$2 USB CRYPTO TOKEN FOR USE WITH GPG AND SSH

26. FEBRUARY 2018 DANMAN 40 COMMENTS

If you are interrested in security devices this post may be for you. Recently I�ve
found a software which makes a GPG security device out of a STM32. It�s called
Gnuk. You just need a compatible board, programmer, flash the firmware and you are
ready to go. I was just hoping to find some cheap device to flash to play with it.

My next condition was it has to come with nice casing � I won�t carry some
unprotected dev board in my pocket � ideally an USB key. Devices recommended in
project itself were either not available anymore or expensive or just plain boards.

Hardware
After a short research on google and aliexpress I found ST-link programmer clones.
They are very cheap, have nice aluminium case and should contain STM32F103. So I
ordered one. The advantage is that if you don�t have STM programmer, you can order
two and you will have everything needed.

When it came it looked very nice so I tore it right down:

It was a little disappointment when I saw the chip � STM32F101CBT6 (128kB flash). I
was afraid that I�ll need to port the software and moreover according to specs it
shouldn�t have USB phy so I though they bit-banged the USB interface. Then I found
one page where they discussed these devices and and they mentioned that in fact
they have USB and they are compatible with F103.

So I gave it a try.

Firmware
First I built the firmware:

danman@silverhorse:~$ git clone git://anonscm.debian.org/gnuk/gnuk/gnuk.git

Cloning into 'gnuk'...
remote: Counting objects: 11644, done.
remote: Compressing objects: 100% (3812/3812), done.
remote: Total 11644 (delta 8560), reused 10561 (delta 7749)
Receiving objects: 100% (11644/11644), 12.04 MiB | 1.69 MiB/s, done.
Resolving deltas: 100% (8560/8560), done.
danman@silverhorse:~$ cd gnuk/
danman@silverhorse:~/gnuk$ git submodule update --init
Submodule 'chopstx' (git://anonscm.debian.org/gnuk/chopstx/chopstx.git) registered
for path 'chopstx'
Cloning into '/home/danman/gnuk/chopstx'...
Submodule path 'chopstx': checked out '87767f1be5d8d4adac8d23a285250299eccee3fb'
danman@silverhorse:~/gnuk$ cd src/
danman@silverhorse:~/gnuk/src$ ./configure --vidpid=234b:0000 --target=ST_DONGLE
Header file is: board-st-dongle.h
Debug option disabled
Configured for bare system (no-DFU)
PIN pad option disabled
CERT.3 Data Object is NOT supported
Card insert/removal by HID device is NOT supported
Life cycle management is NOT supported
danman@silverhorse:~/gnuk/src$ make
mkdir -p build

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/main.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/main.o.d -I. -I../polarssl/include
-I../chopstx main.c -o build/main.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/call-rsa.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/call-rsa.o.d -I.
-I../polarssl/include -I../chopstx call-rsa.c -o build/call-rsa.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/mcu-stm32f103.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/mcu-stm32f103.o.d -I.
-I../polarssl/include -I../chopstx mcu-stm32f103.c -o build/mcu-stm32f103.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/usb_desc.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/usb_desc.o.d -I.
-I../polarssl/include -I../chopstx usb_desc.c -o build/usb_desc.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/usb_ctrl.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/usb_ctrl.o.d -I.
-I../polarssl/include -I../chopstx usb_ctrl.c -o build/usb_ctrl.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/usb-ccid.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/usb-ccid.o.d -I.
-I../polarssl/include -I../chopstx usb-ccid.c -o build/usb-ccid.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/openpgp.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/openpgp.o.d -I. -I../polarssl/include
-I../chopstx openpgp.c -o build/openpgp.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/ac.lst -mthumb -mno-
thumb-interwork -DTHUMB -MD -MP -MF .dep/ac.o.d -I. -I../polarssl/include
-I../chopstx ac.c -o build/ac.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/openpgp-do.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/openpgp-do.o.d -I.
-I../polarssl/include -I../chopstx openpgp-do.c -o build/openpgp-do.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/flash.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/flash.o.d -I. -I../polarssl/include
-I../chopstx flash.c -o build/flash.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/bn.lst -mthumb -mno-
thumb-interwork -DTHUMB -MD -MP -MF .dep/bn.o.d -I. -I../polarssl/include
-I../chopstx bn.c -o build/bn.o
arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections
-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/mod.lst -mthumb -mno-
thumb-interwork -DTHUMB -MD -MP -MF .dep/mod.o.d -I. -I../polarssl/include
-I../chopstx mod.c -o build/mod.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/modp256r1.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/modp256r1.o.d -I.
-I../polarssl/include -I../chopstx modp256r1.c -o build/modp256r1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/jpc_p256r1.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/jpc_p256r1.o.d -I.
-I../polarssl/include -I../chopstx jpc_p256r1.c -o build/jpc_p256r1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/ec_p256r1.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/ec_p256r1.o.d -I.
-I../polarssl/include -I../chopstx ec_p256r1.c -o build/ec_p256r1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/call-ec_p256r1.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/call-ec_p256r1.o.d -I.
-I../polarssl/include -I../chopstx call-ec_p256r1.c -o build/call-ec_p256r1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/modp256k1.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/modp256k1.o.d -I.
-I../polarssl/include -I../chopstx modp256k1.c -o build/modp256k1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/jpc_p256k1.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/jpc_p256k1.o.d -I.
-I../polarssl/include -I../chopstx jpc_p256k1.c -o build/jpc_p256k1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/ec_p256k1.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/ec_p256k1.o.d -I.
-I../polarssl/include -I../chopstx ec_p256k1.c -o build/ec_p256k1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/call-ec_p256k1.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/call-ec_p256k1.o.d -I.
-I../polarssl/include -I../chopstx call-ec_p256k1.c -o build/call-ec_p256k1.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/mod25638.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/mod25638.o.d -I.
-I../polarssl/include -I../chopstx mod25638.c -o build/mod25638.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/ecc-edwards.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/ecc-edwards.o.d -I.
-I../polarssl/include -I../chopstx ecc-edwards.c -o build/ecc-edwards.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/ecc-mont.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/ecc-mont.o.d -I.
-I../polarssl/include -I../chopstx ecc-mont.c -o build/ecc-mont.o
arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections
-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/sha512.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/sha512.o.d -I. -I../polarssl/include
-I../chopstx sha512.c -o build/sha512.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/random.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/random.o.d -I. -I../polarssl/include
-I../chopstx random.c -o build/random.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/neug.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/neug.o.d -I. -I../polarssl/include
-I../chopstx neug.c -o build/neug.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/sha256.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/sha256.o.d -I. -I../polarssl/include
-I../chopstx sha256.c -o build/sha256.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -g -Wall -Wextra -Wstrict-prototypes -Wa,-

