This repository contains research firmware. It is not FIDO certified and has not received an independent security audit.

Use a commercial security key as the primary or recovery method for important accounts. Do not make this firmware the only authentication method for an account.

The release has two profiles. Standard leaves SWD access unchanged. Hardened installs a separate APPROTECT image:

1. On first boot it programs UICR.APPROTECT = 0 through NVMC.
2. It resets so hardware protection takes effect.
3. On nRF52840 configurations covered by Nordic erratum 249, it writes APPROTECT.FORCEPROTECT = 0 to lock the software branch for the current boot.

The Adafruit 0.11.0 bootloader used by this port predates Nordic's firmware-driven APPROTECT-disable support and does not write APPROTECT.DISABLE during startup.

Verification status: a target SuperMini upgraded from Standard to Hardened, cold-booted, and authenticated a credential created before the upgrade. Actual SWD readout rejection remains unverified because no SWD probe was available.

APPROTECT blocks direct debugger access. It does not make the device resistant to an attacker who can enter the stock Adafruit bootloader.

The stock bootloader exposes CURRENT.UF2 through USER_FLASH_END = 0xea000. That range directly includes the credential store at 0xda000..0xe0000. It also accepts unsigned nRF52840 application images across the whole window 0x1000..0xea000 — the SoftDevice region included — so a person with physical access can read the current store, replace OpenSK with firmware that reads it through the CPU, or silently corrupt the SoftDevice under an intact-looking installation. The current release therefore provides no verified secure-boot, anti-rollback, or physical-tamper boundary.

Physical hardening requires a separate bootloader design that removes application readback and accepts only authenticated firmware. Until then, APPROTECT is defense in depth against SWD readout, not protection against a hostile holder of the board.

UF2 application updates run on the CPU through the Adafruit bootloader and remain available while APPROTECT blocks SWD.

Once APPROTECT is latched by a reset, the nRF52840 refuses NVMC.ERASEUICR from the CPU (Product Specification, NVMC instruction table). No UF2 image can therefore undo APPROTECT: the only removal path is CTRL-AP ERASEALL over SWD hardware. For an owner without an SWD probe, enabling APPROTECT is permanent.

CTRL-AP ERASEALL removes APPROTECT but also erases:

• application firmware;
• the credential store;
• PIN state;
• UICR configuration.

Treat ERASEALL as factory reset, not as an upgrade operation.

The credential store occupies 0xda000..0xe0000. The runner reserves 0xd9f00..0xda000; production UF2 images must remain below 0xd9f00. Firmware upgrades preserve credentials only when:

• every UF2 block stays inside 0x26000..0xd9f00;
• the OpenSK store schema remains compatible;
• the user does not flash an erase or factory-reset image;
• recovery through ERASEALL is not used.

Each release must include a post-upgrade authentication test against a credential created by the prior release.

• Credentials are stored in internal flash without a separate secure element.
• Cryptography uses software implementations rather than nRF52840 CryptoCell.
• Physical side-channel and fault-injection resistance have not been evaluated.
• Clone hardware provenance and component substitutions are not controlled.
• The prebuilt firmware's exact tested board population is limited.

Open a private GitHub security advisory for the repository. Do not include credential material, recovery codes, PINs, or private relying-party data in a public issue.