Hacker News Reader

It still has firmware, of course, which cannot be audited -- which makes it exactly as secure as a $40 Yubikey. Perhaps even a little more secure - because a Yubikey is vulnerable to both Yubico and NXP employees, and U2Fzero is only vulnerable to Atmel. [Both, of course, 3 letter agencies]

Is there a similar chip with Curve25519?

What does this do that can't be done with a generic AVR chip? If you set the correct lock flags the memory and firmware can't be read or changed without a complete erase:

http://electronics.stackexchange.com/questions/53282/protect...

The crypto involved in U2F is extremely hard to do in an AVR. There are issues with sources of randomness (I'm currently playing with implementing entropy via Watchdog Timer jitter on the ATTiny85, which appears suitably random but is slow), and the capabilities of the devices themselves to produce output at reasonable speeds.

A slower Cortex M0 might not be sufficient to get decent speeds, but I suspect an M3, something like an AT91 could do the job.

Hmm. If the "insecure" processor is compromised, does that mean that it could ask the SE to sign an attestation even for a key that wasn't generated on the SE?