The New Nitrokey 3 With NFC, USB-C, Rust, Common Criteria EAL 6+

The new Nitrokey 3 is the best Nitrokey we have ever developed. It offers NFC, USB-C and USB-A Mini (optional) for the first time. The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manager, Common Criteria EAL 6+ certified secure element, firmware updates. This reliably protects your accounts against phishing and password theft, and encrypts your communications and data. With strong hardware encryption, trustworthy thanks to open source, quality made in Germany.

Pre order now!

Use Cases

For private and corporate use - protection against mass surveillance and hackers

  • Passwordless login: Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.
  • Protect online accounts using two-factor authentication (2FA): Nitrokey is your key to secure login to websites (e.g. Google, Facebook; overview at www.dongleauth.com). Using FIDO2, FIDO U2F, or one-time passwords (OTP), your accounts remain secure even if your password is stolen.
  • Phishing protection: When using FIDO, the respective domain is automatically checked and users are effectively protected against phishing attacks.
  • Mobile usage with smartphones: Using FIDO and NFC, you can also securely access your accounts on Android and iPhone smartphones.
  • Encrypt data and emails: Encrypt your emails with GnuPG, OpenPGP, S/MIME, Thunderbird or Outlook. Encrypt entire hard drives using TrueCrypt/VeraCrypt, LUKS or individual files using GnuPG. Your private keys are securely stored in Nitrokey and cannot be exported/stolen.

For companies - protection against hackers and industrial espionage

  • Passwordless logon to Windows 10 computers: Employees will be able to log in to their Windows 10 Pro computers managed by Azure Active Directory without passwords. All that is required is a Nitrokey 3.
  • Passwordless login to your own enterprise systems: Replace your password policy, unauthorized password slips and costly password resets with passwordless login with the Nitrokey 3. Security and acceptance through simplicity. We are happy to advise you on integration.

For IT administrators and security experts - protect critical infrastructure

  • Administering servers securely with SSH: Always have your SSH key securely with you in Nitrokey. Your key is PIN protected and cannot be exported/stolen from the Nitrokey. This eliminates the insecure and annoying synchronization of key files on client systems.
  • Protect Internet of Things (IoT) and own products: Protect your own hardware products by integrating Nitrokey. Ideal for remote maintenance and ensuring product authenticity.
  • Store cryptographic keys securely: Store cryptographic keys and certificates securely in Nitrokey, preventing their theft.
  • Protect computer BIOS integrity: Using the Nitrokey and Measured Boot, the integrity of the computer BIOS/firmware is verified. The colored LED of the Nitrokey signals whether the BIOS has integrity (green) or whether tampering has been detected (red). Compatible e.g. with NitroPads.

Functions

  • FIDO U2F, FIDO2 for passwordless login: FIDO sets new standards in easy usability and thus achieves high acceptance. FIDO reliably protects your accounts against password theft and phishing.
  • Disabled passwords to protect accounts against identity theft: Protect your accounts against identity theft. One-time passwords are generated in Nitrokey and serve as a second authentication factor for logins (in addition to your normal password). Thus, your accounts remain secure even if your password is stolen.
  • Secure cryptographic key storage: Store your private keys for encrypting emails, hard drives or individual files securely in Nitrokey. This way they are protected against loss, theft and computer viruses and are always with you. Key backups protect against loss.
  • Password Manager: Store your passwords securely encrypted in the integrated password manager. This way you always have your passwords with you and they remain protected even if you lose your Nitrokey.
  • Integrity Check / Tamper Detection: Verify the integrity from the computer BIOS using Verified Boot. The Nitrokey's colored LED indicates whether the BIOS has integrity (green) or tampering has been detected (red). Supported computers require a BIOS based on Coreboot and Heads such as the NitroPad.

Security Technology

The Nitrokey 3 is based on a novel security architecture:

  • All firmware is developed in the memory-safe programming language Rust. This avoids potentially security-critical memory errors.
  • The firmware is based on the framework Trussed developed in Rust, which is designed for security-critical embedded systems and developed in cooperation with our partner SoloKeys. Among other things, Trussed implements cryptographic operations. Of course, the code is published as open source.

