ZeroCode AI · Community

Published

• USB Security KeyI want to build my own hardware security key, like a YubiKey, that I can plug into my computer by USB and use as two-factor authentication for my online logins (Google, GitHub, etc.). It should work with the normal "security key" / passkey prompts in browsers, with no special drivers or apps. FUNCTIONALITY - It should act as a FIDO2/WebAuthn key (CTAP2) and also support the older U2F standard, so it works on both modern and older sites. - It should support registering on a site, then logging in with it later. Each time, it signs a challenge using ECDSA P-256 (ES256). - It should support passkeys (discoverable credentials), with room for around 25 of them. Other credentials should be stored without using device memory, by encoding them into the credential ID. - It should support an optional PIN, set from the browser or OS, with a retry limit and lockout after too many wrong attempts. - Secrets must be properly protected. Generate a random master secret on first boot using the hardware RNG and store it encrypted. Never send private keys out of the device. Keep a signature counter that survives power loss. Enable flash encryption and secure boot for the final version. - It should show up as a standard USB HID FIDO device, using the CTAPHID protocol. HARDWARE NEEDED - An ESP32-S3 dev board with native USB (the port connected to GPIO19/GPIO20, not the UART/serial port). - Only the board's built-in BOOT button and onboard LED. No extra parts needed. If the board has an RGB LED, use it. If not, use a single LED on a free GPIO. - Please include a clear pin and wiring list in case I want to add an external button or LED later. CONTROLS - A short press of the BOOT button confirms "yes, it's me" for every registration and login. The key must never sign anything without a physical touch. - If I don't touch the button within about 30 seconds, the request should time out and fail safely. - Holding the button for around 10 seconds right after plugging it in starts the factory reset process (see below). - PIN entry happens through the browser or OS, not on the device. RESET & RECOVERY - A factory reset wipes all credentials, the PIN and the master secret. It should need a deliberate action (plugging in, then holding the button within the first few seconds), so it can't happen by accident or be triggered remotely. - If I forget the PIN and get locked out, a factory reset should be the recovery path. Warn me that this deletes every credential, and that I'd need to re-register on each site. - Please make two build modes. A "development" mode with no permanent chip changes, so I can test and reflash freely. A "production" mode that turns on flash encryption, secure boot and disables debug access. Explain clearly, with a warning, that the production eFuse changes are one-time and can't be undone. - Remind me to register a backup key on each site, since a lost or reset key means losing access otherwise. - If the stored data gets corrupted, it should safely reinitialize rather than get stuck. FEEDBACK & INDICATORS - LED idle (plugged in and ready): dim, slow pulse or steady dim light. - LED waiting for a touch: blinking fast, so I know to press the button. - LED success: solid green for about 1 second. - LED error, timeout or wrong PIN: red flash. - LED locked out (too many PIN attempts): slow red pulse. - LED factory reset in progress: alternating colors, then a solid confirmation. - In the development mode only, print debug logs over serial for USB packets and commands. Turn these off in production. Please keep the code well commented, mention anywhere you simplified the FIDO spec, and tell me how to test it with webauthn.io and libfido2 (fido2-token -L). Also tell me any limitation of the ESP32-S3 here, like having no secure element, and how you've worked around it.

Built with ESP ZeroCode AI — describe a device, get production firmware.
Terms of Service · Privacy Policy