alms=build/bignum.lst -mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF
.dep/bignum.o.d -I. -I../polarssl/include -I../chopstx ../polarssl/library/bignum.c
-o build/bignum.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/rsa.lst -mthumb -mno-
thumb-interwork -DTHUMB -MD -MP -MF .dep/rsa.o.d -I. -I../polarssl/include
-I../chopstx ../polarssl/library/rsa.c -o build/rsa.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/aes.lst -mthumb -mno-
thumb-interwork -DTHUMB -MD -MP -MF .dep/aes.o.d -I. -I../polarssl/include
-I../chopstx ../polarssl/library/aes.c -o build/aes.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/entry.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/entry.o.d -I. -I../polarssl/include
-I../chopstx ../chopstx/entry.c -o build/entry.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/chopstx.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/chopstx.o.d -I. -I../polarssl/include
-I../chopstx ../chopstx/chopstx.c -o build/chopstx.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/eventflag.lst -mthumb
-mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/eventflag.o.d -I.
-I../polarssl/include -I../chopstx ../chopstx/eventflag.c -o build/eventflag.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/sys-stm32f103.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/sys-stm32f103.o.d -I.
-I../polarssl/include -I../chopstx ../chopstx/mcu/sys-stm32f103.c -o build/sys-
stm32f103.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/usb-stm32f103.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/usb-stm32f103.o.d -I.
-I../polarssl/include -I../chopstx ../chopstx/mcu/usb-stm32f103.c -o build/usb-
stm32f103.o

arm-none-eabi-gcc -c -mcpu=cortex-m3 -O3 -Os -g -ffunction-sections -fdata-sections

-fno-common -Wall -Wextra -Wstrict-prototypes -Wa,-alms=build/adc-stm32f103.lst
-mthumb -mno-thumb-interwork -DTHUMB -MD -MP -MF .dep/adc-stm32f103.o.d -I.
-I../polarssl/include -I../chopstx ../chopstx/contrib/adc-stm32f103.c -o build/adc-
stm32f103.o

arm-none-eabi-gcc build/main.o build/call-rsa.o build/mcu-stm32f103.o

build/usb_desc.o build/usb_ctrl.o build/usb-ccid.o build/openpgp.o build/ac.o
build/openpgp-do.o build/flash.o build/bn.o build/mod.o build/modp256r1.o
build/jpc_p256r1.o build/ec_p256r1.o build/call-ec_p256r1.o build/modp256k1.o
build/jpc_p256k1.o build/ec_p256k1.o build/call-ec_p256k1.o build/mod25638.o
build/ecc-edwards.o build/ecc-mont.o build/sha512.o build/random.o build/neug.o
build/sha256.o build/bignum.o build/rsa.o build/aes.o build/entry.o build/chopstx.o
build/eventflag.o build/sys-stm32f103.o build/usb-stm32f103.o build/adc-stm32f103.o
-mcpu=cortex-m3 -nostartfiles -Tgnuk.ld -Wl,-Map=build/gnuk.map,--cref,--no-warn-
mismatch,--gc-sections -mthumb -mno-thumb-interwork -o build/gnuk.elf
arm-none-eabi-objcopy -O binary build/gnuk.elf build/gnuk.bin