The "security" of this device is a joke, just look at how randomness is derived:
unsigned int analog1 = analogRead(ANALOGPIN1);
RNG.stir((uint8_t *)analog1, sizeof(analog1), sizeof(analog1)*2);
unsigned int analog2 = analogRead(ANALOGPIN2);
RNG.stir((uint8_t *)analog2, sizeof(analog2), sizeof(analog2)*2);
(See [0] for a comprehensive summary of why this is a terrible thing to do)
And yeah, analogRead() is a function from the Arduino library because .. well, apparently there's an Arduino compatible chip inside that does all the cryptographic operations. Meaning that there is no hardware security whatsoever and it's trivial to extract all your keys from the device if you ever lose it. Whoops.
And yeah, analogRead() is a function from the Arduino library because .. well, apparently there's an Arduino compatible chip inside that does all the cryptographic operations. Meaning that there is no hardware security whatsoever and it's trivial to extract all your keys from the device if you ever lose it. Whoops.
[0] https://arxiv.org/pdf/1212.3777.pdf