    Trussed logo

  • The hardware is based on the LPC55S6x microprocessor, which has numerous security features, such as Secure Boot, ARM TrustZone, Physical Unclonable Functions (PUF). Update: The hardware is based on different microprocessors that support Secure Boot and other security features.
  • Additionally, a Secure Element, quasi a smart card, is used for the cryptographic memory. This has been security-certified up to the operating system level according to Common Criteria EAL 6+ and thus also meets high security requirements. Due to the power requirement, the secure element can only be used via USB but not via NFC.
  • As with all Nitrokey developments, Nitrokey 3 is open source, so the secure implementation can be reviewed by anyone.

Pre order now!

To receive the latest status updates on your Nitrokey 3 order by email, sign up for our newsletter. This is required so that we may contact you by email.

Status Update, 6/14/2022

From now on we will publish future status updates regarding Nitrokey 3 in our blog instead of here.

Status Update, 5/13/2022

The circuit boards of the Nitrokey 3A Mini could not be fully assembled yet, because a passive component is missing. This should arrive next week, which means that the first series production can begin, which we will then test.

The firmware development for the nRF52 or Nitrokey 3A Mini has reached alpha status, i.e. is functionally equivalent to the LPC55S variant (FIDO2). Now the primary focus is on debugging and stabilization.

The next production slot for the Nitrokey 3A NFC unfortunately could not be fixed yet; we are working on it and will keep you informed. However, since the critical component is already in stock (LPC55S), we are optimistic that it will start soon.

Status Update, 4/13/2022

Currently all Nitrokey 3 support FIDO2 functions only. We have released some firmware updates in the last months that fix most of the issues. To update your Nitrokey 3, please follow the instructions. An overview of available firmware updates can be found here.

The delivery of the Nitrokey 3A NFC and the Nitrokey 3C NFC of the first production batch has been completed. Unfortunately, we were not able to fix the technical problems on all devices according to our quality standards, which is why the first production batch turned out to be smaller than expected. Therefore, some orders are slipping into the second batch. Affected customers have been informed personally by e-mail.

We have received the PCBs for the Nitrokey 3A Mini. Now the assembly of the first PCBs will be done soon. After that, there are further steps to be done, such as checking compatibility with the package, flashing, assembly and extensive quality control. The Nitrokey 3A Mini can then be shipped, probably at the end of Q2 or beginning of Q3 2022.

We have received another 1000 pcs. LPC55S microprocessors. With this, we will produce another batch of Nitrokey 3A NFC. Production has been ordered and is expected to take 6-8 weeks. Minor improvements to the hardware layout have already been incorporated to simplify assembly and improve NFC performance.

Porting to the new microprocessor is not yet complete, so the Nitrokey 3A NFC is not expected to be available from stock in large quantities until Q3 2022.

For the Nitrokey 3C NFC, we have decided to develop a new casing. This will provide greater robustness and allow for faster production. The development time of the casing is currently difficult to estimate. Therefore, the production schedule for the Nitrokey 3C NFC has been postponed to Q4 2022. Pre-orderers of the Nitrokey 3C NFC who would like to change their order to the Nitrokey 3A NFC, please email us to "shop at nitrokey dot com".

As soon as there is a change in the current estimate, we will inform you here immediately.

Status Update, 2/5/2022

Unfortunately, some of the shipped Nitrokey 3A NFC (with USB-A connector) have a technical error that results in weak NFC performance. If you have problems using NFC with your Nitrokey 3A NFC, we offer you a free device exchange. Therefore, please send us your Nitrokey 3A NFC and state your order number. The Nitrokey 3C NFC (with USB-C connector) is not affected by this.
Accordingly, the complete delivery of the first production batch is unfortunately still delayed.
Porting to the new microprocessor is progressing and we plan to complete by the end of the month. Once porting is complete, we plan to produce additional Nitrokey 3A NFC and Nitrokey 3A Mini. These models are then expected to be available in Q2 in sufficient numbers to service all pre-orders and also to fulfill new orders immediately.
More Nitrokey 3C NFC (with USB-C connector) will be delivered in the next few weeks. A new production of this model is planned for the 3rd quarter.

