Authuino

What is it?

Authuino is an open-source handheld authenticator appliance. It is capable of standalone operation, so that PINs and keys never touch a potentially compromised host. It is capable of securely storing cryptographic keys and displaying TOTP codes for 2 Factor Authentication (2FA). It is also capable of functioning as a typical USB smart card reader on most Windows, MacOS, and Linux hosts without any additional driver installation.

What is it not?

Despite FIDO2 and PIV displayed in the menu, as of writing, these are stubbed for development with PIV planned to be dropped. The roadmap for this project includes managing FIDO2 credentials and X.509 certificates for two use cases: PKI agent authentication and establishing an offline certificate root. Functionality to manage smartcard-based cryptocurrency wallets and facilitate transactions is in consideration.

How does it work?

A smart card is inserted into the bottom of the unit and if a compatible JavaOS applet is detected on the card, the TOTP option appears on the screen. The applet is then unlocked with the PIN if set. Keys can be added with a QR code generated by the issuing service via the camera on the top edge of the device. Keys remain on the card and can be deleted but not exported, as set by the applet’s policy. TOTP codes are then generated by the smart card and displayed onscreen.

How do I make one?

The source code is available on GitHub and a complete how-to writeup with PCB and CAD files is on the way. I also intend to sell manufactured parts on this site following that publication.