Programming the Nitrokey

Overview

Note: This article does not refer to the Nitrokey Storage.

Nitrokey Pro, Start and HSM use the same hardware but different firmwares and different smart cards. The microprocessor being used is a STM32F103R8T6. The firmware is written in C, the desktop software Nitrokey App is written in C/C++. You find all software sources and hardware layouts at Github.

To develop the firmware of the Nitrokey Pro/Start/HSM you would need:

  • An original Nitrokey Pro/Start/HSM or better a development board such as the Olimex STM32-H103. Alternatively, get any other development board equipped with a STM32F103TB and 128KB flash. On request you can get a Nitrokey for development purposes from us.
  • An OpenPGP Card 2.1 available at Kernel Concepts or on request from us. (Of course, this is not necessary for Nitrokey Start which doesn't contain a smart card.)
    If you use it with original Nitrokey hardware, you would need to cut it to Micro-SIM size. This can be done by using a special SIM card cutter or even with a scissor.
    If you use a development board, you may solder the OpenPGP Card to the board directly by using some wires or you get yourself a smart card jack which you solder to the dev board instead.
  • To compile the firmware we recommend ARM's official GNU tools.
  • The microprocessor can be flashed with two different approaches:
    • SWD is a STM-specific protocol and similar to JTAG allowing programming and debugging. Working adapters are Versaloon or any of the ST-Link V2 (clones). Under Linux you could give a patched OpenOCD a try but in the past it has been very troublesome. This approach requires to solder wires to the contact pads or to use an adapter with pogo pins and some kind of mounting (recommended).
    • DFU is a simple protocol via serial port which allows programming but no debugging. On the Nitrokey hardware we expose the appropriate pins over the USB connector but it's not USB! Details are described in the next chapter.

Programming via DFU

Requirements:

  • If your computer doesn't has a RS232 port (most modern laptops don't have it) you would need a USB-to-RS232/TTL adapter. Pololu CP2102 or sparkfun BOB-00718 should work (untested) and you can find even cheaper adapters online. Previously we built our own adapter which hardware layout you can download.
  • If you use original Nitrokey hardware you would need a simple adapter to bridge its USB plug to the USB-to-RS232 adapter:
  • If you use original Nitrokey hardware you would need a jumper with 2.0 mm pitch:
  • For flashing the device you can use ST's Flash Loader Demonstrator (Windows) or the command line tool stm32flash. Both tools can flash the firmware given as a HEX file.

Steps:

  1. Connect the jumper to the Nitrokey board.
  2. While the jumper is plugged in, connect the Nitrokey to the USB-serial adapter on your computer. The jumper is only required during the first moment of connection and can be removed afterwards.
  3. Flash the firmware using ST Flash Loader Demonstrator or stm32flash.

Nitrokey - Made in Berlin