You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Created bash script 1-click-setup.sh;
Driver for Touch Sensor TTP-223;
Print device info with serial command i;
EncryptionManager to handle byte encryption with ChaCha20 algo;
OtpManager with AES-256 encryption;
OtpCode class to handle OTP codes generation;
Created EEPROMMate library to store and retrieve OTP shared secrets in/from the virtual EEPROM
LedState refactor into LedManager, added new led states;
Kdf refactored - breaking changes;
TurtlPass Firmware provides a simple and secure way of generating passwords using a deterministic key derivation function (HKDF) as specified in <ahref="https://datatracker.ietf.org/doc/html/rfc5869">RFC 5869</a>.</p>
5
+
TurtlPass Firmware offers a straightforward and secure method for creating robust passwords. It employs a deterministic key derivation function along with unique seed material stored in flash memory. Once activated with a touch, it automatically types the password for you.</p>
@@ -14,178 +14,160 @@ TurtlPass Firmware provides a simple and secure way of generating passwords usin
14
14
15
15
## ⚡ Features
16
16
17
-
* Generates unique, secure passwords from a simple input hash
18
-
* 100 characters long, including a combination of lowercase and uppercase letters, as well as numbers
19
-
* Seed material stored in flash memory for added security
20
-
* Automatically types the password for you, so you don't have to
21
-
* Erases the password from memory after use, for extra peace of mind
22
-
* Easy to integrate into your existing projects with USB serial port connectivity
17
+
***Generates Secure Passwords** and **Types It for You**
18
+
* Different long complex password per account
19
+
* *Hardware Password Generator*
20
+
***2FA** support (**keys** encrypted with **AES-256** in the **EEPROM**)
21
+
* *Two Factor Authentication*
22
+
***Hardware Encryption** (**bytes** encrypted with **ChaCha20** algorithm)
23
+
* *File Encryption*
23
24
24
25
25
-
## 🏗️ Hardware
26
+
## 🏗️ Circuit Diagram
26
27
27
-
<imgsrc="assets/rpi-picos.jpg"width="100%">
28
-
29
-
1.**RP2040 Board**: both **Raspberry Pi Pico** and **Adafruit Trinkey QT2040** have been tested ✅
30
-
2.**USB OTG Cable / Adapter**
31
-
3. Cover/Case (optional)
32
-
33
-
34
-
## 💡 LED State
35
-
36
-
*`ON`
37
-
* Operational (default)
38
-
*`PULSING`
39
-
* Password ready to type
40
-
*`BLINKING`
41
-
* Typing... (fast blink)
42
-
*`OFF`
43
-
* No power input
44
-
45
-
46
-
**If your board have a RGB LED**, is possible to **switch seed** by pressing the `BOOTSEL` button on the board (in the `ON` state only). Here are the 6 available colors:
47
-
48
-
1. 🟢 Green (default)
49
-
2. 🟡 Yellow
50
-
3. 🔴 Red
51
-
4. 🔵 Blue
52
-
5. ⚪ White
53
-
6. 🟣 Magenta
54
-
55
-
56
-
## 💿 Installation and getting started
57
-
58
-
### 1. Install the Arduino Legacy IDE (1.8.19)
59
-
60
-
The Arduino IDE 1.8.19 can be downloaded from this [link](https://www.arduino.cc/en/software)
61
-
62
-
> 1.8.X version is required beforehand to ensure device drivers are installed correctly but 2.X can be used once the following steps are completed
63
-
64
-
65
-
### 2. Install the Raspberry Pi RP2040 Boards
66
-
67
-
- Open `File` -> `Preferences` -> `Settings`
68
-
69
-
- Insert the following link into the **Additional Boards Manager URLs**:
**Connect the Touch Sensor (TTP-223) to RP2040-Zero:**
81
40
82
-
### 3. Install the Pico Board package
41
+
1. Connect the GND pin of the touch sensor to a ground (GND) pin on the RP2040-Zero board.
42
+
2. Connect the I/O pin of the touch sensor to GPIO 2 on the RP2040-Zero board.
43
+
3. Connect the VCC pin of the touch sensor to a 3.3V power source on the RP2040-Zero board.
83
44
84
-
- Go to `Tools` -> `Board` -> `Boards Manager...`
85
45
86
-
- Search for "pico"
46
+
## 🔌 Plug and Play (PnP)
87
47
88
-
- Install the `Raspberry Pi Pico/RP 2040` package
48
+
You can connect TurtlPass to pretty much anywhere via USB. To type a default password, *long-touch*the sensor (TTP-223) until the LED fades out completly.
From the security point of view, this feature is useful as it provides decoy passwords for the curious hands of strangers. From the grandma's point of view is easy-to-use as it provides very strong passwords without installing any app.
