Securing offline passwords with Atmel MCUs

Over the past few months, Bits & Pieces has featured a number of DIY offline password keepers built around Atmel microcontrollers (MCUs).

First up is the official HackADay Mooltipass. Powered by Atmel’s ATmega32U4, the device is equipped with an easily readable screen, a read-protected smart-card (AT88SC102) and flash memory to store encrypted passwords.

Next up is the USBPass. Designed by a Maker named Josh, the platform comprises an ATmega32U2 MCU, USB connector, three buttons and a few passives chips. Like the Mooltipass, the USBPass is connected to a computer via USB and read as an HID keyboard.

The latest Atmel-powered offline password keeper to surface in the Maker community and on the HackADay website? Cyberstalker’s ATMega32U4-packing Final Key, which includes a single button and LED, all neatly enclosed in a 3D printed case.

According to HackADay’s Mathieu Stephan, the Final Key is linked to the host computer via USB and recognized as a composite comm device/HID keyboard, requiring Windows-based devices to install drivers.

“AES-256 encrypted passwords are stored on the device and can only be accessed once the button has been pressed and the correct 256 bit password has been presented through the command line interface,” Stephan explained. “Credentials management and access are also [executed by] the latter.”

Interested in learning more about the ATMega32U4-powered Final Key? You can check out the project’s official page here.

Storing passwords with the ATmega32U2

Earlier this month, the HackADay crew confirmed that it had chosen Atmel’s ATmega 32U4 microcontroller (MCU) to power an offline password keeper known as “Mooltipass.”

As it turns out, a Maker by the name of Josh is working on a similar offline password keeper, albeit with an ATmega32U2 instead of the 32U4.

Like the Mooltipass, the USBPass is connected to a computer via USB and read as an HID keyboard. Aside from the ATmega32U2, the platform is equipped with a minimal amount of components, including a USB connector, three buttons and a few passives chips.

“A total of 20 passwords can be stored in the microcontroller’s memory, which can be ‘typed’ by the platform using the push buttons,” explained HackADay’s Mathieu Stephan.

On the software side, the USBPass firmware is based around the LUFA USB stack, to which Josh added HID report functionality to facilitate data transfer from his desktop application.

“The latter uses the Linux/Windows/OS X HID API library so bringing his software to other operating systems can be done in no time,” Stephan added.

Although the current version of the USBPass is pretty sweet indeed, Josh says he is working on a second iteration of the platform which will likely boast an OLED screen.

Interested in learning more about the Atmel-powered USBPass? You can check out the project’s official page here and the relevant GitHub files here.