Google has introduced the open stack OpenSK for creating cryptographic tokens

Google Inc. introduced the OpenSK platform, which allows the creation of firmware for cryptographic tokens that fully comply with standards FIDO U2F and FIDO2. Tokens prepared using OpenSK can be used as authenticators for primary and two-factor authentication, as well as for confirming the user's physical presence. The project is written in Rust and is distributed under the Apache 2.0 license.

OpenSK provides the ability to create a custom token for two-factor authentication on websites, which, unlike off-the-shelf solutions offered by such manufacturers as Yubico, Feitian, Thetis, and Kensington, is built on completely open firmware, available for extensions and audits. OpenSK is positioned as a research platform that token manufacturers and enthusiasts can use to develop new capabilities and promote tokens to a wider audience. Initially, the OpenSK code was developed as an application for Tock OS and tested on Nordic nRF52840-DK boards and the Nordic nRF52840 dongle.

In addition to the software, the project provides are provided 3D-printable designs for USB key fob enclosures based on the popular chip Nordic nRF52840, which includes an ARM Cortex-M4 microcontroller and a crypto accelerator
ARM TrustZone Cryptocell 310. The Nordic nRF52840 is the first reference platform for OpenSK. OpenSK supports the ARM CryptoCell crypto accelerator and all transport types provided by the chip, including USB, NFC, and Bluetooth Low Energy. In addition to utilizing the crypto accelerator, OpenSK also has isolated implementations of ECDSA, ECC secp256r1, HMAC-SHA256, and AES256 algorithms written in Rust.

It should be noted that OpenSK is not the first open-source firmware implementation for tokens supporting FIDO2 and U2F, similar firmwares are developed by open projects Solo and Somu. Compared to the aforementioned projects, OpenSK is built not in C but in Rust, which helps avoid many vulnerabilities arising from low-level memory operations, such as accessing freed memory, dereferencing null pointers, and buffer overflows.

The provided firmware for installation is based on TockOS,
an operating system for microcontrollers based on Cortex-M and RISC-V, providing sandbox isolation for the kernel, drivers, and applications. OpenSK is designed as an applet for TockOS. In addition to OpenSK, Google has also prepared a version of TockOS optimized for Flash storage (NVMC) storage and a set of patches. The kernel and drivers in TockOS, like OpenSK, are written in Rust.

Source: opennet.ru