usb-public-token

Raspberry Pi Pico (RP2040) firmware for a USB vendor-class device that hands a host an Ed25519 public key baked in at build time.

Cexperimentalrp2040 · usb · ed25519 · firmwarehardware & security source on github

Why

A reference implementation of a “root-of-trust token”: a physical device whose only job is to give the host a known public key over USB.

How

Pico SDK and TinyUSB, vendor class 0xFF. Two commands: GET_KEY returns a length-prefixed DER key, GET_INFO returns protocol version, key type and length.
The key is a 44-byte DER SubjectPublicKeyInfo, turned into a C header at build time by tools/generate_key.sh.
A pyusb script reads the key back from the device and compares it with the source.
CI builds release and debug .uf2 images.

Limits

It transports a public key only — no signing, and the key is readable from flash. Secure boot, readout protection and attestation are listed as what a production version would need. Many of these ideas grew into OpenHSM.

make build && make flash && make test
python3 tools/test_device.py --verify-json testkey.json

$ git clone https://github.com/zombocoder/usb-public-token

← all projects