TheMaxMur/RS-Key v0.2.0 on GitHub

[0.2.0] — 2026-06-15

The cycle since 0.1.0. USB bcdDevice is now 0x0760 (incremented once per
firmware change along the way).

Own AAGUID + FIDO Metadata Statement. The authenticator reports its own
model identity (2479c7bf-6b30-5683-9ec8-0e8171a918b7, a reproducible UUIDv5)
instead of the inherited pico-fido one, and ships a self-published FIDO
Metadata Statement (metadata/rs-key.metadata.json) with a drift guard.
Supply-chain provenance. Releases now carry SLSA build provenance
(slsa-github-generator, keyless) and pass a release-time reproducibility gate
that rebuilds all eight flavors bit-identical before anything is published.
Dependency review. A cargo-vet gate (Mozilla / Google / ISRG / Zcash
audits + recorded exemptions) blocks new unreviewed crates; a new
docs/supply-chain.md documents the whole chain.
Versioned documentation site — main, develop and tagged versions are
published side by side with a switcher.
Kani proofs that the OpenPGP import (BER) parser is panic-free and
terminating, plus a CI guard that flake.lock stays in sync with flake.nix.

Every GitHub Action is pinned to a commit SHA, kept fresh by Dependabot.
The physical-attack posture docs are reframed around the published RP2350
hacking challenges (threat model / OTP fuses / limitations).

U2F routing. A vendor-AID SELECT over CTAPHID_MSG no longer leaves a sticky
applet selection that routed later U2F REGISTER / AUTHENTICATE / VERSION into
0x6D00; the MSG selection is dropped on every CTAPHID_INIT.
OATH performance. RESET / LIST / CALCULATE-ALL / lookup probed all 255
credential slots, and each absent slot rescanned flash; they now touch only
present credentials — OATH RESET dropped from ~39 s to ~0.5 s.
USB transport wedge. Bounding the CTAPHID/CCID IN-endpoint writes stops an
abandoned transaction from wedging the interface until a replug.
The OpenPGP card-status self-test now follows GET DATA response chaining.

Constant-time audit fixes — RSA base blinding on the raw path and
constant-time OTP access-code comparisons (docs/ct-audit.md).
Fault-injection fences on the PIN and secure-boot gates, so a glitched
single comparison can't skip the check.