librekeys/pico-hsm-sf
0
0
Fork 0
mirror of https://github.com/librekeys/pico-hsm-sf.git synced 2026-07-28 08:01:04 -07:00
Code Issues Packages Projects Releases Wiki Activity
1,238 Commits 1 Branch 0 Tags
master
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Pol Henarejos bddad2f837 Harden GitHub workflows 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-06-12 17:34:51 +02:00
Pol Henarejos 83b3273f51 Fix pico build 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-05-02 11:39:37 +02:00
Pol Henarejos cf6be6c121 Use ecp keypair calc public instead. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-05-01 21:05:35 +02:00
Pol Henarejos 9865b697de Use dynamic dependence resolver. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-05-01 19:44:34 +02:00
Pol Henarejos cb474f7ad3 Fix build 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-05-01 12:59:46 +02:00
Pol Henarejos 38a7d147b6 Upgrade PicoKeys SDK. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-05-01 12:54:04 +02:00
Pol Henarejos 251b35dd9c Upgrade to v6.6 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-04-07 19:27:37 +02:00
Pol Henarejos 0eebdd330a Upgrade Pico Keys SDK 8.6 and Mbedtls v3.6.6 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-04-06 20:16:15 +02:00
Pol Henarejos 2a4ee5d42f Fix includes. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-04-06 20:16:11 +02:00
Pol Henarejos d5b0a94ba4 Fix build for cyw43. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-28 20:32:46 +01:00
Pol Henarejos 504bb0fc05 Remove debugs. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-27 17:20:56 +01:00
Pol Henarejos f1d927d4ef Add regression tests. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-26 19:07:16 +01:00
Pol Henarejos 1b322755a1 Do not include OTP FIDO in the CCID interface if not available. 
Solves #125

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-20 14:35:32 +01:00
Pol Henarejos e8a398f508 Update memory layout. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-20 13:31:23 +01:00
Pol Henarejos 5297e368d1 Sometimes sc-hsm-tool returns $?=1 despite it succeeds. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-20 13:31:05 +01:00
Pol Henarejos 7c8b39ff82 Update tests 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-20 01:20:46 +01:00
Pol Henarejos 254159d44d Allow access to EE_DEV. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-20 01:19:53 +01:00
Pol Henarejos 75c56bb2c7 Migrate PIN and MKEK to new system. 
This new system is more robust, with derived keys by context and safe in case of flash/ram dumps.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-20 01:19:35 +01:00
Pol Henarejos 1f96fe619b Fix bounds on update ef. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 17:42:25 +01:00
Pol Henarejos 3af776ec26 Removed unused functions in extras. 
Some of them are transfered to rescue interfaces. Others, like OTP, are supressed for security.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 16:57:49 +01:00
Pol Henarejos 54cba3efdf Remove session pin. 
It is intended for bio features, not supported by Pico HSM.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 16:40:08 +01:00
Pol Henarejos 1ced9f6267 Check bounds on update ef. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 16:04:20 +01:00
Pol Henarejos c14a12d9d1 Set ACL for all registers. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 16:03:39 +01:00
Pol Henarejos bbbf28cb42 Fix ACL for static files. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 14:26:43 +01:00
Pol Henarejos db9d6ef2f5 Do not allow reading private objects if not authenticated. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 13:21:14 +01:00
Pol Henarejos 983a5b7d10 Fix secp521r1 test with newer OpenSSL versions. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-18 13:19:20 +01:00
Pol Henarejos 839fb431c4 Add strict build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-09 11:02:47 +01:00
Pol Henarejos cc0e4e43ca Fix MLKEM build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-07 17:54:59 +01:00
Pol Henarejos 7a12177745 Update memory layout. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-07 17:54:14 +01:00
Pol Henarejos 64c4afb5d9 Small typos 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-07 17:19:20 +01:00
Pol Henarejos aae66e7db3 Fix link with mbedtls in openssl backend. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-07 17:16:40 +01:00
Pol Henarejos 2d25ed9939 Fix strict non-prototype declaration warn. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-03-07 17:12:49 +01:00
Pol Henarejos 0ad7e3a610 Fix Secure boot enable. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-02-16 16:03:01 +01:00
Pol Henarejos 25889094e5 [BETA] Add support to Secure Boot in ESP32. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-02-07 14:32:31 +01:00
Pol Henarejos b78c1485c1 Add support for HIGH/LOW ESP32 LED 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-02-04 23:45:14 +01:00
