Is there any new Nitrokey hardware series being planned that addresses the previous gaps?
Especially the incomplete use of the secure element by the current firmware and the fact that the crypt ship is still proprietary and with known weaknesses (closed source, no protection for fido2 credentials,CVE-2022-22819 Secure boot bypass) makes me wonder if those issues will be addressed in the future.
Nitrokey 3 uses SE050 e.g. for OpenPGP. This MCU does not seem affected by the CVE. FIDO2 material is stored in the flash of the LPC55 and is software encrypted. The update is done using nitropy or the Nitrokey App and does double verification in the app and the controller before flashing it. A malicious user with direct access could try to upload a modified firmware to either capture the PIN input or bypass retry counters to brute-force the PIN. Cloning the actual cryptographic material remains difficult as it is encrypted with a unique device key stored in read protected memory. The threat model for most FIDO2 users most likely is against phishing and credential stealing which would still be upheld.
While I also like a fully open source MCU for security related operations, such controllers also could eventually be faced by a CVE targeting the update mechanism that cannot be solved once deployed in the field.
If I would need to speculate, I would think that Nitrokey would add a second chip as fall-back or user choice similar to how it is done today. But how many chips can be added to still have an economic design.
FIDO2 material is stored in the flash of the LPC55
Which is exactly the problem; Unless the PIN verification and decryption is bound to the hardware level restrictions (3 attempts) the entire security of the encryption hangs on the complexity of the pin.
And while a smart card protected 4 character PIN can easily provide comparable security then a 20 character encryption password (or a 128bit random key), the fallback to PIN=secret means that it can be effectively broken in milliseconds. And yes that still requires hardware access to read the flash, but that is not that hard either and determining if this is a problem comes down to the threat model.
So in a time where A) more and more encryption services use the FIDO2 (hmac-secret) as encryption key (as it is intended) while B) the world moves further towards total surveillance, how many users may want to rely on this for protection against unlawful searches etc.?
As it is now, I dont see any meaningful protection of the FIDO2 secret data on a Nitrokey against physical extraction, and as far as I understand it the SE050 is affected by the CVE as well, so the question can potentially be extended to all secret data.