Status Update, 11/25/2021

The delivery of the Nitrokey 3A NFC has started. Furthermore, the delivery of the Nitrokey 3C NFC is progressing. All customers who have subscribed to the newsletter have been informed about their expected delivery status or production batch. The production and delivery of the many pre-orders takes time and our team is working at full speed to ship as many orders as possible every day.

Status Update, 10/18/2021

The first Nitrokey 3C NFC were produced and shipped. Production and delivery of all pre-orders is expected to take several weeks. All pre-orderers will be informed via email as soon as their Nitrokeys have been shipped. Pre-orderers who will only be served from the next production batch will be informed via email in the next few weeks.

Status Update, 10/8/2021

Important: The batch of both NFC models now in production is already sold out. All new orders of a Nitrokey 3A NFC and Nitrokey 3C NFC will be served from the next production batch. Due to the electronics shortage, porting to the nRF52 must be completed for this. We expect delivery later this year and will post regular status updates here. Customers who ordered already will be informed in the next days and weeks from which production batch they will be served resp. when they will be delivered.

Nitrokey 3C NFC: The electronics are completely procured and produced. Also, the new cases have been produced and are now being printed. Next week we will begin flashing the firmware, installing Nitrokeys into the cases, testing and shipping. Production and delivery of all pre-orders is expected to take a few weeks.

  


Nitrokey 3A NFC: For the USB-A model, the PCBs, electronics and enclosures are fully sourced. However, we fortunately unexpectedly found a way to further improve the NFC performance. To do this, we had to do another electronics change and test cycle. Unfortunately, this will delay the delivery by probably 2-4 weeks.

Nitrokey 3A Mini: Electronics and case development is complete. Firmware porting (to the nRF52) is still in progress. We plan to produce and ship in the next few weeks. The quantity should be enough to serve all pre-orders and fill our warehouse for the next weeks and months.

Status Update, 8/25/2021

  • The development of the Nitrokey 3C NFC casing has been completed.
  • Planned delivery date for the PCBs is week 40. The subsequent assembly is planned with a few days.

Status Update, 8/11/2021

  • Development of the Nitrokey 3A Mini and Nitrokey 3C NFC enclosures has made significant progress. We plan to complete the enclosure development concurrently with the availability of the assembled electronics.
  • The required NFC chips have been delivered and tested successfully. Barring any further supply bottlenecks, the electronics will be assembled shortly.
  • In order to achieve the best possible availability despite the global electronics shortage, we will equip the Nitrokey 3 with different microprocessors. Users will not notice this internal difference, but for us it means more effort. Therefore we had to redesign the electronics of the NK3A Mini using the nRF52. We expect the electronics samples next week. We have already got the firmware working on the nRF52 but the porting is not finished yet.

We plan to start shipping the Nitrokey 3A NFC and 3C NFC first. The Nitrokey 3A Mini is expected to start a little later. We are now waiting for our contract manufacturer to assemble it. We can't give a specific delivery date yet but it shouldn't be long.
 

Status Update, 6/11/2021

In the last months and weeks the development of the Nitrokey 3 has made significant progress. Nevertheless, its delivery will unfortunately have to be delayed, especially due to lack of electronics.

We have achieved:

  • The electronics development is finished and the electronics works stable.
  • The firmware has FIDO2, which can be used via USB and NFC.


In work at the moment is:

  • Electronics procurement and production has started
  • Firmware development of one-time passwords (OTP) and the password safe.
  • Porting of firmware to the nRF52 microprocessor. This is important to be able to avoid future supply shortages that we are facing due to the global electronics shortage.


The delivery of the Nitrokey 3 depends on:

  • We are waiting for an electronics component to arrive no later than July.
  • Completion of the case development


It is anticipated that the Nitrokey 3 will ship in the next few weeks or during the summer. We apologize for the delay and ask for your understanding.

