Build Your Own Security Key (and take it home!) | Satochip | Common S3nse - 2026

[music] I was told it was a workshop with a lot of people and laptop and so on. So I need to change my presentation uh at the very last minutes. Sorry. So today um I will present you how to build your own security key. So just a very first question um who is using uh Pasi here.

Okay so you know what's Pasi is and who is using OTP codes. So the six okay so you are uh in good hand here because I will explain you how to create your very own security keys. So you will be able to generate OTP codes from your device and you will be able to store all the pass keys within your device. So it means you don't have to rely on your phone or on your laptop or on any other unsecure devices. So just a bit uh about the presentation I will uh talk about opensource solution but of course there is no fully open-source solution on the market.

If you are using a UB key, everything is closed source from the secure element to the code running onto the devices. There is no opensource secure element on the market. So I'm saying it's an open-source uh solution, but it's not everything open source on the solution and I will explain the trade-off a bit later. So my name is Bastian. I'm the CEO of Socip.

It's a Belgium company. We do provide hardware security solution based on the smart cardart technology. Uh everything we are doing is completely open source. At the end of the presentation I will show you uh our GitHub repository. Um what we are doing is servers.

You have no account needed no subscription no KYC. Uh it's uh the cipher punk way. Um you can build uh everything we are doing by your own including the mobile application or the desktop application if you want to use your hardware security key. And recently one of our product called seat keeper pro uh passed the Fedo2 certification which means the code you can find online has been certified. Of course, if you are loading it yourself, it doesn't come with a certification.

But if you buy the product from our company, it's uh certified by the Fido aliens. So the question is what is a security key? So it's not a USB stick, it's not a computer, it's not a phone. It's a device that is designed to hold cryptographic secrets. It could be a password, a Pasi token, a OTP code and so on.

Basically, a secret goes in the security in the security key which is equipped with a sec secure element and nothing can be exported from the security device. Which means if you store a Bitcoin private key inside a secure element, you cannot export it again. You can only use these secrets to do some cryptographic stuff. for example, signing a transaction. It's not disabled by default.

It's how it works. In a security key, you have four layers. Um, two of those layers are not open source and there is nothing on the market that is open source for those two layers unfortunately, but we try to mitigate the risk of using a proprietary solution. the secure elements. So the temperproof memory [snorts] is uh from NXP in our case and it's a cheap vendor.

So it it's not open source. The operating system running on top of the secure element is called the Java Kart virtual machine and it's not open source neither which means you have to trust the operating system running on top of your hardware. But at sip we are working on the two uh other um layers which are the applets. So the applet is the code that run on top of uh the java cart virtual machine and will perform all the transaction with your secrets. And we are also dealing with the keys which means when we are uh uploading something onto the cart we uh give you the guarantee that everything is secure locked and uh cannot be tempered while in transit for example uh no supply chain attack and so on.

So these are the four layers of the security keys. Another thing to to get in mind uh a security key is not something that will save you from everything of course but it will save you from some very important thing. For example, if you are using a security key it could be a UB key for example or one of our product. It's impossible to extract the information. I told you earlier it's based on a secure element.

That means if you put something inside the secure element and you ask the software not uh to do anything else, it remains onto the secure element. It's temperroof and side channel resistant. You are also uh protected uh from the fishing attack. A fishing attack is when you try to login, for example, on Google, but you didn't read the the domain name correctly and you have a fishing uh login page that ask you your credentials. If you type your credentials and press the it button, your credentials are uh hacked.

Um so using a security key with for example the pass key tokens uh prevent you from being fished. Of course, if you are using a security key, you are also immune from any breach. In France from from example, for example, uh we had seen a lot of breach recently. Uh all the datas of all the people, French people are now online, accessible online. So if you are storing something inside uh a security key, you are sure that uh it won't be exposed on the internet.

and it's an offline vault which means everything stored inside cannot be accessed outside of the environment. The cons if you have a security key and if you lose it you lose the content. So be sure to have a backup. Be sure to have a backup procedure. Be sure to have multiple security key with your pass key token or your password stored.

