Skip to content

Commit 1de2748

Browse files
committed
README updated instructions for arduino-cli;
Created bash script 1-click-setup.sh; Driver for Touch Sensor TTP-223; Print device info with serial command i; EncryptionManager to handle byte encryption with ChaCha20 algo; OtpManager with AES-256 encryption; OtpCode class to handle OTP codes generation; Created EEPROMMate library to store and retrieve OTP shared secrets in/from the virtual EEPROM LedState refactor into LedManager, added new led states; Kdf refactored - breaking changes;
1 parent 8373c3b commit 1de2748

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+2140
-633
lines changed

README.md

Lines changed: 126 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<img src="assets/icon.png" alt="logo" width=90>
33
<h3 align="center">TurtlPass Firmware</h3>
44
<p align="center">
5-
TurtlPass Firmware provides a simple and secure way of generating passwords using a deterministic key derivation function (HKDF) as specified in <a href="https://datatracker.ietf.org/doc/html/rfc5869">RFC 5869</a>.</p>
5+
TurtlPass Firmware offers a straightforward and secure method for creating robust passwords. It employs a deterministic key derivation function along with unique seed material stored in flash memory. Once activated with a touch, it automatically types the password for you.</p>
66
<p align="center">
77
<a href="https://github.com/TurtlPass/turtlpass-firmware-arduino/releases"><img src="https://img.shields.io/github/v/release/TurtlPass/turtlpass-firmware-arduino?color=green&label=Arduino%20Firmware&logo=arduino" alt="Releases"/></a>
88
</p>
@@ -14,178 +14,160 @@ TurtlPass Firmware provides a simple and secure way of generating passwords usin
1414

1515
## ⚡ Features
1616

17-
* Generates unique, secure passwords from a simple input hash
18-
* 100 characters long, including a combination of lowercase and uppercase letters, as well as numbers
19-
* Seed material stored in flash memory for added security
20-
* Automatically types the password for you, so you don't have to
21-
* Erases the password from memory after use, for extra peace of mind
22-
* Easy to integrate into your existing projects with USB serial port connectivity
17+
* **Generates Secure Passwords** and **Types It for You**
18+
* Different long complex password per account
19+
* *Hardware Password Generator*
20+
* **2FA** support (**keys** encrypted with **AES-256** in the **EEPROM**)
21+
* *Two Factor Authentication*
22+
* **Hardware Encryption** (**bytes** encrypted with **ChaCha20** algorithm)
23+
* *File Encryption*
2324

2425

25-
## 🏗️ Hardware
26+
## 🏗️ Circuit Diagram
2627

27-
<img src="assets/rpi-picos.jpg" width="100%">
28-
29-
1. **RP2040 Board**: both **Raspberry Pi Pico** and **Adafruit Trinkey QT2040** have been tested ✅
30-
2. **USB OTG Cable / Adapter**
31-
3. Cover/Case (optional)
32-
33-
34-
## 💡 LED State
35-
36-
* `ON`
37-
* Operational (default)
38-
* `PULSING`
39-
* Password ready to type
40-
* `BLINKING`
41-
* Typing... (fast blink)
42-
* `OFF`
43-
* No power input
44-
45-
46-
**If your board have a RGB LED**, is possible to **switch seed** by pressing the `BOOTSEL` button on the board (in the `ON` state only). Here are the 6 available colors:
47-
48-
1. 🟢 Green (default)
49-
2. 🟡 Yellow
50-
3. 🔴 Red
51-
4. 🔵 Blue
52-
5. ⚪ White
53-
6. 🟣 Magenta
54-
55-
56-
## 💿 Installation and getting started
57-
58-
### 1. Install the Arduino Legacy IDE (1.8.19)
59-
60-
The Arduino IDE 1.8.19 can be downloaded from this [link](https://www.arduino.cc/en/software)
61-
62-
> 1.8.X version is required beforehand to ensure device drivers are installed correctly but 2.X can be used once the following steps are completed
63-
64-
65-
### 2. Install the Raspberry Pi RP2040 Boards
66-
67-
- Open `File` -> `Preferences` -> `Settings`
68-
69-
- Insert the following link into the **Additional Boards Manager URLs**:
70-
71-
> https://github.com/earlephilhower/arduino-pico/releases/download/global/package_rp2040_index.json
72-
73-
- Hit **OK** to close the dialog
74-
75-
<details>
76-
<summary>Screenshot</summary>
77-
78-
<img src="assets/additional_boards.png" width="100%">
79-
</details>
28+
```
29+
RP2040-Zero Touch Sensor
30+
+-----------+ +----------+
31+
| | GND -------- | GND |
32+
| RGB-LED | | |
33+
| (GPIO 16) | GPIO 2 ----- | I/O |
34+
| | | |
35+
| | 3.3V ------- | VCC |
36+
+-----------+ +----------+
37+
```
8038

