Hacker News Reader

Comment by kfreds | Hacker News Reader

I created the TKey together with my colleagues. AMA. :)

Very cool project, will certainly dig deeper!

If you need code for u2f/fido2 I hope you can find something useful from our solokeys (v1 for C, v2 for rust). https://github.com/solokeys

P.S: the usbc plug looks a bit brittle (been there). not sure about your plans to scale production but you prob want to address that sooner rather than later :)

Thank you! I absolutely what you've done with the Limited Edition Solo 2. The epoxy + nail polish and exposed PCB is a great artistic expression of the openness of the device. I appreciate the tip about the USB-C plug. As I recall we've improved the structural integrity through the case and glue.

Would appreciate it if you tested for compatibility on a Chromebook running Linux via Crostini. The Crostini distro is fairly ordinary Debian, but Crostini has an unusual system mediating USB-device access, so it's hard to predict whether any given device or device feature will work.

(And even if a feature works today, it might break tomorrow. It's too bad the Chrome OS team doesn't appear to dogfood with Yubikeys, for example; GnuPG smart cards will work for a few CrOS releases and then inexplicably break for months/years. VSCode runs amazingly well on a Chromebook, but if I can't reliably sign a git commit, it doesn't matter.)

The TKey enumerates as a CDC ACM (serial port) to the host, so I'm afraid it doesn't work on the Chromebook from what I can remember. My colleagues would know better. In any case it's something we aim to support one way or another, even it if means a new hardware.

I suspect using Yubikey's FIDO2 functionality rather than its GnuPG smart card functionality would be reliable. I think Crostini's motivation comes down to security, which they enforce by only passing through certain USB device classes. A device enumerating as USB HID FIDO2 should work reliably, given that Google uses those kinds of USB authenticators internally.

What assurance do I have (I'm speaking cryptographically) that the per-device secret isn't known to you?

None. You'll simply have to trust that we have configured your TKey with a UDS of good entropy, and that we haven't saved it - intentionally or unintentionally.

However, the device's flexibility allows you considerable control. For instance you could have its KDF mix in a user-supplied secret in addition to the UDS.

Of course you'd still be trusting that the device actually performs the KDF we claim it does. That's why we also sell the TKey Unlocked.

Seems like that secondary derivation is something that can be attested to, if it is done homomorphically.

Genuinely curious, what’s the argument for locking down the FPGA?

To protect the UDS that we provision for you. See my other responses in this thread for more details. Also see the TKey Unlocked.

How is it better than Precursor? https://www.crowdsupply.com/sutajio-kosagi/precursor

I'm not affiliated with either but I just looked at the precursor page because I'm a huge nerd and love crowdfunded projects.

They seem to be in slightly different leagues. Tkey is small and meant to be easily carried with you to authenticate with ssh, gpg and more. While precursor is a full development board that can probably do everything tkey can, and more.

Whether TKey or Precursor is better depends on your needs. Here are some differences between them:

* TKey uses open tooling for everything. Precursor uses Vivado.

* Precursor has a screen and a keyboard, allowing the user to interact directly with the trusted device in a completely different way than the TKey.

* The Precursor is bigger than the TKey.

* The Precursor costs much more than the TKey.

Finally I'd just like to mentiont that bunnie and xobs work on Precursor as well as their other projects have been a great inspiration to the TKey project.

Thank you!

Different product at a different price point with different objectives. Security keys are suitable for mass deployment across an entire workforce, precursor aims to be a launchboard for general purpose secure and trustable computation. Even at mass production prices, precursor would likely still cost more than 100$.

For security-only end-user applications, what are the benefits from spending €80 on your device instead of €60 on a Yubikey 5?

It depends on what you value. If you want a computer that can produce Ed25519 signatures with a minimum of software and hardware complexity and a maximum of inspectability then you probably can't do better than a TKey.

Yubikey on the other hand have a lot more features than TKey, for now.

Can you consider OpenBSD support?

Yes. :)

Reply on news.ycombinator.com