Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

passkey doc start #374

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions source/components/nitrokeys/passkey/examples.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Examples
========
27 changes: 27 additions & 0 deletions source/components/nitrokeys/passkey/faq.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
Nitrokey Passkey FAQ
====================

**Q:** Which Operating Systems are supported?
Windows, Linux, and Mac OS X. Also some support (FIDO2) for Android.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"macOS"



**Q:** What can I use the Nitrokey for?
Second or first factor authentication for services which support Webauthn/Passkey/FIDO2/FIDO U2F.

**Q:** What happens if I lose my Nitrokey Passkey device?
When securing accounts using FIDO (two-factor authentication and
passwordless login), you should configure another factor in your account as
a backup. Depending on the service this backup factor can be a phone number,
an app or even a second Nitrokey FIDO2. If you lose a Nitrokey Passkey, you
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not "FIDO2"

can still log in with the second Nitrokey FIDO2 (or with another second
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not "FIDO2"

factor).

**Q:** How large is the storage capacity?
The Nitrokey FIDO2 doesn't contain storage capability for ordinary data (it can
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not "FIDO2"

only store cryptographic keys and certificates). It can hold over 100 Passkeys/FIDO2 keys.
Copy link
Member

@jans23 jans23 Jan 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no certificates. Is the number really correct?


**Q:** How to use Nitrokey Passkey with Azure Entra ID (Active Directory)?
After `disabling Enforce Attestation`_ Nitrokey Passkey is supported by Azure Entra ID out of the box.


.. include:: ../../shared-faqs/hyperlinks.rst.inc
93 changes: 93 additions & 0 deletions source/components/nitrokeys/passkey/getting-started.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
Getting Started
===============

Hardware
--------

TODO Image with focus on touch button

First steps
-----------
The Nitrokey Passkey supports two-factor authentication (2FA) and
passwordless authentication:

- With **passwordless authentication**, entering a password is replaced
by logging in with the Nitrokey FIDO2 and a PIN.

- With **two-factor authentication** (2FA), the Nitrokey FIDO2 is
checked in addition to the password.

The Nitrokey Passkey can be used with any current browser.

.. important::

The Nitrokey App can not be used for the Nitrokey Passkey.


Passwordless Authentication
---------------------------

1. Open a web page that supports FIDO2 (for example
`Google <https://myaccount.google.com/>`__).
2. Log in to the website and go to “Passkeys and security keys” in the security
settings of your account.
3. Click on Create passkey.
4. Click on Use a different device.
5. Follow the prompts to set a PIN for your Nitrokey Passkey.
6. Touch the button of your Nitrokey Passkey when prompted.
7. Once you have successfully configured the device, you will need to
activate your Nitrokey Passkey this way each time you log in, after
entering your PIN.

Two-Factor Authentication (2FA)
-------------------------------

1. Open one of the `websites that support FIDO
U2F <https://www.dongleauth.com/>`__.
2. Log in to the website and enable two-factor authentication in your
account settings. (In most cases you will find a link to the
documentation of the supported web service at
`dongleauth.com <https://www.dongleauth.com/>`__)
3. Register your Nitrokey Passkey in the account settings by touching the
button to activate the Nitrokey Passkey. After you have successfully
configured the device, you must activate the Nitrokey Passkey this way
each time you log in.

You are now ready to go.

Touch Button And LED Behavior
-----------------------------

The first FIDO operation is automatically accepted within two seconds
after connecting Nitrokey Passkey. In this case touching the touch button
is not required.

Multiple operations can be accepted by a single touch. For this, keep
the touch button touched for up to 10 seconds.


+------------------+-----------------------------+------------+
| LED Color | Event | Comments |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See my changes related to such table in the other PR. Remove empty column.

+==================+=============================+============+
| White (blinking) | waiting for touch event | |
+------------------+-----------------------------+------------+
| Teal (constant) | processing | |
+------------------+-----------------------------+------------+
| Red (Constant) | Crash | |
+------------------+-----------------------------+------------+



Troubleshooting (Linux)
-----------------------

If the Nitrokey is not detected, proceed the following:

1. Copy this file
`41-nitrokey.rules <https://www.nitrokey.com/sites/default/files/41-nitrokey.rules>`__
to ``/etc/udev/rules.d/``. In very rare cases, the system will need
the `older
version <https://raw.githubusercontent.com/Nitrokey/libnitrokey/master/data/41-nitrokey_old.rules>`__
of this file.
2. Restart udev via ``sudo service udev restart`` or ``udevadm control --reload-rules && udevadm trigger`` if you are using Fedora.

41 changes: 40 additions & 1 deletion source/components/nitrokeys/passkey/index.rst
Original file line number Diff line number Diff line change
@@ -1,7 +1,15 @@
Nitrokey Passkey
================

.. contents:: :local:

Introduction
------------


The Nitrokey Passkey is a secure authentication device designed to enhance two-factor authentication (2FA) using the FIDO2/WebAuthn standard.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2FA and passwordless login

It provides a convenient way to protect digital identities by securely storing cryptographic keys within the hardware, ensuring sensitive information never leaves the device.
Compatible with various platforms, including Windows, macOS, Linux, and mobile devices, the Passkey supports popular services such as Google and Microsoft without requiring proprietary software.
With a focus on security and user privacy, the Nitrokey Passkey is an excellent choice for individuals and organizations looking to improve their cybersecurity.

The Nitrokey Passkey is the successor to the Nitrokey FIDO2. It is build on top of the technologies
and framework used within the Nitrokey 3. Find the latest `release notes`_ on GitHub.
Expand All @@ -11,3 +19,34 @@ Please see the :doc:`FIDO2 <../fido2/index>` pages for more FIDO2 related docume
Currently there is only one firmware version, so no firmware update is necessary.

.. _release notes: https://github.com/Nitrokey/nitrokey-passkey-firmware/releases


TODO: why and what. brief introduction for first time users of hw keys

.. contents:: :local:

First check the:

.. toctree::
:maxdepth: 1
:glob:

Getting Started <getting-started>
Frequently Asked Questions <faq>

and the product guides:

.. toctree::
:maxdepth: 1

Reset and Recovery <reset>

or check out the features:

* `FIDO2 <../features/fido2/index.html>`_
* `U2F <../features/u2f/index.html>`_





2 changes: 2 additions & 0 deletions source/components/nitrokeys/passkey/reset.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Reset and Recovery
==================