Otherwise, you may lose everything because there is no recovery process from a security key. And of course, if someone is um holding your security keys and your personal pin code, the pin code is needed to open the the memory of the security key. Of course, if the guys the attacker have both, you are completely screwed. So, why is it important to have a security key and what are the trade-off? Um, basically at SACIP, we decided to use the smart card technology.

So, the smart card is not a product, it's a specification. You can have the smart card technology into uh you can have sorry a Java card technology into a smart card. You can have it in a SIM card in your passport on an NFC ring like this one. It's also Java cart uh embedded and it's widely available which means you can buy a compatible smart cart online on Amazon by yourself and it's just the price of a small cheeseburger. you you can have a secure element for less than €10.

Um, so yes, it makes the device the the cheap part and and the code that you will build on top of the the device will be the the open source part and the most important part. There is an argument uh by using Java cart because it's uh supplied by dozen of well-known manufacturer including NXP, including uh Samsung. Um so you can have the smart card available worldwide. If you are in the Netherlands, if you are in Belgium, if you are from um Africa or any other country, it's quite easy to get a smart card in your mailbox. You don't have to sign any KYC.

You don't have to sign any agreement any NDAs to use a Java card. You just have to be sure that it's a compatible one because there are some specific uh cryptographic library store inside the secure element. If you know what you are buying, you can uh easily find one. The opensource part is also very important because as you are using something that will store your most val valuable secrets. It could be your main uh Gmail account password.

It could be the token uh to access your Binance account or any other important platform. It's important to know how your secrets will be uh used uh how the secure element will handle those secrets. And that's why we decided to fully open source all our applets. So you are able to check what's run inside the product and also you are able to build the applet by yourself optionally um improve it and then load it onto the Java card you can buy online. So there is no trust uh on the company there is no trust on the code needed.

You just download it, compile it and you can embed it into the the Java card, the smart card. It's not a trade-off because uh there are many uh other vendor on the market that are either offering secure element with uh nonopensource code for example UB key. There are vendors that are offering open-source code but with no secure element. For example, they are using MCU but MCU is just an open chip which means if I can get access to the MCU I can extract the information uh that is stored inside the MCU. We are providing the best of both world meaning there is a secure element with the open source code and this is an acceptable trade-off in my point of view.

Another thing very important um is that our code can be um is reprodictable. So you don't have to trust what we are providing online. Uh we have of course the cap file ready to be loaded into a Java cart. But we also offer all the code and all the documentation for you to be able to build it by yourself. That's a very important point because many of other uh vendors or other uh company uh said that the code is open source but there is no way to reproduce it by your own.

So if you are buying a product from uh such company you're not sure that the code that is loaded inside a product is the code that is provided to you online. with us you have the full uh reproductibility. So now I will enter the the tech part. So the goal of this workshop is to give you all the information for you to build uh a Java card uh as a security key when you are at home. So there are two big pillar on the product I will explain uh to you.

The first one is uh the password manager. So it's very useful to have a password manager on the security key because anyone here at least have one very important passwords. Maybe the one of your keypass, maybe the one of your uh bit warden account, the master key of uh another vault, maybe your bitcoin passphrase. Those are very important secrets that you don't want to see on the cloud. So that's why you need a security key.

Um, of course uh I explained it um previously and I will explain it later. Uh everything is protected by a pin code. So even if someone get access to your security key, they won't be able to extract any information without the pin code. So this is the first pillar. Uh yes, with the password manager we have implemented you can uh back up any credentials.

It could be a login, a password, a passphrase, a bitcoin seed phrase, any other cryptocurrency seat phrase. You can also put uh sensitive notes if you want. So it act let's say like a USB stick but but with all the security uh that is required for a security key. uh it's not designed to store hundred of passwords. It's not designed to replace your keypass.

It's not designed to replace your Bit Warden and vault because it's not the same convenience. You can use it with your mobile phone of course, but you have let's say um the capacity of 100 passwords uh not more. So it's let's say for your most valuable secrets um that you can use this kind of security key. The second pillar is the access management because this is by far the most uh interesting problems nowadays. Um we are asking people to have very strong passwords.

