Sunrise 博客
0%

使用U2F开源硬件密钥

发表于 更新于

连接工具

OpenSK

nRF52-U2F

1
git clone --recursive https://github.com/makerdiary/nrf52-u2f

直接下载官方固件

U2F-bootloader

1

编程烧写工具

编译固件

  • 安装rustup
1
2
~$ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
~$ source $HOME/.cargo/env
  • 安装nrfutil
1
~$ pip3 install nrfutil
  • 安装OpenSK.
1
2
3
4
~$ git clone --recurse-submodules https://github.com/google/OpenSK.git
~$ cd OpenSK
~$ git switch -c develop origin/develop
~$ ./setup.sh
  • 烧写之前，要确保nrfutil是可以正常使用的。先要按设备上的reset键,进入DFU bootloader模式，在按Enter确认进行烧写.不知为何在OpenSK/stable分支上没有测试成功。这里使用了develop分支测试成功。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
OpenSK$ ./deploy.py --board=nrf52840_dongle_dfu --opensk --programmer=nordicdfu
info: Updating rust toolchain to nightly-2020-06-10
info: syncing channel updates for 'nightly-2020-06-10-x86_64-unknown-linux-gnu'
info: checking for self-updates
info: component 'rust-std' for target 'thumbv7em-none-eabi' is up to date
info: Rust toolchain up-to-date
info: Building Tock OS for board nrf52840_dongle_dfu
info: This is the version for the rustup toolchain manager, not the rustc compiler.
info: The currently active `rustc` version is `rustc 1.45.0-nightly (fe10f1a49 2020-06-02)`
    Finished release [optimized + debuginfo] target(s) in 0.01s
info: Building OpenSK application
    Finished release [optimized] target(s) in 0.02s
info: Generating Tock TAB file for application/example ctap2
info: Generating all-merged HEX file: target/nrf52840_dongle_dfu_merged.hex
info: Creating DFU package
info: Please insert the dongle and switch it to DFU mode by keeping the button pressed while inserting...
info: Press [ENTER] when ready.
info: Flashing device using DFU...
  [####################################]  100%
Device programmed.
info: Programming OpenSK device AAGUID fdecda13-0c04-4463-82c4-43f425871f2f (CtapHidDevice('/dev/hidraw4')).
info: Certificate: Missing
info: Private Key: Missing
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00, 26.69it/s]
info: Your device is not yet configured, and lacks some functionality. If you run into issues, this command might help:

./tools/configure.py \
    --certificate=crypto_data/opensk_cert.pem \
    --private-key=crypto_data/opensk.key

Please read the Certificate considerations in docs/customization.md to understand the privacy trade-off.
  • 如果上面烧写操作后，不能正常工作，先把运行下面的命令，再重复一次，上面的烧写命令。
1
2
./deploy.py --board=nrf52840_dongle_dfu --programmer=nordicdfu --erase_storage

  • 烧写错误
1
2
3
4
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
manifest-tool 1.5.2 requires colorama<0.4.0,>=0.3.9, but you have colorama 0.4.5 which is incompatible.
manifest-tool 1.5.2 requires protobuf<3.6.0,>=3.5.0, but you have protobuf 3.20.1 which is incompatible.

  • 出现上述错误，需要使用PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python来处理protobuf.

在线网站测试

  • https://webauthn.io/
  • 这里使用Firefox打开上述网站,随意输入一个用户名,再点击Regster,浏览器会弹出提示窗口,并且板上的LD1,LD2出现交替闪烁,表示需要按SW1进行下一步.这里按下SW1后,网站会提示注册成功.
  • 网站登录测试,点击界面上的Login后,浏览器会弹出提示窗口,并且板上的LD1,LD2出现交替闪烁,此时按下板上的SW1,网站会提示登录成功。

使用U2F登录OpenSSH服务

1
2
3
4
5
6
7
8
9
~$ cat ~/.ssh/config
[...]
Host vps
    Hostname YOUR_SERVER_IP
    User root
    Port YOUR_SSH_PORT
    Compression yes
    IdentityFile ~/.ssh/id_ecdsa_sk

谢谢支持

  • 微信二维码: