HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
trustcrypto
libraries
C2019–2019
trustcrypto / libraries

libraries

Libraries for OnlyKey Firmware

4Distinct people
5Mentions
0Explicit recommenders
32GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Libraries for OnlyKey Firmware

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by hour5 dated mentions

Observed mentions: 2019-12-26 16:58:14 UTC to 2019-12-27 03:15:52 UTC.

0122019-12-26 16:00:00 UTC to 2019-12-26 17:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsDec 26, 16:002019-12-26 17:00:00 UTC to 2019-12-26 18:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-26 18:00:00 UTC to 2019-12-26 19:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-26 19:00:00 UTC to 2019-12-26 20:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2019-12-26 20:00:00 UTC to 2019-12-26 21:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-26 21:00:00 UTC to 2019-12-26 22:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsDec 26, 21:002019-12-26 22:00:00 UTC to 2019-12-26 23:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-26 23:00:00 UTC to 2019-12-27 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2019-12-27 00:00:00 UTC to 2019-12-27 01:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-27 01:00:00 UTC to 2019-12-27 02:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-27 02:00:00 UTC to 2019-12-27 03:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-12-27 03:00:00 UTC to 2019-12-27 04:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsDec 27, 03:00

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Dec 26, 16:002019-12-26 16:00:00 UTC2019-12-26 17:00:00 UTC101
Dec 26, 17:002019-12-26 17:00:00 UTC2019-12-26 18:00:00 UTC000
Dec 26, 18:002019-12-26 18:00:00 UTC2019-12-26 19:00:00 UTC000
Dec 26, 19:002019-12-26 19:00:00 UTC2019-12-26 20:00:00 UTC101
Dec 26, 20:002019-12-26 20:00:00 UTC2019-12-26 21:00:00 UTC000
Dec 26, 21:002019-12-26 21:00:00 UTC2019-12-26 22:00:00 UTC000
Dec 26, 22:002019-12-26 22:00:00 UTC2019-12-26 23:00:00 UTC000
Dec 26, 23:002019-12-26 23:00:00 UTC2019-12-27 00:00:00 UTC202
Dec 27, 00:002019-12-27 00:00:00 UTC2019-12-27 01:00:00 UTC000
Dec 27, 01:002019-12-27 01:00:00 UTC2019-12-27 02:00:00 UTC000
Dec 27, 02:002019-12-27 02:00:00 UTC2019-12-27 03:00:00 UTC000
Dec 27, 03:002019-12-27 03:00:00 UTC2019-12-27 04:00:00 UTC101

