How to clear / initialize? #134

Open
opened 2025-03-28 20:56:14 +08:00 by erikschul · 4 comments
erikschul commented 2025-03-28 20:56:14 +08:00 (Migrated from github.com)

I've used the Raspberry 2350 for testing. The passkey now contains multiple test accounts (which show up in Firefox/Linux). I've tried using the online Pico Commisioner, with "Initialize" selected, and clicked "Commission via WebAuthn", but it doesn't remove the keys.
I've also tried uploading a new ROM via U2F (which I assume shouldn't affect the storage?).

How do you clear it?

I've used the Raspberry 2350 for testing. The passkey now contains multiple test accounts (which show up in Firefox/Linux). I've tried using the online Pico Commisioner, with "Initialize" selected, and clicked "Commission via WebAuthn", but it doesn't remove the keys. I've also tried uploading a new ROM via U2F (which I assume shouldn't affect the storage?). How do you clear it?
IsayIsee commented 2025-03-28 21:53:32 +08:00 (Migrated from github.com)
you can use nuke fireware, https://www.raspberrypi.com/documentation/microcontrollers/pico-series.html#resetting-flash-memory
polhenarejos commented 2025-03-29 02:47:31 +08:00 (Migrated from github.com)

Look for Pico Nuke in my repos and download the fw for your board.

Look for Pico Nuke in my repos and download the fw for your board.
erikschul commented 2025-03-29 05:15:32 +08:00 (Migrated from github.com)

@polhenarejos Do I understand correctly that configuring Secure Boot would only allow releases certified by your signing key, which includes the Pico Nuke?

On a side note, do you have any documentation regarding how to use my own signing key, if I plan to make modifications? Does the Pico Fido web commissioner configure the signing key? And can the key be commissioned locally?

@polhenarejos Do I understand correctly that configuring Secure Boot would only allow releases certified by your signing key, which includes the Pico Nuke? On a side note, do you have any documentation regarding how to use my own signing key, if I plan to make modifications? Does the Pico Fido web commissioner configure the signing key? And can the key be commissioned locally?
polhenarejos commented 2025-03-31 06:29:36 +08:00 (Migrated from github.com)

I uploaded v1.4 which adds my signature in case you enabled secure boot to be able to nuke it too.

No, Pico Commissioner burns my public key in fuse 0. In case you want to use your own public key, then you should build the firmware locally and specify the SECURE_BOOT_KEY variable in the CMake to point to your .pem file.
Besides which key you use, it is only used during the boot sequence and Pico Commissioner is agnostic to which public key you use (except for Secure boot and lock, obviously). In case your burn your own key, you will be able to continue using the commissioner.

I uploaded v1.4 which adds my signature in case you enabled secure boot to be able to nuke it too. No, Pico Commissioner burns my public key in fuse 0. In case you want to use your own public key, then you should build the firmware locally and specify the SECURE_BOOT_KEY variable in the CMake to point to your .pem file. Besides which key you use, it is only used during the boot sequence and Pico Commissioner is agnostic to which public key you use (except for Secure boot and lock, obviously). In case your burn your own key, you will be able to continue using the commissioner.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dearsky/pico-fido#134