Skip to content

V0.56
Compare
Choose a tag to compare
@nitrokey-ci nitrokey-ci released this 31 Jul 15:55
· 28 commits to master since this release
V0.56
This tag was signed with the committer’s verified signature. The key has expired.
szszszsz Szczepan Zalega
GPG key ID: D9BAE35991DE5B22
Expired
Learn about vigilant mode.
6fd0fcd
This commit was signed with the committer’s verified signature. The key has expired.
szszszsz Szczepan Zalega
GPG key ID: D9BAE35991DE5B22
Expired
Learn about vigilant mode.

After the update only the Unencrypted and Encrypted Volumes data will be retained. Password Safe, OTPs and Hidden Volumes will be lost.

Update guide:

Use of nitrokey-storage-V0.56.hex firmware file should be preferred.
This is the first release with the free space of the image filled with random data (taken from the attached random.bin). The other hex file with the reproducible suffix contains only the compiler produced output, without this extension. Both should work identically. The difference is, that the random data will show up in the results of the firmware image export for the former, which by design should make harder to hide a malicious code in the firmware.

This firmware requires Nitrokey App v1.4 to fully operate. Otherwise the OTP slot writing and configuration update will not work.
Known limitations:
- Write to the 15th TOTP slot is disabled (until the next firmware) due to a bug - #91;
- Write to OTP slots in Nitrokey Apps v1.3.2 and older is silently (without a warning to user) disabled due to a modified authorization method (#22). At the moment only Nitrokey App v1.4 can handle it. Other features works as usual.

Firmware is signed with szczepan@nitrokey.com, key id: 868184069239FF65DE0BCD7D D9BAE35991DE5B22
(valid until 2022-01-11). ID can be confirmed to be the same with one on the main download site - https://www.nitrokey.com/download.

$ gpg2 --verify sha256sum.sig
gpg: assuming signed data in 'sha256sum'
gpg: Signature made Sat 31 Jul 2021 05:48:36 PM CEST
gpg:                using RSA key 868184069239FF65DE0BCD7DD9BAE35991DE5B22
gpg: Good signature from "Szczepan Zalega <szczepan.zalega@gmail.com>" [ultimate]
gpg:                 aka "Szczepan Zalega (Nitrokey) <szczepan@nitrokey.com>" [ultimate]

Built with optimizations disabled (-O0), using GCC 4.3.3 (AVR_Toolchain_3.0_124).
avr32-gcc (AVR_Toolchain_3.0_124) 4.3.3

Firmware changes:

  • Add HMAC control sum to EV AES key, and abort EV unlock operation if it does not match;
  • HMAC is generated on the first use of the EV key, and removed on the AES key regeneration and factory reset;
  • The returned error is WRONG_PASSWORD for the backward compatibility purposes (to be changed in the future);
  • Removed obsolete matrix-input feature, and connected implementation;
  • Introduce more time-rigid memory comparison function where needed;
  • Reintroduce logs collection through debug file written to UV (disabled for the release);

Development:

  • Add helpers for the development (build, upload through bootloader and test in one step, without debugger);
  • Divide the main Makefile for better readability;
  • Remove obsolete code;

Tested on Linux Fedora 33:

  • libnitrokey test suite v3.6-21-g0748451
  • firmware update path: v0.55 -> v0.56 -> v0.55

Maintenance note: firmware built locally, using known to work compiler version from the previous releases. New compiler will be introduced on the next release.

Assets 7
Loading