So if you are working in a company uh the first thing they ask you is to have a 10 or 14 char passwords then you need to download uh an OTP application to generate a new OTP code and at the end you reduce your overall security by just providing your face to unlock your computer and it's a real trade-off. We need to find solution that allows people to easily use their passwords to access uh something to access a website to access a web service to access a wallet. So uh the access management part uh is split it in in two part. The first one is the Fedo applets that will grant you all the pass key functionalities that which means you are fishing resistant. You can log into any website that support pass key just by tapping your device behind your phone.

And uh I explain a bit about the fishing but this is a representation. Um the website will store a pass key token inside the security key with the valid domain. So if you are logging to Gmail account to your Gmail account, Gmail will store the PSI token only for the gmail.com domain. which means if a fishing website tries to uh try to ask you to to sign or to login using your basket tokens uh it won't pass through because it's not the same domain.

And the second one is the OTP code. So uh a lot of people are using Google authenticator, Microsoft authenticator on their mobile. It's great but if you lose your phone again you lose everything but also the token are stored inside a device that is always connected uh to internet and that is uh that has a bigger attack surface rather than a security key. So with the third the third applet uh we implement the OTP functionalities that will allow you to generate OTP codes from the security device which is very interesting when you are traveling for example you can use your OTP accounts with any other devices no need to have your phone you can use your friends phones you can use uh another laptop because the secrets are stored inside the smart card or inside the ring and you can use it out of the box uh with the NFC technology uh inhouse. We call this product the seat keeper pro.

So it embed all the functionalities and um we will explain all the applets. So the seat keeper applet this is the the password manager part. It will take care of all your credentials. The OTP applet is the one that will generates all the OTP codes uh based on time. And the Fedo applet uh is where you can have discoverable pass keys up to uh 100 pass keys stored inside a device and you can use it uh to log into any website.

Those three applets are running on the security key. They share the same memory but they are living their own life inside the secure elements. So even if one is compromised for I don't know which reason but if one is compromised the other are not. Um in the Java card ecosystem uh so uh the Java card is the operating system running on top of the secure element uh the command line that that you use to interact with uh the secure element are called APDU. And for those who uh are um coders uh this is a simplified explanation about how we deal with interaction with the secure element.

So as you can see it's quite uh simple um because you just have to ask uh your secure element to do something. For example, you just have to ask import secrets. It's a one common line that allows you to import uh the secrets that is displayed by the user inside the secure element for the password manager. You can also optionally export the secrets because obviously you need to read it. So this is only for the password uplets but for the fido and the OTP you cannot export anything from the memory.

There are also some uh security measure because some people might ask okay what if I'm trying to listen the communication between the smart card and the device uh when you start a communication between a device and the smart card there is a secure channel that is uh started between both parties. So even if you can try to act the NFC communication between both devices, you won't be [clears throat] able to listen to the communication uh because of this secure channel. And of course there is a pin that protect access to the memory which means if you don't provide the right pin code, you cannot unlock the memory. Regarding the OTP, it's also a simplified excerpt of what we are doing. But basically uh we ask um basically the the service is asking the card to store a random uh ash into the smart cart that will then be used to generate codes based on time.

So every 30 seconds the code will change and every 30 seconds you will have to scan your device again. uh to generate the code. A few words about the Fedo2 implementation. Uh in this case we are Fedo certified. So um at the level one which means the whole uh application uh comply with the fido aliens uh rules and all the discoverable uh tokens are stored uh inside the resident key vault uh of the memory.

So whenever you need a new uh pass key token, you can instantly load it inside uh the security key and whenever you want to use it, if you provide the right pin code, you can get access to your uh basket token. A bit about the usability. Um devices I show you a smart card. It could be also a smart ring like this one or all NFC enabled, meaning you can use it with your mobile phone just by tapping the cart or the device on the back of the phone, but you can also use it with a laptop using a smart card reader or a NFC reader, which is great because you can use your security key with barely all the devices out there. We have mobile application that are also open source.