39+
**Connect the Touch Sensor (TTP-223) to RP2040-Zero:**
8140

82-
### 3. Install the Pico Board package
41+
1. Connect the GND pin of the touch sensor to a ground (GND) pin on the RP2040-Zero board.
42+
2. Connect the I/O pin of the touch sensor to GPIO 2 on the RP2040-Zero board.
43+
3. Connect the VCC pin of the touch sensor to a 3.3V power source on the RP2040-Zero board.
8344

84-
- Go to `Tools` -> `Board` -> `Boards Manager...`
8545

86-
- Search for "pico"
46+
## 🔌 Plug and Play (PnP)
8747

88-
- Install the `Raspberry Pi Pico/RP 2040` package
48+
You can connect TurtlPass to pretty much anywhere via USB. To type a default password, *long-touch* the sensor (TTP-223) until the LED fades out completly.
8949

90-
<details>
91-
<summary>Screenshots</summary>
92-
93-
<img src="assets/boards_manager.png" width="100%">
94-
<img src="assets/boards_manager_pico.png" width="100%">
95-
</details>
50+
From the security point of view, this feature is useful as it provides decoy passwords for the curious hands of strangers. From the grandma's point of view is easy-to-use as it provides very strong passwords without installing any app.
9651

9752

98-
### 4. Select the Raspberry Pi Pico Board
53+
## 💡 LED Color / Seed
9954

100-
- Go to `Tools` -> `Board` -> `Raspberry Pi RP2040 Boards(1.9.5)`
55+
**Switch Seed** and **LED Color** by *single-touching* the sensor (TTP-223).
10156

102-
- And select `Raspberry Pi Pico`
57+
__9 different color/SEED pairs available:__
58+
1. 🐢 Turtle Green
59+
2. ☀️ Sunny Yellow
60+
3. 🍒 Cherry Red
61+
4. 💙 Electric Blue
62+
5. ❄️ Snow White
63+
6. 🔮 Mystic Violet
64+
7. 🔥 Fire Blaze
65+
8. 🌊 Aqua Breeze
66+
9. 🎀 Bubblegum Pink
10367

10468
<details>
105-
<summary>Screenshot</summary>
69+
<summary>💡 LED State Meaning</summary>
10670

107-
<img src="assets/select_pico_board.png" width="100%">
71+
* `ON`
72+
* Idle
73+
* `PULSING`
74+
* Password/OTP ready to type
75+
* `BLINKING` (fast blink)
76+
* Typing/Encryting
77+
* `OFF`
78+
* No power input
10879
</details>
10980

11081

111-
### 5. Install the Crypto library
82+
## 💿 Installation and getting started
11283

113-
- Go to `Tools` -> `Manage Libraries...`
84+
### 1. INSTALL and setup `arduino-cli`
11485

115-
- Search for "arduinolibs crypto"
86+
**Run the script** `1-click-setup.sh` to install automatically the `arduino-cli`, `RP2040 boards` and all the libraries required.
11687

117-
- Install the `Crypto` library
11888

119-
<details>
120-
<summary>Screenshots</summary>
121-
122-
<img src="assets/manage_libs.png" width="50%">
123-
<img src="assets/install_crypto_lib.png" width="100%">
124-
</details>
89+
### 2. SEED generation
12590

91+
**Run the script** `generate-seed.sh` to generate your own unique seed on your local machine. The output file `Seed.cpp` will be added to your codebase.
12692

127-
## 🔧 Generate your own seed
93+
**IMPORTANT**: Make sure you delete `turtlpass-firmware/Seed.cpp` file once you're done!
12894

129-
1. Run the bash script `./generate_seed_file.sh` to generate a new seed file `Seed.cpp.<timestamp>` on a computer with macOS or Linux.
13095

131-
2. Rename the generated file to `Seed.cpp`.
96+
### 3. BUILD your custom TurtlPass Firmware
13297

98+
**Run the following command to compile the firmware to your RP2040 board:**
13399

134-
## ⬆️ Upload sketch
135-
136-
1. Open `turtlpass-firmware.ino` with Arduino IDE on a computer.
100+
```
101+
$ arduino-cli compile --clean \
102+
--fqbn "rp2040:rp2040:generic" \
103+
--output-dir ../turtlpass-firmware/build/ \
104+
--build-property "build.extra_flags=\"-D__TURTLPASS_VERSION__=\"2.0.0\"\"" \
105+
../turtlpass-firmware/turtlpass-firmware.ino
106+
```
137107

