Nitrokey FIDO2 is an open source security key which supports FIDO2 and U2F standards for strong two-factor authentication and password-less login. It protects you against phishing and other online attacks. It's based on Solokey.
This repo contains the firmware, including implementations of FIDO2 and U2F (CTAP2 and CTAP) over USB and NFC. The main implementation is for STM32L432, but it is easily portable.
For development no hardware is needed, it also runs as a standalone application for Windows, Linux, and Mac OSX. If you like (or want to learn) hardware instead, you can run the firmware on the NUCLEO-L432KC development board.
Nitrokey FIDO2 is based on the STM32L432 microcontroller. It offers the following security features.
- True random number generation to guarantee random keys.
- Security isolation so only simple & secure parts of code can handle keys.
- Flash protection from both external use and untrusted code segments.
- 256 KB of memory to support hardened crypto implementations and, later, additional features such as OpenPGP or SSH.
- No NDA needed to develop for.
Clone this repository and build it
git clone --recurse-submodules https://github.com//Nitrokey/nitrokey-fido2-firmware
cd nitrokey-fido2-firmware
make allThis builds the firmware as a standalone application. The application is set up to send and recv USB HID messages over UDP to ease development and reduce need for hardware.
Testing can be done using our fork of Yubico's client software, python-fido2. Solokey's fork of python-fido2 has small changes to make it send USB HID over UDP to the authenticator application. You can install Solokey's fork by running the following:
pip install -r tools/requirements.txtRun the application:
./mainIn another shell, you can run Solokey's test suite.
You can find more details in Solokey's documentation, including how to build on the the NUCLEO-L432KC development board.
Check out our official documentation or Solokey's documentation.
Contributors are welcome. The ultimate goal is to have a FIDO2 security key supporting USB, NFC, and BLE interfaces, that can run on a variety of MCUs.
Look at the issues to see what is currently being worked on. Feel free to add issues as well.
This software is fully open source.
All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT. You may use this software under the terms of either the Apache 2.0 license or MIT license.
All hardware, unless otherwise noted, is dual licensed under CERN and CC-BY-SA. You may use the hardware under the terms of either the CERN 2.1 license or CC-BY-SA 4.0 license.
All documentation, unless otherwise noted, is licensed under CC-BY-SA. You may use the documentation under the terms of the CC-BY-SA 4.0 license
Available in our online shop.