Cardea Key

An open security key, in the making.

“Her power is to open what is shut, to shut what is open.”
Ovid, Fasti VI, on Cardea, Roman goddess of hinges and thresholds

What it is

Cardea Key is an open-source hardware security key that brings together, in a single device, what today usually needs several:

FIDO2 / WebAuthn passkeys and U2F, for phishing-resistant sign-in;
OpenPGP, for signing, encryption and SSH;
PIV smart-card certificates, for VPNs, TLS client auth and code signing;
OATH one-time codes (TOTP/HOTP).

The goal is a key whose secrets live in a dedicated secure element rather than in the microcontroller's flash, with a PIN counted by that chip and a fingerprint unlock bounded in time.

Status

Early development. A unified firmware prototype runs on a Raspberry Pi Pico 2 (RP2350) and passes our first FIDO2, OpenPGP, PIV and OATH tests. The secure element and the fingerprint sensor come next; custom hardware comes last.

There are no releases yet, and the prototype is not meant to hold real credentials. The source code will be published under the AGPL-3.0 once it is ready.

Built on

The firmware builds on pico-fido, pico-openpgp and pico-keys-sdk by Pol Henarejos (AGPL-3.0). Cardea Key is an independent project, not affiliated with PicoKeys, Yubico or Raspberry Pi Ltd.