138-
> If the first time, select the appropriate **Board** and **Serial Port** in the Arduino menu `Tools`.
139108

140-
2. Connect the Raspberry Pico to a computer with a micro-USB to USB-C cable.
109+
### 4. UPLOAD TurtlPass Firmware to your RP2040 Board
141110

142-
> To upload your first sketch, you will need to hold the `BOOTSEL` button down while plugging in the Pico to a computer.
111+
**Run the following command to upload the firmware to your RP2040 board:**
143112

144-
3. Click in the `Upload` icon to upload the sketch to the Pico
113+
`$ arduino-cli upload --fqbn "rp2040:rp2040:generic" -i ../turtlpass-firmware/build/turtlpass-firmware.ino.bin -p <PORT>`
114+
115+
*Example:*
145116

146-
4. The sketch should be transferred and start to run.
117+
```
118+
$ arduino-cli upload \
119+
--fqbn "rp2040:rp2040:generic" \
120+
-i ../turtlpass-firmware/build/turtlpass-firmware.ino.bin \
121+
-p /dev/cu.usbmodem14101
122+
```
147123

148-
<details>
149-
<summary>Screenshots</summary>
150-
151-
<img src="assets/upload_firmware.png" width="50%">
152-
<img src="assets/upload_done.png" width="50%">
153-
</details>
124+
**IMPORTANT**: Make sure you delete `turtlpass-firmware/build/` directory once you're done!
154125

155126

156-
## 🐞 Debugging
127+
### 5. DONE! Check Serial Monitor if you want
157128

158-
1. Open the **Serial Monitor** console
159-
> Settings: `Newline` and `115200` baud rate
129+
**Run the following command to start a serial communication with your RP2040 board:**
160130

161-
2. Type, for example, `/0` and send it
131+
`$ arduino-cli monitor --config baudrate=115200 -p <PORT>`
132+
133+
*Example:*
162134

163-
3. You should get a response saying `OK` and the LED should be `PULSING`
135+
```
136+
$ arduino-cli monitor \
137+
--config baudrate=115200 \
138+
-p /dev/cu.usbmodem14101
139+
```
164140

165-
4. Now press the button on Pico and the password should be typed (wherever the focus is on)
141+
**Then send:**
166142

167-
<details>
168-
<summary>Screenshots</summary>
169-
170-
<img src="assets/serial_monitor_send.png" width="100%">
171-
<img src="assets/serial_monitor_result.png" width="100%">
172-
</details>
143+
`$ i [ENTER]`
144+
145+
You should get a response with the current version of the firmware.
146+
147+
*Output example:*
148+
149+
```
150+
TurtlPass Firmware Version: 2.0.0
151+
Arduino Version: 10607
152+
Compiler Version: 12.3.0
153+
Unique Board ID: E692635B74C2374
154+
```
173155

174156

175157
## 💾 Backup
176158

177-
Having multiple devices with the same seed can serve as a backup, similar to having multiple copies of your house key. One device can be kept in a secure location while another one is for daily use.
159+
Having multiple devices with the same seed can serve as a backup, similar to having multiple copies of your car key. One device can be kept in a secure location while another one is for daily use.
178160

179-
Alternatively, you can store the seed file elsewhere, but it is best to let the device store the seed offline for added security.
161+
Alternatively, you can store the seed file elsewhere, but it recommended that it stays stored offline only inside a TurtlPass-RP2040 device for full security.
180162

181163

182164
## 🛡️ Security
183165

184-
It's important to remember that if someone has physical access to the device, they may be able to compromise it with enough time and effort. However, even if the device is compromised, it is still hard to recreate the password generated by TurtlPass without access to the hash result of the inputs, such as the PIN code, app/domain, and user account, used in the client app.
166+
It's important to remember that if someone has physical access to the device, they may be able to compromise the seeds with enough time and effort. However, even if the seeds are compromised, it's impossible to recreate the passwords generated by TurtlPass without access to the hash result of the inputs, such as the PIN code, app/domain, and user account (via client app).
185167

186168

187169
<details>
188-
<summary>Raspberry Pi Pico</summary>
170+
<summary>Cloning RP2040</summary>
189171

190172
It is important to note that the firmware binary on the Raspberry Pi Pico RP2040 can be easily extracted using [picotool](https://github.com/raspberrypi/picotool) due to its utilization of external ROM.
191173

