librekeys/pico-fido
0
0
Fork 0
mirror of https://github.com/librekeys/pico-fido.git synced 2026-07-28 08:01:53 -07:00
Code Issues Packages Projects Releases Wiki Activity
826 Commits 4 Branches 4 Tags
1b5342ba3c488f9253678f8601cc90bcb177646d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Pol Henarejos 370be2cd47 Upgrade to v7.4 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-28 00:57:51 +01:00
Pol Henarejos 524deea038 Upgrade Pico Keys SDK 8.4 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-28 00:57:38 +01:00
Pol Henarejos 31a6315721 Transmit CBOR errors in SW x64 with CCID. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-26 17:22:00 +01:00
Pol Henarejos 9fb8d475b3 Old files. Not used anymore. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-26 15:54:59 +01:00
Pol Henarejos c0298ece7d Remove PHY and MEMORY vendor commands as they are available through rescue applet. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-26 15:40:08 +01:00
Pol Henarejos bea7706d63 Fix emulation build 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-26 01:27:12 +01:00
Pol Henarejos cfd22c2d2c Fix ccid max packet length & interface naming. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-26 01:20:22 +01:00
Pol Henarejos 8ea118fe91 Fix OATH in iOS Authenticator. Fixes #248. 
For strange reason, iOS app doesn't follow strictly YKOATH spec. When there are remaining bytes after serial, it assumes there's challenge (and thus, access code), but algorithm 7B is there. Apparently algorithm 7B is only returned when challenge is present but I could not see where it is used.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-26 01:18:51 +01:00
Pol Henarejos 8e6f571b48 Move rtc 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-24 01:15:23 +01:00
Pol Henarejos 3c20800839 Add rtc to credential. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-24 01:14:46 +01:00
Pol Henarejos f2eef5b839 Use new VID:PID allocated to Pico Fido. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 12:33:08 +01:00
Pol Henarejos bc6ebdd069 Upgrade to new layout 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 12:09:42 +01:00
Pol Henarejos 3f890757ac Not present 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 01:00:18 +01:00
Pol Henarejos 18d68d7e05 Fix needs power cycle logic. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 00:57:31 +01:00
Pol Henarejos c8d62de621 Add vendor commands via CCID 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 00:26:51 +01:00
Pol Henarejos 60165c21ca Fix vendor keydev loading 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 00:26:27 +01:00
Pol Henarejos 55a60f8875 Fix power_cycle behavior 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 00:26:13 +01:00
Pol Henarejos 7ed90007ef Add support for slots 3 & 4 in OTP. 
Both slots are activated by clicking three or four times the BOOTSEL button.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-19 16:37:19 +01:00
Pol Henarejos c23cc9ffe1 Add set/get RTC. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-19 16:36:49 +01:00
Pol Henarejos dc4565a8fb Fix LED default parameters in Pimoroni boards. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-15 01:17:18 +01:00
Pol Henarejos 804ee68e86 Remove non-standard MAKE CREDENTIAL step. 
It may collide with other userName and the purpose is achieved cleaner via Rescue interface.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-08 10:46:51 +01:00
Pol Henarejos fe49149d86 Update README with up-to-date info. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-06 21:20:04 +01:00
Pol Henarejos 81d97f1a18 Upgrade to v7.2 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:56:09 +01:00
Pol Henarejos d16016cf1e Upgrade Pico Keys SDK to v8.2 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:51:11 +01:00
Pol Henarejos 2e0333677b Fix button logic. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:39:46 +01:00
Pol Henarejos becdc94339 Disable button press by default since LED may not be properly configured until it is commissioned. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:37:30 +01:00
Pol Henarejos bd499ae1d4 Remove print 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:37:27 +01:00
Pol Henarejos 5fc84d7097 Reset internal state of GA to avoid phantom requests on GNA. 
When a previous GA had more than 1 credential, it stored the full list in the internal state. Later, if a GA had only 1 credential, subsequent GNA returned older state of previous non-related GA.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 12:36:44 +01:00
Pol Henarejos ac7e34522a Fixed resident credential storage when two userId have the same prefix. 
Added a specific test for this case.