It's a bit of business uh I convince but um you can download them but you can also check the code on GitHub because as I told you everything uh we are doing is completely open source. Uh yes uh one word about the CAP file. If you want to go deeper into the Java card process and build uh all this stuff by your own um you just need to remember that the cap file is like the program that will run uh the functionalities described previously. So the password functionalities, the Fedo functionalities and the OTP functionalities and each of those program uh have has a signature. It's called a a UID.

So you can also check that when you are loading a cap file into a security devices, you can also check that this is the right one and not a temper um a temper uplet. So now that's the most for me the most interesting part because I will explain you in nine minutes but it will take way less because it's very very easy uh to create your own security keys. I will show you how to do that. Uh what you need is a blank Java card or a blank NFC ring compatible one. We are using uh the G3R uh 180 coming from NXP.

You can find this kind of Java card online for let's say€ 10 or so. Uh so this is by far the most affordable security key on the market. You will also need a smart card reader. uh any smart card reader on the market will work uh to be able to plug it on your computer and then load the cap file inside uh the Java card. So it's about€ 10 euro online.

So now we are at uh 2025 euro and on the software part the only thing you will uh need to be able to to do that is Java. If you can run Java on your machine uh you can uh create your own security key in less than 10 minutes. There is no tool chains, no compiler, no NDA, no account except the GitHub account if you want to fork or uh get the code there. Nobody's permission. You are the only one that can create your own security key for your own business.

There is one tool called uh global platform. Um abbreviation is GP. Um, it's a tiny uh software that will allow you to load the CAP file into the smart card. It's the interface between your computer and and the smart card. Another thing is the factory key.

I will explain it just a bit later. The factory key um is uh this one. So, this is a universal factory key. If you are buying online a Java card, ask the vendor if the card is with the factory key. Otherwise, you won't be able to load any applet onto the cart.

So, this is very important. There are a lot of vendor online on Alibaba, Amazon and so on that doesn't even understand the whole concept of the Java cart and they are trying to sell you uh do it yourself Java cart and when you get it you are not able to load anything. you will see you you hit the enter button. They will try this key and say it's not the locked key so I won't be able to load anything onto the device. The only thing you can do is return the Java card to the vendor and ask a new one.

So this is uh quite important to ask if you want to buy it by yourself. Then there are a few sanity check you can do if you buy a card. So you plug the card into your smart card reader. You open a terminal. Uh you have the global platform application uh you can use and then using global platform you will hit the the Java jar GP jar info and you will have all the information about the smart card.

A smart card um has little memory, but if you see something different from the data sheet, it's uh the first warning. The second one is regarding what is already installed into the Java cart because of the uh factory key. That means anyone can install something onto the Java cart without you know it. So it's very important to check what's inside a Java cart before doing anything else. Uh online you will find a lot of um databases showing uh which cap file has uh um which ID.

So you can also see okay I have this applet loaded into my Java card. It's needed for the for the product to be working well. But if you are seeing something unknown, try to delete it uh if you can. So when you are ready with your Java card, when you have done the sanity check, um you can download our code or you can download any other code online. You can build it by yourself or you can uh download the CAP file.

So the CAP file is the code already built and ready to be deployed onto the smart card. The second sanity check I would recommend is to check uh the check sum of the cap file uh if you download it even if you download it from our uh GitHub account because uh if you have a malware on your uh computer and you try to download a cap file maybe it will be changed and you will upload uh this uh malicious cap file onto your security keys. So be sure to have the right check sum if you uh decided to download the cap file from our GitHub. The last step is to install those uh programs those cap file inside the security key and it's just three command three command line with the argument install and you select uh the name of the cap file you want to install to install. The first one seat keeper is our password manager.