@@ -204,25 +186,36 @@ Wrote 369000 bytes to firmware.uf2
204186
Using a secure element such as the **ATECC608A/B** or **OPTIGA Trust X/M** for password generation can be a secure solution due to its physical tamper-resistance and isolation from the rest of the system. However, there are limitations to consider such as the difficulty in using them across multiple devices or platforms, and lack of backup or recovery options in case of loss or damage. Additionally, it may be difficult to manage and control access to the password in situations where multiple users need to access it.
205187
</details>
206188

189+
190+
## 🔑 TurtlPass ≠ FIDO
191+
192+
TurtlPass is **not** a **FIDO** Security Key and does **not** intend to be one. If you're looking for that, check [pico-fido](https://github.com/polhenarejos/pico-fido) project. **TurtlPass** is intended for **all the other websites/apps** that don't support hardware security keys, the ones with a `password` field :)
193+
194+
195+
## 📚 Libraries
196+
207197
<details>
208-
<summary>Other hardware options</summary>
198+
<summary>[Raspberry Pi Pico Arduino core](https://github.com/earlephilhower/arduino-pico)</summary>
209199

210-
I am continuously exploring and evaluating new hardware options for this project. As more information and resources become available, I will keep you updated on my progress.
200+
* Port of the RP2040 (Raspberry Pi Pico processor) to the Arduino ecosystem.
201+
* It uses the bare Raspberry Pi Pico SDK and a custom GCC 10.3/Newlib 4.0 toolchain.
202+
* _LGPL 2.1 license_
211203
</details>
212204

205+
<details>
206+
<summary>[Arduino Cryptography Library](https://github.com/rweather/arduinolibs)</summary>
207+
208+
* Libraries to perform cryptography operations on Arduino devices
209+
* _MIT license_
210+
</details>
213211

214-
## 📚 Libraries
215-
216-
* [Raspberry Pi Pico Arduino core](https://github.com/earlephilhower/arduino-pico)
217-
* Port of the RP2040 (Raspberry Pi Pico processor) to the Arduino ecosystem.
218-
* It uses the bare Raspberry Pi Pico SDK and a custom GCC 10.3/Newlib 4.0 toolchain.
219-
* _LGPL 2.1 license_
220-
* [Arduino Cryptography Library](https://github.com/rweather/arduinolibs)
221-
* Libraries to perform cryptography operations on Arduino devices
222-
* _MIT license_
223-
* [Keyboard Library for Arduino](https://github.com/arduino-libraries/Keyboard)
224-
* Library allows an Arduino board with USB capabilities to act as a keyboard
225-
* _LGPL 3.0 license_
212+
<details>
213+
<summary>[Keyboard Library for Arduino](https://github.com/arduino-libraries/Keyboard)
214+
</summary>
215+
216+
* Library allows an Arduino board with USB capabilities to act as a keyboard
217+
* _LGPL 3.0 license_
218+
</details>
226219

227220

228221
## 📄 License

assets/additional_boards.png

-128 KB
Binary file not shown.

assets/boards_manager.png

-203 KB
Binary file not shown.

assets/boards_manager_pico.png

-110 KB
Binary file not shown.

assets/install_crypto_lib.png

-334 KB
Binary file not shown.

assets/manage_libs.png

-191 KB
Binary file not shown.

assets/select_pico_board.png

-323 KB
Binary file not shown.

assets/serial_monitor_result.png

-63.5 KB
Binary file not shown.

assets/serial_monitor_send.png

-70.1 KB
Binary file not shown.

assets/upload_done.png

-33.8 KB
Binary file not shown.

assets/upload_firmware.png

-23.9 KB
Binary file not shown.

scripts/1-click-setup.sh

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
# chmod +x 1-click-setup.sh
3+
4+
brew update
5+
brew install arduino-cli
6+
# or
7+
# curl -fsSL https://raw.githubusercontent.com/arduino/arduino-cli/master/install.sh | BINDIR=~/.local/bin sh
8+
9+
arduino-cli config init --overwrite
10+
arduino-cli core update-index
11+
arduino-cli core install --additional-urls https://github.com/earlephilhower/arduino-pico/releases/download/global/package_rp2040_index.json rp2040:rp2040
12+
arduino-cli config set library.enable_unsafe_install true
13+
arduino-cli lib install --git-url git@github.com:rweather/arduinolibs.git
14+
arduino-cli lib install --git-url git@github.com:Seeed-Studio/Seeed_Arduino_mbedtls.git
15+
arduino-cli lib install --git-url git@github.com:dirkx/Arduino-Base32-Decode.git
16+
arduino-cli lib install --git-url git@github.com:FrankBoesing/FastCRC.git
17+
arduino-cli lib install --git-url git@github.com:dojyorin/arduino_base64.git
18+
arduino-cli lib install --git-url git@github.com:FastLED/FastLED.git

0 commit comments

Comments
 (0)