Compass Security Schweiz AG Completes Independent Public Security Review of Token2 PIN+ FIDO2 Security Keys

Versoix & Jona, Switzerland – September 9, 2024 – Compass Security Schweiz AG (Compass), a leading Swiss IT security firm, has conducted a comprehensive and independent public security review of the Token2 PIN+ FIDO2 Security Keys firmware. This assessment, completed in August 2024, reaffirms the robustness and transparency of Token2's open-source firmware, designed to provide advanced protection while staying open for evaluation by the security community.
This independent and public review is part of Token2's commitment to ensuring the highest standards of security for its products.

Building Trust with Open-Source Firmware

By making its firmware open-source, Token2 allows for continuous public scrutiny, which is crucial in today's evolving cybersecurity landscape. Independent evaluations like this one build confidence in the product, ensuring that users can trust the security mechanisms protecting their sensitive data.

Publicly Available and Independent Review

The Token2 PIN+ FIDO2 Security Keys firmware is open source, ensuring that its security protocols are transparent and accessible for independent evaluation. The review by Compass Security specifically examined critical aspects of the firmware, including PIN policy enforcement, interactions with the platform, and the secure generation and storage of cryptographic key material.

The review focused on several key security areas to ensure that the Token2 PIN+ FIDO2 Security Keys offer comprehensive protection across multiple use cases. Compass Security also assessed how the firmware enforces PIN policy, crucial in mitigating unauthorized access attempts. The interactions between the security key and the platforms were also scrutinized to guarantee secure communication, preventing man-in-the-middle attacks. Additionally, particular attention was given to the generation and storage of cryptographic key material, ensuring that sensitive information remains fully encrypted and inaccessible to external threats.

Review Findings

The independent assessment found no critical vulnerabilities within the firmware. It confirmed that the Token2 PIN+ keys securely generate and store credentials, ensuring that cryptographic materials remain protected within the security key. Compass Security recommended including Unicode characters in the PIN policy to expand the key space, potentially enhancing security for users globally. For further details, please refer to the executive summary report.