The second one called totp is for the OTP code generation and the last one is for uh the pass key functionalities. When it's done, if you are again doing a list of what's inside the the Java card, you will see uh all the app here with the unique identifier and the selectable option, which means they are usable by the security devices out of the box. At this point, you have a fully functional security keys, which means if you remove the Java card from the reader, you can use it out of the box with any compatible mobile application that support NFC pass keys, OTP codes, uh, OTP generators and so on. You can out of the box log to any website using pass keys and the pass key will be stored inside your Java cards which is very interesting because you just spend 20 euro and half an hour to have your own security key. There is uh one step that you can do.

It's optional but uh strongly recommend it. Um I show you that this key was the factory key used by all the vendor. It's a standard. It can be changed. Meaning when you have finished loading your cap file inside a security key, you can lock uh the device with your own key.

There is a trade-off. If you lose this key, which is your own, you can decide it. You lose access to the content of the card because you won't be able to change it. But that's not a big deal because a Java card costs less than a cheeseburger. So even if you lose one, you can create a new one with a new key and and you are good to go.

But this is a security recommendation uh to lock the card. So you are sure that even if you lose your card or if you leave your card on your desk, nobody will be able to change the code inside the Java card. So as a summary uh what just happened um we explained the trade-off regarding the Java cart. So yes, it's not open source. Yes, uh it come from NXP for example.

Um yes, it runs the Java cart operating system which is also closed source, but you have a fully functional secure element that you can load by yourself with fully open source code and you can use it with fully open source application. Uh the code is available on our GitHub and if you lock the cart you have a fully functional uh security key just like a UB key for half the price and you made it by your own. This is the information um to get the code online. So on our GitHub uh topora you will have all the cap file all the code of the three product I explained. You can also go to the Martin Paljac GitHub.

Uh he is the guy who is maintaining the global platform uh application gp.jar. This is the the tiny software that allows you to load the cap file onto the security key. And we have all the documentation uh on our website docs.sitkeeper.

io. I also have a few blank smart card for those who want to have a try. Uh those smart card are of course unlocked provided with the the default key. So if you want to play around this weekend, it's a nice uh Sunday uh workshop uh to do with uh friends um because it's also very useful. We are using security keys every day especially if you are working for a company that is um aware of those threat.

uh so you will be able to use your own uh security key. That's it. I don't know if there is any question regarding the presentation or the Java technology or the security in general. Thank you. Yes.

So this is the same way except that the token currently stored inside your phone and you unlock the memory of the phone with your finger. Here the website will ask you whether you want to use your phone as a pass key storage solution or the smart card. You tap the smart card on the back of the phone. You provide a pin code which is the same as your biometric information to unlock the memory and then the website gets the token back. So it's one step more than uh unlocking from your devices but it's more secure because the pass key token is stored elsewhere.

If you lose your phone, that's not a problem. If someone can get access to your phone, a malware, and can get access to the content, they can also steal the pass key. With a secure element, it's impossible to steal the pass key. So, it's a trade-off. Uh, for example, I'm using pass key on on my iPhone.

I have a few pass keys stored inside my phone, but for nonsensitive services, for most of them, I'm using my ring. Uh, it's also convenient. I have just one step on top. uh to be locked in, but I have much more security. Yes.

Yes. Yes. Yeah. So, so, so we can provide any kind of uh form factor. uh the chip by itself containing the secure element uh is really tiny and then we can have it in many form factor.

So if you have any ID of implementation uh we can provide it we or any other vendor I do suppose but we also have uh this kind of uh possibility stickers uh we call it uh FPC flexible printed secrets so it's like a stamp it's really tiny you can stick it on whatever you want we can embed uh this kind of chip inside a token uh inside a wristband of your watch for example So sky is the limit. But uh this that's also the beauty of this technology. It has been uh here for so long that a lot of manufacturer are embedding the technology into many form factor. Yeah. Yeah.

Yeah. This is Yeah. So all the website that are only supporting one key uh are a shitty website. No, I mean because the recommendation uh even from the Fedo aliens is to use at least two pass key store into two or multiple devices. So basically if you are trying to log into PayPal they if they have a good security uh advice they should at least allow you to use two Pasi token and it's your job to have those Pasi token split it into many devices.

