🛠 Transformer la carte en clé de sécurité FIDO2 avec OpenSK

The project

OpenSK is the open-source implementation (Rust, google/opensk) of a FIDO2/CTAP2 authentication key. It runs on the nRF52840 MDK family, and MakerDiary documents building its own firmware in a dedicated wiki post. The choice of board is not random:

• CryptoCell 310 + TrustZone: the nRF52840's hardware cryptographic subsystem performs key operations (ECDSA/P-256, HMAC) — this is what OpenSK leverages for attestation and resident secrets.
• Native USB exposed: the board's USB hub connects one port to the SoC's USB controller, which enumerates directly — essential for a key that presents itself as a HID device on the bus.
• 64 Mbit of external QSPI flash for credential storage.

Step 1 — Prerequisites

rustup target add thumbv7em-none-eabihf
git clone https://github.com/google/opensk
cd opensk

The expected toolchain (Rust version, signing tools) is listed in the repository's README; follow the MakerDiary post "Building your own OpenSK firmware" for board-specific steps.

Step 2 — Compile the firmware

The OpenSK build produces a signed application image (the repository provides packaging tools, historically makeelf). The exact command and attestation provisioning variables are found in the README and the MakerDiary guide — do not invent them: the default attestation for a custom build is self-signed.

# principe (détails et flags : README opensk + billet MakerDiary)
cargo +nightly build --release --target thumbv7em-none-eabihf \
  --features ...      # cible la carte, voir le guide

Step 3 — Flash without bricking

• Pin header board (MDK V1.0): the final firmware is programmed by drag-and-dropping the hex file onto the DAPLINK drive, then pressing the Boot/Reset button. No bootloader manipulation is necessary.
• USB Dongle variant: it ships with a UF2 bootloader, but the Nordic DevZone documents devices being bricked after reflashing the bootloader hex via the drive — only touch the bootloader if the official procedure explicitly requires it.

Step 4 — Test the key

1. Plug in the board: it enumerates as a HID FIDO device (the native USB port, not the DAPLink).
2. Register it on a WebAuthn-compatible service (GitHub, Google, a test passkey server): the RGB LED serves as a presence indicator — touching it validates the operation.
3. Verify the configured PIN and countersignatures; development logs are available via the DAPLink's CDC port.

Honest limitations

• A home-built key has self-signed attestation: perfect for learning and self-hosting, but not for enforcing strong attestation in an enterprise environment.
• No certified secure element on the consumer MDK: consider the board a development platform, not an HSM.
• The project is evolving: pin an OpenSK release tag and keep the release aligned with the MakerDiary guide.