Pol Henarejos 7e651c78e3 Upgrade to v6.4 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-02-01 20:34:41 +01:00
Pol Henarejos 2dec7c0b4e Fix phy marker write. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-02-01 20:34:24 +01:00
Pol Henarejos 0b18ab5e3d Upgrade to Pico Keys SDK 8.5 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-29 16:12:41 +01:00
Pol Henarejos 868caff665 Use new VID:PID allocated to Pico HSM. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 12:33:42 +01:00
Pol Henarejos ed980c3093 Use new layout 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-22 11:59:46 +01:00
Pol Henarejos 16d4d0d26e Update README with up-to-date info. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-06 21:20:13 +01:00
Pol Henarejos 380ff7afa4 Upgrade to v6.2 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:54:07 +01:00
Pol Henarejos 60dafec2e8 Upgrade Pico Keys SDK to v8.2 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:51:51 +01:00
Pol Henarejos 3207fe3451 Disable button press by default since LED may not be properly configured until it is commissioned. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2026-01-05 19:40:50 +01:00
Pol Henarejos 6914be4fea Fix build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-29 20:36:55 +01:00
Pol Henarejos 7d551f6fea Blink led three times to acknowledge proper commissioning. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-29 20:17:03 +01:00
Pol Henarejos d3a7ff425a Fix pimoroni led 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-27 22:03:47 +01:00
Pol Henarejos 97e7303505 Move pointer 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-26 20:00:59 +01:00
Pol Henarejos e41f2ba712 Releaser is available up to 6.7.0 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-26 19:54:15 +01:00
Pol Henarejos 710eb70af7 Update reamde & usage. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-13 23:36:43 +01:00
Pol Henarejos 9dbd764c8c Reset by recopying memory file. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-13 21:12:45 +01:00
Pol Henarejos feec958d10 Not used 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-11 20:05:08 +01:00
Pol Henarejos 9720bcfd4b Fix build 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-11 19:59:39 +01:00
Pol Henarejos 4bb81f5b25 Build only necessary boards. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-11 19:56:01 +01:00
Pol Henarejos c9926a71d1 Do not call pytest 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-11 19:48:23 +01:00
Pol Henarejos 10c25b6a3a Update pointer. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-11 19:36:06 +01:00
Pol Henarejos 629f14ab0d Revert "Move EDDSA to another branch." 
This reverts commit a0faf5308e.
 2025-12-11 19:35:27 +01:00
Pol Henarejos 4d6f6e4635 Revert "Move Secure Boot to another branch." 
This reverts commit 8978456524.
 2025-12-11 19:35:20 +01:00
Pol Henarejos 8e35104695 Update memory.flash for tests 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-10 00:20:28 +01:00
Pol Henarejos 82f4b2201c Remove printf 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 21:38:15 +01:00
Pol Henarejos 8978456524 Move Secure Boot to another branch. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 21:37:52 +01:00
Pol Henarejos a0faf5308e Move EDDSA to another branch. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-09 15:49:20 +01:00
Pol Henarejos f4df9766b6 Fix MSOS/BOS descriptor. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-03 16:34:24 +01:00
Pol Henarejos a1d64d2523 Set anti-rollback version only when the binary is signed. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-02 09:55:49 +01:00
Pol Henarejos 82c6badc48 Increase anti-rollback version to 2. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 23:42:16 +01:00
Pol Henarejos 2243629d58 Add anti-rollback argument. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 23:42:01 +01:00
Pol Henarejos b5b5ccd53c Upgrade to v6.0 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 17:21:26 +01:00
Pol Henarejos 0df97c881f Update mbedtls only when necessary. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 17:20:36 +01:00
Pol Henarejos 3c0706f7b2 Fix on AID selection. It should support shorter AID if matches. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-12-01 01:45:43 +01:00
Pol Henarejos 0d1d77b3f6 Upgrade Pico Keys SDK to v8.0 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-30 18:30:57 +01:00
Pol Henarejos 25301f14e1 Upgrade to mbedtls v3.6.5 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-30 18:28:24 +01:00
Pol Henarejos 256e61d813 Update tests to new CA2/DV2 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-28 12:14:36 +01:00
Pol Henarejos 1fe771f074 Fix tests 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-28 01:13:27 +01:00
