mirror of https://github.com/tillitis/tillitis-key1.git synced 2024-12-20 05:14:29 -05:00

Board designs, FPGA verilog, firmware for TKey, the flexible and open USB security key

Go to file

Matthew Mets e71d70008b TK-1 and TP-1 PCBs (#52 ) * Add kicad library for flat programming clip * Add descriptions to part symbols * Add extended values, manufacturer/distributor info to components in mta1 * Add new board entry for TK1 * Add TP1 programmer design * Update MTA1-USB-V1 release files to match production * Change SPI flash memory type to XT25F08BDFIGT-S * Change touch sensor feedback cap to 1uF * Add manufacturer, manufacturer part number, distributor, distributor part number * Update component values for TK1 PCB * Use specific part # for C8 * Change flash back to Winbond part, for easier sourcing * Change C1 to 1pF * Fixes for production programmer PCB * Swap GND and 5V on J3 * Replace graphic logo with text * Rename part to 'TP-1' * TK-1 release * Add dimensions for PCB * Add layer stackup for PCB * Change PCB component origin to match expanded board * Change schematic title to 'TK-1', update release date * mta1-usb-v1-programmer: Add corrected part numbers for OSFC production * Q1, Q2, F1 part subsititutions * add mfr/supplier info for all parts * PCB library: add parts * Rectangular footprint for TK-1 test pads * BOM generation script used for TK-1 and TP-1 releases * TP-1 release * Schematic: Add manufacturer, supplier information for all parts * Schematic: Update name and release date * PCB: Add PCB fabrication information * PCB: Correct pinouts on silkscreen * PCB library: add 'screw' and 'foot' symbols * Screw is a schematic-only part, for including mechanical screws in the BOM * Foot is for self-adhesive rubber mounting feet that can be stuck to the bottom of a PCB * TP-1 release: Add screws, feet to the BOM * Pico library: Add footprint for RPi Pico w/solder paste * TP-1 RevA release updates: * Add fiducials in 3 corners (1mm exposed copper ring w/2mm soldermask opening) * Add solder paste openings to Raspberry Pi Pico pads * TK-1: RevA.1 release * Add two fiducials to TK-1 board * TP-1: Update fuse type to match actual part * Make placement diagrams for TP-1, TK-1 * Update BC-1-xxx footprints to include placement outlines * Update TP-1 PCB with new footprints, clean up top fab layer * Take screenshots of top layers of both boards * tk-1: fix placement footprints * Add pin1 marking for ncp footprint * Add refdes for w25q80 footprint * Update board with new footprints, clear extraneous text on fab layer		2022-12-22 16:41:46 +01:00
contrib	build tools: Add podman support	2022-12-16 10:14:21 +01:00
doc	Doc UDI lock-down	2022-12-20 12:06:07 +01:00
hw	TK-1 and TP-1 PCBs (#52 )	2022-12-22 16:41:46 +01:00
LICENSES	Use TKey name	2022-12-02 08:03:06 +01:00
.editorconfig	Help our editors fight less	2022-09-21 14:47:24 +02:00
.gitattributes	Make initial public release	2022-09-19 08:51:11 +02:00
.gitignore	Ignore virtualenv dir down where we use it; unignore disused toolchain dirs	2022-11-29 08:10:05 +01:00
dco.md	Add dco file and link to the dco in README	2022-11-21 13:47:42 +01:00
README.md	Use same name as elsewhere on USS	2022-12-02 13:44:43 +01:00

README.md

Tillitis TKey

Introduction

The Tillitis TKey is a new kind of USB security token. What makes the TKey unique is that it allows a user to load and run applications on the device, while still providing security. This allow for open-ended, flexible usage. Given the right application, the TKey can support use cases such as SSH login, Ed25519 signing, Root of Trust, FIDO2, TOTP, Passkey, and more.

During the load operation, the device measures the application (calculates a cryptographic hash digest over it) before running it on the open hardware security processor. This measurement is similar to TCG DICE.

Each TKey device contains a Unique Device Secret (UDS), which together with the application measurement, and an optional User-Supplied Secret (USS), is used to derive key material unique to each application. This guarantees that if the integrity of the application loaded onto the device has been tampered with, the correct keys needed for an authentication will not be generated.

Key derivation with a User-Supplied Secret allows users to build and load their own apps, while ensuring that each app loaded will have its own cryptographic identity, and can also be used for authentication towards different services.

The TKey platform is based around a 32-bit RISC-V processor and has 128 KB of RAM. The current firmware is designed to load an app that is up to 100 KB in size, and gives it a stack of 28 KB. A smaller app may move itself in memory to get larger continuous memory.

All of the TKey software, firmware, FPGA Verilog source code, schematics and PCB design files are open source. Like all trustworthy security software and hardware should be. This in itself makes it different, as other security tokens utilize at least some closed source hardware for its security-critical operations.

The TK1 PCB, the first implementation of the TKey.

Documentation

Getting started

Applications and host programs that communicate with the apps are kept in this repository: https://github.com/tillitis/tillitis-key1-apps

In-depth technical information

System Description
Threat Model
Framing Protocol
Boards
Boards
FPGA
Software
QEMU (branch tk1 in separate repository)

Note that development is ongoing. For example, changes might be made to the measuring and derivation of key material, causing the public/private keys of a signer app to change. To avoid unexpected changes, please use a tagged release. Read the Release Notes to keep up to date with changes and new releases.

About this repository

This repository contains hardware, software and utilities written as part of the TKey. It is structured as monolithic repository, or "monorepo", where all components live in one repository.

Licensing

See LICENSES for more information about the projects' licenses.

All contributors must adhere to the Developer Certificate of Origin.