solokey with integrated fingerprint reader

[ivanbalashov239]

A hardware key with secure fingerprint reader required to approve all actions

How hard will it be to implement with solo v2 hardware(v2.1 so to say)?

Can support for a fingerprint reader be implemented as an "app" without compromising security of fido2 and ensuring that no action will be approved without actual fingerprint present?(connecting to fp reader pins and forcing to approve fido2 action or even getting access to fido2 keys threat model)

fake fingerprint is probably out of scope of this question

[nickray]

Typically, fingerprint readers seems to come in (closed source) all-in-one packages, with an additional bundled chip doing the "recognition". I'd be interested in sensor modules that we could read out ourselves (from the LPC55 chip).

[My1]

Thanks for the info, sad that it needs a closed lib. And likely reversing the hell out of the chip to build an open library is likely not gonne be an option because of the effort. But i would say that an fp solo would be cool.

[0x0ece]

Another consideration is FIDO certification. There's no point in having a key with biometric sensor unless it's FIDO certified.

The approach the alliance is taking is that vendors offer pre-certified readers, so that products can only "delta certify". This is good, but significantly restricts the number of readers we should use, if we want to keep certifying Solo. And combined with open source it's pretty much a no go.

It'd be nice for someone to build an open reader, an open library to dialog with the reader, an open library to enroll a user (e.g., openly train a ML model, and the trained model is a secret that we can store in our secure chip). Where open = not GPL, because we need to be able to lock down our firmware. And FIDO certify their reader + libs.

[My1]

@0x0ece gpl prevents lock down? How do embedded devices with no way of custom cfw get away with it?

[0x0ece]

Yes, GPL prevents lock down, google for "tivotization". This is for example the reason why we had to rewrite (still unsuccessfully) openpgp instead of using gnuk (see solokeys/solo1#16).

[My1]

at least as far as I read the language against that was added in v3. you might be able to run something that also allows v2.