KeyRing

Another year & yet again this project has fallen to the wayside. Revamping it for this year, moving away from the wristband & focusing on a sleek ring that's sole functionality is authentication. I already have the microcontroller I want to use, testing key generation this month.

The evaluation kit has arrived! This next week I plan on generating an ECC key on the device & writing a simple program that will retrieve the public key from the device, issue authentication challenges, receive the responses from the device, & determine if valid. Once this is complete, the next step is to implement this back-and-forth over a Bluetooth connection.

After doing more research into the secure authentication IC marketplace, I have decided to move away from my original plan of a secure element -- essentially a tamper resistant microcontroller that usually runs some kind of JavaCard operating system. The advantage of the secure element implementation was that current JavaCard apps like Visa Paypass could be integrated into the project but I decided that the secure elements were to secretive & hard to get ahold of & more of a headache than I think they are worth. Also they introduce extra layers of complexity that I believe increase the probability of a security issue.

What am I considering using now you might ask. Good question! Well, I wanted a small footprint, extremely low powered IC with anti-tamper mechanisms that is made to efficiently carry out Elliptic Curve Digital Signature Algorithm (ECDSA). Also two other vital features I was looking for were availability (no sense in finding the perfect chip if I can't get my hands on it) & a good & affordable dev kit. With these features in mind, my searching lead me to the Atmel ATECC108A. I think it is a perfect fit for the project & ordered the evaluation kit the other day. I should have some preliminary results up in about two weeks & if all goes well, I will get the dev kit (more expensive so wanted to use the much cheaper eval board first) & start building my first prototype!

I came up with this idea over a year ago & when the Hackaday Prize contest was launched around that same time, I was motivated to actually start looking into making my idea a reality. Although I was able to more concretely lay out my idea, I did not have the time or resources to being development. Now with the 2015 Hackaday Prize in full swing, I have decided to reapply myself to the project & make some good progress towards an idea I truly believe in.

At first, I wanted to use NFC so that batteries would not be an issue but seeing as NFC is not making its way into US mobile devices as fast as I thought, BLE is a promising alternative. BLE is very convenient with its power usage & I am aiming to hopefully be able to have the finished product last for 2-3 years on its battery, possibly by employing flexible batteries (to be looked into!).

There is a lot of work to be done in this department & it is pretty far out of my expertise but there is a surprising amount of projects out there which track heart rate. I will utilize these projects along with pattern matching algorithms in order to create a system to validate a user based upon their heart-rate.

Choosing a secure element is the toughest part of this project. All the popular ones, (NXP, Infineon, etc) are proprietary & go against the openness of the project & therefore can not be used. In order to keep the openness of the project, I have chosen to base my secure element design off of work done on cryptocores over at http://opencores.org/projects.

The design should be very minimal as to keep the attack surface as small as possible. Also, best practices for side channel & tamper resistance will need to be included.

For the Bluetooth module, I decided upon the Nordic Semiconductors nRF8001. The nRF8001 is an affordable Bluetooth v4.0 low energy IC with the ability to run off of coin cell batteries for years. It also seems to be the most widely utilized in the community which will make it much easier to work with.