14.6.2022

Comments

Das wäre in der Tat fein, ich persönliche hätte sowas auch gerne, aktuell ist das aber dann leider doch eher ein Traum. Der Entwicklungsaufwand und entsprechend die Kosten als Produkt für den Kunden wären dann doch ziemlich abschreckend und nicht rentabel leider.
So sehr ich mich auf den Nitrokey3 freue, so sehr nervt mich die endlosen Verzögerungen...
Verstehen wir sehr gut, wir geben unser Bestes. Gegen die Halbleiterknappheit ist aber momentan nur Abwarten und Gegenlenken möglich, letzteres versuchen wir, wie auch im Artikel beschrieben, so gut es geht.
Are the shop prices for delivery correct at the moment? They seem to increase with the amount of keys ordered (but it does not seem to be linear), they change after the page has finished refreshing (for a few seconds they show up at some value, and then they change to a higher value), and also seem to spike depending on whether express shipping is selected or not before refreshing the page.
Hey, yes there is an bug currently in the shop. You can either wait until the upcoming week (then it should be fixed) or you can order and write an email to [email protected] with your order-no. and we'll update your recipe/order.
Die Auslieferung verzögert sich offenbar noch weiter und ich gehe nicht davon aus, dass es hier zeitnah ein Update geben wird, das vom Gegenteil überzeugt. Da in der Zwischenzeit sicherlich weiter an der Firmware gearbeitet wird, werden alle bereits vorab für "später" geplanten Funktionen wie Einmalpasswörter, Passwortmanager und OpenPGP Chipkarte zum tatsächlichen Release verfügbar sein?
Das kann ich leider so nicht bestätigen, aber was ich sagen kann ist, dass es jetzt in naher Zukunft ein weiteres Update geben wird.
Wie nah ist diese Zukunft?
Sobald es für uns möglich ist sinnvolle Zusagen zu machen, wir warten leider immer noch auch Elektronikkomponenten.
Hallo, ich wollte 2 Stk vorbestellen. Das die Entwicklung Geld kostet, verstehe ich, ich halte die Preise für die Sticks auch für gerechtfertigt. Aber 18€ für UPS Versand von D nach D? Dafür sende ich 25kg um die Welt. Woher kommen die Sticks, wird sich das ändern? Gibt es eine Einkaufsmöglichkeit in Berlin? Mika
Im Shop gibt es leider aktuell ein Problem mit der Versandberechnung, dieser wird die Woche behoben. Sorry, für die Umstände, entweder die Bestellung per Überweisung wählen und uns dann eine kurze Mail an [email protected] schreiben, dann updaten wir die Rechnung, oder bis Ende kommender Woche gedulden bitte.
Mich würde es ebenfalls interessieren wann das Problem behoben ist? Immerhin haben wir mittlerweile Ende der Woche.
Es sollte jetzt wieder voll funktionieren, bitte melden falls das nicht der Fall ist!
Moin, gibt es hier schon updates wann die Auslieferung beginnt?
Wir werden in Kürze weitere Informationen für alle Veröffentlichen.
"As with all Nitrokey developments, Nitrokey 3 is open source, so the secure implementation can be reviewed by anyone." How was the OpenPGP SmartCard Applet Open Source? Not to talk about the underlying BasicCard OS? To me this sounds like you have two realities: A Marketed one, and a real one - where you publish tons of sources on github, but not the ones that matter... the Crypto Functions!
Well, reality is not black & white here: We as Nitrokey open-source nearly all development efforts. Nevertheless we have to use components that are not (entirely) open-source, the OpenPGP SmartCard Applet is open-source btw.: https://github.com/Nitrokey/openpgp-card/ ... ZeitCard/BasicCard OS provides various means to audit/review their crypto functions, but various components are under NDA - it's still (patented) crypto and semi-conductor-layout material. If you know of a "more" open-source-ish solution, feel free to point us there...
Hi Nitrokey, Can you give us an update on the expected shipment date. I know the current chip market is completely unpredictable, so if you don't know that's an answer to. Regards, Rienk
As of today we have no news regarding this topic, sorry.
Kommt denn auch mal ein Update zum Status der Lieferung und Entwicklung? Wenn man keine neuen Details zur Lieferung mitteilen kann dann wäre ein Statusupdate zur Firmware und der Gehäuseentwicklung für einige mit Sicherheit erfreulich, das letzte Update ist ja auch schon 2 Monate her.