What Hacker News says

5 sources
Like literally the first post issue is completely incorrect, thats one of the issues in reading a post like this in an online thread, literally that user copied part of but not all of the function that is used for RNG. The part they copied uses analog input as one of the sources of entropy, they failed to also include the 6 capacitive touch inputs that are also inputs to the RNG. Those touch inputs literally change every time you press a button and even with atmospheric changes, i.e. it's cloudy out today, your RNG has changed. RNG.stir((uint8_t )analog1, sizeof(analog1), sizeof(analog1) 4); touchread1 = touchRead(TOUCHPIN1); RNG.stir((uint8_t )touchread1, sizeof(touchread1), sizeof(touchread1)); delay((analog1 % 3) + ((touchread1 + touchread2 + touchread3) % 3)); //delay 0 - 6 ms integrityctr1++; touchread2 = touchRead(TOUCHPIN2); RNG
Read the rest
.stir((uint8_t )touchread2, sizeof(touchread2), sizeof(touchread2)); touchread3 = touchRead(TOUCHPIN3); RNG.stir((uint8_t )touchread3, sizeof(touchread3), sizeof(touchread3)); touchread4 = touchRead(TOUCHPIN4); RNG.stir((uint8_t )touchread4, sizeof(touchread4), sizeof(touchread4)); touchread5 = touchRead(TOUCHPIN5); RNG.stir((uint8_t )touchread5, sizeof(touchread5), sizeof(touchread5)); touchread6 = touchRead(TOUCHPIN6); RNG.stir((uint8_t )touchread6, sizeof(touchread6), sizeof(touchread6)); unsigned int analog2 = analogRead(ANALOGPIN2); RNG.stir((uint8_t )analog2, sizeof(analog2), sizeof(analog2) 4); // Perform regular housekeeping on the random number generator. RNG.loop(); delay((analog2 % 3) + ((touchread6 + touchread5 + touchread4) % 3)); //delay 0 - 6 ms integrityctr2++; if (integrityctr1 != integrityctr2) { //Integrity Check unlocked = false; CPU_RESTART(); return; } https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04...
In OnlyKey: Open-Source Alternative to YubiKey
I understand the Arduino model is different than other projects but we proudly use Arduino as it's open source and has lots of great features. As we use the Arduino model you can find that our source consists of the .ino you mentioned here https://github.com/trustcrypto/OnlyKey-Firmware as well as libraries here https://github.com/trustcrypto/libraries. Our code is reviewed by Codacy and yes, it does receive a grade of A. For the .ino grading you will need to look at the OnlyKey-Firmware Github repo and for the libraries check out the libraries library. I think some of the confusion in your comment here may be related to how Arduino works, all source can be found on Github.
In OnlyKey: Open-Source Alternative to YubiKey
The 7000 lines don't bother me as much as the complete lack of refactoring, heavy use of magic numbers repeated throughout, and logical expressions that duplicate logic over and over again. Some examples... Compare these two blocks of assignments and memcpy calls: https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04... https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04... Yes, they are as identical as they appear. The only differences (other than a couple of lines commented out in one) are the use of 'data' in the first and 'large_resp_buffer+offset' in the second, along with some arbitrary whitespace differences. (The first uses spaces around the + operators, the second does not.) And all the hard coded numbers! What do they mean? Or this block of code that appears to be a limited version of a decimal number formatter:
Read the rest
https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04... Or this code that keeps checking the same flags over and over again instead of combining the tests: https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04... (Scroll horizontally to see all the repeated tests!) Or this code with the same logic repeated 24 times: https://github.com/trustcrypto/libraries/blob/5bd1f8eb15eb04... The next function after that one also has 24 copies of duplicate logic. Well, the logic isn't entirely duplicated. The individual cases call functions like onlykey_eeget_urllen1, onlykey_eeget_urllen2, ... onlykey_eeget_urllen24, and onlykey_eeset_urllen1, onlykey_eeset_urllen2, ... onlykey_eeset_urllen24. Here are those functions: https://github.com/trustcrypto/libraries/blob/527113dfeeb20e... Yes, they are all identical except for the different constants each one uses: https://github.com/trustcrypto/libraries/blob/527113dfeeb20e... This pattern of "24 copies of the same logic with different constants" occurs all through the code. Look through okeeprom.h/cpp for several other examples. None of this inspires confidence that the code can be trusted.
In OnlyKey: Open-Source Alternative to YubiKey
It seems this is literally written in the horrible Arduino "everything in one huge file" style: https://github.com/trustcrypto/OnlyKey-Firmware/blob/master/... The funny thing is they have a "Source code reviewed by Codacy" badge on the readme claiming the code is grade A... but if you actually click through, of course Codacy didn't pick up the .ino file at all, so in fact nothing of substance is being reviewed. That .ino file wouldn't pass any style review... it's a mess. Anyway, looks like that firmware is incomplete (e.g. "onlykey.h" is missing). Just a quick scroll through the code gives me zero confidence in this thing, code quality wise. Someone who can't consistently indent code almost certainly isn't qualified to be writing security-critical software. Edit: looks like the rest of the code is here, and yeah, it doesn't inspire much
Read the rest
confidence (7000+ lines of code in okcore.cpp, ouch): https://github.com/trustcrypto/libraries/tree/master/onlykey
In OnlyKey: Open-Source Alternative to YubiKey
Doing a quick look through the library repository, I spotted another more scary function. It doesn't appear (at a quick glance) to be used anywhere, but still... https://github.com/trustcrypto/libraries/blob/master/randomb... For anyone wanting to try this out (it will compile with plain GCC if you add): #include <stdlib.h> #include <stdio.h> to the start of the file, and declare a main function: void main() { unsigned char* buffer; buffer = malloc(32 * sizeof(char)); randombytes(buffer, 32); for (int i=0; i < 32; i++) { printf("%02x", buffer[i]); } printf("\n"); free(buffer); } And you'll (of course) get some rather deterministic output. As I say though, doesn't look to be used (that I could see), but strange to have something like this there. RE the RNG implementation,
Read the rest
looks to be at https://github.com/trustcrypto/libraries/blob/master/Crypto/..., and looks to have some support for hardware RNGs on certain boards, but not others. Does sound like there's no hardware protection involved.
In OnlyKey: Open-Source Alternative to YubiKey

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.