This project is based on Mycropython running on a RP2040. The navigation will be a d-pad with select in the center. Time will be kept by a DS3231 RTC chip. As this is a project with no wireless connectivity, and this is a protocol that relies heavily on time being correct between the client and server, I want the time to be stable.

For storing the TOTP tokens, I'm thinking of using the file format that KeePass2 uses. That way, you can transfer them to devices easily with whatever derivative of KeePass that you like. My concerns are the length of time it'll take to decrypt the vault files (especially at the highest level you can set), and an ergonomic way to enter passwords if one desires something more complicated than a pin. I want to figure out encrypted storage in the future as an extra layer, but for right now I want to utilize the microSD slot on the ST7789 TFT breakout Adafruit offers.

In regards to protecting the code on the RP2040, I found out the boot.py file has the ability to lock the local storage. I'm thinking of allowing the user to set a pin to unlock the local storage. I also have an idea of compiling the program akin to a library and then having that run the show as an extra layer of obfuscation. Don't know if that's possible yet.

The (hopeful) final form will be a compact card that you can slide in your wallet. I know that is super ambitious, so for now I want to get my PoC on a breadboard working, then figure out the best way to smush the breakout boards together onto one PCB for a true device.

I'd like to use a lower level language at some point, but I'm the most familiar with Python at this point.

A lot of my knowledge on how TOTP works comes from a very helpful blog by [Hendrik Erz].