Siehe unten im Artikel, tagesaktuell quasi
Hallo! Lässt sich der 3C auch mit einem A-Adapter an einem einem A-Port verwenden? Muss man da etwas Besonderes beachten? Überlege gerade, was praktischer ist: C auf A oder A auf C...
Ja das sollte problemlos gehen, für diese Flexibilität ist USB generell "von Haus aus" vorgesehen.
Based on the Solo V2 FAQ they support PIV instead of OpenPGP. Do you real support OpenPGP?
Yes, we can confirm that the Nitrokey 3 will support OpenPGP Card later, we are already working on that. We are evaluating, if we would like to provide the option to switch between PIV and OpenPGP Card support, but at this point I cannot confirm if and how this will be available.
Is it safe to assume that the keys will be delivered after october? Thanks for making it, I know it isn't easy.
Please check the update above, it says cw40 + some days to start delivery, obviously we deliver in order thus depending on when you ordered this might take awhile from there.
It is not "obvious" from the update that delivery might take a while - this is the question of the OP as I understand it, and I am interested in an answer as well. The status update reads "The subsequent assembly is planned with a few days." I assume you mean "within", so one could be forgiven to assume that this concerns delivery of all ordered keys (except maybe the mini as noted in a different update). Your last answer indicates otherwise, which is new info. So to rephrase the question: What is the expected time span of delivery for _all_ keys currently on order? I am not interested in knowing when someone else receives their keys, I need to assess what timeframe is reasonable to expect for _me_ to receive _my_ keys. I have pre-ordered many products over the years, from many companies and projects, and delivery delays are expected. What is not expected is lack of communication with your customers. Communication has a far greater impact on customer satisfaction than the length of delay in my experience, and you can clearly do better in this regard.
Hey, sorry if the "obviously" phrasing came through as rude --- wasn't intended. Further please understand that we cannot make predictions about a production process that is currently up-ramping, a pessimistic view will make you and others unhappy an optimistic one will lead to this very same discussion, but clearly we are not talking about years or many months here. Further we'll take the communication remark as feedback, although the last update is describing the critical path, what in our impression was the most important information for you as a customer.
You could give us more precision in your updates, as you just did. The update mentions delivery of "the PCBs", which sounds like the entirety, not "some PCBs" from a process that is ramping up. We can't know if you receive your orders in large batches or if the components and PCBs arrive in a steady flow from a process that will continue to pick up speed, so we can't understand the meaning of your update, unless you give us that info. Furthermore, context with the first item in the update (3C NFC casings) might indicate you are only talking about 3C NFC PCBs - but there is no way for us to tell. So what about "Planned delivery date for the first [large|small] batch of PCBs for model[s] xxx [and yyy] is week 40. The subsequent assembly of that batch is planned within a few days. The production process will continue to ramp up in the following [weeks|months] and preorders will be filled in the order in which they were received. Production of model [yyy and] zzz will start [real soon™|later|subsequently|...]. If you ordered both a model xxx and zzz we [will perform partial shipments of items as they become available|wait for all items in your order to be available before shipping]."
You are interpreting this correctly: The latest update refers to the 3C NFC casings and thus PCBs --- and yes the 3A Mini will be delayed. I wish we could give you details as you wish, but the uncertainty on the electronics market is something that hits us repeatedly, so even if we would give you this level of details, we'd have to equally often correct them, which would also not be taken positively, I hope you understand. On top of that there are the typical issues for developing mechanical parts and software development. I feel your frustration and your good intentions here, please be assured that we are trying as hard as possible to get our vision of the Nitrokey 3x to you customers as fast as possible and sorry for any inconvenience this has generated for you.