I know it's pain in the ass because um you need to think the security on the other side which means if you want to use pass key you need to have all your devices ready to accept pass key before uh enabling pass key on PayPal or Google. So you won't be able to add another pass well you you are able to add another pass key later but if you want to have backup solution it's better to have it uh done at the very first login. Yes. And there is no proper solution. Um we try to offer this kind of solution because for some people buying two, three, four UB key might be expensive.

You can build it for 20 or uh 40 euro by yourself. Um currently there is no solution. Yeah. That's part of the cryptography. Yes.

Yeah. Yeah. Yeah. So, so that's the limitation of the smart card. It doesn't has uh a lot of memory.

I think the maximum nowadays is like 200 or 300 kilobyte. If you count the applet you load on top of it, if you count the Java card operating system, then you have uh less in free space for your passwords. But again uh these kind of devices is not designed to store your entire life. Uh you have to think it like a safe deposit box. You have a safe at house for example but you don't store all your books, all your paper inside a safe.

Even if those paper are important, you you just put those you want to be safe against fire, fluid, theft. Uh you have to see the the security key the same way. Okay. You have more space. Yes.

Yes. You have more space. Yes. No. No.

Because there are two applets, two different applets and two different technologies. The password manager, you can see it as a U USB stick where you put in plain text your passwords. It's not in plain text because it's encrypted into the secure element. But the pass key come in conjunction with your passwords. I give you an example.

You have a fresh brand new Google account with your login, your password. you can store them inside your security key and then you can go to the um Google security features and enable the pass key login which means Google will store another information inside the secure element of the security key which is the the pass key tokens and you will be able to login with this token without providing your passwords. So at some point you don't even need your your main passwords anymore unless you lose the basi token. So you need the the passwords. Okay.

Yes. If you if you use an external password manager uh you need to copy paste all the information because you can see the password when it's exported from the secure element but there is no bridge with uh the the website. The only bridge comes from the Fedo uh applet because it implements all the pass key and capab 2.1 functionalities. So out of the box you can share uh the pass key tokens but it's not available on the password manager.

Um if you have a smart card it also work contact through a smart card reader otherwise it's only over NFC. Uh, no USB uh unless you use a USB smart card reader somehow, but uh no uh it's NFC because it's uh very reliable communication protocol uh most secure than Bluetooth or any other uh communication protocol and it's um it allows also many use cases because the NFC technology doesn't require any battery. Uh Bluetooth require battery, NFC doesn't. It's the device that powered uh the smart card. Sorry.

So um no need to have uh any buttons, any battery, any screen on the device. Just the chip and it's enough. Yeah. Yes. So that's uh that's right.

uh many uh phones including iPhones are using a secure uh memory which is not a secure element but a secure memory inside the phone which means even if there is a malware or a virus on your phone they won't be able to uh get access to the token but there are some attacks that you can mitigate for example if um the malware is trying to login with your pass key on the right server services to do something, they will be able to do that because the pass key is inside your device. So they will trick you to unlock the memory to use the pass key, but when the connection will be done on the server, they will be able to use that connection, for example, with the cookies to uh browse the the the content. So it's it's um it's a good solution if you trust uh Apple. And another cons uh in my point of view is that you are tied to one ecosystem. If you are storing your pass keys on your iPhone, there is no way you can use those uh pass keys with my computer for example.

And it's quite a bit strange because it's an access token. So I I need it uh when I need to access my software, my web application. So having the access token only onto one device, it's it's not no more an access token. It's just a grand privilege token. Yes.

Yes. This is another another way to login. So we call them bridges. Uh it's working well on Android and on iPhone. You can use the pass key through this kind of bridge to log to your desktop application, but it's more convenient to just plug the smart card inside your laptop and do the same.

So it's up to you to use your phone to store the pass keys or a dedicated device. It's cheaper to have a Java card because a phone cost 10 times uh this but it's more convenient in some way to use your phone as and as I told you I'm also using some pass keys on my phone. Yeah. Thank you. If someone uh need a Java card, I can give you some blank one.

If you want to play around with, I will put them here. Take it.