Jan 31, 2020 16:00:00

Google launches an open source project `` OpenSK '' that allows you to create your own security key

Ideally, if you want to secure your PC, protect your PC with

two-factor authentication such as Google's ' Titan Security Key '. In order to spread such security keys, Google has announced a project to open source authentication technology for security keys, ' OpenSK '. This makes it possible to prepare not only the software for authentication technology but also the USB itself.

Google Online Security Blog: Say hello to OpenSK: a fully open-source security key implementation
https://security.googleblog.com/2020/01/say-hello-to-opensk-fully-open-source.html

'We are excited to announce an open source implementation of an open-key security key, OpenSK, that can easily combat phishing scams.' The project uses both FIDO U2F and FIDO2 . '

If you play the following movie for 40 seconds, you can see in one shot how you are actually using the security key created with OpenSK.

OpenSK demo-YouTube


OpenSK is written in Rust, an open source system programming language supported by Mozilla.

I will actually use it. When I tried to log in to the site, I was prompted for authentication.

Connect to PC. Press the white button.

Only this is successful login. The time required for authentication was only a few seconds.

OpenSK is published on GitHub, so anyone can download and use it freely.

The security key has been tested for operation with the

nRF52840 Dongle and nRF52840 DK USB devices from Nordic semiconductor company Nordic Semiconductor . However, both products have bare boards and are inconvenient to carry around.

Therefore, a design drawing that can create a case for protecting the security key is also released.

The design drawings are compatible with various 3D printers including the MakerBot 3D Printer Replicator 2X .

There is also a slit for pressing the button, so you can use the case without losing control.

'OpenSK is written in Rust and boasts strong memory security and zero-cost abstractions, so it has a strength against logical attacks. Thanks to the fact that it runs on TockOS , 'The separation of security key applets, drivers, and kernels' is essential for building defense- in-depth, 'he emphasized. However, since the project is still in the development stage, at the time of writing the article has not been officially tested, and it is not officially FIDO certified.