested to contribute for an android application, I can start the work soon.

[token2]

We previously reported the rollback issue described in Token2's advisory T2-SA-RP2350-Dec2025 originally reported to pico-fido, and it applies to current RS-Key too (#37): the persistent store is reachable via BOOTSEL + picotool, so flash can be dumped and restored to roll the device back to a prior state (e.g. reset a PIN retry counter).

But - pico-fido has since fixed this purely in firmware — the new UF2 ships an RP2350 partition table that restricts bootloader (NSBOOT) access to the data partition, so picotool load to it now returns a permission failure. No hardware change or OTP fuse needed; flashing the updated UF2 was enough.

Directions to research for RS-Key

• Embed an RP2350 partition table in the firmware image that carves flash into a firmware partition and a separate data partition covering the persistent store, with the data partition's bootloader permission set to r (or none) while keeping secure/nonsecure as rw so the running firmware still has full access. See RP2350 datasheet §5.10 and how pico-fido embeds its pt.json.
• The data-partition boundary must match RS-Key's actual store offset/size, or the firmware loses access to its own data — this is the main thing to get right.
• Verify by confirming that picotool save/load over the data range are refused from BOOTSEL.
• Residual limitation: without secure boot, the partition table can itself be overwritten in BOOTSEL, so pair this with the existing OTP/secure-boot path for full robustness.

[TheMaxMur]

Excellent feedback, thank you. I've added this to the documentation and created a special script that can automatically adjust the required data partition.

[TheMaxMur]

And now, by default, release builds come with this mitigation (from 0.4.7). Manual builds now require an additional step with the script, but I don't think this will be a problem for anyone who can build the firmware themselves.