Use different certificates for different Solo models

Minor update.

• Refactor to allow building Solo as lib
• Secure version of Solo will have different certs for Solo, Solo Tap, and Somu now.
  • Additionally, the first byte of the AAGUID for each model is different.

Many improvements, 3.0.0 release

A lot of improvements with this release.

• Secure and Hacker firmware are no more. There is only one firmware now, and lock/unlock settings are configured/set separately. (#331)

  • Old devices can still update normally, but you may need to update your solo-python.

• Bootloader now checks version on updates and prevents downgrades. This is a security improvement. It is not enabled on devices with a "hacker" bootloader. Thanks a lot to @szszszsz of @Nitrokey for implementing this! (#238)

• The CTAP2 PIN is now stored only in hash form, instead of in plaintext. Thank you to @szszszsz / @Nitrokey for implementing this! (#240)

• Our docker build was optimized and is more friendly for people to build the firmware for their own uses, in addition to use using it for release builds. Thanks a lot to @ccinelli for adding this! (#329, #330 )

• Add support to U2F to be able to handle FIDO2 key handles. This was causing some problems when the various FIDO stacks out in the wild are mixed. (#323 )

• Code cosmetics and documentation improved. Thanks @jolo1581! (#318, #324)

To update:

wget https://github.com/solokeys/solo/releases/download/3.0.0/firmware-3.0.0.json
solo program bootloader firmware-3.0.0.json

Make sure you upgrade solo to latest version (pip install solo-python --upgrade).

Ctap2 bug fixes

Fix two issues with CTAP2/FIDO2:

• RpID in request is checked to match credential for non-RK
• Up=false option in get_assertion allows assertion to pass without UP

#308
#306
#305

Thanks to @KenTaylorPhoenix for reporting. Also thanks to @merlokk for another NFC improvement #301.

Passes FIDO Alliance functional tests using NFC

• Small change to catch invalid length #297

Minor patch

Minor patch for 2.5.0. Be sure to read 2.5.0 notes.

• #292

Windows Hello NFC

This release adds improvements on NFC so it is compatible with Windows Hello NFC and more NFC readers (in addition to USB).

Thanks a lot to Oleg @merlokk for developing a number of improvements for NFC. The most important change was adding "apdu-level" chaining in addition to extended APDU support. Tested with ACR and HID NFC readers.

Thanks a lot to Alex @aseigler for finding issues with Windows Hello & Solo and testing the various fixes we came up with along the way. Also for testing multiple readers and devices.

Other improvements (#289,#290) around handling of button and timeouts.

Minor improvements

• Improve button behavior for U2F when some platforms do not poll quickly (#264, #216, #211 )
• Minor NFC improvements (#267, #226 )
• Fix CDC ACM descriptor to work on MacOS (while still working on Windows & Linux) (#265 )
• Improved documentation (#273 )

Fixes for Windows Hello

A few small fixes -- Now Solo is tested to work fine with Windows Hello.

• Change error code returned for PIN status
• Change how CTAPHID_STATUS was handled prior to user presence.

Thank you to @aseigler for identifying the issues and testing !

Fix hmac-secret

• Fix incorrect signature calculated when hmac-secret extension is used (#228)
• Improve length check in USB request to increase fault resistance

NFC bug fixes

• Fixes #213, #214
• Fixes bug when U2F registering via NFC while the key is USB powered, the key hangs.

Update by running the following:

# signed update for secure
solo program bootloader firmware-secure-2.4.0.json

# update for hacker
solo program bootloader firmware-hacker-2.4.0.hex