96
51
97
52
98
-
### 4. Select the Raspberry Pi Pico Board
53
+
##💡 LED Color / Seed
99
54
100
-
- Go to `Tools` -> `Board` -> `Raspberry Pi RP2040 Boards(1.9.5)`
55
+
**Switch Seed** and **LED Color** by *single-touching* the sensor (TTP-223).
**Run the script**`generate-seed.sh` to generate your own unique seed on your local machine. The output file `Seed.cpp` will be added to your codebase.
126
92
127
-
## 🔧 Generate your own seed
93
+
**IMPORTANT**: Make sure you delete `turtlpass-firmware/Seed.cpp` file once you're done!
128
94
129
-
1. Run the bash script `./generate_seed_file.sh` to generate a new seed file `Seed.cpp.<timestamp>` on a computer with macOS or Linux.
130
95
131
-
2. Rename the generated file to `Seed.cpp`.
96
+
### 3. BUILD your custom TurtlPass Firmware
132
97
98
+
**Run the following command to compile the firmware to your RP2040 board:**
133
99
134
-
## ⬆️ Upload sketch
135
-
136
-
1. Open `turtlpass-firmware.ino` with Arduino IDE on a computer.
You should get a response with the current version of the firmware.
146
+
147
+
*Output example:*
148
+
149
+
```
150
+
TurtlPass Firmware Version: 2.0.0
151
+
Arduino Version: 10607
152
+
Compiler Version: 12.3.0
153
+
Unique Board ID: E692635B74C2374
154
+
```
173
155
174
156
175
157
## 💾 Backup
176
158
177
-
Having multiple devices with the same seed can serve as a backup, similar to having multiple copies of your house key. One device can be kept in a secure location while another one is for daily use.
159
+
Having multiple devices with the same seed can serve as a backup, similar to having multiple copies of your car key. One device can be kept in a secure location while another one is for daily use.
178
160
179
-
Alternatively, you can store the seed file elsewhere, but it is best to let the device store the seed offline for added security.
161
+
Alternatively, you can store the seed file elsewhere, but it recommended that it stays stored offline only inside a TurtlPass-RP2040 device for full security.
180
162
181
163
182
164
## 🛡️ Security
183
165
184
-
It's important to remember that if someone has physical access to the device, they may be able to compromise it with enough time and effort. However, even if the device is compromised, it is still hard to recreate the password generated by TurtlPass without access to the hash result of the inputs, such as the PIN code, app/domain, and user account, used in the client app.
166
+
It's important to remember that if someone has physical access to the device, they may be able to compromise the seeds with enough time and effort. However, even if the seeds are compromised, it's impossible to recreate the passwords generated by TurtlPass without access to the hash result of the inputs, such as the PIN code, app/domain, and user account (via client app).
185
167
186
168
187
169
<details>
188
-
<summary>Raspberry Pi Pico</summary>
170
+
<summary>Cloning RP2040</summary>
189
171
190
172
It is important to note that the firmware binary on the Raspberry Pi Pico RP2040 can be easily extracted using [picotool](https://github.com/raspberrypi/picotool) due to its utilization of external ROM.
191
173
@@ -204,25 +186,36 @@ Wrote 369000 bytes to firmware.uf2
204
186
Using a secure element such as the **ATECC608A/B** or **OPTIGA Trust X/M** for password generation can be a secure solution due to its physical tamper-resistance and isolation from the rest of the system. However, there are limitations to consider such as the difficulty in using them across multiple devices or platforms, and lack of backup or recovery options in case of loss or damage. Additionally, it may be difficult to manage and control access to the password in situations where multiple users need to access it.
205
187
</details>
206
188
189
+
190
+
## 🔑 TurtlPass ≠ FIDO
191
+
192
+
TurtlPass is **not** a **FIDO** Security Key and does **not** intend to be one. If you're looking for that, check [pico-fido](https://github.com/polhenarejos/pico-fido) project. **TurtlPass** is intended for **all the other websites/apps** that don't support hardware security keys, the ones with a `password` field :)
193
+
194
+
195
+
## 📚 Libraries
196
+
207
197
<details>
208
-
<summary>Other hardware options</summary>
198
+
<summary>[Raspberry Pi Pico Arduino core](https://github.com/earlephilhower/arduino-pico)</summary>
209
199
210
-
I am continuously exploring and evaluating new hardware options for this project. As more information and resources become available, I will keep you updated on my progress.
200
+
* Port of the RP2040 (Raspberry Pi Pico processor) to the Arduino ecosystem.
201
+
* It uses the bare Raspberry Pi Pico SDK and a custom GCC 10.3/Newlib 4.0 toolchain.
0 commit comments