Fixes #241.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 12:34:04 +01:00
Pol Henarejos 70dec5596a Fix build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-29 20:36:37 +01:00
Pol Henarejos 2331dcb3ec Blink led three times to acknowledge proper commissioning. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-29 20:16:22 +01:00
Pol Henarejos 42b8b0af5f Fix pimoroni led 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-27 22:04:03 +01:00
Pol Henarejos ceb54d9a08 Move pointer 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-27 16:03:07 +01:00
Pol Henarejos 527943fbba Releaser is available up to 6.7.0 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-26 19:53:46 +01:00
Pol Henarejos 7dddfd971e Build only necessary boards 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-11 20:01:08 +01:00
Pol Henarejos 29f942dab9 Update pointer 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-11 15:42:47 +01:00
Pol Henarejos aa9df892d3 Revert "Move EDDSA to another branch." 
This reverts commit 1867f0330f.
 2025-12-11 15:41:47 +01:00
Pol Henarejos 7ac2ce30f0 Revert "Move other curves to another branch." 
This reverts commit 46720fb387.
 2025-12-11 15:40:16 +01:00
Pol Henarejos e86862033c Revert "Move enterprise attestation to another branch." 
This reverts commit 1d21d93b74.
 2025-12-11 15:40:10 +01:00
Pol Henarejos ae36143498 Revert "Move Secure Boot to another branch." 
This reverts commit d90dbb6c5f.
 2025-12-11 15:39:57 +01:00
Pol Henarejos d90dbb6c5f Move Secure Boot to another branch. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 21:39:14 +01:00
Pol Henarejos 1d21d93b74 Move enterprise attestation to another branch. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 21:39:10 +01:00
Pol Henarejos 8b9be258de Fix applet cmp 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 19:15:35 +01:00
Pol Henarejos 46720fb387 Move other curves to another branch. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 18:52:13 +01:00
Pol Henarejos 1867f0330f Move EDDSA to another branch. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 15:56:31 +01:00
Pol Henarejos bb542e3b83 Add is_gpg flag for fido2. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-07 20:34:42 +01:00
Pol Henarejos 31991a31c3 Fix MSOS/BOS descriptor. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-03 16:34:49 +01:00
Pol Henarejos fcc9b49799 Do not debug in ESP32. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-02 14:39:43 +01:00
Pol Henarejos cf40b8dff8 Fix OTP button press in ESP32. 
Fixes #208

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-02 14:39:01 +01:00
Pol Henarejos 1f5e106f22 Set anti-rollback version only when the binary is signed. 
Fixes #207

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-02 09:57:37 +01:00
Pol Henarejos 39208c2167 Increase anti-rollback version to 2. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 23:49:34 +01:00
Pol Henarejos f5c0793a8d Add anti-rollback argument. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 23:48:55 +01:00
Pol Henarejos abcfe6e87b Upgrade to v7.0 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 17:17:17 +01:00
Pol Henarejos d0526d7de6 Update mbedtls only when necessary. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 17:17:04 +01:00
Pol Henarejos 4ce816e9f6 Update mbedTLS only when necessary. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 12:15:54 +01:00
Pol Henarejos 85bd329e3b Fix on AID selection. It should support shorter AID if matches. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 01:45:08 +01:00
Pol Henarejos 5f45a6b75b Fix oath aid test. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-30 19:06:15 +01:00
Pol Henarejos f97b942d11 Upgrade Pico Keys SDK to v8.0 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-30 18:31:19 +01:00
Pol Henarejos 93bba4fb76 Moved to pypicofido. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-18 01:04:36 +01:00
Pol Henarejos 0dc2b73de4 Add support for RP2354. 
Add PHY READ.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-15 20:18:23 +01:00
Pol Henarejos dc572bcc81 Add versions. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-15 20:18:08 +01:00
Pol Henarejos 0d89a21be7 Fix if/else logic. Fixes #199. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-09 20:13:45 +01:00
Pol Henarejos 65194e3775 Remove debug. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-09 20:13:04 +01:00
Pol Henarejos 5b778f2e27 Fix CI/CD 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-28 10:19:48 +01:00
Pol Henarejos b0180711e7 Fix build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-28 09:36:55 +01:00
Pol Henarejos 4bcbf7f9a9 Merge branch 'development' 2025-10-27 09:30:13 +01:00
Pol Henarejos cf0686f857 Add template for pull requests. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-27 08:57:59 +01:00
Pol Henarejos c54a6fa6fe Add CONTRIBUTING 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-27 08:53:08 +01:00
Pol Henarejos 8b08618875 Update license models and add ENTERPRISE.md 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-26 20:45:37 +01:00
Pol Henarejos a59cdef8e6 Merge branch 'main' into development 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>

# Conflicts:
#	pico-keys-sdk
 2025-10-26 20:12:26 +01:00
Pol Henarejos d4f2d04487 Relicense project under the GNU Affero General Public License v3 (AGPLv3) 
and add the Enterprise / Commercial licensing option.

Main changes:
- Replace GPLv3 headers with AGPLv3 headers in source files.
- Update LICENSE file to the full AGPLv3 text.
- Add ENTERPRISE.md describing the dual-licensing model:
  * Community Edition: AGPLv3 (strong copyleft, including network use).
  * Enterprise / Commercial Edition: proprietary license for production /
    multi-user / OEM use without the obligation to disclose derivative code.
- Update README with a new "License and Commercial Use" section pointing to
  ENTERPRISE.md and clarifying how companies can obtain a commercial license.

