Skip to main content
This whitepaper summarizes how ZeroKeyUSB protects credentials, for security teams, auditors and procurement. It describes what the device does and, explicitly, the boundaries of what it protects. For the deeper technical detail, each section links to the Software documentation, which is fully open-source and verifiable.

​
What ZeroKeyUSB is

A hand-held, offline credential device based on an ATSAMD21 microcontroller and an ATECC608A secure element, encapsulated in epoxy resin. It stores logins, TOTP secrets and short notes, and types them to a host over USB HID on a physical press. It has no Wi-Fi, Bluetooth, NFC, battery or cloud account.

​
Security architecture

​
Security properties

  • No cloud, no account, no telemetry. Nothing is transmitted to any server.
  • Secrets stay off the host. The host receives keystrokes, never the vault.
  • Tamper-resistant key custody. The AES key and the device are bound; ciphertext from one unit cannot be decrypted by another.
  • Verifiable firmware. Only ECDSA-signed images run; the source is open for audit.

​
Scope and limitations

A credible security statement names its boundaries. ZeroKeyUSB does not claim to protect against:
  • A trusted-host compromise during use. When you type a credential, it lands on the host; if that machine is already compromised, it can capture what is typed. The device reduces storage exposure, not in-use exposure.
  • Plaintext backup on an untrusted host. The USB backup exports credentials in clear text to the connected computer; do it only on a trusted, offline host.
  • A determined physical/lab attacker. The PIN hash is readable over the I²C bus, so an attacker who defeats the epoxy encapsulation and reaches the bus can attempt an offline PIN crack. The epoxy and a long PIN are the mitigations; there is no destructive self-wipe.
See the Threat model for the full analysis, and Security frameworks for how this maps to ISO, NIST and ENS controls.