Pol Henarejos 0588dde490 Do not use editable mode. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-28 00:53:29 +01:00
Pol Henarejos 1d6cc6ff89 Do not install apt pyscard 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-28 00:21:42 +01:00
Pol Henarejos 8fde25eff2 Fix build, key generation for RP2040 and added reboot bootsel command. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-28 00:13:10 +01:00
Pol Henarejos 634eac50b1 Moved to pypicohsm. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-18 01:05:49 +01:00
Pol Henarejos c4a1cf32e5 Add Pico Version Major 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-18 01:05:40 +01:00
Pol Henarejos de33124d6b Fix test case with newer openssl. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-09 21:38:52 +01:00
Pol Henarejos ae61150f5c Upgrade Dockerfile for fixing. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-09 20:00:23 +01:00
Pol Henarejos 605819f0a3 Fix build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-11-09 19:56:18 +01:00
Pol Henarejos c9dc70b095 Add template for pull requests. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-27 08:58:12 +01:00
Pol Henarejos 7060e4df7c Add CONTRIBUTING 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-27 08:53:48 +01:00
Pol Henarejos 28c99a21bd Update license models and add ENTERPRISE.md 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-26 20:46:01 +01:00
Pol Henarejos dba614ed36 Relicense project under the GNU Affero General Public License v3 (AGPLv3) 
and add the Enterprise / Commercial licensing option.

Main changes:
- Replace GPLv3 headers with AGPLv3 headers in source files.
- Update LICENSE file to the full AGPLv3 text.
- Add ENTERPRISE.md describing the dual-licensing model:
  * Community Edition: AGPLv3 (strong copyleft, including network use).
  * Enterprise / Commercial Edition: proprietary license for production /
    multi-user / OEM use without the obligation to disclose derivative code.
- Update README with a new "License and Commercial Use" section pointing to
  ENTERPRISE.md and clarifying how companies can obtain a commercial license.

Why this change:
- AGPLv3 ensures that modified versions offered as a service or deployed
  in production environments must provide corresponding source code.
- The Enterprise / Commercial edition provides organizations with an
  alternative proprietary license that allows internal, large-scale, or OEM
  use (bulk provisioning, policy enforcement, inventory / revocation,
  custom attestation, signed builds) without AGPL disclosure obligations.

This commit formally marks the first release that is dual-licensed:
AGPLv3 for the Community Edition and a proprietary commercial license
for Enterprise customers.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-10-26 20:18:45 +01:00
Pol Henarejos 5f5e010a19 Stick with Espressif v5.5 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-08-12 00:51:24 +02:00
Pol Henarejos 5e4f2286e6 Add autobuild for RP2350. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-07-05 00:52:06 +02:00
Pol Henarejos f0f8e4382a Fix cross build. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-06-22 20:33:06 +02:00
Pol Henarejos a0f6abf6a6 Remove the tweak for packets multiple of 64 bytes. It was fixed in the USB stack handling (don't remember where). 
Fixes #95.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-05-23 20:18:29 +02:00
Pol Henarejos defa18a5ec Add ESPICOHSMCA00002 to scs3 docs. 
Fixes #87.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-05-18 19:06:23 +02:00
Pol Henarejos bf06081b9c Fix interface descriptor when HID is disabled. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-05-02 18:28:43 +02:00
Pol Henarejos f1a8d8bc91 Use pyscard 2.2.1 since 2.2.2 has a bug 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-24 19:11:32 +02:00
Pol Henarejos d6f15f8384 Fix eddsa output folder. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-10 19:56:20 +02:00
Pol Henarejos dce4e304bc Upgrade to v5.6 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-10 18:41:31 +02:00
Pol Henarejos f97aaadd17 Update build script to automatize EdDSA builds. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-10 18:41:00 +02:00
Pol Henarejos 611b762a1f Use K1 curve in emulation mode. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-07 01:29:02 +02:00
Pol Henarejos 7c1ef56799 Fix ne parameter when secure message protocol is used. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-07 01:27:57 +02:00
Pol Henarejos 4b59bd6481 0x85 and 0x86 should return not found to avoid authentication path. 
Fixes #81 and #84.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-07 01:27:21 +02:00
Pol Henarejos 9b1dceb8da Use K1 curve for general authentication. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-07 01:24:22 +02:00
Pol Henarejos c4bc346d98 Sign release builds. 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
 2025-04-06 18:37:36 +02:00