Why this change:
- AGPLv3 ensures that modified versions offered as a service or deployed
  in production environments must provide corresponding source code.
- The Enterprise / Commercial edition provides organizations with an
  alternative proprietary license that allows internal, large-scale, or OEM
  use (bulk provisioning, policy enforcement, inventory / revocation,
  custom attestation, signed builds) without AGPL disclosure obligations.

This commit formally marks the first release that is dual-licensed:
AGPLv3 for the Community Edition and a proprietary commercial license
for Enterprise customers.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-26 20:10:06 +01:00
Pol Henarejos 6b93938040 Fix warnings. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-12 18:56:14 +02:00
Pol Henarejos 898c88dc6d Migration to the new system of secure functions to derive keys based on OTP, if available, and pico_serial as a fallback. PIN is also an input vector, which defines a separated domain. 
PIN is used to derive encryption key, derive session key and derive verifier. From session key is derived encryption key. As a consequence, MKEK functionalities are not necessary anymore, since key device is handled by this new set directly. Some MKEK functions are left for compatibility purposes and for the silent migration to new format.  It also applies for double_hash_pin and hash_multi, which are deprecated.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-08 00:33:23 +02:00
Pol Henarejos 51c13b0f0b Add memory leak checker. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-07 23:41:58 +02:00
Pol Henarejos d424f0dea7 Add sanity check. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-07 21:11:50 +02:00
Pol Henarejos de1bf3d2d4 Add OTP security enhancements. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-06 14:22:23 +02:00
Pol Henarejos 85423fed85 Using new PIN format. 
Now, PIN uses OTP as a seed to avoid memory dumps, when available (RP2350 / ESP32).

Related with #187.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-28 20:29:06 +02:00
Pol Henarejos 6c85421eca Using new PIN format. 
Now, PIN uses OTP as a seed to avoid memory dumps, when available (RP2350 / ESP32).

Related with #187.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-28 20:28:04 +02:00
Pol Henarejos 3e9d1a4eb4 Fix silent authentication with resident keys. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-28 00:05:25 +02:00
Pol Henarejos c6dba5df43 Fix silent authentication with new resident key system. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-27 23:52:08 +02:00
Pol Henarejos eae22a97fb Fix conditional build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-23 17:17:01 +02:00
Pol Henarejos 1b8ee2fc87 Fix missing files. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-23 17:03:53 +02:00
Pol Henarejos 7d97b21ca4 Update Pico Keys SDK. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-23 17:00:10 +02:00
Pol Henarejos 665f029593 Fix build for non-pico boards. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-22 23:41:55 +02:00
Pol Henarejos 78de56f0a9 Fix build for non-pico boards. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-22 23:36:05 +02:00
Pol Henarejos b25e4bed6c Fix build for non-pico boards. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-22 23:35:55 +02:00
Pol Henarejos 56b6b4a8b9 Vendor Config cmds have to be < 0x8000000000000000 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-21 01:23:02 +02:00
Pol Henarejos 9b254a0738 Add support to PIN POLICY URL via VendorConfig. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-11 19:20:20 +02:00
Pol Henarejos e4f8caa1ba Add VendorConfig upload EA command to get_info(). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-11 18:20:36 +02:00
Pol Henarejos 7e720e8c23 Enable enterprise attestation through VendorConfig. 
Add a subcommand to enable through pico-tool.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-11 12:56:02 +02:00
Pol Henarejos b3b3a5eecc Add other PHY commands to get_info(). 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-11 12:23:45 +02:00
Pol Henarejos bf484d8663 Use internal macro. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-11 12:16:14 +02:00
Pol Henarejos 6b636d0bf4 Fix CMD_CONFIG with VendorCmd. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-11 12:13:44 +02:00
Pol Henarejos 54fb02995f Add 4 pseudorandom bytes to allow indexing used by some RP entities. 
Fixes #185

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-11 11:31:45 +02:00
Pol Henarejos 56d5c61044 Add compatibility of old resident key system with the new one. 
Related to #184.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-06 19:14:27 +02:00
Pol Henarejos 1ac628d241 Major refactor on resident keys. 
Now, credential ids have shorter and fixed length (40) to avoid issues with some servers, which have maximum credential id length constraints.

Fixes #184

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-04 21:57:53 +02:00
Pol Henarejos 48cc417546 Added support for Brainpool curves and Ed448. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-02 15:49:39 +02:00
Pol Henarejos 2919b37e9c Fix descriptor description when there are disabled interfaces. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-02 01:20:15 +02:00
Pol Henarejos 6836ffaf02 Add dummy led driver to avoid crashes in case a non-supported board is built. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-01 22:02:13 +02:00
Pol Henarejos d1c61536e0 Add support for dynamic led driver. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-09-01 21:28:09 +02:00