patvdleer
commented
4 years ago FYI I did the following to try and setup the FIDO.
That is the bundle.hex from solo program dfu bundle.hex above I uploaded.
git clone --recurse-submodules https://github.com/solokeys/solo.git
cd solo
VERSION_TO_BUILD=3.1.1
git checkout ${VERSION_TO_BUILD}
git submodule update --init --recursive
cd targets/stm32l432
make cbor
make build-hacker
cd ../..
solo key rng raw > seed.bin
curve=prime256v1
country=NL
state=XXX
city=XXX
organization=XXX
unit="Root CA"
CN="Patrick XXX"
email=pat.vdleer@XXX.com
# generate EC private key
openssl ecparam -genkey -name "$curve" -out root_key.pem -rand seed.bin
# generate a "signing request"
openssl req -new -key root_key.pem -out root_key.pem.csr -subj "/C=$country/ST=$state/O=$organization/OU=$unit/CN=$CN/emailAddress=$email"
# self sign the request
openssl x509 -trustout -req -days 18250 -in root_key.pem.csr -signkey root_key.pem -out root_cert.pem -sha256
# convert to smaller size format DER
openssl x509 -in root_cert.pem -outform der -out root_cert.der
# print out information and verify
openssl x509 -in root_cert.pem -text -noout
# generate EC private key
openssl ecparam -genkey -name "$curve" -out device_key.pem -rand seed.bin
# generate a "signing request"
openssl req -new -key device_key.pem -out device_key.pem.csr -subj "/C=$country/ST=$state/O=$organization/OU=$unit/CN=$CN/emailAddress=$email"
# sign the request
openssl x509 -req -days 18250 -in device_key.pem.csr -extfile v3.ext -CA root_cert.pem -CAkey root_key.pem -set_serial 01 -out device_cert.pem -sha256
# convert to smaller size format DER
openssl x509 -in device_cert.pem -outform der -out device_cert.der
# Verify the device certificate details
openssl x509 -in device_cert.pem -text -noout
echo 'challenge $RANDOM' > chal.txt
# check that they are valid key pairs
openssl dgst -sha256 -sign device_key.pem -out sig.txt chal.txt
openssl dgst -sha256 -verify <(openssl x509 -in device_cert.pem -pubkey -noout) -signature sig.txt chal.txt
openssl dgst -sha256 -sign "root_key.pem" -out sig.txt chal.txt
openssl dgst -sha256 -verify <(openssl x509 -in root_cert.pem -pubkey -noout) -signature sig.txt chal.txt
# Check they are a chain
openssl verify -verbose -CAfile "root_cert.pem" "device_cert.pem"
python3 print_x_y.py device_key.pem
# solo mergehex --attestation-key "b26443XXXXXXXXXXXXXXXXXXXXXXXXXXXX" --attestation-cert device_cert.der --lock solo.hex bootloader.hex bundle.hex
lf94
conorpp
while trying to setup FIDO via the links below the following happened.