U2F Zero - A Secure and Open Source U2F Token
About U2F Zero
U2F Zero is an open source U2F token for 2 factor authentication. It is implemented securely. It works with Google accounts, Github, Duo, and anything else supporting U2F. The latest version uses key derivation and has no limit on registrations.
You can easily build your own. You just need to order the 8 SMT parts, $1.13-$3.5 per PCB, and programmer. It ends up being $35 for programmer and ~$5/board. The token should be durable enough to survive on a key chain for years, even after going through the wash.
Check out the wiki for more on how to build your own.
Redesign / FIDO 2
FIDO 2 protocol is replacing U2F. It has more flexibility and support for password-less login. A new open source FIDO 2 token is being planned (with support for USB, Bluetooth, and NFC). Discussion for hardware design and usage is happening here, feel free to chip in.
Security Overview
The security level is about the same as a modern car key. Any secret information cannot be read or duplicated. A true random number generator is used to create unpredictable keys.
However, side channel leakage is an unsolved problem in industry and academia. So for well equipped adversaries that can make targetted attacks and get physical access, secret information leakage is possible. Any other hardware token that claims it's "impenetrable" or otherwise totally secure is still vulnerable to physical side channels and it's important to acknowledge. However, most people don't worry about targeted attacks from well equipped adversaries.
For more information about U2F Zero's secure implementation and the problem of side channels, check out the wiki.
Why it's Secure?
* Hardware Random Number Generator:
A TRNG is used on chip to ensure high entropy keys get generated during registration.
* Write Only Keys: Keys are generated on an off chip peripheral and live in write only memory. Nothing can read them except the peripheral itself.
* Tamper Resistance: Atmel secure chip includes temperature and voltage tampering sensors.
* Open Source: Because the source is open, there is confidence there are no backdoors in the source code.
How to Support?: Support this project by purchasing or sharing U2F Zero on Amazon.
License: Everything is open source and licensed under the Simplified BSD License.
The images of the U2F Zero
U2F Zero is an open source U2F token for 2 factor authentication. It is implemented securely. It works with Google accounts, Github, Duo, and anything else supporting U2F. The latest version uses key derivation and has no limit on registrations.
You can easily build your own. You just need to order the 8 SMT parts, $1.13-$3.5 per PCB, and programmer. It ends up being $35 for programmer and ~$5/board. The token should be durable enough to survive on a key chain for years, even after going through the wash.
Check out the wiki for more on how to build your own.
Redesign / FIDO 2
FIDO 2 protocol is replacing U2F. It has more flexibility and support for password-less login. A new open source FIDO 2 token is being planned (with support for USB, Bluetooth, and NFC). Discussion for hardware design and usage is happening here, feel free to chip in.
Security Overview
The security level is about the same as a modern car key. Any secret information cannot be read or duplicated. A true random number generator is used to create unpredictable keys.
However, side channel leakage is an unsolved problem in industry and academia. So for well equipped adversaries that can make targetted attacks and get physical access, secret information leakage is possible. Any other hardware token that claims it's "impenetrable" or otherwise totally secure is still vulnerable to physical side channels and it's important to acknowledge. However, most people don't worry about targeted attacks from well equipped adversaries.
For more information about U2F Zero's secure implementation and the problem of side channels, check out the wiki.
Why it's Secure?
* Hardware Random Number Generator:
A TRNG is used on chip to ensure high entropy keys get generated during registration.
* Write Only Keys: Keys are generated on an off chip peripheral and live in write only memory. Nothing can read them except the peripheral itself.
* Tamper Resistance: Atmel secure chip includes temperature and voltage tampering sensors.
* Open Source: Because the source is open, there is confidence there are no backdoors in the source code.
How to Support?: Support this project by purchasing or sharing U2F Zero on Amazon.
License: Everything is open source and licensed under the Simplified BSD License.
The images of the U2F Zero
 |
| Put it on your key chain |
 |
| Plug it in and press a button. No drivers needed |
 |
| Wear it around your neck |
