ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-30 09:48:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
3dbf1f5f39
heads/modules/libremkey-hotp-verification

38 lines
1.6 KiB
Plaintext
Raw Normal View History

Add Librem Key support to Heads The Librem Key is a custom device USB-based security token Nitrokey is producing for Purism and among other things it has custom firmware created for use with Heads. In particular, when a board is configured with CONFIG_LIBREMKEY, this custom firmware allows Heads to use the sealed TOTP secret to also send an HOTP authentication to the Librem Key. If the HOTP code is successful, the Librem Key will blink a green LED, if unsuccessful it will blink red, thereby informing the user that Heads has been tampered with without requiring them to use a phone to validate the TOTP secret. Heads will still use and show the TOTP secret, in case the user wants to validate both codes (in case the Librem Key was lost or is no longer trusted). It will also show the result of the HOTP verification (but not the code itself), even though the user should trust only what the Librem Key displays, so the user can confirm that both the device and Heads are in sync. If HOTP is enabled, Heads will maintain a new TPM counter separate from the Heads TPM counter that will increment each time HOTP codes are checked. This change also modifies the routines that update TOTP so that if the Librem Key executables are present it will also update HOTP codes and synchronize them with a Librem Key.
2018-06-19 19:27:27 +00:00
modules-$(CONFIG_LIBREMKEY) += libremkey-hotp-verification
libremkey-hotp-verification_depends := libusb $(musl_dep)
Make hotp-verification hashes same across two CIs Move from CMake build system to GNU Make for hotp-verification Change version to one supporting Makefile build Fixes https://github.com/osresearch/heads/pull/724 Connected: - https://github.com/Nitrokey/nitrokey-hotp-verification/issues/13 - https://github.com/osresearch/heads/pull/722
2020-05-21 05:38:02 +00:00
libremkey-hotp-verification_version := 809953b9b4bef97a4cffaa20d675bd7fe9d8da53
modules/libremkey-hotp-verification: make reproducible Modeled after modules/tpmtotp, use a specific git commit hash for module libremkey-hotp-verification. Add hidapi as a submodule with dummy/placeholder in modules (like coreboot-blobs), also specified by git commit hash. Adjust libremkey-hotp-verification patch file name so patch applied properly. Addresses issue #640 Test: build Librem 13v4 Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 19:28:15 +00:00
libremkey-hotp-verification_dir := libremkey-hotp-verification-$(libremkey-hotp-verification_version)
libremkey-hotp-verification_tar := nitrokey-hotp-verification-$(libremkey-hotp-verification_version).tar.gz
libremkey-hotp-verification_url := https://github.com/Nitrokey/nitrokey-hotp-verification/archive/$(libremkey-hotp-verification_version).tar.gz
Make hotp-verification hashes same across two CIs Move from CMake build system to GNU Make for hotp-verification Change version to one supporting Makefile build Fixes https://github.com/osresearch/heads/pull/724 Connected: - https://github.com/Nitrokey/nitrokey-hotp-verification/issues/13 - https://github.com/osresearch/heads/pull/722
2020-05-21 05:38:02 +00:00
libremkey-hotp-verification_hash := 251e5cef74e4e45eeddc49e4a1da1e22d1de774cd32cb0451a9030579ae958ba
Add Librem Key support to Heads The Librem Key is a custom device USB-based security token Nitrokey is producing for Purism and among other things it has custom firmware created for use with Heads. In particular, when a board is configured with CONFIG_LIBREMKEY, this custom firmware allows Heads to use the sealed TOTP secret to also send an HOTP authentication to the Librem Key. If the HOTP code is successful, the Librem Key will blink a green LED, if unsuccessful it will blink red, thereby informing the user that Heads has been tampered with without requiring them to use a phone to validate the TOTP secret. Heads will still use and show the TOTP secret, in case the user wants to validate both codes (in case the Librem Key was lost or is no longer trusted). It will also show the result of the HOTP verification (but not the code itself), even though the user should trust only what the Librem Key displays, so the user can confirm that both the device and Heads are in sync. If HOTP is enabled, Heads will maintain a new TPM counter separate from the Heads TPM counter that will increment each time HOTP codes are checked. This change also modifies the routines that update TOTP so that if the Librem Key executables are present it will also update HOTP codes and synchronize them with a Librem Key.
2018-06-19 19:27:27 +00:00
libremkey-hotp-verification_target := \
$(MAKE_JOBS) \
$(CROSS_TOOLS) \
libremkey-hotp-verification_output := \
libremkey_hotp_verification \
libremkey_hotp_initialize
libremkey-hotp-verification_configure := \
INSTALL="$(INSTALL)" \
libremkey-hotp-verification: toolchain adjustments Pass through new toolchain path via $(CROSS) so we can set the c/c++ compiler paths correctly for CMake. Adjust patch to use new paths, and fix compiler/linker paths to correct a libusb linking issue. Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-01-22 03:43:56 +00:00
CROSS="$(CROSS)" \
Make hotp-verification hashes same across two CIs Move from CMake build system to GNU Make for hotp-verification Change version to one supporting Makefile build Fixes https://github.com/osresearch/heads/pull/724 Connected: - https://github.com/Nitrokey/nitrokey-hotp-verification/issues/13 - https://github.com/osresearch/heads/pull/722
2020-05-21 05:38:02 +00:00
$(CROSS_TOOLS) $(MAKE) LDFLAGS="$(INSTALL)/lib/libusb-1.0.so" && $(MAKE) install INSTALL="$(INSTALL)"
modules/libremkey-hotp-verification: make reproducible Modeled after modules/tpmtotp, use a specific git commit hash for module libremkey-hotp-verification. Add hidapi as a submodule with dummy/placeholder in modules (like coreboot-blobs), also specified by git commit hash. Adjust libremkey-hotp-verification patch file name so patch applied properly. Addresses issue #640 Test: build Librem 13v4 Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 19:28:15 +00:00
libremkey-hotp-verification_depends += hidapi
modules-y += hidapi
hidapi_version := e5ae0d30a523c565595bdfba3d5f2e9e1faf0bd0
hidapi_dir := libremkey-hotp-verification-$(libremkey-hotp-verification_version)/hidapi
hidapi_tar := hidapi-$(hidapi_version).tar.xz
hidapi_url := https://github.com/Nitrokey/hidapi/archive/$(hidapi_version).tar.gz
hidapi_hash := acc2a5089a8917085c2b3ebe9446065a21c760ba7e13cb54917043c4122188e0
## hidapi will be built as part of libremkey-hotp-verification
## so nothing to do here (but need make to be happy)
hidapi_output := .built
hidapi_configure := echo -e 'all:\n\ttouch .built' > Makefile
Reference in New Issue Copy Permalink