FIDO2 passkey storage with ESP32-S3

There is an open source alternative to commercial hardware keys like Yubikey. The alternative is COTS so it is not a secure element, and in my setup by default there is no secure boot and the efuses are not blown, so the key can be copied. Although it is possible with rp2350 and esp32-s3 to make it secure (not possible with rp2040). But a device like this still has its applications, taking into account the threat model. The device uses FIDO2 authentication standard and works on both Windows and Linux. The following is how I set it up.

Update 1: twitter and google are not accepting this key, I believe they treat it as a simple U2F key and not FIDO2 storage, despite fido2-token -L -d /dev/hidraw1 reporting version strings: U2F_V2, FIDO_2_0, FIDO_2_1, FIDO_2_2. I will try https://github.com/librekeys/pico-fido2 next.

Update 2: https://github.com/librekeys/pico-fido2 has the same behavior.

Lilygo t-dongle s3 (I added 2.4GHz antenna, IPEX-1 connector) on the left and Muse Lab ESP32-S3 USB Dongle on the right

hardware

I’m keeping it very minimalistic: RP2350 or ESP32-S3. I went with Muse Lab ESP32-S3 USB Dongle, which is very much like Lilygo t-dongle S3 but: without the screen (not needed), the sd card slot is inside the case (difficult to access, but I do not need the storage), the boot button is also difficult to access (not critical, I only need to press it once). and it’s almost half the price.

firmware

for rp2350 I would go with https://github.com/TheMaxMur/RS-Key/ , but for my s3 I went with the original pico fido firmware, flashed it in Chrome at https://www.picokeys.com/esp32-flasher/

management

I use picoforge to manage the device. Works on Windows and Linux, for Ubuntu I did

sudo apt install pcscd
sudo systemctl enable --now pcscd
wget https://github.com/librekeys/picoforge/releases/download/v0.7.1/picoforge_0.7.1_amd64.deb
sudo apt install ./picoforge_0.7.1_amd64.deb
picoforge

the key works in Chrome, and to make it work in Firefox (installed form snap) i had to:

lsusb | grep Pico
# gave me:
# Bus 001 Device 024: ID 2e8a:10fe Pol Henarejos Pico Key

sudo tee -a /etc/udev/rules.d/70-snap.firefox.rules <<- 'EOF'
SUBSYSTEM=="hidraw", KERNEL=="hidraw*", ATTRS{idVendor}=="2e8a", ATTRS{idProduct}=="10fe", TAG+="snap_firefox_firefox", TAG+="uaccess"
EOF

sudo udevadm control --reload-rules && sudo udevadm trigger

initial setup

open picoforge and set the PIN. optionally, one can change the default lentgh of the PIN from 4 to something longer. picoforge listed secure boot as a feature for future releases, so it will be possible to make this storage more secure later.

optional

might as well install sudo apt install libfido2-1 libfido2-dev libfido2-doc fido2-tools for additional diagnostics:

fido2-token -L
fido2-token -I  /dev/hidraw1
fido2-token -I -d /dev/hidraw1

references

• https://tutoduino.fr/en/discovering-fido2-and-passkeys/
• https://webauthn.io/
• https://demo.yubico.com/webauthn-technical/registration (U2F only for some reason)
• https://github.com/librekeys/pico-fido2
• https://docs.picokeys.com/picofido/passkeys/