Fand Nitrokey immer sehr interessant und eine tolle Firma. Aber was mit dem Nitrokey3 abgeht, lässt mich an der Professionalität zweifeln. Im März das Geld kassieren und dann nicht liefern. Dafür monatlich neue Produkte raushauen. Sorry dafür fehlt mir echt das Verständnis. Ganz zu schweigen, dass man nicht mal über die Lieferverzögerungen aktiv informiert wird. Ich muss immer auf die Webseite gehen und mir die Info's selbst suchen.
Sorry, wenn das so einen negativen Eindruck hinterlässt. Grundsätzlich haben wir uns dagegen entschieden für Verzögerungen E-Mails an alle herauszusenden, verstehen aber auch, dass es da andere Präferenzen geben könnte. In Zukunft könnte es für Vorbestellungen einen Haken bei der Bestellung zu setzen geben, der zu setzen ist um derartige Informationen direkt geschickt zu bekommen. Bei den Verzögerungen kann ich leider nur um Verständnis bitten, dass diese uns auch unerwartet trafen, insbesondere die Verfügbarkeit der Komponenten. Schließlich die anderen Produkte: Die Produkte sind sehr verschieden, beim Nitrokey 3x reden wir von Embedded Rust Entwicklung, d.h. es gibt nahezu keine Schnittmengen zu einem NitroPhone oder NitroPC im Sinne der benötigten Skills und entsprechend handelt es sich hier um andere Mitarbeiter.
Your status update from August 11 states that you are still working on porting the firmware and point to your github, but there is next to no activity there. I agree with previous posters that it would be welcome if there was some indication that the delay was being used to implement promised firmware features, but that does not seem to be the case ? Could you please publish or point me to an official list of minimal features that will be supported when we receive the key later this year ?
The official features available with the Nitrokey 3x on delivery date are comparable to the Nitrokey FIDO2. The porting itself is not required for the first deliveries, as we'll be delivering the ST µC for these. For the repos, please keep in mind that the work is not always public until certain releases happen, but you can be sure that once delivered the public repos will reflect the state of the product.
Any updates since 25.8.2021?
Nope nothing bad so far, so things are going as planned.
It's week 40 now, so any news?
please see above "Status Update, 10/8/2021"
Seit dem letzten Update sind sechs Wochen vergangen. Dass es weiterhin weltweite Lieferschwierigkeiten im Bereich Halbleiter gibt, ist hinlänglich bekannt. Daher würde es mich nicht wundern, wenn sich die für diese Woche erwartete Leiterplattenlieferung weiter verzögern sollte. Gleichzeitig gibt aber sicherlich erwähnenswerte Fortschritte bezüglich der Software oder ähnliches (z.B. OTP, OpenPGP, etc.). Um zumindest die Vorbestellenden etwas zu füttern schlage ich vor, die öffentlichen Updates etwas frequenter und proaktiver zu gestalten.
Na dann hoffe ich mal, dass "Status Update, 10/8/2021" seinen Zweck hier erfüllt...
Any delivery updates?
please see above "Status Update, 10/8/2021"
Gibt es ein Update zum aktuellen Status?
Yes, siehe "Status Update, 10/8/2021" oben
What is the exact brand / model of the Secure Element that is used ? Can you provide a link to the EAL certificate for the SE platform (covering HW + SW of the secure element?)
The secure element is a SE050 from NXP
Woher weiß ich ob ich zu den glücklichen der ersten Charge gehöre? Bis zu welchem Datum einer getätigten Vorbestellung ist dies?
Dazu möchten wir öffentlich keine Angaben machen. Innerhalb der nächsten Tage/Wochen werden wir alle Vorbesteller anschreiben, so dass jeder individuell bescheid kriegt.
Hey hey, thanks for the info the last few weeks. Looks like we are getting close ( I ordered the 3A NFC in june so I assume I am in the first batch that is coming?) If not, well it's a preorder so it's expected I guess. Again, thanks for the update.

Pages

Add new comment

Fill in the blank.